eventcls.dll
Microsoft Volume Shadow Copy Service event class file version info
Library on Windows 2 known copies with hashes
Is it the real eventcls.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Volume Shadow Copy Service event class
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eventcls.dll · signed by Microsoft Windows
a047e468d560fc20a4fcb48a5151de835f6dd90aa043259fe53c85d46d9a54b410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\eventcls.dll · signed by Microsoft Windows
bed07c1966cbe2b309f4c6384b9de374f8297fab3bb8f24af78d388325d0670aFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.