CmdID

CmdID / Files

plasrv.exe

Performance Logs and Alerts DCOM Server file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real plasrv.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPerformance Logs and Alerts DCOM Server

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\plasrv.exe · signed by Microsoft Windows

2d0dbeacc174f37ba63c8443e53387e30f9777a0e789006d06c984644dd14063

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\plasrv.exe · signed by Microsoft Windows

2d1c235ddc76d427c48c39c22e6dc50141f09734270eaf01778713f987e99cc4

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\plasrv.exe · signed by Microsoft Windows

be3470b470693a544bb3a38ac6f565306b4811e29558c760b2905c861b492904

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\plasrv.exe · signed by Microsoft Windows

42d13db2be5a3b913ef39622f8357752a6ca625ae1280992c21d971ce9b7e701

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\plasrv.exe · signed by Microsoft Windows

30370f7ec771e86dc4908a7e52d43946d9fe3da956069a8000cade71bf8a7865

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\plasrv.exe · not signed

78e1e6dd5b4cc1312bcc4c24675378ab1166971064adc65de6b57815f3fe3a06

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.