CmdID

CmdID / Files

shrpubw.exe

Share Creation Wizard file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real shrpubw.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionShare Creation Wizard

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\shrpubw.exe · signed by Microsoft Windows

209231ba2381288d22150fa2037d18868d705a6bb9c6b86ce9493edb8d5a662e

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\shrpubw.exe · signed by Microsoft Windows

bf19ea91232055a316446b74e4cdf7ee73978b35a69b01ea444681fc0eef6cf7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\shrpubw.exe · signed by Microsoft Windows

18f9df881ffeb43ebf558cb5bfc2b40bb64e54a2dee391b79cebb10173fb41eb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\shrpubw.exe · signed by Microsoft Windows

6b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\shrpubw.exe · signed by Microsoft Windows

54f7e59beae5d13d35b5da91f1875a528fcd3bd3243c72ba4a79098c4577ba54

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\shrpubw.exe · signed by Microsoft Windows

5d4e7d512b463f0c9ed32da207c2e150e510691ef2e65e0e0291aae6ba2f5a84

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\shrpubw.exe · signed by Microsoft Windows

25736365d4fb5eb9165a474cf2fbcfb478ca190bfe93cc21ab03fac81a5a2e5c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\shrpubw.exe · signed by Microsoft Windows

6b4e6bb29538f24afcf8b823383b846d2d483d83b38c3f74902995de6e6679f8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\shrpubw.exe · signed by Microsoft Windows

1d405032f1b68d576450775b0d66ad42004d2b975db767a999111b4a33cb111e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\shrpubw.exe · signed by Microsoft Windows

2ad75c0bdab3585f749500fcf3bfe85d0b97172589f4aefeaa4f69f87229543f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\shrpubw.exe · not signed

1f27caf4ae172acd6f866727908a8731bc3a9992f83e2c71dd68e9bcf82617d2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\shrpubw.exe · not signed

c9481b9dbe4a9689b0d694a17d2d3b02813c283435b11be3f345ef449db47626

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.