CmdID

CmdID / Files

WindowsUpdateElevatedInstaller.exe

WindowsUpdateElevatedInstaller file version info

Program on Windows 5 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WindowsUpdateElevatedInstaller.exe?

file version info and known copies
Original nameWindowsUpdateElevatedInstaller in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindowsUpdateElevatedInstaller

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WindowsUpdateElevatedInstaller.exe · signed by Microsoft Windows

b706e1856716abeaa31fe1dd0e357a0a116a62793b0adea54893f6e4c170a05e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WindowsUpdateElevatedInstaller.exe · signed by Microsoft Windows

e387376538f15a27b9548db7abbc04cae62cce7cbe7bacb1b504f5d082ad83fc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WindowsUpdateElevatedInstaller.exe · signed by Microsoft Windows

190ca5674323788d0c52abaa150c04064a8ea44ad43fd54ce2ea8e1658ca9d2d

10.0.17763.652 (WinBuild.160101.0800) · C:\Windows\system32\WindowsUpdateElevatedInstaller.exe · signed by Microsoft Windows

401f666b3ffcc3d9c77d9e8b2e0c0838467e93f4cea83e34d659b2639bb65d32

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WindowsUpdateElevatedInstaller.exe · signed by Microsoft Windows

e441a22a97e87c09244eaf8c0384d63050224fa34abf359c3f077ec509a1a0f7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.