CmdID

CmdID / Files

CloudExperienceHostBroker.exe

CloudExperienceHost Broker file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CloudExperienceHostBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCloudExperienceHost Broker

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

abcb9873528c1dad58a73a8f5290958d5ede3acd610809cba225225c163d8022

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

c09a976e22be8847e57a277ea54ef596b7f6f315e4e7297ca8f831079d4d904f

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

8a9a207a88bfe90889f783ef4fce2383a6955ab5c5afa13f49826d6b88360fe8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

f7687091c771abb14fc8f12a70ce361fe414d4d679b8070e48272d9763c01594

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

d28f9b923f9121fa8b6169f401f1662d202c4cdd30cd6240291fcdd6b7839a11

10.0.17763.1457 (WinBuild.160101.0800) · C:\Windows\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

fdfc37e84bd4fcc1132cb44e1b06db8082df4b9d5dae395d8324eb64610fcaaa

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

d2a6bd3aa9853d5e4026c5f65ac60da579e4a94c90ffa636d4c70f070dba82f6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\CloudExperienceHostBroker.exe · signed by Microsoft Windows

f5a654ebdbaa9a88412f718f8924d70e75e22e5cfe45a06406aae71c3e28630a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.