CmdID

CmdID / Files

AppVDllSurrogate.exe

Client DLL Surrogate Host file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real AppVDllSurrogate.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionClient DLL Surrogate Host

7 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

61a143f28453946a88c9aa2310cb7127ecb2a58961b03c41413d6ec08a9e9924

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

5bd041cb98925247e539c1b59cc5e4469ecb619b2b9ace99719d2991d64b7290

10.0.19041.264 (WinBuild.160101.0800) · C:\Windows\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

06585c80bae0a70d59dc957900cd461e0a700d78629268e0709400e43ccbe1b2

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

262a115406764149d2f468975231d2cd7a46d14bf0c379ee193a129ac0b39c04

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

bb807e6b95b7ef13ce36c75b313e62e213b7d2ee68c2797702b953a452ea0013

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

ddefaedb6e9da7e17be3ee8e0a8563a6ab5751e85aca55b90666f449b93d92ec

10.0.14393.3659 (rs1_release_1.200410-1813) · C:\Windows\system32\AppVDllSurrogate.exe · signed by Microsoft Windows

01a9fdc4bc9b4571ef8019569903893604053ccf5a639d65dec5ce2a3af4d5c0

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.