CmdID

CmdID / Files

BackgroundTransferHost.exe

Download/Upload Host file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real BackgroundTransferHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDownload/Upload Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\BackgroundTransferHost.exe · signed by Microsoft Windows

5efaa346669939fea3013ce4a82bfeea10e4adfdef7245414ec5210c7b8f47ea

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe · signed by Microsoft Windows

c4b2f30e8ac46b5a6963fa736eda26ce0b42456a8e3d0d5dec0a8d3b3d06d7d2

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\BackgroundTransferHost.exe · signed by Microsoft Windows

3e77eaae650e851aa72330a76ec536ceac253ef9b770e7bfb7e1f5b1571d410d

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\BackgroundTransferHost.exe · signed by Microsoft Windows

bd5f35555de04ffcc3564dbe10711acb7010accc40132be616a519c29b9538b4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\BackgroundTransferHost.exe · signed by Microsoft Windows

3d395fe2c562d0222cb77d89219685a22ff8ada9fec0d2b55d1e8137d864e8b1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\BackgroundTransferHost.exe · signed by Microsoft Windows

62b52f9594bdd96e73b2a21944977229786d4f4c421eb0f353c310b71a56c9aa

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe · signed by Microsoft Windows

29b16d498ca375787ac2360aa6b131198ca93a0f5b6f73e9a863929f09617721

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\BackgroundTransferHost.exe · signed by Microsoft Windows

a6750e6cfab55aca0a4704e90aeb9fde1bc6a341bdc158189cc5442708ec7f81

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\BackgroundTransferHost.exe · signed by Microsoft Windows

50e46406c00182189f74ec64ca3aed40b35b99f999b254be4205c1e7de3194f6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\BackgroundTransferHost.exe · signed by Microsoft Windows

f393d6fbcbbe46cc63c7996d0f35763ba46e512cc18adc3ead71855c59bab946

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\BackgroundTransferHost.exe · signed by Microsoft Windows

d99d243cf16ce52fb4ecf7118ef43d8ab253012e680d63da82ee1b25814abbf1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\BackgroundTransferHost.exe · signed by Microsoft Windows

ee406f94f5e8e4db280dfa70a77b7cc3ab53d1b11d6a52566a5cbcaa70d9eabc

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\BackgroundTransferHost.exe · not signed

007bdab757d03d94e60c9b1e3eec13b07562705c514992ba7ceb0b6f177e5160

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\BackgroundTransferHost.exe · not signed

d0b2ea23edf1c29e722904b4c2157e6f08b8a0f910cb2876b0a4821f3d434d50

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.