CmdID

CmdID / Files

fontdrvhost.exe

Usermode Font Driver Host file version info

Program on Windows 23 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real fontdrvhost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUsermode Font Driver Host

23 known copies

10.0.22000.132 (WinBuild.160101.0800) · C:\WINDOWS\system32\fontdrvhost.exe · signed by Microsoft Windows

acbf12e7ef506f62c7e334919ea995f036e888f96e3e74472dccdac9d0204eb2

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

4f5d509ed0813495684a0a5ced614f234e3f595b7a83b25c0aa2940c76d327aa

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

605dfc2bdf26a311335f395fc4fda76a6f7617dfe0a39d740043817bf8687f29

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

418fbe7f21915384a1a87010de7cdbf86690b497999547e6c5be93fba8e91ff7

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

fd7d157f3d96eaa831b76928905d028095a4ded3744e312b2f93de2f3a25b609

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

367c3092c5ce05706db09f260b17d748b90efa1bf274dd8898dbb1cddd9f735d

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

3ad0bccfa9e5a3b145d989c2ddcb947d1f6982d6b1b49f4eeef90b262b40fea5

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

85e69a27959fece359e3a371019a529bd00a57016819ca087c8cd8f873f138ab

10.0.19041.450 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

d18ba47935089cd4b7b5b8e2102aa7c5d761eb6e708d21f003a0cda9da662585

10.0.19041.264 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

7d6f286e6efe472c60d1654effea92b98fa4185ecb3502e61ab83d276ad84126

10.0.19041.264 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

cb65954758bad7044104a52b7729aeec1c428df01fedf99b70a6a6a26f0237e0

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

45b8da33889982e8f93b9409b1f02e4ba063eb72f88c5ee67810ae02a53ec18e

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

78fc107e194699c39a62373670c1f51b60c936ec1abb79a4c638b57409be15e9

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\system32\fontdrvhost.exe · signed by Microsoft Windows

8d4d87697b4761194e8cd6dd028660501bc89e6aef1da9e23d231d5d8868edf1

10.0.18362.836 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

a3f38c9f8c5880105effb8f71160417392e76ddb15944256b9860fa1fe1adb1d

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

13d9ce74a99fe00496ebe7461c5d505fd957b83d313aa9b2a23c359b470cec9f

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

f1a5e53b6cbea2011f5b7f46f5d65708dc43ef78eec8ec3ef69f6736b1d12020

10.0.17763.1397 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

121dfe1c1eb1ba38bba6c15a2302d63b95c1bb31a4d04593e2a251c76f67a5ae

10.0.17763.1397 (WinBuild.160101.0800) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

457bc0bc95f8ca1135d822d7d9f7c971a30a883ceb4489b49414f26b786fbbb6

10.0.17763.1217 (WinBuild.160101.0800) · C:\windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

a7895d86bdeff3f5c2b3bf6435a2e3f9bb5f572d6c422b3e08adc17ee85de329

10.0.17763.1217 (WinBuild.160101.0800) · C:\windows\system32\fontdrvhost.exe · signed by Microsoft Windows

cb96f4ac1dd1afde82ca9fc3c8ed5b862b0eee9b066ff565b1d3095856d4ccd6

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\SysWOW64\fontdrvhost.exe · signed by Microsoft Windows

6c89d263352851947720b41fc81fa3951d5db19ef3d14620a4609ea097c9007c

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\system32\fontdrvhost.exe · signed by Microsoft Windows

e58a0460b0c64ff8de25653baa81c33623856e932b85a3dca0e3abc81dd94b61

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names fontdrvhost.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.