CmdID

CmdID / Files

lpremove.exe

MUI Language pack cleanup file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real lpremove.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMUI Language pack cleanup

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\lpremove.exe · signed by Microsoft Windows

62353861d0c1908bfaee2ee6c80bd04f449990e163c7b1db929a24c892c235ff

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\lpremove.exe · signed by Microsoft Windows

6220ba55d96ddafb6b573b2405db412f7420c77d09b5c1a1637d558ea5480057

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\lpremove.exe · signed by Microsoft Windows

998d0f493d434897ced456d6645eeb89c5f8a2a8e76c7e5292d3cfed08d72a25

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\lpremove.exe · signed by Microsoft Windows

148b7b678fe8e74f8d92412b14eff11496d7b1ab7b8a548b327594f806df77af

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\lpremove.exe · signed by Microsoft Windows

1422eab9650f4d37d496bd0efb976628e4336d2bd7ff1b4864d6e8e073300c5f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\lpremove.exe · not signed

792488a8f240b110d849cba2aa8b74e2a158604475c5a23942838815628c935d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.