CmdID

CmdID / Files

mpnotify.exe

Windows NT Multiple Provider Notification Application file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mpnotify.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows NT Multiple Provider Notification Application

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mpnotify.exe · signed by Microsoft Windows

40925f754de3fd453ae36660dce1037b84c5775613f768186012531ef85228dc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mpnotify.exe · signed by Microsoft Windows

33f636f222a3af0bbbe429cc87b25b21b6c56182936c81c9453c4bdfb61a3c5e

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\system32\mpnotify.exe · signed by Microsoft Windows

9e2be15984787436709c024b89bdb7b8da54daf0da1fdd040af1168973cf7c21

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\mpnotify.exe · signed by Microsoft Windows

909bd459e937642e17c188c998fe0a6e228c4e48cdf8f0645168d4f09a97dac2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\mpnotify.exe · signed by Microsoft Windows

f4d9c53ad952f148985584e1899543ce791fb41a1fca297fc8d8083273a7ad07

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\mpnotify.exe · not signed

77f61bb677dc591f01382e88307ce1bdb62c41d9929cb3c6ba3ec6c93fafc2ce

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.