CmdID

CmdID / Files

UserAccountBroker.exe

User Account Control Panel Host file version info

Program on Windows 14 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real UserAccountBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUser Account Control Panel Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

74f0b23b6d0b8d7ecd9e2a094275b0a390bb871ae13859cc03187ad94def724b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\UserAccountBroker.exe · signed by Microsoft Windows

a87e35f8fe002554c09f0c5a4ce50e8cd4c36a4e7453b0335506cb7a8bb9936e

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\UserAccountBroker.exe · signed by Microsoft Windows

b0a0b66d205e4979fb1630d68b4caa77cafd3f98a793eb843da19ea9a9f5c2af

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

ffa4f0bbebad9fd4aebcaef463cffc0489b4f5e074333c296d382f050a80af7f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\UserAccountBroker.exe · signed by Microsoft Windows

a632049a11a5cd83688a40c27d3285377f82b41840504b158415bdfbbd90e488

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

cd28fe6b1b0ecfecf01aa674326fc250d158908f33ebd023356683cae108c2bb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\UserAccountBroker.exe · signed by Microsoft Windows

1812fcf0f9d6c8fbad3a7dc2cb4fbd056947aaa5dd229f6d4c9cf80e0469f01b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

51293d345f6b8a2980a2815d8ae3c0c72cb17c42cd3e077cd127981be83d1236

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

0e8430217b5215859ddb9b141649982b838538286334f309042fa614d5026d87

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\UserAccountBroker.exe · signed by Microsoft Windows

efbf9d87eeba124b157c9d0068450b1880a2a5a09d59c41adde3a292392d0984

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

46841656f6dcc63c1f340c08bfda0ae0c32248cba83b0235e887ad117381393a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\UserAccountBroker.exe · signed by Microsoft Windows

ad7ac816864676a75f46fc6b91209c321fde554c9ea860026b5678c6965c59b7

6.3.9600.18339 (winblue_ltsb.160512-0600) · C:\windows\system32\UserAccountBroker.exe · signed by Microsoft Windows

30fcc44e784849dafc052eb8eff1ed5bdc8d88a6fb01266519c76c2286f40270

6.3.9600.18339 (winblue_ltsb.160512-0600) · C:\windows\SysWOW64\UserAccountBroker.exe · signed by Microsoft Windows

a2e5dbb8b6ce5ef7d32dbc75af3ebd9229c8389f468f7fa5457221e55f4e7c6b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.