CmdID

CmdID / Files

rasphone.exe

Remote Access Phonebook file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rasphone.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemote Access Phonebook

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rasphone.exe · signed by Microsoft Windows

26b3f14407e5318b462fcc97abf9a07dae0d58d210cb6b92e8274d77c86884f6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rasphone.exe · signed by Microsoft Windows

2d55c650614efa050bd9b5278de8686e29b6be86722da1cdf350834dde220ebf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasphone.exe · signed by Microsoft Windows

081f631d598c327c2e9093d34fefee01bc571becf0b3b3eaf1f6537fe18a945e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rasphone.exe · signed by Microsoft Windows

f0b3457eefb179af919f3ef4014655e17a6ce49065504f0b4e48d9ec0cdf6e64

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rasphone.exe · signed by Microsoft Windows

a26099eb7ce5b70db3d369cf66a407ab2247d1ac292ea2aabd9c4647736522f9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rasphone.exe · signed by Microsoft Windows

af0309ab694d5bbdb2e303852d82ae8d0a49bb27be19d61aa102f90406527826

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasphone.exe · signed by Microsoft Windows

45453fdad201a4699f6ccb1799a8b14041600cfbc77c3ff79ff9f7964be89dde

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rasphone.exe · signed by Microsoft Windows

a3124a4c8aa0ee06d9c1bce39dd9c5e1e38bbc895d14fa36b75afe1f2fd758e3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rasphone.exe · signed by Microsoft Windows

ad664055df0c489a40ed13617ab4b59a78c7fd11202ed761d178a7fb19850dd9

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rasphone.exe · signed by Microsoft Windows

b91891aca0aaf870bbd34b46503de1a62331df95e786dfb2bfe6125226fa1e6b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rasphone.exe · not signed

8305bc3353655b4e0e1ae300064e0f865be0be10084c902d1f8958a6fe335910

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rasphone.exe · not signed

e4b55bba2bb62d38c699fca8b752bd0d18654d7edf2fc4bd5dfb5b4780586aaa

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.