CmdID

CmdID / Files

qappsrv.exe

Query Remote Desktop Session Host Server Utility file version info

Program on Windows 9 known copies with hashes Command qappsrv

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real qappsrv.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuery Remote Desktop Session Host Server Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\qappsrv.exe · signed by Microsoft Windows

4180949bb3ef6e913a8da36b1745ea481043f6a7b8a2de15701b5fb0e8e5cbfd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\qappsrv.exe · signed by Microsoft Windows

7854bece46eca8917904d60666a856de11ca4896c6452d5af1a1b20f1626c971

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\qappsrv.exe · signed by Microsoft Windows

04b00881c96b29833c5a7ff0296638acd66494768d58cf7ae5f408c358b79f67

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\qappsrv.exe · signed by Microsoft Windows

cb7f28d3121604628402db28b7627de8d64a1b7116b883c83ae496d6f6d0b667

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\qappsrv.exe · signed by Microsoft Windows

fe90f56d6830c6a908b113bba48bf4101f14b54ae7423801ae499050605fc350

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\qappsrv.exe · signed by Microsoft Windows

0ef81d441c58793c3d80893387ada88947def3d332768f1cb4e90c4fb7fa9070

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\qappsrv.exe · signed by Microsoft Windows

a17e6e3ef7dcfed272a02e962c009a4eb2394b853c7584a55163ddd72b21c743

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\qappsrv.exe · not signed

65219ffa2bf89071b495af984ac20e2c37cffe3de2cb9c72ba40c1b8e2ced9dc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\qappsrv.exe · not signed

c7b819b38a086c2b50e4f2ac3ba2cc7248b0993a23dce275e4a090ef6075c8c5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.