SecureAssessmentBrowser.exe
Take a Test file version info
Program on Windows 3 known copies with hashes
Is it the real SecureAssessmentBrowser.exe?
C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\3 known copies
10.0.19041.844 · C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe · signed by Microsoft Windows
e9a48b937e94852e0495a77e4c73bc978bb90617d1d0f80c6907c68f48a2380010.0.19041.423 · C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe · signed by Microsoft Windows
aad8b016b42cc5d58b719795d235fd306c14d85f189dc3867c223be9288d940e0.0.0.0 · C:\WINDOWS\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe · signed by Microsoft Windows
c95fd3793a57956148e5c8d76f9fba4b3525f38d70edbda8bf70bad939eaa6cfFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.