CmdID

CmdID / Files

RdpSa.exe

RDP Session Agent file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RdpSa.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRDP Session Agent

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RdpSa.exe · signed by Microsoft Windows

974fa8de39345e8b2a91ae97d8291ceb6f3ee2dd1bed9378ced9ef715027add6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RdpSa.exe · signed by Microsoft Windows

aaaf9a7dcb0b5a40abd1737b7f9ed279546cccf4f0d5e52e41f248043f48a760

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RdpSa.exe · signed by Microsoft Windows

32f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RdpSa.exe · signed by Microsoft Windows

47b333f35b84f5a13563c74d6bdb0e59d21627757c4ac3458e3515ccc7b3dd59

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RdpSa.exe · signed by Microsoft Windows

244f4e066fedba11046dd2b79a3d8e0ee0f4e6e8c280b5a02c359f73776dd927

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RdpSa.exe · signed by Microsoft Windows

84728f30268b2afa8a5490a1560a0cfef6076f54093ce7283dfabf0f420395a2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RdpSa.exe · signed by Microsoft Windows

7bea697939c4d7c207d1a7c3ea109392d214868311a7bdf1e8055367d9d27238

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RdpSa.exe · signed by Microsoft Windows

bcb046625db80875af6732ceef40bfbaf801875a1be9e9d4d8b4c94111018e47

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RdpSa.exe · signed by Microsoft Windows

9cb261a036e78918845f37942f8f13cf2e25476d2df5c9bc9ee2d5f4c8c12331

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RdpSa.exe · signed by Microsoft Windows

d6c78ad907ca266a909fb1253fe2f6c8e10624dd21e585fb1bd46bd45640da31

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\RdpSa.exe · not signed

0944947ed9340339840782005e1e13db90f7c9a78494bd0db0090d13ad62cfbc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\RdpSa.exe · not signed

fad964c4489c42da17341cbedbb178d2232e6ecfc045f517c949ae37cdc9b2a6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.