CmdID

CmdID / Files

WPDShextAutoplay.exe

Windows Portable Device Shell Extension Autoplay Handler file version info

Program on Windows 10 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WPDShextAutoplay.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Portable Device Shell Extension Autoplay Handler

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WPDShextAutoplay.exe · signed by Microsoft Windows

33b655d125e5a57f08214f629f8e6d33d7a9358cc6275bbd3d7a2f57903e5a8f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WPDShextAutoplay.exe · signed by Microsoft Windows

b5d90634481e60aa58c13046dadbe3d0a374d0a1cfe062274c57c6e206af5968

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WPDShextAutoplay.exe · signed by Microsoft Windows

c0f8536c11be99d0128dd970de2b592b7c558037f07783df006b552a9c07f17d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WPDShextAutoplay.exe · signed by Microsoft Windows

f8ac6ce639fb1c444108974ad831aa10b67eaee65bc2618570f8f18cf5dc5f78

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WPDShextAutoplay.exe · signed by Microsoft Windows

2f3ac64c8ea56828743602e01e1f12c58140f5e26371721eba26d8ed72643743

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WPDShextAutoplay.exe · signed by Microsoft Windows

a80d4039ebdde0f1f733b3e0a1e3405a9f0f73bf469ba94476d292e71ea98d08

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WPDShextAutoplay.exe · signed by Microsoft Windows

0613c8cd54fdfb88868a7a8a379fde648dab69425b53f77f2b1b2c996cb8db85

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WPDShextAutoplay.exe · signed by Microsoft Windows

1c5e965f4471f558e688ead0ddb32c3b3d1d22ea1facef76b1fd541ae09379eb

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\WPDShextAutoplay.exe · signed by Microsoft Windows

058244813e36a807cd749ea2a9e749e2d60185d2d069bf73c0e252fb7d293f33

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WPDShextAutoplay.exe · signed by Microsoft Windows

77cef9a66108f8b434d06e420a772aa28c57d2a432e48e73bff7891abffef767

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.