CmdID

CmdID / Files

credwiz.exe

Credential Backup and Restore Wizard file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real credwiz.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCredential Backup and Restore Wizard

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\credwiz.exe · signed by Microsoft Windows

191e5c8244e8b46c8a3394c05aa8d3f58596a62438f6481208b0fdbfdc0df9c6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\credwiz.exe · signed by Microsoft Windows

995587b68c4cc076ffb95b80a3592cbf7fed6e24e1daf3137014d7713f56fb9e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\credwiz.exe · signed by Microsoft Windows

2156279eac34cc622f755766de61090290ff8b0960ebb46b03038ae321b3566d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\credwiz.exe · signed by Microsoft Windows

dd73d0adbedf9c251c055081279cf152e3e84197f91024474efd4d23fab3c6c3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\credwiz.exe · signed by Microsoft Windows

99086d3d6f4e05a08bd2a74b336ded81b92eacec241c22626935f3ad3cd56312

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\credwiz.exe · signed by Microsoft Windows

c6350ee68a5ced47c79a32124ed86c398d5d8ee4bebb3c703da16d67ce292a4f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\credwiz.exe · signed by Microsoft Windows

6dda8d8158bf23069b64014eedb2c2b2ac8334e4f13dbf88d555f67dfebdbaba

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\credwiz.exe · signed by Microsoft Windows

c3bf35b99f90d420b879f5f7bbea8b39ad265865ee7538a72fd147f8a900f1c7

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\credwiz.exe · signed by Microsoft Windows

896c66af66fb0b23c751b79044da47d0068d66a02a15ee4b78917df2a0eec337

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\credwiz.exe · signed by Microsoft Windows

9dedb08c7f04f9c0bf33b48c4b8692a200ae62112f02fef985f13322d6ab540e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\credwiz.exe · not signed

9932324e1cdfc4bc88d5bc908b90ae7e032ce999c46091f97e6784faaf8ac97f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\credwiz.exe · not signed

c7e7428639c598dd6fe35371cf7c9c11c9e6fc91230b8c615eec4ed3dff47efd

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.