CmdID

CmdID / Files

subst.exe

Subst Utility file version info

Program on Windows 12 known copies with hashes Command subst

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real subst.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSubst Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\subst.exe · signed by Microsoft Windows

7d3d8f263c384f38236c83e3e0302a04e6cd79658801e972a7b7edcad5d0abed

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\subst.exe · signed by Microsoft Windows

c74f772a78cd3146912d8febc4bbb6e859a0f44d5f84e456664341c953772b76

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\subst.exe · signed by Microsoft Windows

2aef2b8b7896fd5a0f2da5781521b60d2fbf1ab361b0ce64ae8eeeb6c8e21aeb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\subst.exe · signed by Microsoft Windows

bf91a26c040417656e389188f291c9fcc8c7beb4f1a00067d3d3623ef8f3c03c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\subst.exe · signed by Microsoft Windows

917140098adf2e6eaec3adeab430ff72e7b0879dcec9b01245e07373d25a7a0e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\subst.exe · signed by Microsoft Windows

b79d8342239852f136263b77f2b01577812e977e26974a893dfb285d062999e1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\subst.exe · signed by Microsoft Windows

7825146856defe9d7d240585117330a3d6b3bc8e4023ffa94c351cde6feb2f39

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\subst.exe · signed by Microsoft Windows

899a5e7e86b1b9f63a1d5e8c63f93c28565528b25eb6c7199b85a0fd69d79ad1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\subst.exe · signed by Microsoft Windows

3e090e518681034aa40e6a194e798b0b1a6691848746ea1d345441c575c73dac

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\subst.exe · signed by Microsoft Windows

c2d5620f9712c2fae78fdf585f25a1739c2af4972329e1d83d494aaf1beae7c0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\subst.exe · not signed

51cd26a60d77b16d7bf4458fb5e54ba7c4d1f3b0df3de51bb95391b54da33c21

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\subst.exe · not signed

b52b8c9cca6b8051e5b81aa16b51eb56a7800b4805f09d599570f87dd3c0a6c5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.