CmdID

CmdID / Files

MsSpellCheckingHost.exe

Microsoft Spell Checking Host file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MsSpellCheckingHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Spell Checking Host

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MsSpellCheckingHost.exe · signed by Microsoft Windows

b20bb3bbac7975095f37c26715f2764966293e4dad0b2a3de59fa7065a8a116b

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\MsSpellCheckingHost.exe · signed by Microsoft Windows

fbd55b94c083844ab2c93ae623255b6a5a5c109fcae9fcb99ca1b9cf627d2def

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\MsSpellCheckingHost.exe · signed by Microsoft Windows

c3bc4b8c3e4bc49c6ae5f28de4891fa946d0566160e2c47e3927df4c9bad0e41

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MsSpellCheckingHost.exe · signed by Microsoft Windows

32af9c20e6c3d579cb6912a524f5678b60a3a0f79c0836a3161062d77148577e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\MsSpellCheckingHost.exe · signed by Microsoft Windows

933410f4a3cd7142cd6950c0d9e33e11b5e37b129dc142022a67c06313581541

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\MsSpellCheckingHost.exe · signed by Microsoft Windows

053eb691798367edf00a0d178ab3ccf65811ba85c22b2c18e881610824d33c29

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\MsSpellCheckingHost.exe · not signed

31fe6da399914a64f1053c2ff632546ccf707202b02b9292e83612af3fba306b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\MsSpellCheckingHost.exe · not signed

72675e5a3dd33588c281ab794d14c505a81a607342db98f9e148a775b8ce00ac

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.