CmdID

CmdID / Files

RdpSaUacHelper.exe

RDP Session Agent UAC Helper file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RdpSaUacHelper.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRDP Session Agent UAC Helper

12 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RdpSaUacHelper.exe · signed by Microsoft Windows

335b1b194bcfc27c34e31930f3910218ba021e532352776561f4bddb9c25d3df

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\system32\RdpSaUacHelper.exe · signed by Microsoft Windows

3d2835b1f8c0c4e4395d3517ec9e9dfccee7ad99f3c632f9f6dfeba0f833712d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RdpSaUacHelper.exe · signed by Microsoft Windows

6a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RdpSaUacHelper.exe · signed by Microsoft Windows

cfca756bd7fc0101d4e942e11b080176594999b1c38628015a459c1de695bbe9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RdpSaUacHelper.exe · signed by Microsoft Windows

916a1969ad6f97ab233c49d36d57f499e59056baa9ee7f4d1f7ec73c0330133b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\RdpSaUacHelper.exe · signed by Microsoft Windows

eac7d86d938a8e335ded8dcaa8b94ee5308c3d56685105433196ef75d4b49534

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RdpSaUacHelper.exe · signed by Microsoft Windows

cbd3dbd850289f1888b4dc6884f0e5474063fe4d57e9f8bef0b325f76284bbd6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RdpSaUacHelper.exe · signed by Microsoft Windows

eb835ab51c25b6b42bbcf488e65b06abaa4131cc1617579c89ac8c7f4a1b24ec

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RdpSaUacHelper.exe · signed by Microsoft Windows

53381f4f0f08bb3a38f342a7a66605a0991a15ddc5a1caac26d4a099fd96ce3d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\RdpSaUacHelper.exe · signed by Microsoft Windows

982d50bc4640ff36f71b234492d932856e5952c143341cc013ed051721006834

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\RdpSaUacHelper.exe · not signed

9b906535f0a197649930f04099aed098f8b53bf55c7ba7ca1bb4e39bdb547025

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\RdpSaUacHelper.exe · not signed

baddd1785777b240daec204cc72a840c75f1cc1d428b691e3b491c5fb75eca75

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.