CmdID

CmdID / Files

rtlist.exe

Microsoft User-Mode Process Server Query Tool file version info

Program on Windows 4 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rtlist.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\
Signed byMicrosoft Windows Kits Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft User-Mode Process Server Query Tool

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\rtlist.exe · signed by Microsoft Corporation

18011587ceb54a206edb1be97bef4583f37c50cd712f3538610db330e932f38f

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\rtlist.exe · signed by Microsoft Windows Kits Publisher

19e6ed728b308b9416957adb9447f873b37e71ae34592b79c62e22b85b784aea

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\rtlist.exe · signed by Microsoft Corporation

6640e4e7e9c2c0f0eac82134d6600e2f5ed550d4716ef8d12c79d91fed1ea813

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\rtlist.exe · signed by Microsoft Windows Kits Publisher

ecefae02b1d9fcf8618c91b4a949c719c55d414e581cd5e6f50b29a21ac836de

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.