imagehlp.dll
Windows NT Image Helper file version info
Library on Windows 2 known copies with hashes
Is it the real imagehlp.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows NT Image Helper
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\imagehlp.dll · signed by Microsoft Windows
85a9e7e8abbd9220773b121e2bd0cba2ab4f5894b527f9ba5824c4b870480b5610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\imagehlp.dll · signed by Microsoft Windows
8f7a32efce7e0975e3233fb0a1e02bd2604f1cd28b3b6185b2f38a4fd87ed6c6From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.