CmdID

CmdID / Files

wowreg32.exe

SetupAPI 64-bit Surrogate file version info

Program on Windows 16 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wowreg32.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSetupAPI 64-bit Surrogate

16 known copies

10.0.22000.194 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wowreg32.exe · signed by Microsoft Windows

4a7518214838e239da314421669599ff3e12c779df774beabce94db3d62d20d2

10.0.22000.194 (WinBuild.160101.0800) · C:\WINDOWS\system32\wowreg32.exe · signed by Microsoft Windows

e6ce0937608b31858c013c3e54e9dabfc375804b0c6cc8309a77ff09f80dc464

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wowreg32.exe · signed by Microsoft Windows

26e34d8f1370e557f2d864aa552aa3d77c4bb6371c49778007a2dc91f206ffa7

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\wowreg32.exe · signed by Microsoft Windows

fdc250b842e7744bc51d217941465df1055c9780966e00a701557ccf1f1a6905

10.0.19041.1237 (WinBuild.160101.0800) · C:\Windows\system32\wowreg32.exe · signed by Microsoft Windows

2e021f5641ee030c3292173d3b7be0ede018ff6096cc46f31b510d2a53103f83

10.0.19041.1237 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wowreg32.exe · signed by Microsoft Windows

5790ecbb47ee1391502c81159a9dcf24b569ea2e3f4dd47e4267f81eacb70a4c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wowreg32.exe · signed by Microsoft Windows

0a3d73c61d5ff6a7e477ebc5bb2746d091599a75d218999a5c8db1cd7d54171c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wowreg32.exe · signed by Microsoft Windows

a18a76290cd968d6a1734ca77b6553274359e24cc67e75b364b19732f9470425

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wowreg32.exe · signed by Microsoft Windows

2eff52772b1eddc04bccc01957a39ace8cc5106b0de68a4549cf447a9270ce3c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wowreg32.exe · signed by Microsoft Windows

e08c50df581cfd718d85b40cadbd0c0bee6f8d74f4ef80ea77b26842ae4a65a1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wowreg32.exe · signed by Microsoft Windows

5fbed7838e7ae5306b25b05b85d8a78f57badbf76eddc103a4a60aa55bf999c1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wowreg32.exe · signed by Microsoft Windows

eb9048606c0ce6be9f82f0b6b62a977133a6c43459e3dc6417f941d591fab2a8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wowreg32.exe · signed by Microsoft Windows

005293cff6e4c0cd03377f60ae4d7d1e12cc863dc62d033622d1612494d9f325

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wowreg32.exe · signed by Microsoft Windows

b696d63b850c914b706da9bb9f5cc0bc601d89338ac65b00e2fafe95bfd05797

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\wowreg32.exe · not signed

0bb7c9e1fe33f19a092a1765ccf5ee86a9f8fdd4e0ea1cb6af33ad0ad5c8d91b

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\wowreg32.exe · not signed

421bd619eafb8ce48990654c61420de25b8c06e4234c1c7a4a227f5c673f855c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.