CmdID

CmdID / Files

tskill.exe

Remote Desktop Services End Process Utility file version info

Program on Windows 9 known copies with hashes Command tskill

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tskill.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemote Desktop Services End Process Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tskill.exe · signed by Microsoft Windows

eb750788a75be4f99e27ca345ee0fddf98d82ff70505bad03ae0dc8be6fa47b3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tskill.exe · signed by Microsoft Windows

8d9373ebd69f42153b0b47dbda2174811599db91630651ca01627ac1795f8d56

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tskill.exe · signed by Microsoft Windows

1b92303b2b2d13f02f45f7164bc0b73ee39fb6cee6c61296904bd7f7c87e4685

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tskill.exe · signed by Microsoft Windows

56e8d6c41d904c855fc44bc50e7460ac0d1803111c0c8032b12c00b3c0482816

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tskill.exe · signed by Microsoft Windows

7468a5dd894ad3b4eab0cfb10acf6347336356038ec9446ed3c15862088e4849

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\tskill.exe · signed by Microsoft Windows

8f532be7093e87f41d23c1fde02088f85ac70f106209540d701e1c0f2dabacc3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\tskill.exe · signed by Microsoft Windows

b2fa07a9a1634079f537a5a81af8d2c658b0f19483eeaca014c22111db426eec

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\tskill.exe · not signed

a5fae2450541751f488984a6dda11cc3324ec3a98e063b9662dd535597778b58

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\tskill.exe · not signed

f778d267fc863772f35601fcea10ebff9a42f95ddd34c14c58af58e2f6d4cf96

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.