CmdID

CmdID / Files

kdsrv.exe

Microsoft Kernel Debugger Connection Server file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real kdsrv.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Kernel Debugger Connection Server

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\kdsrv.exe · signed by Microsoft Corporation

462463dc74ecd9c39c2631e7b2f068e65a6dea82442e31e19a80ddff62026f16

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kdsrv.exe · signed by Microsoft Corporation

6d2807f32a87de9b0167136721b9f8332c1a58f33fc4792155d880052fc5b7f7

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\kdsrv.exe · signed by Microsoft Windows Kits Publisher

d6f534caed9032cab3e000a65c276039afe096575fb166bbb657999a8a06bb23

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\kdsrv.exe · signed by Microsoft Windows Kits Publisher

e5eedde27b19be9ae493f688af944513840023b100d55fb42823c8b8dd9cfdea

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.