CmdID

CmdID / Files

iisrstas.exe

Internet Information Services reset control file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real iisrstas.exe?

file version info and known copies
Installed inC:\Windows\system32\inetsrv\
Signed byMicrosoft Windows
ProductInternet Information Services, Microsoft Corporation
DescriptionInternet Information Services reset control

3 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\inetsrv\iisrstas.exe · signed by Microsoft Windows

818d9be7ddc6f9363972771b39959a923a1af92d4d9c90f2b5bd38366589e0e2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\inetsrv\iisrstas.exe · signed by Microsoft Windows

72664d7b7f0c01dfbf357fa660714c5a5dd1dfb8c535a47244b1ebcf1da05a7d

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\inetsrv\iisrstas.exe · not signed

719e55fc497a8a052074cca8f99837f6e692011727a8bfac0c7947f7a3cd8100

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.