CmdID / Files

aspnet_counters.dll

Microsoft ASP.NET Performance Counter Shim DLL file version info

Library on Windows 2 known copies with hashes

Is it the real aspnet_counters.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft ASP.NET Performance Counter Shim DLL

2 known copies

4.8.4084.0 built by: NET48REL1 · C:\Windows\SysWOW64\aspnet_counters.dll · signed by Microsoft Windows

1b715895ddcdf90aa5edbfe9099a732d68abd8f2ad01b18e1adab94110e34541

4.8.4084.0 built by: NET48REL1 · C:\Windows\system32\aspnet_counters.dll · signed by Microsoft Windows

476a8ad72655ce420c84e9487964aa2b5722fa5fbe480e587d7d20283df22545

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.