redircmp.exe

File Path: C:\Windows\SysWOW64\redircmp.exe
Description: Microsoft Computer Container Redirection Utility

Hashes

Type	Hash
MD5	`8F4D89AC94572CAEB280E4EACE21D646`
SHA1	`A1E55584BC114F32CE6E5FB84C9D1EA03C0E8B5D`
SHA256	`9D2D61C3CF1CA87C1EB7672FBD7247D723448B0B8E2AB07786A9D7635FCAC0A8`
SHA384	`9212545C589964FA32558D2186E905A9209145E03A3BE9BF75C1CDA8335DE0E24D95B9710F71195862543A4FD1C399F6`
SHA512	`489C2E7363AC5AE0C2A18B0F94951393A337F3DB98D3C568F1EAF868DB276611F3D341F012EECA6BDCEFAD37D0ACD5A1C1CED00C54E0F55F1B04CB98415050BE`
SSDEEP	`192:xEHKqmOcff9gYqYLfuQhYnqarDhwbRM7eF4Uk1WqnbW:xEHKhlqYLfjhQqahwbCa4n1WqnbW`

Runtime Data

Usage (stdout):

Usage:

redircmp CONTAINER-DN

    where CONTAINER-DN is the distinguished name of the container
    that will become the default location for newly created computer objects

    Note: The domain functional level must be at least Windows Server 2003

Child Processes:

RdpSa.exe

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\redircmp.exe

Signature

Status: Signature verified.
Serial: 33000001C422B2F79B793DACB20000000001C4
Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: redircmp.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.17763.1 (WinBuild.160101.0800)
Product Version: 10.0.17763.1
Language: English (United States)

File Similarity (ssdeep match)

File	Score
C:\Windows\SysWOW64\redirusr.exe	79