CmdID

CmdID / Files

pktextract.exe

Side-By-Side Public Key Token Extractor file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real pktextract.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSide-By-Side Public Key Token Extractor

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\pktextract.exe · signed by Microsoft Windows Kits Publisher

20696df2a0fd94be372d4a2952aae02d6bcc79c4be5f7c5243fd84f39f3a40c7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\pktextract.exe · signed by Microsoft Corporation

cde9a01633b67494d37b9bd50472a72e87bb68e63c8007209e98edf4c5cd1ea8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\pktextract.exe · signed by Microsoft Corporation

de7e8d40697bee642d8d5e97276dfa9086e224947c21c37782c7bacd53432fb4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.