CmdID

CmdID / Files

rekeywiz.exe

EFS REKEY wizard file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rekeywiz.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEFS REKEY wizard

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rekeywiz.exe · signed by Microsoft Windows

0034596464c01487f5893ff27bf975397b7354978f043a3cfb84f04454cde21b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rekeywiz.exe · signed by Microsoft Windows

68718f048d93755906c55601fd216ec4423012e4dce0cbf9407caa82e91c95c2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rekeywiz.exe · signed by Microsoft Windows

1fd493e3fded8e64f7c9b50eab2e2062441728f4d3aea8ca9fdc654c493794ff

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rekeywiz.exe · signed by Microsoft Windows

a56393270663bf591d0269692536f6ba2e0909a11879201f6edc7ff2a80f13ab

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rekeywiz.exe · signed by Microsoft Windows

77679449b8ec5a8db4bbb55907e8b93f92af8567ece4f08314383e7896746202

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rekeywiz.exe · signed by Microsoft Windows

cab4b9eed43b096a25170709523d2f3cf4a8b7513bd8806d5635df4d03e0446e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rekeywiz.exe · signed by Microsoft Windows

3b934cb9d1196ca92c803fd76c04496936d4aa553f0409f99f835994fcb3a9e7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rekeywiz.exe · signed by Microsoft Windows

9a42ebd4abf86ffef637d63fa8445d582ea720bb59d81713a23d918414d9efc5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rekeywiz.exe · signed by Microsoft Windows

67981bd38108e2bffabb6aa40c3bde23c46d67ff200160ed9b5bab4d88b1d8d0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rekeywiz.exe · signed by Microsoft Windows

c8927eed99b5d0454ea577a279fd5b450b7e2688987450740b39abf7eda5be81

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rekeywiz.exe · not signed

3d4c479aaafc020554ff87993139c503ef7c152d2a43bf98c2100542268baed2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rekeywiz.exe · not signed

85723f259c824129052ad6190e5094f66f47b175a580e17b6095c7bffc8d90eb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.