CmdID

CmdID / Files

betest.exe

BETest, Volume Shadow Copy Service (VSS) Backup/Restore Test Tool file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real betest.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductBETest, Microsoft Corporation
DescriptionBETest, Volume Shadow Copy Service (VSS) Backup/Restore Test Tool

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\betest.exe · signed by Microsoft Windows Kits Publisher

329fe912e14cd49af4ab2eb63927de5c7b820e54a3cfe679eeaf820f4117af4c

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\betest.exe · signed by Microsoft Corporation

713f78c71f178ef3f79868a1977deb033a65c72e08ad06d6c1d4780801292e79

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\betest.exe · signed by Microsoft Corporation

a46046da397b9ecdffe72540638d4a25ebc1ac0ae4376697cbb564b85339165d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.