CmdID

CmdID / Files

DevicePairingWizard.exe

Device Pairing Application file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DevicePairingWizard.exe?

file version info and known copies
Original nameDevicePairing.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDevice Pairing Application

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\DevicePairingWizard.exe · signed by Microsoft Windows

152df8f2fa209e21c8df9f2998690af78509e95eaabebf89ed45822c0a8efc32

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DevicePairingWizard.exe · signed by Microsoft Windows

69b9e20bdb273266c0406e8aa189fdc942516a38830fb9b800463e6b1fa5d641

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DevicePairingWizard.exe · signed by Microsoft Windows

2adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DevicePairingWizard.exe · signed by Microsoft Windows

e681baf7aff55b0d22c8ac7034100b532f45f760847a969658159043f930ae78

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\DevicePairingWizard.exe · signed by Microsoft Windows

344905882e5c1c5a1f614843004559b5792ec0c96ef488ac82c67ac2d375763b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DevicePairingWizard.exe · signed by Microsoft Windows

9d6442c12fea13548fa7f204e2080b7b075b6883f5565154c7b74db4f5b4111e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\DevicePairingWizard.exe · signed by Microsoft Windows

1003a2e8786ef3f2bdb2c9a017dd5712192eb2c2ac88c296fa290b7f15c47efb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DevicePairingWizard.exe · signed by Microsoft Windows

b8e0841130eb3dc73e827e8cdd0ca7a8caa2da7aa0d7de74433b13b0c19ab7a1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\DevicePairingWizard.exe · signed by Microsoft Windows

6885edfb1712b3b20c3ca24ba4560929fe1ed7af06699cda3448c667124c67a2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\DevicePairingWizard.exe · signed by Microsoft Windows

8eb20ebe33e5850dfed3d61ea65794ce40984198002d0a1f4db53f3748a282cb

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\DevicePairingWizard.exe · not signed

352cedd04fd2bc1c7b83ebf7d34ef892e0a1a05f93d526cab101a44263c95b5d

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\DevicePairingWizard.exe · not signed

409048510049c01050297c1acba114d8c4effafd88ab5d25e4c687ca8baa3a1a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.