CmdID

CmdID / Files

vswriter.exe

Volume Shadow Copy Service (VSS) Test Writer file version info

Program on Windows 3 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real vswriter.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Corporation
ProductVswriter, Microsoft Corporation
DescriptionVolume Shadow Copy Service (VSS) Test Writer

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\vswriter.exe · signed by Microsoft Windows Kits Publisher

182d25c84a5dec922c5c860260f2ff8c792837292f840e065fd15bbc9205821e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\vswriter.exe · signed by Microsoft Corporation

42242487dfbc75422b79888e21c53cc980c66174650584e148ef269ca4b62216

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\vswriter.exe · signed by Microsoft Corporation

792e8d2a00a60473f465da0f539129d9bf348bbf7e35f2fa7b79977885b079e1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.