adtschema.dll
Security Audit Schema DLL file version info
Library on Windows 2 known copies with hashes
Is it the real adtschema.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSecurity Audit Schema DLL
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\adtschema.dll · signed by Microsoft Windows
b9be5d6d8badc9ca1fd86704763dc560c86dbae88db890d232965dbee436db8810.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\adtschema.dll · signed by Microsoft Windows
c572d29090841bea4d361fea78770aea7abb5e217a2b44ae48e78c140adf6310From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.