CmdID

CmdID / Files

UserOOBEBroker.exe

User OOBE Broker file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real UserOOBEBroker.exe?

file version info and known copies
Installed inC:\Windows\system32\oobe\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUser OOBE Broker

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

2cf3f53e333643f0351c1fea65247d450a6cd98b79c50daf8844b77effa00670

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

ad938c303f12ea8d164433cc7ba46fc7b9ae00f6f899e308d4317dab46e25642

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

2a449e3d6a3954fb9765152be964a29b743665738f78b6b81ae5cb712876b8a4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

6888918159c79da40e8435080d82e49bcdc1519ae48601b51f2d883c7847950c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

fdbb7e8b952e66a0a6c16595964ec17908a9da84b9da09dcd5d6cb6c51263270

10.0.17763.1457 (WinBuild.160101.0800) · C:\Windows\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

f66c11d32206e0b26cdd2a70b103a18585e59cb1a16020b8a4b6fbccce131ac4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

59911f2c3bbbeb69233ddfc1c9be173b00c35372c850fb197e7a73c136649594

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\oobe\UserOOBEBroker.exe · signed by Microsoft Windows

af006be92927e60b400fe9d3b20ee764c5a1099e55cb7d526d7f356c7f960f22

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.