Microsoft.Diagnostics.AppAnalysis.dll

"Microsoft.Diagnostics.AppAnalysis.dll" file version info

Library on Windows 4 known copies with hashes

Is it the real Microsoft.Diagnostics.AppAnalysis.dll?

file version info and known copies

Original name"Microsoft.Diagnostics.AppAnalysis.dll" in the file’s header: a renamed copy still carries it

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\AppAnalysis\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\AppAnalysis\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\AppAnalysis\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

Description"Microsoft.Diagnostics.AppAnalysis.dll"

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\AppAnalysis\Microsoft.Diagnostics.AppAnalysis.dll · not signed

07fd72a4f2481c0e4bcfba88d598fb810be2b973b38cc0068fc9ef75df3d59db

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\AppAnalysis\Microsoft.Diagnostics.AppAnalysis.dll · signed by Microsoft Windows Kits Publisher

a84a2a4361f57c23dab8b3158bd117d3852827c95a2a2ad485282ed44f62a250

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\AppAnalysis\Microsoft.Diagnostics.AppAnalysis.dll · signed by Microsoft Windows Kits Publisher

b1567d3502fcd34131b75715903169e85c7b55470e8b9e1502bbdbc97526a45f

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\AppAnalysis\Microsoft.Diagnostics.AppAnalysis.dll · not signed

ca481fc87306d0faaf7e0d2ace8bc28c2e15f126b8724065db9ba49d3d327c55

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.