CmdID

CmdID / Files

wiawow64.exe

Thunking WIA APIS from 32 to 64 Process file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wiawow64.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionThunking WIA APIS from 32 to 64 Process

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wiawow64.exe · signed by Microsoft Windows

a1a2852a37e208d475a3648bf9c7900e0e6edb76903158a9be17af9c8f9e80bf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wiawow64.exe · signed by Microsoft Windows

5cbb42d37f3fea5496598a6fe85405047c7e78697e6fa474353cfedcae9883ea

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wiawow64.exe · signed by Microsoft Windows

57b23ddc5759ff32bdd98001ce17232f59f6aa39d2dcffdda9f12a9b50a82cdc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wiawow64.exe · signed by Microsoft Windows

310d64eb8f9d0b8cde591aa0b8857bf2bcd3cd25a232429904c34388d1b9f829

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wiawow64.exe · signed by Microsoft Windows

ae290b64456214e715ad89361098fed7819150c3acf1de664268d9b2179dc455

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.