CmdID

CmdID / Files

tsdiscon.exe

Session Disconnection Utility file version info

Program on Windows 9 known copies with hashes Command tsdiscon

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tsdiscon.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSession Disconnection Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tsdiscon.exe · signed by Microsoft Windows

c3998459ab8ffacc280dad39fc4339a7ecfd9b97445866fa606f00a6d17ebffc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tsdiscon.exe · signed by Microsoft Windows

4fa837762a3a76bcee46f7d34f8d2e3e4ea59a0d8f9094a8ca96144e137370f9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tsdiscon.exe · signed by Microsoft Windows

7d5f038fc3fb6ccdaf91af641364d8b1abca7adc4ffa5345089a4952eb5ac8bf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tsdiscon.exe · signed by Microsoft Windows

7d3104a15f906d28e302b00e440366ddc4c91a4cc9c2806abd27c123e3009a79

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tsdiscon.exe · signed by Microsoft Windows

c6f572841f362b549c9facc377e280d09623873502ec1d02961bd4eddc7d1e27

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\tsdiscon.exe · signed by Microsoft Windows

a3a379b1834a12854eb5eae1074091dea0bfdd2427b64db510d04919019ca171

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\tsdiscon.exe · signed by Microsoft Windows

f80edbeb4cc05669ea5e9074261504bbabfca2370af868ae8c7b96e7645c3b41

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\tsdiscon.exe · not signed

df20ae70ba1d8da2fd3a5c6a0cb2a2f9fc0ca9c343512b3c276d3599f7d59a9e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\tsdiscon.exe · not signed

e46c156d2116416c1c27eb47b46e891ec7bc12522b73f646d576477b71aa69ba

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.