CmdID

CmdID / Files

RemoteAppLifetimeManager.exe

RemoteAppLifetimeManager_ServerExe.exe file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RemoteAppLifetimeManager.exe?

file version info and known copies
Original nameRemoteAppLifetimeManager_ServerExe.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemoteAppLifetimeManager_ServerExe.exe

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RemoteAppLifetimeManager.exe · signed by Microsoft Windows

d1c0854ae778672d432f14a429ac69b621881dd89391b25197b5a5e26ca65fbb

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\RemoteAppLifetimeManager.exe · signed by Microsoft Windows

75c15b8cc4b2817ac54d79d9215f8134b39a245164d437c1b1b650449923a39e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RemoteAppLifetimeManager.exe · signed by Microsoft Windows

e4940a4e264098b8bd5c26b4621884c1465025563cf67e0c93af40bd990a1999

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RemoteAppLifetimeManager.exe · signed by Microsoft Windows

78769e1db1f1ee15a925262025792b7c9f9d532740ab3c8036fc4daf93eed075

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.