CmdID

CmdID / Files

CredentialUIBroker.exe

Credential Manager UI Host file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real CredentialUIBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCredential Manager UI Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CredentialUIBroker.exe · signed by Microsoft Windows

cf6e043948d78fc1eb5e925bd06f04f7813fe819747b95dc4d453c17408376c5

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

d9d6203855cf64f244aec583d17d80430d248c7349a4c70220df2a184f780772

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

88c29a13b03bb5bd2bde59750fee657a9b10cd8c2f19db031900099f24db5d33

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\CredentialUIBroker.exe · signed by Microsoft Windows

950f3629b5c8732b1e3c263239a6ccd87e93422e0d4f50a7b051b7b389a6fe64

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\CredentialUIBroker.exe · signed by Microsoft Windows

13b403048599690a2c7d261e9ca44033f214f2a92a8c45e07750e32ca4038735

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

88435303fd2a0b7d0b03a017238aba5c46b1f75dbcd9ecb8b35756be2b444bcd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

32976fdd25365a3796a6c226c0bf9351a064ab02f19e98d70b934d00e6e2059f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\CredentialUIBroker.exe · signed by Microsoft Windows

a0f468167c8e9d8fe0134c12aece39a5d974f6fda9f7f15f3013ffd0f87b28e4

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

b47ae441fbb2c3307ee6b8f7807d9de244d5127eff68474adcfe3c0adf8d335d

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\CredentialUIBroker.exe · signed by Microsoft Windows

b81b3aa5c5c239b13584c1f5425439075213802ef55683f1ea7760dc62bd876a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

95dc6a3711e8a9804461ecad0d245105bc709c2b6880bcafc391e877b22cba6c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\CredentialUIBroker.exe · signed by Microsoft Windows

a9804ed800307e8e9d14d7909936521619acfa6ec714559963fc2dec0c3ce8b7

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\CredentialUIBroker.exe · signed by Microsoft Windows

916f9843e05f135eed67d3374c0e0ed1fa8b8374e89748a451584ba08d8dfc7a

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\CredentialUIBroker.exe · signed by Microsoft Windows

c8442825955edc99c4554b73efde720fa43b249e6a91fdb7318ea9927b83f309

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.