CmdID

CmdID / Files

dvdplay.exe

dvdplay placeholder Application file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dvdplay.exe?

file version info and known copies
Original namedvdplay in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptiondvdplay placeholder Application

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dvdplay.exe · signed by Microsoft Windows

5a1bbdbee526610ff0547676bd54eb8de559ac7554b5c211ef3a2371b2a1faf3

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dvdplay.exe · signed by Microsoft Windows

e60444f7c058932d58401a1650675713a2411cd3ab856708244ef1cf951901e1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dvdplay.exe · signed by Microsoft Windows

59576775d8a06038bd9975903418aebf003f075d82f1f109feaddab8877e3c20

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dvdplay.exe · signed by Microsoft Windows

b740fbba53980b4c2eec43d09f3ada7d7b55431d68a15d83ad77e1dc582ad31e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dvdplay.exe · signed by Microsoft Windows

22840313ccc74e88fd03ecbd6d135fda05ba4ae84c68c759f67b89940ee87fba

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dvdplay.exe · signed by Microsoft Windows

2bc3fc9f68a9ab043add98166e30bc7f80afdaef9ed3f22fe0e4ca0720a6b3e6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dvdplay.exe · signed by Microsoft Windows

28695005c5b4780b5258367964580af6568ac187d0e8726eb1c70370ad042cb8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dvdplay.exe · signed by Microsoft Windows

5a1eb8cc2898aed6894e840d89ba33314629ebeb422d5f7a91cf8fbd5be528c7

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dvdplay.exe · signed by Microsoft Windows

0e7099cae6efd37bd377e780c6d8fac60b12531a49f05febb263cb8bc2aa7e90

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dvdplay.exe · signed by Microsoft Windows

afe0549982345226eda82dd0d58f41d238f8aee911d7cfe48f233cbe76d772f5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dvdplay.exe · not signed

7f4428467318428ef3b0431c650a5c1ba976bf2e7392e3cbfe191efe5a31ac0d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\dvdplay.exe · not signed

fcc3442059d7314aee8904a5ce2b93ef0a0c9865c2ab670c8ee438e4d828a9b8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.