CmdID

CmdID / Files

sessionmsg.exe

Microsoft Remote Desktop Services Session Message Server file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sessionmsg.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Remote Desktop Services Session Message Server

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sessionmsg.exe · signed by Microsoft Windows

097e0f4c2cf2a55c5b62726d1170bf94f3c69d9caf71ba2f6509f229c87dcb18

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sessionmsg.exe · signed by Microsoft Windows

1fdeb92b01aa906a7fbec8573c70480edfcd2a35649cca7f1ebf2b3755ae0fae

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sessionmsg.exe · signed by Microsoft Windows

2416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sessionmsg.exe · signed by Microsoft Windows

5d134d17096689092f69fc5b7982a67b0dc5888114185ec10c6a6eb4e57d24d3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sessionmsg.exe · signed by Microsoft Windows

20247e34c5139fa1ef689c134148b2373be2d1a1e1a568950d9641826f6a1d4e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sessionmsg.exe · signed by Microsoft Windows

0a3c8caf440e88bb22c91e29fb5c1a9ebc9b3baf651005f140cdc04768eb113a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sessionmsg.exe · signed by Microsoft Windows

4f162db6af3d885a51c2a9d67b1263c4f0bb091472891f7070b2eeddfdd99a34

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.