CmdID

CmdID / Files

ImeBroker.exe

Microsoft IME file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ImeBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\IME\SHARED\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft IME

7 known copies

15.0.9600.19612 · C:\windows\system32\IME\SHARED\ImeBroker.exe · not signed

fd742bd6ea621b08b25df12181cefc031dcda114987fc541e06aa0477d972efa

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\IME\SHARED\ImeBroker.exe · signed by Microsoft Windows

02caff8e8897a4a8955cc31b42f80b39dd46d60c5b81b088abfb2240cfa05f59

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\system32\IME\SHARED\ImeBroker.exe · signed by Microsoft Windows

b019c9e41e1ae6af62d461a801021e29ded512a270d38ffd6a47fdff4bc2f1a8

10.0.19041.84 (WinBuild.160101.0800) · C:\Windows\system32\IME\SHARED\ImeBroker.exe · signed by Microsoft Windows

165b5570c07d102725bcd757006234fbb501bfd47c9a85d4b656866cba40eaea

10.0.18362.657 (WinBuild.160101.0800) · C:\WINDOWS\system32\IME\SHARED\ImeBroker.exe · signed by Microsoft Windows

e5f9dbf6abb52c0e7ef696a171dce7274cbb3c049d1bb8fea7b0eefa7250777a

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\IME\shared\ImeBroker.exe · signed by Microsoft Windows

e37af0474aa463e544abc4e202d0a5e43a9b24423b51601ab4dd1a58cf5ef2a5

10.0.14393.3503 (rs1_release.200131-0410) · C:\Windows\system32\IME\SHARED\ImeBroker.exe · signed by Microsoft Windows

93c60cf640001363cfdbcf53368845b2358ee7fb9801aa4d9cd174d98c3343fb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.