CmdID

CmdID / Files

recover.exe

Recover Files Utility file version info

Program on Windows 12 known copies with hashes Command recover

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real recover.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRecover Files Utility

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\recover.exe · signed by Microsoft Windows

067ddf575a5e28467605b9201967fcc8ff61759bdd058c3356c980702bc74a01

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\recover.exe · signed by Microsoft Windows

56ce9555153058218b159c7b0bb4b41f57e65f501871f5466e653b5edd9df804

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\recover.exe · signed by Microsoft Windows

d971d5f962e2188a429de6ac6dd6fba3fa97199cdc1a8182e753069aec2fb93e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\recover.exe · signed by Microsoft Windows

dd8bc56ffb5b471b94f101c385439159b289bb9255a48edd1f0c247f5101fdd7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\recover.exe · signed by Microsoft Windows

c058763d70da19240090335942bf92ba038129d88d033994548526fa7b44367a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\recover.exe · signed by Microsoft Windows

e1e9c5ae4d6c5d0eacc305c9147fc34d72f616f8bc7866509d212f6401cf45c9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\recover.exe · signed by Microsoft Windows

29f48c967efd519b84c8ff518bf7f6cafa13bb34d8fa9af893c05a10197f3a34

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\recover.exe · signed by Microsoft Windows

b6ec80d55c7ba99165767d74e219d9393e81ca0b7cc1b65e6a697e84e62b9dfd

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\recover.exe · signed by Microsoft Windows

4696efe7ab6648628fe6bfc5ba47335d33b8108c9919887e99194a1f3ceeea92

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\recover.exe · signed by Microsoft Windows

af41daa435ead497a132a848a7cadbd0fa4ff9ab644a9e2a04a900a7b839ddea

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\recover.exe · not signed

34aef088190d020b1684d7433c2f9393bbbe37cc33dfe40ed63195a16a735a85

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\recover.exe · not signed

525bc408b5da791f7eb751ba5fa34343ad3719d6f8ee64a90f122c069e4c9f47

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.