CmdID

CmdID / Files

vsstrace.exe

vsstrace, Volume Shadow Copy Service (VSS) trace formatting tool file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real vsstrace.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
Productvsstrace, Microsoft Corporation
Descriptionvsstrace, Volume Shadow Copy Service (VSS) trace formatting tool

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\vsstrace.exe · signed by Microsoft Corporation

39de95abc33f911ffe40b0804ee68abbcd9d3b6c4c2a25005ad7ade59b5c5ba9

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\vsstrace.exe · signed by Microsoft Windows Kits Publisher

671d41df57d62c2efd56d91deea027ce896c157ca7f17deca7f0e4a3fa0c138d

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\vsstrace.exe · signed by Microsoft Corporation

72619984fcfe978792ac77a0a4dca39109b55f2024b82ce672210958faba5f3e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.