CmdID

CmdID / Files

tdlrecover.exe

Microsoft Tile Data Layer Reset Tool file version info

Program on Windows 2 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tdlrecover.exe?

file version info and known copies
Original nameTdlRecovery.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Tile Data Layer Reset Tool

2 known copies

10.0.14393.3564 (rs1_release.200303-1942) · C:\Windows\system32\tdlrecover.exe · signed by Microsoft Windows

66718ded2e5aea4d072b55d748cdaa686d4fb98ccb811682a18fe1c5b7dd1153

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\SysWOW64\tdlrecover.exe · signed by Microsoft Windows

3b5613ebeda448d1473de8511e3f0796278b3afadc7fbee340ddb446d2e9e6de

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.