CntrtextMig.dll
Microsoft Performance Counter Migration Lib file version info
Library on Windows 2 known copies with hashes
Is it the real CntrtextMig.dll?
Installed in
C:\Windows\system32\migration\C:\Windows\SysWOW64\migration\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Performance Counter Migration Lib
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\migration\CntrtextMig.dll · signed by Microsoft Windows
6ef68f2fb28731d6622d1c4ce0a041ea5e84932ab8092557e9f2a3d0a88cefed10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\migration\CntrtextMig.dll · signed by Microsoft Windows
e8ffa1b7eaf5c9a44beb6463c83041ae6da06e0d8d2f66fe83249785c3d80b57From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.