CmdID

CmdID / Files

SystemPropertiesProtection.exe

System Protection Settings file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SystemPropertiesProtection.exe?

file version info and known copies
Original nameSSystemPropertiesProtection.EXE in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSystem Protection Settings

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SystemPropertiesProtection.exe · signed by Microsoft Windows

2ab2fecd64e90c5ee26aa7f1e2765af9c7a76946fc4a5bd4276a6af20206856e

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemPropertiesProtection.exe · signed by Microsoft Windows

6ed7976f8b11282af2a8aff46822e03dff3b9d740fc9179bdbd5e6bac4293bcc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SystemPropertiesProtection.exe · signed by Microsoft Windows

64d46a44784b59500be52a0e7f8f2b8acc2fa679115c31c9defa04511662d8aa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemPropertiesProtection.exe · signed by Microsoft Windows

a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SystemPropertiesProtection.exe · signed by Microsoft Windows

1bc4dcf332efd5578f88f82a157dfdc6f58d6dac57e2b07ba32742ce531217fc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SystemPropertiesProtection.exe · signed by Microsoft Windows

7457741b6eea940108bdeab4f587bcd8f299ee4979d50666d9e946f639c6824e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SystemPropertiesProtection.exe · signed by Microsoft Windows

71438d2a073507b0d8a41acd59418ec9f0659dc01cb0ecf8f23517b33f2cc454

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SystemPropertiesProtection.exe · signed by Microsoft Windows

a13c30df2c1d6c82a068c207e4ea66b4614c272b733511d234827fbabe6f73f3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SystemPropertiesProtection.exe · signed by Microsoft Windows

9f97eb9b0e80cdbf6d8cee98a65ab3e99dd70ed5ed55bf8c8031d9193258dbd5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\SystemPropertiesProtection.exe · signed by Microsoft Windows

f64ab1a173afc75c625aab489274be8425c8c882a32183eb3607035005b6b625

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\SystemPropertiesProtection.exe · not signed

2d9aaf96ccd090daf53a0e24bc97fe74d756f806fd08f2e7d0d679e0ab5550d9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\SystemPropertiesProtection.exe · not signed

82a3ee64dbac482efc1f1df9ab51e2365e4eb0dc36fa87e3628c1d25500c20e6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.