tedutil.dll

Topology Editor Utility Library file version info

Library on Windows 4 known copies with hashes

Is it the real tedutil.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMedia Foundation Topology Editor, Microsoft

DescriptionTopology Editor Utility Library

4 known copies

1.0.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\tedutil.dll · signed by Microsoft Windows Kits Publisher

9446492aa3d36e78c7203bc47d9f7406dde4a9d9a1520e3ab8ced009766a2de0

1.0.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\tedutil.dll · signed by Microsoft Corporation

c31b09f7c5d520c4307386619e33a582c374a4b247e36bfe6416958e5d5042d1

1.0.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\tedutil.dll · signed by Microsoft Windows Kits Publisher

dc3e00c32ce0543da67706beec0ebbd8893fb0a683abf4dccab2a29cfda7693b

1.0.0.1 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\tedutil.dll · signed by Microsoft Corporation

f0873c2df1123b9acb820f333a0e7167596a3697f4151ab822686ab24c08eec5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.