CmdID

CmdID / Files

UtcDecoderHost.exe

Microsoft Windows Diagnostics Tracking Decoder Host file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real UtcDecoderHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Windows Diagnostics Tracking Decoder Host

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\UtcDecoderHost.exe · signed by Microsoft Windows

df015a0ca853f8c1380164296482a915ce928cfa176f5bf97f3c9e8e58413c48

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\UtcDecoderHost.exe · signed by Microsoft Windows

b285cb12050fa52ae6a41f76e540b8a9a88f2d7b2f52dd3467f66703b7b112b1

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\UtcDecoderHost.exe · signed by Microsoft Windows

07493b3176d7cc35a9e25bf4dae820fbdf7c576c0a6f361d5909518de289dba4

10.0.19041.207 (WinBuild.160101.0800) · C:\Windows\system32\UtcDecoderHost.exe · signed by Microsoft Windows

334b0f305bfdd30385e3b676c14f77b22adee0daa7d2701457d50132999df047

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\UtcDecoderHost.exe · signed by Microsoft Windows

fe885f8b2f38002953dd0f3853900184b01a46611ff51e4a410e6390fd8b4893

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.