CmdID

CmdID / Files

wkspbroker.exe

RemoteApp and Desktop Connection Runtime Broker file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wkspbroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemoteApp and Desktop Connection Runtime Broker

7 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\wkspbroker.exe · signed by Microsoft Windows

bea10d387258969f911744865fc318b2941ee7916b52a9fd4dd07464b46ea3a7

10.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\wkspbroker.exe · signed by Microsoft Windows

88be8968bfe5ccc7ce7a62ebaf83e3d41189e7b0bc0a374bf06885fc834982f1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wkspbroker.exe · signed by Microsoft Windows

82be5f871b0981113cd84cc4f8e093588e1abb00ddd199ae0f93d9b2a6c66b3d

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\wkspbroker.exe · signed by Microsoft Windows

9b47c71d96016772e403b6008bc5cfe589558bca6578399308da558c794d92d3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wkspbroker.exe · signed by Microsoft Windows

2418929fec25b3a30c10fe01901f4d75d6895480df500beb19717517ccd5bb41

10.0.14393.2248 (rs1_release.180427-1804) · C:\Windows\system32\wkspbroker.exe · signed by Microsoft Windows

fadf5f90abf4d2f733132acdfbc2ca3fe9587fc7858c20f4d5c955cda347b4f8

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\wkspbroker.exe · signed by Microsoft Windows

8758403fc0c36faeb4aef38720963810ff1cd4f399e7a208fe968ddab5d8049d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.