CmdID

CmdID / Files

perfhost.exe

x86 Performance Counter Host file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real perfhost.exe?

file version info and known copies
Installed inC:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
Descriptionx86 Performance Counter Host

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\perfhost.exe · signed by Microsoft Windows

8e0bc2c99afdb1aa9ea9be6f9ef54dcbcd72c891d87202d99e932c60526c13cc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\perfhost.exe · signed by Microsoft Windows

41d7da706f0cf613df768b6795cd09c5c1035f9f101051fb58f5042eb4352db6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\perfhost.exe · signed by Microsoft Windows

a802de40d4f9fea20516d4d8ba65942f48e47546deb116c75b7a9edb1f2eaac6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\perfhost.exe · signed by Microsoft Windows

68654262029a6f62dee7f9d296a69a99dd6811c7aa6056de40ce34440d4513ce

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\perfhost.exe · signed by Microsoft Windows

f57804a06e76ef78b76a1c1d8744657b4d4ddab088d8b2ed31d8e7e893a36b59

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\perfhost.exe · not signed

3de978b005bf2e88ba858ce37d9e27bd3584642b8412e22c300a1e739743838a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.