dcdiag.exe
Active Directory Domain Services / Lightweight Directory Services diagnosis utility file version info
Program on Windows 2 known copies with hashes Command dcdiag
Is it the real dcdiag.exe?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionActive Directory Domain Services / Lightweight Directory Services diagnosis utility
2 known copies
10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dcdiag.exe · signed by Microsoft Windows
4743c32af3d19cdf125811ed9d17fb72b25cb453319a8af08c2f1369b3e50a7010.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dcdiag.exe · signed by Microsoft Windows
dbefece2b296a91054c674ec3f9246879d02e1d76ac56eb2dba803ee2e9d971dFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.