CmdID

CmdID / Files

ShellExperienceHost.exe

Windows Shell Experience Host file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ShellExperienceHost.exe?

file version info and known copies
Installed inC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Shell Experience Host

4 known copies

10.0.22000.132 (WinBuild.160101.0800) · C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe · signed by Microsoft Windows

c56c4e137cdc4caec937a61a6a868072d4cbcaafd29a2bc321f3e2f946389ae9

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe · signed by Microsoft Windows

6cc44fbee63233a379e08b2fdf451890f6fce8615878c44bc1a680a6f13c9cbd

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe · signed by Microsoft Windows

c8af972a1aa4132c0c43b05b4b66515394f7a49235653ac273bb947e321e0be2

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe · signed by Microsoft Windows

4c920501a1c25235ddbd63825a238ff29c4bd89bd054cd0157ec7f55ed20ce59

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.