dbgeng.dll

Windows Symbolic Debugger Engine file version info

Library on Windows 6 known copies with hashes

Is it the real dbgeng.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Symbolic Debugger Engine

6 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\dbgeng.dll · signed by Microsoft Windows Kits Publisher

0d0817aa8395dee43e643fe2548e1f3bf97504abdc7979959ff28dc2823b5836

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dbgeng.dll · signed by Microsoft Windows

24dffb608a996ace1d4bb610001bf69e537fad7e6bb24f16e20640fe35d0a256

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dbgeng.dll · signed by Microsoft Windows

34fe4cecb8fee38460016139d00c9f66fa9115ef230b7f2fc4d753d5f1767e63

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbgeng.dll · signed by Microsoft Corporation

779689b113220a4e618f283e305262d208412c2186ec37d3638cd47808b6bb44

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\dbgeng.dll · signed by Microsoft Windows Kits Publisher

8de1d394ed0b2fb63ac7891474075cb367e85a6a5b1c03276126459a3029f7e9

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbgeng.dll · signed by Microsoft Corporation

90b44932da70c0626d0d0409ec4149f89bc7db8011acf930a2f84e0a453d4b9f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.