CmdID

CmdID / Files

wksprt.exe

RemoteApp and Desktop Connection Runtime file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wksprt.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemoteApp and Desktop Connection Runtime

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wksprt.exe · signed by Microsoft Windows

7c6b4e3a09b40752db9e329237ae843262f5f172f3fa777a6b596d06190fa0e5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wksprt.exe · signed by Microsoft Windows

3159d37162e97c34bd7809fa98aaad1993f2fb72d70806503f808820ad5871d9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wksprt.exe · signed by Microsoft Windows

8d6deb903f62a95a3e9e4bdd4a6a4d54b288b32c56c24a05158d5c2c8f43f6b6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wksprt.exe · signed by Microsoft Windows

07e441f315452e5dc03bb2f1411ce59737c1436de482648e8ac05324b0e52070

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wksprt.exe · signed by Microsoft Windows

6c5e5c792ff17b6ce2987dc7cd84e9afd0cfc9f21cbebdd674bda5a70db6fcf0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wksprt.exe · signed by Microsoft Windows

6a9700dce43a9ffb4c59a13a6cb8a1a94197fc051310615f1ad7ea84b6d22fea

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wksprt.exe · not signed

4f57f549aea9065ca3d487b18ee3048689cdb1a93947bd1368bb4bd9f2581e6b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.