CmdID

CmdID / Files

dpapimig.exe

DPAPI Key Migration Wizard file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dpapimig.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDPAPI Key Migration Wizard

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dpapimig.exe · signed by Microsoft Windows

0c8c7a8a3b884191eca9a1378ce4f8cada01a5ec87e09de98351d03c71e080ff

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dpapimig.exe · signed by Microsoft Windows

7454e56ab55f9fe4fbc1985e5050736650c3ae314fc694ba328ff13822500b7f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dpapimig.exe · signed by Microsoft Windows

63de0e29608ba9702fc0996460271886d1f5c8809788be035105bc317a47a5cd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dpapimig.exe · signed by Microsoft Windows

a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dpapimig.exe · signed by Microsoft Windows

0717722801838e2ea2c64bd7350155c821abb5ac47c7978c0e8816fc2123fde7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dpapimig.exe · signed by Microsoft Windows

5481ca9a5f95a5315e2cde26540b6e63f01f4d74c950e33314aafa940b6ceb74

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dpapimig.exe · signed by Microsoft Windows

86b408e98c6c96ec0109228edfd37c6ac6903129b85e4bb8b24734abe6986cf0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dpapimig.exe · signed by Microsoft Windows

e9f1f2c4fbca349cba6d1f3039ff6ad9375a702101a9d69d602e263323bc15fe

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dpapimig.exe · signed by Microsoft Windows

12d150470cc9cede08d632fcdabf4dab05d1119c2c3ec158f530acc28b7986b6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dpapimig.exe · signed by Microsoft Windows

adb6e4a682d56cedc4df75a41271dadc69ddcf0ff03e3ac0f1ecaf6d9e96e48f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dpapimig.exe · not signed

021d977c2b378e6b9f5bde36556ce4ea18d21be2531245e385477e6df9a171c6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dpapimig.exe · not signed

77a9dec390619c80d99d13f3629749663dfc3bc10e866604ff5ce5cc594697ec

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.