CmdID

CmdID / Files

EduPrintProv.exe

Printer Provision Utility for EDU file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real EduPrintProv.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPrinter Provision Utility for EDU

3 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\EduPrintProv.exe · signed by Microsoft Windows

99ee0560cbecb054658273ab7d530b2e3aefcbc664024f939168be924a24284e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\EduPrintProv.exe · signed by Microsoft Windows

1d3595fc64e37533fbbfc26ea27e6f66420759bd9341321435a5872ecfc13d8c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\EduPrintProv.exe · signed by Microsoft Windows

aad57ca6a22703446dc7013909a90d22c60104b820cbe6300fcc5bd51aecd60c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.