CmdID

CmdID / Files

rdpsign.exe

Remote Desktop Session Host Server Sign Tool file version info

Program on Windows 10 known copies with hashes Command rdpsign

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rdpsign.exe?

file version info and known copies
Original nameTSSignTool.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemote Desktop Session Host Server Sign Tool

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpsign.exe · signed by Microsoft Windows

97f3872ab311a5b05419602e0e761f60a25240be41f275763969ddfb889a1b92

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpsign.exe · signed by Microsoft Windows

2da5d38a23c4fca4c44957f392256e3a761f90c1c4f5789513a265023b837117

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpsign.exe · signed by Microsoft Windows

8cb8a09b32c56c8e1c7bca6b2ef24c9705fb494ec2ca834256b56ec378c90159

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpsign.exe · signed by Microsoft Windows

29cac1697d24828830fe0a2cb273918b3e4344048100fdca331766bdde01fc29

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdpsign.exe · signed by Microsoft Windows

64f5500e72011caaf9b0f0b354163e89ee1656a15da23959d3109bc1ed7fc36f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpsign.exe · signed by Microsoft Windows

d58172ffc44bc94722c950984d056919739fdff69eab646a06f499cb137204f6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rdpsign.exe · signed by Microsoft Windows

221add740903ee9b8c7b15d19b0b01909b790626a224fe575b76710bd636a58d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rdpsign.exe · signed by Microsoft Windows

b75813377fd6ff39421158dd1e1ef7b5aee175f427d516596410534006bd369a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rdpsign.exe · not signed

18a0defb57e307a84fb497d096a7834ab6ba59d7683dca00d99dbfab64e5e2c4

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rdpsign.exe · not signed

89412d995dfecd94256bf93978a02d0b4d349461fa9b5e0376b1928d482a1e42

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.