CmdID

CmdID / Files

upnpcont.exe

UPnP Device Host Container file version info

Program on Windows 18 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real upnpcont.exe?

file version info and known copies
Original nameupnpcont.dll in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUPnP Device Host Container

18 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\upnpcont.exe · signed by Microsoft Windows

87958b11f12198bd2ca12e419bf73562ee9680e896e26bc9f3d36f2f52fdec4f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\upnpcont.exe · signed by Microsoft Windows

fa0cf307c04041ec26ec31f1a70f988904ede7176e0cc5256fb9a3a2b91a22af

10.0.19041.867 (WinBuild.160101.0800) · C:\Windows\system32\upnpcont.exe · signed by Microsoft Windows

0b6f3a562dd9c806ab0c2f8391f0d808d807ba8b231a163d9b57b38f1b4d7277

10.0.19041.867 (WinBuild.160101.0800) · C:\Windows\SysWOW64\upnpcont.exe · signed by Microsoft Windows

1998bfdc9c424f01f1b95a0ebdd861ecdf84d742e379f73893e0eec682255b87

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\upnpcont.exe · signed by Microsoft Windows

273c07a18e58228eceec37878621407faeafce7310f1e44307b592a386e994f5

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\SysWOW64\upnpcont.exe · signed by Microsoft Windows

402d06eff121d704268b193dd4fe00fd9fe37e8d1c0e1abe6991f76e036f320f

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\SysWOW64\upnpcont.exe · signed by Microsoft Windows

a3bdbccdfe582cf0ebf7cd717b65ddaa6f542965de30299b1a93192705ea91ce

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\upnpcont.exe · signed by Microsoft Windows

d31c35e8655d8fd49dd0c8f55e19cd9e5a795ede6c148cdaa34e13cca6f05d72

10.0.19041.153 (WinBuild.160101.0800) · C:\Windows\system32\upnpcont.exe · signed by Microsoft Windows

6c679fdf203595b383c57ff4737e82e37baa0c9f443ae83d47661bb175bd6f0b

10.0.19041.153 (WinBuild.160101.0800) · C:\Windows\SysWOW64\upnpcont.exe · signed by Microsoft Windows

74d5085931b886591b9595e53bf96afd3ff81abd2fc8b189086bbf8443215af5

10.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\upnpcont.exe · signed by Microsoft Windows

0b04b209e2b1884f50d17eebe72312aa8898d43ee49b73ddf7963a735cb66eb8

10.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\system32\upnpcont.exe · signed by Microsoft Windows

8fbf028a55cfb5dd5df94be4927d003a1b0490e4f88b1137217107192b326827

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\upnpcont.exe · signed by Microsoft Windows

481542dbafc0494531864444544e54b5292565aad7547428dbd1d2f76d361a4b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\upnpcont.exe · signed by Microsoft Windows

8fc99d5aa8a124a217d12adebc52ac8a47f04e4a214a9d44cc125a70fff58a85

10.0.14393.3321 (rs1_release.191016-1811) · C:\Windows\SysWOW64\upnpcont.exe · signed by Microsoft Windows

2e26aabbf0ee0b1ae3b758f4f093708a45296753a35afdfcd65c58dd115a0604

10.0.14393.3321 (rs1_release.191016-1811) · C:\Windows\system32\upnpcont.exe · signed by Microsoft Windows

d81e4d64f43f00d295881f41e3776236e2834ef9bd0971078470c010d6bb6f10

6.3.9600.19547 (winblue_ltsb.191011-0600) · C:\windows\system32\upnpcont.exe · not signed

c725acd8c15c95f8c740f86711f553b88ebe625939e545eb4d4bffd592a2f369

6.3.9600.19547 (winblue_ltsb.191011-0600) · C:\windows\SysWOW64\upnpcont.exe · not signed

e721ea0875249ed1e441899022324acbdf58d768e14bb8f68c7434b1e8d11ccb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.