CmdID

CmdID / Files

dxdiag.exe

Microsoft DirectX Diagnostic Tool file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dxdiag.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft DirectX Diagnostic Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dxdiag.exe · signed by Microsoft Windows

6798f6b549916beb78cb7d6770e31d5258fde14f781795c5d439c2fed62fa324

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dxdiag.exe · signed by Microsoft Windows

83dfe57c5d6fc7f8760e9f55ad6565ed1db2709c19a1972cc02bc3f356f0216a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dxdiag.exe · signed by Microsoft Windows

b3c1048df7a2292798efcad66b3400c5c3c5747e8f09993621fd0de7b33a159c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dxdiag.exe · signed by Microsoft Windows

c36c36c2945802feb2195ad271c98f994b22a09f6cf2a1764a190865d1d6ce2b

10.0.18362.387 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dxdiag.exe · signed by Microsoft Windows

5de783d53e91033c9c1822649c8a42be856d5e49d07bb1a087eac5b5711cb96d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dxdiag.exe · signed by Microsoft Windows

bc1ac87e76d9f205e7b82481bacb79eed1a1adf48c95eda07a60418ed24a47da

10.0.17763.475 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dxdiag.exe · signed by Microsoft Windows

61a5f3a9e4307dcba263f68d6bc470ebdc7dc4bbdf75f872e200e10e97552341

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dxdiag.exe · signed by Microsoft Windows

942f70ace785dc2a2d7377abc3db1a2b769c5ff8ad4dff0d3cd66b9e029cd178

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dxdiag.exe · signed by Microsoft Windows

b0703d68fc7edb41a99b612e62efe7ece347c17e3f875e89e4a2860c258f031b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dxdiag.exe · signed by Microsoft Windows

d035316f6bdf5009934565079ce30ea49a540492780ca476571c904b18c8518a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dxdiag.exe · not signed

fcb3a1bcbe786c808f6acc7cc0a8906deb37c83b170a937f9cca5635fcea35e5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dxdiag.exe · not signed

fcf2e265151532bdf1b3e322a78c7f61cdd90ee5e8706e88c84da9daba86c8be

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dxdiag.exe
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems)

Sigma names dxdiag.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.