CmdID

CmdID / Files

PickerHost.exe

File Picker UI Host file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real PickerHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFile Picker UI Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PickerHost.exe · signed by Microsoft Windows

03420e9237c128ad61fc4005e8bf89f65fa2e7a1b2a866504f6c1a29de19b40f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PickerHost.exe · signed by Microsoft Windows

8b864070c0203202defd1a3a14d27c8028da49c9c6b45b9024780df6d88d6356

10.0.19041.1023 (WinBuild.160101.0800) · C:\Windows\system32\PickerHost.exe · signed by Microsoft Windows

1daad9a09bc5bc51f41a34cb604106eebe1559d35e8464785601e3e6d98c3f17

10.0.19041.1023 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PickerHost.exe · signed by Microsoft Windows

4afecb9addd61bf3f4bf3914b56c1896480498d0f32385058c045b47b3e62280

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PickerHost.exe · signed by Microsoft Windows

2fe89df706c2b56461d988c1e9b57c1c4fef94353d4e2bf267a99a7eb63846bf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PickerHost.exe · signed by Microsoft Windows

7d8f2de2869889f41fe94fd9a4ccc1f67b971f9db8f564e216b99b682e6c7241

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PickerHost.exe · signed by Microsoft Windows

36640bda611cc9d6e2b9984127e6e492fb31f9fe7e07e70a64f5eb46f6d40227

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PickerHost.exe · signed by Microsoft Windows

540b7d239d686faebf7ac426b5252dd9feebdfdb9a3212d3164ec3be05b4e579

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PickerHost.exe · signed by Microsoft Windows

7e6e3f5ec8bf74886709652dea921bfdbaeb243074715691d890b738a03784c6

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\PickerHost.exe · signed by Microsoft Windows

82834848dcdede5a8509f2905d576cf00e576162b80ff85e6a0286a4f5b6ad29

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\SysWOW64\PickerHost.exe · signed by Microsoft Windows

06ff431403210fde7ea6afd689a2d40945c02ee60ab3a9b6e7337d5aa93b2aaf

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\system32\PickerHost.exe · signed by Microsoft Windows

dda4ffcf2b374c000d60fe9fea6e08f76765e484d376b5f22ecca0fc0692332c

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\PickerHost.exe · signed by Microsoft Windows

89566d72f4e1ddd5ff449372e7068e40d35e0afe613647990a3fb5cccc700107

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\PickerHost.exe · signed by Microsoft Windows

c21c318738ccc820973d9334bf5bc83aa62938538ba057601f9078e57b3361fd

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.