CmdID

CmdID / Files

MDEServer.exe

Cast to Device Server file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MDEServer.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCast to Device Server

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MDEServer.exe · signed by Microsoft Windows

18bf5be5e13ec45cc3116396e05e1ed73a572428bd92388cb7fa70e75c4d312f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\MDEServer.exe · signed by Microsoft Windows

47c664b20c6818b29397298f941ce64807d82d80ec96d1e874a9d70f11acd8d2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\MDEServer.exe · signed by Microsoft Windows

7139509e1d169411dab32a948427988afc81960bdca61fa6bb83b621540328fb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MDEServer.exe · signed by Microsoft Windows

92c1d8370ffe92c15c7930e7e715ddd8350ca70832253be409126432a0cf7a63

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\MDEServer.exe · signed by Microsoft Windows

41bb53be1ee4c34cc75511f0e416f289d1e95a40864dc1afebe66a3dd77c8f9a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\MDEServer.exe · signed by Microsoft Windows

5c6f11be84a35c3cfb81b56b666c9bcb63d79f8f7e7347f3bd4f3449020c8c6b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.