CmdID

CmdID / Files

TokenBrokerCookies.exe

Token Broker Cookie Helper file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TokenBrokerCookies.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionToken Broker Cookie Helper

14 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

5dfe25c783af173b694f63ee7c2db6b1b4d45e11733e5b564b975581dc74a819

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

b2a09d35d3633716b46acb378143ff850d7f9d3a792a132eb08f80280c5eb609

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

398a23608a0db31951be5a3eddd979771bffd84a4f1548609d3c8c608de736ca

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

48ec4693d70e9eb63a21d7a6c8b04bde7c886d786650dd43d952faedbd357ca3

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

1f9d63a75db722254c7f9c29aeb66de6b3f71f9783439c7f34e7551570fd649f

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

ebb4709ed4f1730a15fac118ff8cf4c5790876596d0c581d9c92fdc5e773a401

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

bb59915d9d1a310e3b2f8f2db2fd0ec0fb5f00e994113a5d427a831db5988b8c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

f138cd58278b472b577854ef866f062c8e129b4d7f401f775ac7f6a14d074081

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

34c7622c56a44eb11e56f5053fa75a42c4d48701965c333a1d70e67980a20837

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

5aad4004a73a1d7074b8714075f5c81441170a56f6fd9628b245de2b591f4890

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

55006ad12e81756ce62630173ffc24ce8865b3aaf2b8497af1ff6ab2e13fbd67

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

950fb6c29989f0291446281bb4cd2f1477855197f52f5aa8901c0e7b5f96d0a6

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\SysWOW64\TokenBrokerCookies.exe · signed by Microsoft Windows

95581ff2a0eb3ee8fc5436b1635f8027c814bb123fe83aee81256a383e51c0af

10.0.14393.3686 (rs1_release.200504-1524) · C:\Windows\system32\TokenBrokerCookies.exe · signed by Microsoft Windows

bd28b188174eec50b459095623b8aabbc449354922424d79967833d776df69e4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.