CmdID

CmdID / Files

refsutil.exe

refsutil.exe file version info

Program on Windows 6 known copies with hashes Command refsutil

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real refsutil.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionrefsutil.exe

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\refsutil.exe · signed by Microsoft Windows

d389f047fd6e6ce8ad3e4c300add255009c7f812f9faf5cf70bb33647d3f7178

10.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\refsutil.exe · signed by Microsoft Windows

ce4b9871e0c700095e53baec341b8bea5c4b6d5046561594e5a88f90bba9e2b5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\refsutil.exe · signed by Microsoft Windows

7e740610db81f36d96ddc05ca9fe15fbb0c09bfc7168e80e1fb93586c6970cfd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\refsutil.exe · signed by Microsoft Windows

f25b0357f49e3861f6e5b24d5f598ab225f4151c8d7f9059506332e892208a58

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\refsutil.exe · signed by Microsoft Windows

9ecace2a69d7a34b5b98d72412deba5610ad0227b68312cbf631eb0c9c172bca

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\refsutil.exe · signed by Microsoft Windows

dd917bf2a33b6b68c49f3fa8ebd18fa3ec90320633c87988c97c468c57f5e793

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.