CmdID

CmdID / Files

wstraceutil.exe

Windows Web Services API Trace Utility Tool file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wstraceutil.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Web Services API Trace Utility Tool

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\wstraceutil.exe · signed by Microsoft Windows Kits Publisher

14332fd721c1915cbe915c1e2885a9b9e933fcd9205fafb9b19fe11ed70aa5a6

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\wstraceutil.exe · signed by Microsoft Corporation

59472e068e7846264a66c02bbf074369a480cfe0b9fb4739906fe57232c021e6

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\wstraceutil.exe · signed by Microsoft Corporation

aae274556fd2c0454f1a2e0c8796ad4f2f4dceca82423bb71e257a87a502a743

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\wstraceutil.exe · signed by Microsoft Windows Kits Publisher

bf66d70d50987584d84749feec01a3d3f8e7d6589d6dd3828ceaefdf9e014254

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.