CmdID

CmdID / Files

KernelDumpDecrypt.exe

Windows Kernel Dump File Decryptor file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real KernelDumpDecrypt.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Kernel Dump File Decryptor

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\KernelDumpDecrypt.exe · signed by Microsoft Corporation

7b422910859c6d7c46f309ce857904b06fbe867e77c552786d23376804e73806

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\KernelDumpDecrypt.exe · signed by Microsoft Windows Kits Publisher

8f700aafc0571abf32b1b60a2477eaf9101246352ad526b7353b1920b49c8d3c

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\KernelDumpDecrypt.exe · signed by Microsoft Corporation

a629705ebc2205ee0c565e397e93814a46ba40a35e981fbc8b8f0ebf8d8e2e95

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\KernelDumpDecrypt.exe · signed by Microsoft Windows Kits Publisher

eda7271a238227dca5ad5a77187424f4f0cf0b9608c5f396424046fa4b632c35

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.