CmdID

CmdID / Files

MpDlpCmd.exe

Microsoft Malware Protection DLP Command Line Utility file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MpDlpCmd.exe?

file version info and known copies
Installed inC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2004.6-0\
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2006.10-0\
Signed byMicrosoft Windows Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Malware Protection DLP Command Line Utility

6 known copies

4.18.2009.7 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2009.7-0\MpDlpCmd.exe · signed by Microsoft Windows Publisher

65e60b3657b58ac9d61c67e7aa9160646e8d2feee3c998fef943b365b902718b

4.18.2008.9 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpDlpCmd.exe · signed by Microsoft Windows Publisher

9d5a5d804b4ad306f8f08f1d3cfd1dd80255cd8db745f648643dc4baddc5660e

4.18.2007.8 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.8-0\MpDlpCmd.exe · signed by Microsoft Windows Publisher

5144b12fc98f3e601225b4f3cb3545c6bb528e2fb8cbd166f1f3ec9abca459ad

4.18.2006.10 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2006.10-0\MpDlpCmd.exe · signed by Microsoft Windows Publisher

22c6d64ad05f492c179340a06d32fd6d7d7d3b2fedd0ed122d6b71ba311a703c

4.18.2005.5 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\MpDlpCmd.exe · signed by Microsoft Windows Publisher

d558255073afc3582d6ad5e9e3f65be7cac733c6a6851a073b79888a69107564

4.18.2004.6 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2004.6-0\MpDlpCmd.exe · signed by Microsoft Windows Publisher

14edb56c13057a6c5e0c007d4d7009f6e55e3a4f476b19f74795cffa5ad83f5b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.