CmdID

CmdID / Files

ifilttst.exe

IFilter command line test tool file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ifilttst.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionIFilter command line test tool

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\ifilttst.exe · signed by Microsoft Corporation

2225a37a21c190fed2a4bbccbce2d64a715b2a11f28a4aad462a1e651fb1ac33

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\ifilttst.exe · signed by Microsoft Windows Kits Publisher

97a73bc965db9c2920153c1c1c0eb3bd738e1da62f1f253611bc534e5716f6e3

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\ifilttst.exe · signed by Microsoft Corporation

c42a1986082967157f511f5cc56818d83cf4f1e19f731d2e0c67a8003a9053de

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\ifilttst.exe · signed by Microsoft Windows Kits Publisher

cb63812e777d6957c2c438a796fb796fe185b7e37b4e0f4bc87989591f4db073

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.