CmdID

CmdID / Files

wecutil.exe

Event Collector Command Line Utility file version info

Program on Windows 14 known copies with hashes Command wecutil

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wecutil.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEvent Collector Command Line Utility

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wecutil.exe · signed by Microsoft Windows

6f4da7f4cfafeda512ff12c9bbbc576f2394a95b2e17f6417f0d0917f3c3a7f2

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wecutil.exe · signed by Microsoft Windows

fe064ae32b0d59d4fe6f69e96115fb6316c0e55bc0fba581747aabed7a8342c4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wecutil.exe · signed by Microsoft Windows

32e06b5e1acb62625b9805450f9030ed4e074031c6fa3d769a44f3ac6f5a1598

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wecutil.exe · signed by Microsoft Windows

6538b49c984d6c100a969a90f337c158c52ad072d84df746f676176728e74520

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wecutil.exe · signed by Microsoft Windows

8270bb4468b3fc5c2ea6fe92a550de517992dd2f84e195124cfef358f1c8ea5a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wecutil.exe · signed by Microsoft Windows

c9669a68f4a2d84d0d330e190d500ae15f0a1e5dbd5b5a5d06ba076990bd2891

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wecutil.exe · signed by Microsoft Windows

edc98ae8985aa1646b5ad1e57586a8d2c6327ce205c920a4da548976bbb7e124

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wecutil.exe · signed by Microsoft Windows

f9f9db493a29faf1763852696562db8f2e5a4f3256f6d51197123e2aaf28ff65

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wecutil.exe · signed by Microsoft Windows

53b07ab9dae0e58b06dab40cf837dd9150a6125759b4d4a18d3c36a07042b9e7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wecutil.exe · signed by Microsoft Windows

96f7ca1b02c1a0d63747f0bd1448a723a4f49cbef45a0dbb168e69b2f5fb98f5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wecutil.exe · signed by Microsoft Windows

5ee18d4e09f2188d26ad5d70e2f7cf5fb1d8ed68e43247115e52ee673a110c71

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wecutil.exe · signed by Microsoft Windows

789705ebcbbc42c73bb32308cf7d600f99d789dad08db6e79c9f7ca4c37ab8e0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wecutil.exe · not signed

811a33b362ff1e1b7dc9a8f9bc093ae717387fd1117411d3fd76def49b7bb985

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wecutil.exe · not signed

a7488e0bbf2c837ad00cf1862a4097d640c5086628058d62a1f745749ac13057

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.