CmdID

CmdID / Files

backgroundTaskHost.exe

Background Task Host file version info

Program on Windows 14 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real backgroundTaskHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionBackground Task Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\backgroundTaskHost.exe · signed by Microsoft Windows

329061796eae488a7975f2afd2a6d006b6b298f46efec27586f912133edfde77

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\backgroundTaskHost.exe · signed by Microsoft Windows

3974ccc64faa92230554d21d1292fa8587dbc55f9d4a2ef2b8ee16f552aaa812

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\backgroundTaskHost.exe · signed by Microsoft Windows

20330d3ca71d58f4aeb432676cb6a3d5b97005954e45132fb083e90782efdd50

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\backgroundTaskHost.exe · signed by Microsoft Windows

cd2bf90fe5cd57dc49af50950c8ce3cfc6433cce7b68fb20dfd78e30a865b134

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\backgroundTaskHost.exe · signed by Microsoft Windows

51eac3c367791ff55dd56684d8438a0017c72f023b4aea1c09a56dc0e7573aac

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\backgroundTaskHost.exe · signed by Microsoft Windows

5a2f7c3bd5b63e15465cc5159beee66332c86a95c5c554de7953e5c1c6944e3c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\backgroundTaskHost.exe · signed by Microsoft Windows

74b3323405cdfb85cfc9d5c1cd29c816c80361df154801e44f14863c9058906e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\backgroundTaskHost.exe · signed by Microsoft Windows

80898e0ba235c0b49dc7336f7079bd303302be396ce14f05f8e2e5b969156301

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\backgroundTaskHost.exe · signed by Microsoft Windows

1b170e9624d0c6a699f6fed4f612802b3d82c21b6c27f9b41296c1f814a0f668

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\backgroundTaskHost.exe · signed by Microsoft Windows

b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\backgroundTaskHost.exe · signed by Microsoft Windows

23a80e09dae6db17909e81b1ca7e9bf43158bdee69c1646125fc62e6bfe2745b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\backgroundTaskHost.exe · signed by Microsoft Windows

655d6b2adcfb5f1cabd60607616d234f8c0d89682d8357a2475467e90c778613

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\backgroundTaskHost.exe · not signed

5587cea38b44259178bbc4fc45fedbef86f0273bf662eebdf397c9e58c168954

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\backgroundTaskHost.exe · not signed

c0a4c60c7747edacf18735f0ba41f2d7dedac813b3f4d4ce6e18f9d1e6ce746f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names backgroundTaskHost.exe in 3 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.