CmdID

CmdID / Files

InstallAgentUserBroker.exe

InstallAgentUserBroker file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real InstallAgentUserBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionInstallAgentUserBroker

2 known copies

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\system32\InstallAgentUserBroker.exe · signed by Microsoft Windows

319bc440f8e272cdca6e557433fc646302408fb16a2f7ce282e4dbdd0a8dd187

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\SysWOW64\InstallAgentUserBroker.exe · signed by Microsoft Windows

69076e2c39e9869b21cd1f13c5265f960271368d010f499919ec63cd354e0c69

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.