CmdID

CmdID / Files

RdpSaProxy.exe

RDP Session Agent Proxy file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RdpSaProxy.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRDP Session Agent Proxy

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RdpSaProxy.exe · signed by Microsoft Windows

280b7b41652cfc6099550d5d2c29b837b69c5e339a14ca665a0a7e476af80892

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RdpSaProxy.exe · signed by Microsoft Windows

636a9cbccd1c63355113e569a2ef359fadd9d93604652aa8197663c5e6607d10

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RdpSaProxy.exe · signed by Microsoft Windows

d263aa2dbfd48f580594630c9ac3d72e64620b8ea67b9123332dd52467311095

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RdpSaProxy.exe · signed by Microsoft Windows

f8e6d42eaee102b1880b173ac56c091e2962ea4b724f9dde7f01a8f85357600f

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\RdpSaProxy.exe · signed by Microsoft Windows

6becd3b5c276e25e8fea9a02afac62235db3e009a0b89f349689ab906977fc05

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RdpSaProxy.exe · signed by Microsoft Windows

a02d8f2a4230c4cc83a4211d40d5c91bbaf3a10bbf783230695b735aac7f9aec

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RdpSaProxy.exe · signed by Microsoft Windows

112725aa0a890535231f201529cb5f382e5f00959f268a6a637818b74216d13c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RdpSaProxy.exe · signed by Microsoft Windows

fd58018194b07a634ad8f7d900bc8f97ca13d09a7c5064842d250a84f42d764d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RdpSaProxy.exe · signed by Microsoft Windows

2dd3ad4d981e86b92635b8a2f716277bb58f82a8f8cf00d05cb932cb459f030d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RdpSaProxy.exe · signed by Microsoft Windows

e0e7a048efe840fed6731dac7bb5d4d07887ff92f3f963eaf5fd7b7f48570783

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\RdpSaProxy.exe · not signed

258f820a155e91731a53181d06300baa774bade6bcdc146a612c97a02c6459b8

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\RdpSaProxy.exe · not signed

f1cbde5e9b8b08a42789eb454ffbeea497774cfc1c807211cb501dded8e84698

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.