CmdID

CmdID / Files

UsoClient.exe

UsoClient file version info

Program on Windows 8 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real UsoClient.exe?

file version info and known copies
Original nameUsoClient in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUsoClient

8 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\UsoClient.exe · signed by Microsoft Windows

cce6e20beccd434445f58e9d572cf9f1575a5598b21f61a85d20d9bdad8da46e

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\UsoClient.exe · signed by Microsoft Windows

fa54e07e1d8dd669e5bdbb0ea918677ea0391ab419ec849fe0f1793165900794

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\UsoClient.exe · signed by Microsoft Windows

85e6f2d57908b4b6095d3fd01d6488af4b4e8664658048525dddee7cd8d1bfe4

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\UsoClient.exe · signed by Microsoft Windows

7708961ed15b45f05d1d1bf30150f31722f5163f1a0fc8478ed15fb717d5d750

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\system32\UsoClient.exe · signed by Microsoft Windows

13b3c382ab9865163945fc0912ffb56cd49a8aaeb4a1235b05eb3edd62726b04

10.0.18362.628 (WinBuild.160101.0800) · C:\WINDOWS\system32\UsoClient.exe · signed by Microsoft Windows

6def49b50a6feba64cbd73d0801b65133b47861170e0be8ec1efe3182e64d62c

10.0.17763.1007 (WinBuild.160101.0800) · C:\Windows\system32\UsoClient.exe · signed by Microsoft Windows

df3900cdc3c6f023037aaf2d4407c4e8aaa909013a69539fb4688e2bd099db85

10.0.14393.3471 (rs1_release_1.191218-1729) · C:\Windows\system32\UsoClient.exe · signed by Microsoft Windows

7053282544c47530c3b2fc0f4829097aadd41d19d7c4c8260744510fbe295a9c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.