CmdID

CmdID / Files

dpinst.exe

Driver Package Installer file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dpinst.exe?

file version info and known copies
Installed inC:\Program Files\Amazon\XenTools\
C:\Program Files\Amazon\XenTools\.Drivers\xenbus\
C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_318aa16b062fddc3\
Signed byMicrosoft Windows Hardware Compatibility Publisher
ProductDriver Package Installer (DPInst), Microsoft Corporation
DescriptionDriver Package Installer

3 known copies

2.1 · C:\Program Files\Amazon\XenTools\dpinst.exe · signed by Microsoft Windows Hardware Compatibility Publisher

07acbff9a241cf67051807d261066db56b159e3e25b26feb8564a7ed1bc74e8b

2.1 · C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_4e500223b4e4a9e4\dpinst.exe · signed by Microsoft Windows Hardware Compatibility Publisher

1165ca1c70618fdbc1e703550413788fffedd1a0663e1c7f29a3cfbe1d25906b

2.1 · C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_318aa16b062fddc3\dpinst.exe · signed by Microsoft Windows Hardware Compatibility Publisher

a8ef0f47cf6e4f993456ab535363091f6ed6be77f5086ef2cb4a53a106e5bd76

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.