CmdID

CmdID / Files

Netplwiz.exe

Advanced User Accounts Control Panel file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Netplwiz.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAdvanced User Accounts Control Panel

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Netplwiz.exe · signed by Microsoft Windows

a1f36badff8b19b20864a77cf5dead46f018d601ca518dfe37a5881dccfb84d0

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Netplwiz.exe · signed by Microsoft Windows

d5803d4d1f358a4dece148ee6d2233d9ee8fe96b0d32b0bced73416cddab274c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Netplwiz.exe · signed by Microsoft Windows

223adf0652426b95c10c2081f185ae82fd96ba1de0ab1569913809922e5765f9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Netplwiz.exe · signed by Microsoft Windows

8323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Netplwiz.exe · signed by Microsoft Windows

0cac9b0008e2e888b25b908c61773e3a8af377b85eb3273fd8204505bebf0682

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Netplwiz.exe · signed by Microsoft Windows

46e31f337ed0d9a6fe3f159abc91c9b9b6a6062982bbcd84a51784d7128e7ae4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Netplwiz.exe · signed by Microsoft Windows

4d65d42a1af2c1193b6dddfcc1393e4887cab79c109103e7b234b518d9001207

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Netplwiz.exe · signed by Microsoft Windows

f0bdeae93f385d0242e902deac742ee3a2d3b928996ab9a9f539ed26c496daa1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\Netplwiz.exe · signed by Microsoft Windows

2a026f06f5116babb3250c021184d78961e939ac7d2069c4b75b6404e8e5b717

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Netplwiz.exe · signed by Microsoft Windows

a8dfca8ae3a43d3a60141a0a949692ad02883bf359fb764776072fa89da6ec11

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Netplwiz.exe · not signed

7633069eeda4a819edd74a87aa78f63b63527b1a31e9ab6e7fdc03b80a1dfdc6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\Netplwiz.exe · not signed

f886e452846d31c82b404962e11ed68e2576cdda8e36d6213a15eff36d044189

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.