gflagsui.dll

Microsoft NT Global Flags Manipulator file version info

Library on Windows 4 known copies with hashes

Is it the real gflagsui.dll?

file version info and known copies

Original nameGFLAGS.EXE in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft NT Global Flags Manipulator

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\gflagsui.dll · signed by Microsoft Corporation

57ab48e3523ccd6069af0042bcdf70d18d99bc24e66506feae635130456540cf

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\gflagsui.dll · signed by Microsoft Windows Kits Publisher

6bc69ae71661595849d30ee61edeb370d1a767abd830b6b8af2c3f3268795fb5

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\gflagsui.dll · signed by Microsoft Corporation

764b50016ff4ff3ace09cf69d8615bad3791dfbb3a9f2c2831aed446efc77344

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\gflagsui.dll · signed by Microsoft Windows Kits Publisher

b04388ab1a2e20312844c5fb6279f2f6145a19b22287e34a2c1e1d2ee982cba2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.