CmdID

CmdID / Files

raserver.exe

Windows Remote Assistance COM Server file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real raserver.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Remote Assistance COM Server

8 known copies

10.0.22000.71 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\raserver.exe · signed by Microsoft Windows

b979617d090cbde75a01350787d80ecb91a4a045ef20ca49c103c78376c2ae32

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\raserver.exe · signed by Microsoft Windows

ec40264f6f478d30f098fff73d7b75121dc92bde736bbc9e89ce206807d33c6e

10.0.19041.1110 (WinBuild.160101.0800) · C:\Windows\SysWOW64\raserver.exe · signed by Microsoft Windows

b9062a9aff2095befbf977e4f0891c922762af492abce64d943dbe1dd4d1b1b7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\raserver.exe · signed by Microsoft Windows

38732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\raserver.exe · signed by Microsoft Windows

448e69db2624789e2927aaa2c7b5271acc10f6de949d89a427ff856e4117cafe

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\raserver.exe · signed by Microsoft Windows

51e1d2363c200c8ce80c4d225e623cb3e359a0d9053d4aeb5f48c96adb227a9e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\raserver.exe · signed by Microsoft Windows

8dc947229a329b73980a31b5377f5dfa019d978c3ba2ceabfed1d92878eea78f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\raserver.exe · signed by Microsoft Windows

a2022d262aac5f9774409cadd72f5f042599745f9bbcb7ab91d6aac306713578

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.