CmdID

CmdID / Files

ddodiag.exe

DDODiag is a tool that collects Device Display Object (DDO) information from the system and logs it file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ddodiag.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDDODiag is a tool that collects Device Display Object (DDO) information from the system and logs it

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ddodiag.exe · signed by Microsoft Windows

d9fcfb3c176ea76d997c98a492e54a00dba2d584fdb46280062ee7354828b3f7

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ddodiag.exe · signed by Microsoft Windows

e17c631fbc00ed16d86f865ed542f71cdd54a6d6b5b0c02d49315b9d8f220bfb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ddodiag.exe · signed by Microsoft Windows

1a40075ae8330d3b2ab1c567b4fd183cfdda20794015dab8503a406b58df9d44

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ddodiag.exe · signed by Microsoft Windows

99c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ddodiag.exe · signed by Microsoft Windows

b2b6e11af0d745bc36a76dc73ab08ad5b4bb45e5c13d481caee639e98ec5e114

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ddodiag.exe · signed by Microsoft Windows

d3887e2b8537644653c1787d8cf9e142b43653c0266f76930798780b60249a13

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ddodiag.exe · signed by Microsoft Windows

a67110c259924e1de43d648c700337226e57d6df55099cac5d4602137706bc81

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ddodiag.exe · signed by Microsoft Windows

b8e52abd573af6b8773a567425a5fa667be939e3bc1e522b0db388a4f0fa2b5d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ddodiag.exe · signed by Microsoft Windows

6584e99e510951361469880d7802718f16d5d598c65858cc9cb7529186b03384

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ddodiag.exe · signed by Microsoft Windows

d09fc7e59208123462a2c984e246123c1decd61640d8bbc1359f0c1f3acce922

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\ddodiag.exe · not signed

5807ea585d1ae08aae728a0ea73828ea1cfd030e32119e4b06a70698232fd185

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\ddodiag.exe · not signed

a596c36731eb24fec689091e741c52159ba802440aa91c39c3ba826dea4f9276

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.