CmdID

CmdID / Files

prproc.exe

PlayReady Process EXE file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real prproc.exe?

file version info and known copies
Original namePlayReady Process EXE in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPlayReady Process EXE

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\prproc.exe · signed by Microsoft Windows

88769fc1b4a589554eed33ba6fdfcdedc9b7885c89b9603095c695000047b55b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\prproc.exe · signed by Microsoft Windows

a174de17639a2c544d8124895f878abaaa634fdc63bf49979b407fd7a20c28bf

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\prproc.exe · signed by Microsoft Windows

2f381489726c037873d0bf9f32e01e2b1e6e0edd362c84660e78b60f4a70abcd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\prproc.exe · signed by Microsoft Windows

f6112b403195d586d859f1d4e1c3a5a7d2d4380a450f06e62ea9ee877f019818

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.