event.dll

Active Accessibility Event Tester Event Hook (32-bit UNICODE Release) file version info

Library on Windows 4 known copies with hashes

Is it the real event.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Active Accessibility, Microsoft Corporation

DescriptionActive Accessibility Event Tester Event Hook (32-bit UNICODE Release)

4 known copies

7.2.0.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\event.dll · signed by Microsoft Windows Kits Publisher

20f28b77d082d57f289e058b518d82fa4939bc87722261e2da2c5649a43f9003

7.2.0.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\event.dll · signed by Microsoft Corporation

4afaaea8ca701c8ef7a99b0f9a5f8d1a8aad72841e9f223b7c81ba27b09bac49

7.2.0.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\event.dll · signed by Microsoft Corporation

6f98e111308adb5220f11aed3f6f1f57401132260d0412a2becf51eb9dd77419

7.2.0.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\event.dll · signed by Microsoft Windows Kits Publisher

be59d66ba5f9474acd0193e5563abee294a26635a9480c435a6429eceaf522e1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.