CmdID

CmdID / Files

DWWIN.EXE

Windows Error Reporting file version info

Program on Windows 24 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DWWIN.EXE?

file version info and known copies
Original nameDWWIN in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Error Reporting

24 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

5c19bf223be67a1b5fb54443bd6be18f3c8063a73e86a0d4c6083fa0e222caa6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DWWIN.EXE · signed by Microsoft Windows

87d0750d9ea50e39930bdfa8e54b0b4159a3d818db4671493c66c157fa46c5a3

10.0.19041.630 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

d96cfe9e5e79d519bd3d88ee9716c145490d93840c858aad58b9ef1c446c6e8d

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

84ab9f2f1e3b38bd86d7f8d05783c9119b4347c49ffaf94ce736d12ace6ed5b3

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

64f219a6b7083358013331a2dee073750b625c2bf30338bed290d42d4bc6d307

10.0.19041.264 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

1c86021c126852564e95c71858b84bfc626fc62382fbcb2f3e841b71b7bc7ad8

10.0.19041.1081 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

644aa4f9edd57a884e36c6412771f5d7970743176636ce8e523efc30f35e927a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

28f96cdd44f4ef2350f47e4c3e9fda9f0ffa880796533b9a377edeb89bbde450

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

32be8352e1e158bf893e9a9e49d91178dea7fb16025d669faf4e2bc9fad988e6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

38be333cd288a2e17a7e0e82925b57bb8a949e6e4ee5dc16c6b68a57a6bcbb7a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

4b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

5051d8f1cc0456ef5ca1e442331d5eb7dce58c550ccb07b71aede081f07f2c56

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

fe1f1096cc71c24e44ec964f9f90006d6f4ea62632b122d126348ae1dc874b63

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DWWIN.EXE · signed by Microsoft Windows

2e8a073a2aa39fdf87d780c3261ff691cfec47dc82deab465f2643f7ca74808e

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

63da39c618acf8ffd5bca9e2afa80e97307be6e5fe61a90d491242709cf04274

10.0.17763.1339 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

18a4091201e9cb313234e68f7aa4a11c12db0bf1e0b5846a139158d8bbb5cb7c

10.0.17763.1217 (WinBuild.160101.0800) · C:\windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

e5dba38ce3058a4a83b0f2aa4be24f64d9f629f18b44a56bcc360a49c99ae7c3

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\DWWIN.EXE · signed by Microsoft Windows

42c43300f9c77fbd5739c4fe0a74e01661f62c9adbc99b288085d0eefc94af11

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

4754e10a43497c6997b388acf5f81ae268570973bd8834202b2f1cfaa6f66ee6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

80efa2321618d983a52ef01de6171257900e77b454d3be5e2039fe3d0bf72de9

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\DWWIN.EXE · signed by Microsoft Windows

24bf4efb1f90427f0a039ab8a8080911eeb2315309d899574611bcddf7f8e751

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\DWWIN.EXE · signed by Microsoft Windows

6e0b5909fb49fefb74677a2e6e9a1e07075c48a4028a512b2339d4d6c353e3c2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\DWWIN.EXE · not signed

7a45814b011c4df2f05c945c06f0724426e1d3ab11fc29d61ab32582884daf02

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\DWWIN.EXE · not signed

8660b3fe1ca132438d8e7383ac6337f02e04ad14b65d6b4002b984f78d78cd76

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.