CmdID

CmdID / Files

regtrace.exe

REGTRACE MFC Application file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real regtrace.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductInternet Information Services, Microsoft Corporation
DescriptionREGTRACE MFC Application

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\regtrace.exe · signed by Microsoft Windows

99ae56ccbde0049f4aff6979287f2b9c03428403847bbf66cee455cb9666af60

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\regtrace.exe · not signed

beb0475dc80b99ea8c0e3c391fa206c1bc051b171d756e0bdc20d284ee8ccd21

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.