CmdID

CmdID / Files

prevhost.exe

Preview Handler Surrogate Host file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real prevhost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPreview Handler Surrogate Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\prevhost.exe · signed by Microsoft Windows

a08b54f33e989959cb4f7fe8d84466112d1dc3e1b865829f1e0928d7a6987b8d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\prevhost.exe · signed by Microsoft Windows

db2f9819b55b3240a4ca9cb7b8fd9606f0a579bf9da6a3edcf7c38599dd06836

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\prevhost.exe · signed by Microsoft Windows

32863169da356243fd74440ab2ce0de7eacf2a5760027602dab5159c464621d4

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\prevhost.exe · signed by Microsoft Windows

9ab198ea2629d406170c16cf4fd97e1f44d5a3c1237946afee314298e7686009

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\prevhost.exe · signed by Microsoft Windows

a5e77d6c2d343da645acc660d45b15acaafefbd091a2f18a0c5137655d848026

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\prevhost.exe · signed by Microsoft Windows

bf39153d7ee708f5aae0746ec64f813f9bd3c345394641d8651aba8161c9c039

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\prevhost.exe · signed by Microsoft Windows

c24a7ea93c8788369a22fff0dffe26133ff8b937e7a60732ab40b79363f0fdc1

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\prevhost.exe · signed by Microsoft Windows

ca345b9bfc51923f6a505ddb4f13583c63967682bc1c349e817dcf9f23d5b296

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\prevhost.exe · signed by Microsoft Windows

0d7d86f67aae91ffde3ab7b2a4a2c8404f399a3fb01b4ddbe7530d55729b2dbc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\prevhost.exe · signed by Microsoft Windows

243d1ab7b5573b2e816e7adc93bb36c40fd19e8c7e2f39d81172f32dfb13d802

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\prevhost.exe · signed by Microsoft Windows

48b1b644ee8348e44fccddb3c4a71a263b2d9a098a6ed6975668a5fef4ddd7a3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\prevhost.exe · signed by Microsoft Windows

c091788934a12b5a2e0d526ea2960b8c0308532dcf52de6feb482fea83881d76

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\prevhost.exe · not signed

a5a93afb788af807ad358ba4ea1a2d4ee09968d0dcacc38319a5745c4d6c4fc3

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\prevhost.exe · not signed

d9ea07fa377f97eaf12a28af9fc32d88c8b65f65e7f2bd446df246e881c0596c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.