CmdID

CmdID / Files

SyncHost.exe

Host Process for Windows Sync file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SyncHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHost Process for Windows Sync

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SyncHost.exe · signed by Microsoft Windows

0f2a9b2c3b9c3f74afe4fef6638dad9322e2b49dff4a42b1287945e89b3a3170

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SyncHost.exe · signed by Microsoft Windows

157be9d752e9a8d35d59f0f15d75db2c6c7c62295fc80c560df5ddb6ec5fb5b1

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\SyncHost.exe · signed by Microsoft Windows

348e77b7b5824fedfa715bea145fd1da9784b6adb4a92ebfbfb40b4a685b1e50

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SyncHost.exe · signed by Microsoft Windows

bb07a8e597fd345b820784bb0300680588ec1c564c2df6d03008f31110ab5aed

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SyncHost.exe · signed by Microsoft Windows

706b4f7cdd4f85e604ddc69fe8d4faae2401b41c1ebd1186266b6ab0aaa2bd79

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SyncHost.exe · signed by Microsoft Windows

f6f36d637d7f9c69cd7cfb953db81d16ae5dd1b28ef2ead799258ec3351cd4ab

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SyncHost.exe · signed by Microsoft Windows

1cfa0eac0e6d0e6b113d443ea30f0b78c8cadb1d33d8b974952cef305b7cdda4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SyncHost.exe · signed by Microsoft Windows

e9f54ddeec9f56f1869ce3581173545ac934c008e337e04c7e56a0331086a2e8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SyncHost.exe · signed by Microsoft Windows

3cd03758490f23167fc21a5285167c601752117fb87594b7acfa5ad4248825c7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SyncHost.exe · signed by Microsoft Windows

47eb6d62cc9b494eb451d19a84407a879b0a4a98a46301558f6da66d5a3cef84

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SyncHost.exe · signed by Microsoft Windows

0f31c0dd6fb75e94da67a08abc076c46c89415f02593f64aedad20ebcdb3e071

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\SyncHost.exe · signed by Microsoft Windows

deb73c57e9062c88885237c663c50ff91b01b502874edcf2c789ca4b13f8a432

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\SyncHost.exe · not signed

8e416aced9319c33c48654100f999279e69f6a81623d4ba92bf950f4dabb5901

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\SyncHost.exe · not signed

9fa2fe53d4354944160a467971df68ee62f7a12be20ca9aa4e884b2af320fe44

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.