CmdID

CmdID / Files

EhStorAuthn.exe

Microsoft Enhanced Storage Authentication Program file version info

Program on Windows 11 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real EhStorAuthn.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Enhanced Storage Authentication Program

11 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\EhStorAuthn.exe · signed by Microsoft Windows

1d21f7c4d828528b77313367f95473e28df38a8af589f9b012c9c517dc8fc247

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\EhStorAuthn.exe · signed by Microsoft Windows

65aa5d728a529c6e5d80b35efa872db1775c1d9631e9f69777473f2b519fd945

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\EhStorAuthn.exe · signed by Microsoft Windows

d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\EhStorAuthn.exe · signed by Microsoft Windows

de0662eb81790fe9e872a5061ba088da715d50156aaf1e2b0546e20892e05d8e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\EhStorAuthn.exe · signed by Microsoft Windows

68db0e55677cbdb01a5bd1d8f7e5e6b51412bb5d36a8fe710cb881d5b3415022

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\EhStorAuthn.exe · signed by Microsoft Windows

90bdf000792d013f2cff18f1c5f91fa20b12ae5b97a223bc4e76556385556fad

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\EhStorAuthn.exe · signed by Microsoft Windows

3e8e7238533a1e251c9c607d84890ffa02983f02d5911a79df557e328801a5da

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\EhStorAuthn.exe · signed by Microsoft Windows

f7a1acf775987523b769f2c5e389bc0b6bcb2dc8d80b3ea0f76c1014e824b3c1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\EhStorAuthn.exe · signed by Microsoft Windows

04a8d05965b6e408be13d5d1dd1a3bae139f6a8b2bf01efe6de6822147a9cde2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\EhStorAuthn.exe · signed by Microsoft Windows

ba685f4466f5ffee339982a714d58ae0bc602b838ed70c447f332a295092b246

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\EhStorAuthn.exe · not signed

5f84ffaeb40ffb2a6779bb2fe60c00f98dd95cf55903fb1283bb9a9f67dca8bc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.