CmdID

CmdID / Files

wpr.exe

Microsoft Windows Performance Recorder file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wpr.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\
Signed byMicrosoft Windows
ProductMicrosoft Windows Performance Recorder, Microsoft Corporation
DescriptionMicrosoft Windows Performance Recorder

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wpr.exe · signed by Microsoft Windows

fb10e998ba94e4f569442dc4f0a1cc19f647d42d01e679541f49dee85ea0a3d2

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\wpr.exe · signed by Microsoft Windows

2c76e0336d3e3f15fbe0fefe4143510c2132a6808f6d88b29b229414648fc7cc

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\wpr.exe · signed by Microsoft Windows

30940147d6c68c79c9cb8e56cedb4daa4f025eddf1134274de90dd39d0d8ead0

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\wpr.exe · signed by Microsoft Corporation

a368454e020e720987ded3d604d654f6314803397153d64d0d2744401b3ff11f

10.0.18362.778 (WinBuild.160101.0800) · C:\WINDOWS\system32\wpr.exe · signed by Microsoft Windows

eecbf924a2dfa96d2b585a9b5ede60491841ca4d3af9019a92946ba58b1f8d20

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\wpr.exe · signed by Microsoft Windows

37869599b8f17a1d5f7bf91a20a1ce4555919a4758078ffe8dddad422be5ccaa

10.0.14393.2969 (rs1_release.190503-1820) · C:\Windows\system32\wpr.exe · signed by Microsoft Windows

fa94893095a4879b1c0b8994440b786d3aed8feaa4b785388784b4fc14dfbed4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.