CmdID

CmdID / Files

SgrmBroker.exe

System Guard Runtime Monitor Broker Service file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SgrmBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSystem Guard Runtime Monitor Broker Service

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SgrmBroker.exe · signed by Microsoft Windows

dfe2f8a137b596cdbe40b7299d0273f0d7305d8fdebbba86e1964d219e0ab9ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SgrmBroker.exe · signed by Microsoft Windows

29dbf6e36c4cf437b4e4563ff466fcb53eab8fd49363398d5d399eddbec10ac0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SgrmBroker.exe · signed by Microsoft Windows

f9cbf1ff87d6f11920c4b7367ea2178bf13aa276c65d918950683983f268bc1f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SgrmBroker.exe · signed by Microsoft Windows

2df8a183b3dca4de156433280fd69b49e7b20b474211d7125fbe256ca25d769c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SgrmBroker.exe · signed by Microsoft Windows

a428e6c8f23145dc75a0425e56a6c2a687bb78548ac697ba20465876cca2deca

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.