CmdID

CmdID / Files

dplaysvr.exe

DirectPlay Stub file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dplaysvr.exe?

file version info and known copies
Original namewcodstub.dll in the file’s header: a renamed copy still carries it
Installed inC:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDirectPlay Stub

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dplaysvr.exe · signed by Microsoft Windows

302c2f6c332a24422a898ef5c6764f2a95038653feb65fd0e1e2a319adb506f5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dplaysvr.exe · signed by Microsoft Windows

f0f847a5079f94adfd5b224c05ddd4a5651c757b920b6c26e629993c7dd36951

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dplaysvr.exe · signed by Microsoft Windows

8f9add8e95a4a7aa859afd81375bebd9fe82835091ae3c76818e15aaf5b86975

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dplaysvr.exe · signed by Microsoft Windows

991aab6b229a376b02b64d95f5dac5059c33aa8cc914a640201a95d556b21399

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dplaysvr.exe · signed by Microsoft Windows

8ee1af4f87971a0ddbb14dee0ea86cf9aa49001063a7e85e04eb3c4de3cb6368

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dplaysvr.exe · not signed

0597aaf25f1e7458c19a7b78ee64711d256c3c649af9fff40675e73af6cf7836

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.