CmdID

CmdID / Files

edpnotify.exe

Microsoft Enterpise Data Protection file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real edpnotify.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Enterpise Data Protection

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\edpnotify.exe · signed by Microsoft Windows

37008aaab315550f2314a4b96c9c02cd6923c9a16cd79648d489fe0685415204

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\edpnotify.exe · signed by Microsoft Windows

4100af049e251a644aa4900f430af2048e99381a49cf41bead656d1fcba4d8bc

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\edpnotify.exe · signed by Microsoft Windows

589cacedadf3a399db2fcaa2508ec4e52df6fe4cf7aedabfcadeaf14a31c684b

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\edpnotify.exe · signed by Microsoft Windows

cd83e0891f6a928c05127e264b5d46e6808a77cfb369b51bebfe390102cd861c

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\edpnotify.exe · signed by Microsoft Windows

525dca9c70f7899cff169663fc6a1f5561c9a67a4d9c519a7d72d96c5dfb7e48

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SysWOW64\edpnotify.exe · signed by Microsoft Windows

7dfd4d9eb34ad639df6e88ce37557368fb5f13608878954ef27356a4f0fc6fd3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\edpnotify.exe · signed by Microsoft Windows

28e9ff9359c238b130d963b0d4fdb042fe10a7ab6df68f7233e0ca5668578696

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\edpnotify.exe · signed by Microsoft Windows

59654b1486f92ca7706c7ddaa1dc47334647b7f5986ad3f070a73847068a0ed3

10.0.18362.329 (WinBuild.160101.0800) · C:\WINDOWS\system32\edpnotify.exe · signed by Microsoft Windows

a92d24c7028fc60991babdd7fa62a8c673856cd3f8c510fe9d10baf98f954861

10.0.18362.329 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\edpnotify.exe · signed by Microsoft Windows

f3b835d99fecbbcf197260f0b28074dffc4456069b6de601c849c48bce236856

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\edpnotify.exe · signed by Microsoft Windows

22632a042e750a84fa52ff9561c03570334b11e5cea2d50c525eb0edc3ecd30b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\edpnotify.exe · signed by Microsoft Windows

7ce0d1716206ea262eac237edfad7c98cc0c73ecaddb5f0c307330190a44c5b1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\edpnotify.exe · signed by Microsoft Windows

62b940a1c8d72d5b746b1a94005555fcc08f728ed0f772cce6480d0fedf50c1f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\edpnotify.exe · signed by Microsoft Windows

cb54139b6f0d7f937376665b76540407e4898303276a55a0740c1d8082ee5bf1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.