CmdID

CmdID / Files

PinEnrollmentBroker.exe

PinEnrollmentBroker file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real PinEnrollmentBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPinEnrollmentBroker

4 known copies

10.0.22000.41 (WinBuild.160101.0800) · C:\WINDOWS\system32\PinEnrollmentBroker.exe · signed by Microsoft Windows

6138a570f4a7c05e38ad021b4fc0bb2015949fe037e6df598a0cbce796acc69e

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\PinEnrollmentBroker.exe · signed by Microsoft Windows

1953c9e88e24fd6594170a1f62da21b27847595e067ef9dba7e07543d0e3a510

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PinEnrollmentBroker.exe · signed by Microsoft Windows

0031642ed03ca783be44a6ab62702bc1f4afe78c245b5b42ddc41d65155468a0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PinEnrollmentBroker.exe · signed by Microsoft Windows

d6a2274bdc71fe08fb2b21fcfa7e4b0ac9c7c6da05d2d13597125a7b7f7d00cc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.