SynMood.exe
MoodPad file version info
Program on Windows 3 known copies with hashes
Is it the real SynMood.exe?
C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_318aa16b062fddc3\C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_4e500223b4e4a9e4\C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_b28b907efbdd0634\3 known copies
19.3.31.31 16Aug17 · C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_318aa16b062fddc3\SynMood.exe · signed by Microsoft Windows Hardware Compatibility Publisher
12f1048bd9f8734c145783b758d73c246d42527716d479ab51405735edfa56b419.0.12.95 06Jul15 · C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_4e500223b4e4a9e4\SynMood.exe · signed by Microsoft Windows Hardware Compatibility Publisher
e1e104815cf8c08e1536e2400bc64275e8f6e6b3f3ae576e10a4c530fabadb8b15.3.29 13Oct11 · C:\WINDOWS\system32\DriverStore\FileRepository\synpd.inf_amd64_b28b907efbdd0634\SynMood.exe · signed by Microsoft Windows Hardware Compatibility Publisher
3dcd908b1140b4607badf590fdfbefdc72d99460eaecdd2697b9a5b596ca94d4From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.