CmdID

CmdID / Files

InputSwitchToastHandler.exe

Input Switch Toast Handler file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real InputSwitchToastHandler.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionInput Switch Toast Handler

8 known copies

10.0.22000.37 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\InputSwitchToastHandler.exe · signed by Microsoft Windows

a965669e947b0de37bba710b26e8f3939550e49872b9fa8f1cd5a807044df6a5

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\InputSwitchToastHandler.exe · signed by Microsoft Windows

9cdbe0247cef666d0754298deb3b227efc70a14ec9d4f31b6ae27560323f0e8b

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\InputSwitchToastHandler.exe · signed by Microsoft Windows

e4a60ac169b2f5272ac295f5d9f73f4a34322addb67f9ae72d0fa382385124fa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\InputSwitchToastHandler.exe · signed by Microsoft Windows

2bf6b3e12e08ee322a6c3fd6437e36d2dc8cf3a2c16bbb5a1a30a61626b24123

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\InputSwitchToastHandler.exe · signed by Microsoft Windows

977e71c9547055db4a0814971d85c5b0faaf8a5be529af55fa60b4e67417131e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\InputSwitchToastHandler.exe · signed by Microsoft Windows

c7894fd7d612033d69d0cefe679614a0cc4f45c07aa4b081ed5791af20e6ef00

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\InputSwitchToastHandler.exe · signed by Microsoft Windows

28101207125f4e814c7815db0cd75d5f05f0bd436bb7afffdfc0ab1c8e4cc5b4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\InputSwitchToastHandler.exe · signed by Microsoft Windows

4f6c7195735fe4c8b559f6c043ac4bcf01855c73c68d50fd07fd0beae8b5c9af

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.