kerneltracecontrol.dll

Performance Analyzer Kernel Tracing Control Library file version info

Library on Windows 4 known copies with hashes

Is it the real kerneltracecontrol.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\legacy\
C:\Windows\system32\DiagSvcs\

Signed byMicrosoft Corporation

ProductMicrosoft Windows Performance Analyzer, Microsoft Corporation

DescriptionPerformance Analyzer Kernel Tracing Control Library

4 known copies

10.0.19041.508 (WinBuild.160101.0800) · C:\Windows\system32\DiagSvcs\KernelTraceControl.dll · signed by Microsoft Windows

SHA-2560d93fdcbfd5612c1fb58d3e2cd655966743613e111cf212a10ee974a605f0d08SHA-1b83af0d29c82b968fadfe0f62444ccac9dc10922MD54580ecb197f49ba82c93345ca3cff1dc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DiagSvcs\KernelTraceControl.dll · signed by Microsoft Windows

SHA-2565c46722555c29d9835ff3a96e86e7e9450e8e006b250ae0dae100aa1368177a0SHA-11e239b8a97ef70c5ef165177c301fad46bc069fbMD5650a0cccb151da79c3cf8597f11d1792

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\legacy\kerneltracecontrol.dll · signed by Microsoft Corporation

SHA-2567bcf8e05e823f16456f0e779a8f3d0c3cecfc3ad4d62a8d16d4101f3b2613770SHA-1eb082e863ab2083c1897430de6e6de37ee9fb1a3MD5d7908abe117486ad02baea324d254436

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\kerneltracecontrol.dll · signed by Microsoft Corporation

SHA-256e29492666deaccc00df744741df6d51fa57896133d812adaa2ca1f3fc788f2d7SHA-1d3a3c70a346ed24faa10b092fb6d438f6fa48d60MD56e6d569bd9f9d5a2e71d00bfbff33d19

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.