CmdID

CmdID / Files

djoin.exe

Unattended Setup Generic Command For Domain Join file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real djoin.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUnattended Setup Generic Command For Domain Join

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\djoin.exe · signed by Microsoft Windows

013775598914bc8dfb240392f0977f62a984d2fc7ddcc9c2540f4c7366a26dae

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\djoin.exe · signed by Microsoft Windows

aaa3994d7c79226680d59f82e8ba59807b08aab0b796ef6323fab915fc532153

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\djoin.exe · signed by Microsoft Windows

f5ee00bf7cfd7bf7504597d0106d1fa2c8cebfc7b693dc18e6e10f2864fad690

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\djoin.exe · signed by Microsoft Windows

110082ddd72069dbc9a64fca588db41e6c2049cf2860ca51de3c14a175609ad5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\djoin.exe · signed by Microsoft Windows

a7b6ac2649e6398cec55a349929fe1de8da137b9f77ecd7d9036f4bacb29bb59

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\djoin.exe · signed by Microsoft Windows

fbc1ae96d1ee1a883658c6f9101590777f95f480010acac4e7934505b405f507

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\djoin.exe · not signed

5c7ef0e0f9f35c90d304c56bfc04c85ab4476d83fbb91f38fc207809fbc38210

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.