CmdID

CmdID / Files

Microsoft.AAD.BrokerPlugin.exe

AAD token broker plugin file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Microsoft.AAD.BrokerPlugin.exe?

file version info and known copies
Installed inC:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAAD token broker plugin

4 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe · signed by Microsoft Windows

f007fd89219249c3cc580b78a35f8b46dc9adb368c2df263c5c466345c2f412d

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe · signed by Microsoft Windows

d658782eb8ebabc7dfd4109e68bd396b521cd0c92775c429b7317c1018ace75c

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe · signed by Microsoft Windows

0b9c5be55849bfda6886d54ddf422570906dac32f7cdb7b62ab1140ff7e4d734

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe · signed by Microsoft Windows

7315cae350b38386f15ee491f53f9efe97bcd1befe30e9662535366aca4d7876

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.