CmdID

CmdID / Files

WSCollect.exe

This tool collects Windows Store log files file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WSCollect.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionThis tool collects Windows Store log files

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WSCollect.exe · signed by Microsoft Windows

b1c75231e8e323bbf7119d982f6c35437b27ae0822ce2604fd6b0e16927a5cd3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WSCollect.exe · signed by Microsoft Windows

b9fbb27be73e23a835b4b8803c82775274be26339bf68f1f7c0499de3d330533

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WSCollect.exe · signed by Microsoft Windows

bdfc7a603625fc50d9fbb92f2fea5e4395b5e93a27c9bc1287221e3124ce8f77

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WSCollect.exe · signed by Microsoft Windows

2d0016951f7af6f5f9758b7592d03107909026bbe7cbef7f95559933012d7c72

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WSCollect.exe · signed by Microsoft Windows

d50771e8dbc656cbe87670806f9a9fa4146a354858e549cff70bcb07b69d1c02

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WSCollect.exe · signed by Microsoft Windows

7ea319d8dfc2593cac903a9d05f5f9ae14d0c44ed027c290c62651ebc6b80fe6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.