CmdID

CmdID / Files

TCPSVCS.EXE

TCP/IP Services Application file version info

Program on Windows 12 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TCPSVCS.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP Services Application

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TCPSVCS.EXE · signed by Microsoft Windows

29b182634136616994c493eadd526f8195bc5bd7dddcd7bbed28d241128ac5da

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TCPSVCS.EXE · signed by Microsoft Windows

55e71c60f11f319107e6677de60611ffbc992dc0c8a136c28df77a318539f2d1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TCPSVCS.EXE · signed by Microsoft Windows

7d6386a5beba7635c8ff0b0e24cec90a409853440650af583462c36b8e04971d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TCPSVCS.EXE · signed by Microsoft Windows

fc2bc4b2b115bde5341c2d40e371a4f50feee14d19aad12eaf5fd0a052bea403

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TCPSVCS.EXE · signed by Microsoft Windows

7de09594b8a36cd9d56e33df9f24a73d92f7b26122c30e4a4af1d42b4f0e8494

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TCPSVCS.EXE · signed by Microsoft Windows

fd592588c00212ee22f2ad980d8ae1c4b8833045290d6fdd9c7a68140346358c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\TCPSVCS.EXE · signed by Microsoft Windows

03c299db96ad76879007bae4d248292e15e574a03fd080a868ec289e07a0d917

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TCPSVCS.EXE · signed by Microsoft Windows

b2268460262b8587c8acd530a5edd7fb5d13cf41640d8bcf02a2ea213882fab4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\TCPSVCS.EXE · signed by Microsoft Windows

6595f4051262b20690d2e28b052515542f273fbd686c23e187365dfe8c94fe6c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\TCPSVCS.EXE · signed by Microsoft Windows

9be29e8e2c17b8e840772d7271ae98d229fa12e7bdd32d8d952f12c1be9abb38

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\TCPSVCS.EXE · not signed

001232c77bbc2eed3dd40533222e0662e94137eb5a3340123bb2b191ae5226ea

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\TCPSVCS.EXE · not signed

c87812c59cd5b639c5ec64cc00ee1d1bd9310f95f5f939a8531f9fbf952305a9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.