CmdID

CmdID / Files

convert.exe

File System Conversion Utility file version info

Program on Windows 12 known copies with hashes Command convert

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real convert.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFile System Conversion Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\convert.exe · signed by Microsoft Windows

51ae3c6225a8c1c6f25d20c6d44ff6d8e727a537bb1b52251034d6d4f7ec009c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\convert.exe · signed by Microsoft Windows

b2a41e4a4d2cc2b11d48601725b89350e04b747d85820aa0cf3ff8a1e66311ae

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\convert.exe · signed by Microsoft Windows

2598be0686dd5bf41f3270483a210a33dfd190a902021adf2407bed8a9c5c84d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\convert.exe · signed by Microsoft Windows

9678122abe2ffeda75912da16b188c755b7517ea1da8e51bba38934f2a5d3252

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\convert.exe · signed by Microsoft Windows

89b294d1f29e4b10a0dce0ad95eb6f48224ba1bc2e2e241f0bb8ef107d084a47

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\convert.exe · signed by Microsoft Windows

934e31a623332839c4068c8565efd5e9718b58c46b42d865034a690cdd3fb1a1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\convert.exe · signed by Microsoft Windows

91c6b20a6d953a3b0769323918d0eac216c9f9bbdd5880a1a1ccfb9e43179f69

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\convert.exe · signed by Microsoft Windows

d280ff3983af2b77eeea7c5d1f021cccd254444c30f65700df097328b6e3ad2f

10.0.14393.2969 (rs1_release.190503-1820) · C:\Windows\system32\convert.exe · signed by Microsoft Windows

e02c54fda923dc10375e569d6c5c45d95af8ed5e6613b073a77dae2ba0b20ae9

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\SysWOW64\convert.exe · signed by Microsoft Windows

e0a1b8b41a7499048fc515a90865d115b3e7e3cd9356ffd702880935cd2ab2aa

6.3.9600.18724 (winblue_ltsb.170606-0600) · C:\windows\system32\convert.exe · not signed

558339886c1c7477ae17cc747702fb69bb2e8e1b8db70c42570c4739884a42df

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\convert.exe · not signed

74f4956142e6867378635c2e2e52a6a312c21ffd20253b95e6183c76872787e8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.