CmdID

CmdID / Files

ThumbnailExtractionHost.exe

Thumbnail Handler Extraction Host file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ThumbnailExtractionHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionThumbnail Handler Extraction Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ThumbnailExtractionHost.exe · signed by Microsoft Windows

56e05103efae1ba339cc5419e437cca1cdd34f8a7fbe83cc1e892b258651d938

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ThumbnailExtractionHost.exe · signed by Microsoft Windows

72d927c531fdd6794a8db3a089d85fa44825c420c07eaae25d290afdcfbfadc4

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ThumbnailExtractionHost.exe · signed by Microsoft Windows

dcc96b237f4c46ffc5255e1f43136a35b3299fe69c2048a12d89660eaa15f9aa

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\ThumbnailExtractionHost.exe · signed by Microsoft Windows

dfc08877e0bf2b36d1a17ef21857117bd26789558746c19283d1affadf070c45

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ThumbnailExtractionHost.exe · signed by Microsoft Windows

274e6d2aafb4e660a1fe3fe4fdb8c8ef79576af9ad5fc0d64a42abb9d7afaf9c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ThumbnailExtractionHost.exe · signed by Microsoft Windows

3c63aadaf7c52e13e296b11c20d92cb4b75a711a7e1df3e91027ba69c7197ab6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ThumbnailExtractionHost.exe · signed by Microsoft Windows

42b9dc3dea8839fda52640cdd3e4dd209badc847548905ffa6d5d2347665de6f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ThumbnailExtractionHost.exe · signed by Microsoft Windows

9b5345cca2eff5dd47894fdaa6d8b6865f47c2b928a63d17d1c6868d49c79360

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ThumbnailExtractionHost.exe · signed by Microsoft Windows

37ed1945a2bc2f4c53b0231be12efd84ad6d4568dab2d0b4197bbbf847f0ec26

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ThumbnailExtractionHost.exe · signed by Microsoft Windows

ab58bab0565be06dbe5eaf5ee4cd0c3281a6bb6efa4f23cebc9e0f71ca29a797

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ThumbnailExtractionHost.exe · signed by Microsoft Windows

9cd936c2477be5deb22d77e2d0aa543c8d741553d588c6515e2c9e64f5644791

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ThumbnailExtractionHost.exe · signed by Microsoft Windows

c561761738abd510dd0efba3f8889a7800ab3e9922b2448036aed380a0443eb8

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\ThumbnailExtractionHost.exe · not signed

6784269501e37eeabeef9ef6bb0f0c690ac90e904e9b901c540cfaa7a4dbced7

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\ThumbnailExtractionHost.exe · not signed

a70b9a58d6091599c7309152f13dd9306d1b584139287a7969fb131f1b61f7e8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.