CmdID

CmdID / Files

TsWpfWrp.exe

Windows Presentation Foundation Terminal Server Print Wrapper file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TsWpfWrp.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Presentation Foundation Terminal Server Print Wrapper

4 known copies

3.0.6920.1210 (lh_tools_devdiv_wpf_sp1qfe.140326-0902) · C:\Windows\system32\TsWpfWrp.exe · signed by Microsoft Windows

1383b0f3a4fc5f643c5d7707bc3458f7c3e6c3ffb6f34da499058246b5c882c7

3.0.6920.1210 (lh_tools_devdiv_wpf_sp1qfe.140326-0902) · C:\WINDOWS\system32\TsWpfWrp.exe · signed by Microsoft Windows

30979d44b9ee1a5d76ad1f18790fad3e175a08bb7caa22fbfaf69bb33a54d6ab

3.0.6920.1210 (lh_tools_devdiv_wpf_sp1qfe.140326-0902) · C:\Windows\SysWOW64\TsWpfWrp.exe · signed by Microsoft Windows

9bf409c590d07ee076bea82e21c6762bd7ac287f33268c2879e7f9401f6954b7

3.0.6920.1210 (lh_tools_devdiv_wpf_sp1qfe.140326-0902) · C:\WINDOWS\SysWOW64\TsWpfWrp.exe · signed by Microsoft Windows

b2e47bb64b8542a478789436ac6fd9bcb189fa2beb688dd2338ae4571519144a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.