CmdID

CmdID / Files

wextract.exe

Win32 Cabinet Self-Extractor file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wextract.exe?

file version info and known copies
Original nameWEXTRACT.EXE in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionWin32 Cabinet Self-Extractor

12 known copies

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wextract.exe · signed by Microsoft Windows

85d97640fd8b1ee1579becc3364647edbdbe41f1b6acc9e98cb377048c907f48

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wextract.exe · signed by Microsoft Windows

fff5e843f90d5ae7ff48fbcac810dcd5174910d7a897004edd188046bc367d19

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wextract.exe · signed by Microsoft Windows

085de9df12eb199667f49ba42bdc20ee7ad86ba5b856016af17fdcbad17f0043

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wextract.exe · signed by Microsoft Windows

fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wextract.exe · signed by Microsoft Windows

87d2df8fd8922b7bde7c65b4d2698fe43c74f12e287bcd58387f6f91a49a7b0f

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wextract.exe · signed by Microsoft Windows

c352fd23e19b69e7543d39105a7888a2ef2f7a81372cedaf730fcc312dad803f

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wextract.exe · signed by Microsoft Windows

1c010be91ac208aac741a2a5bf2439d9edaecdc537b9303f09e5e1668766892b

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wextract.exe · signed by Microsoft Windows

64bc17d02d409b0eae84dccc71dd0c5115ef208efc79a30281e60404a5632d91

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wextract.exe · signed by Microsoft Windows

9c04a0573b703a811df8b7348f80c0fc7c78a76e689c394b7cd0777053c1d495

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wextract.exe · signed by Microsoft Windows

a24793258b3bd87290808c9ff6f20600766ed2cc5d5a1eae5e013bb90eabce66

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wextract.exe · not signed

4e2f6a6effc06e758dc5107084598f7dcf73b51b90d37c427e2d3736d6acb4f4

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wextract.exe · not signed

bee6558e08359da2f716bfcaa524778844c696a4e4dec87426afb7f5ef23dfe0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.