devmgr.dll
Device Manager MMC Snapin file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real devmgr.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDevice Manager MMC Snapin
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\devmgr.dll · signed by Microsoft Windows
2a3706f4a1e7cd34bed48970374ac367fb83300bf8d2a94dc28fa522721a1fcc10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\devmgr.dll · signed by Microsoft Windows
9666061d1a8fb5a4ea7083cfbac63ead521e3a3a9be9df1809d4d05cb863dc9cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.