DbgModelApiXtn.dll

Data Model API Extension Library file version info

Library on Windows 4 known copies with hashes

Is it the real DbgModelApiXtn.dll?

file version info and known copies

Original nameApiExtension.dll in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winext\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winext\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionData Model API Extension Library

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\DbgModelApiXtn.dll · not signed

088948669fab03ed0c1092da8297c8af6232d27cda0c0888bd06de451835aecb

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\DbgModelApiXtn.dll · not signed

6cf7e42a9ab03dc9460371c9cdd649557b437b052d7c624292eb486603080e8e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winext\DbgModelApiXtn.dll · signed by Microsoft Windows Kits Publisher

864ac7d95d37ff5aaf65f5c315515a7b4997dbfd1c9347b414d06b4490bf82f1

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winext\DbgModelApiXtn.dll · signed by Microsoft Windows Kits Publisher

d87b6cc61d9990dc6cac59a15ece1cade5f481c3c82e0fb6773851535698f0af

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.