CmdID

CmdID / Files

FlashUtil_ActiveX.exe

Adobe Flash Player Utility file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real FlashUtil_ActiveX.exe?

file version info and known copies
Original nameFlashUtil.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\SysWOW64\Macromed\Flash\
C:\Windows\system32\Macromed\Flash\
Signed byMicrosoft Windows Third Party Application Component
ProductAdobe Flash Player Utility, Adobe
DescriptionAdobe Flash Player Utility

7 known copies

32,0,0,445 · C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows Third Party Application Component

5da7fe49b7f2f946f5e5d979bbcd0ebdc00fa52c76c0e931c09477b5c6b6fc65

32,0,0,445 · C:\Windows\system32\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows Third Party Application Component

5f2b3f35184e5145cc3b3483c75d5600698c4d644ab71fb6de6d0654ecc25419

32,0,0,387 · C:\Windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows Third Party Application Component

3b0445899883106d28a8473bb06b8bc2caba6b5b24e56e92cfa751be07cbb93c

32,0,0,387 · C:\Windows\system32\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows Third Party Application Component

c05b1c1b1f0fb1849d809e05da33ae19db6e9e6c3f3b462713d8629a82357ca4

32,0,0,330 · C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows

284d4ef2e93f8a83cadcb7d6ab60fd3975ac3041dd91c653e17cbbd6a95a4d1c

32,0,0,330 · C:\WINDOWS\system32\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows

6457f83b8b3e580b3ea9c3be5e3c0432e7da4123246e305f5ff1bdfe79c06030

31,0,0,108 · C:\windows\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe · signed by Microsoft Windows

3199f90e617257c0bdfa5c6669de4a8b8b736de586745aa7e897dc0655a59ed7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.