CmdID

CmdID / Files

xpsrchvw.exe

XPS Viewer file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real xpsrchvw.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionXPS Viewer

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\xpsrchvw.exe · signed by Microsoft Windows

58e2f83cfe6303600d4f6d0a20261724250a2f396f607a787aca22e7ae88c52e

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\xpsrchvw.exe · signed by Microsoft Windows

ed50b1b008f34a3bf2a7522879354ff4d16c65d2216a90a6137bc7862900821b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\xpsrchvw.exe · signed by Microsoft Windows

50fe090667d3a0e466871fbeb3909e73ec0891aebff63975444483ef4cc4fae5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\xpsrchvw.exe · signed by Microsoft Windows

bbaad58466b8056c0cfff7ee56f5e8573ec72966d7f1962978d754fa1f35de5d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\xpsrchvw.exe · signed by Microsoft Windows

3e35bf6359b05915c42f13f6ac3a3a357b64e55e201abfd3541e4fa6be542ab6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xpsrchvw.exe · signed by Microsoft Windows

43aa9e85009dc934eda66a109a9a6881fb8a0e12ac3c1c68706c7996ab399f98

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\xpsrchvw.exe · signed by Microsoft Windows

4f952762181f94c8007ead69bac284848dea839f9bb2a3b64943397190f1f258

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xpsrchvw.exe · signed by Microsoft Windows

9d38288014250dd0703c1cbb71c8022daed0998ca8f6691827214fc8258b64a2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.