distnoted.exe

by Various

Application Support

Summary

Distributed Notification Daemon - notification distribution service.

distnoted.exe is the 1066th most commonly executed Windows program in EchoTrail's dataset, observed 1,755 times across enterprise environments. It typically runs from C:\Program Files (x86)\Common Files\Apple\Apple Application Support and it is most often launched by AppleMobileDeviceHelper.exe.

1066th

most commonly executed Windows program

1,755

observed executions

low

statistical confidence

Behavior

Top Paths

C:\Program Files (x86)\Common Files\Apple\Apple Application Support96.6%
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support1.36%
C:\Program Files\WindowsApps\AppleInc.iTunes_12102.3.43028.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.45%
C:\Program Files\WindowsApps\AppleInc.iTunes_12113.17.53090.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.45%
C:\Program Files\WindowsApps\AppleInc.iTunes_12107.3.48019.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.23%
C:\Program Files\WindowsApps\AppleInc.iTunes_12110.26.53016.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.23%
C:\Program Files\WindowsApps\AppleInc.iTunes_12094.104.41048.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.11%
C:\Program Files\WindowsApps\AppleInc.iTunes_12101.4.43017.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.11%
C:\Program Files\WindowsApps\AppleInc.iTunes_12104.2.43056.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.11%
C:\Program Files\WindowsApps\AppleInc.iTunes_12105.12.48001.0_x64__nzyj5cx40ttqa\VFS\ProgramFilesCommonX86\Apple\Apple Application Support0.11%

Top Hashes (SHA256)

384f13f437a5a9d647b85c649300abecec665ba69ae885ba91a7dec5b7ef16ed53.02%
aca9ec5ae43e11f3650a69ee8346559121ddc714d032b04cb430495d5c964a6c16.39%
484e27d807580e0bc916dd2db1f591a43ca3ff75c107bfaccd0d4b4c2d4ec19613.34%
d5c99557d2a5e507e87ddfc778e3090ec6251ef8c446416e24a132cbfe7d4b455.75%
811dfc387e68968954eae7de43f20b81e0f1454a38ba0087b8ac19d697a8275e1.96%
e83e8c010249742b7ee92e094e86ebab877d59af175cf69dc59ca8056af90a1c1.5%
115ed76d8dce427f9a40f7cf2c79a23bcebf6b2710d7dd7a8b8ab7a17f598fd61.38%
1830fd52a20cc6778612435553177dc646b6584ddea14338f65af6208e26655e1.38%
de8690a5c27f4176f6efa2a4ec35ac239c938708f7e2fc7ca449b3bfd84218d61.04%
e49d0add988aecf613a7fd4f9b9851c7255dff8f35b9fd3c9f6c85bae5b7a0b90.69%

Process Ancestry

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about distnoted.exe

Rocky answers questions about distnoted.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.