CmdID / Files

BOOTVID.DLL

VGA Boot Driver file version info

Library on Windows 2 known copies with hashes

Is it the real BOOTVID.DLL?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionVGA Boot Driver

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\BOOTVID.DLL · signed by Microsoft Windows

52aed2a37c6a321b82310d30880a10c3a0822aeab36dab1171348540a204760a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\BOOTVID.DLL · signed by Microsoft Windows

de2f4364da996c125b7b4ff6ad5e14a94f38620d9b61459a65797b8cd537b957

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.