CmdID

CmdID / Files

WFS.exe

Microsoft Windows Fax and Scan file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WFS.exe?

file version info and known copies
Original nameClientConsole.EXE in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Windows Fax and Scan

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WFS.exe · signed by Microsoft Windows

8a6389bdc9082aa775994b93df46825d5233a2a5f341773a0f34b4a8cdb5edc6

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\WFS.exe · signed by Microsoft Windows

e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\WFS.exe · signed by Microsoft Windows

3524b83acff7070143dae54426fcf5b3a83f3bcfb0cbfd1cc96e2f9002e1f4f0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WFS.exe · signed by Microsoft Windows

30e69ec541876eeb5e7eac4658a1f72f7c4924280f7623bf495e08ca5fcd1265

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WFS.exe · signed by Microsoft Windows

b66c712322eb9b21a78a8de99aa0d849506e7e32b6b3a835425fb3428200ff08

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WFS.exe · signed by Microsoft Windows

8fbac98180bcf2d79ccea364f3d7e1301e1592727b99c712b1db5e2e50a7bf25

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.