Microsoft.Diagnostics.Tracing.EventSource.dll

Microsoft.Diagnostics.Tracing.EventSource file version info

Library on Windows 4 known copies with hashes

Is it the real Microsoft.Diagnostics.Tracing.EventSource.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\App Certification Kit\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\AccChecker\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\AccChecker\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft.Diagnostics.Tracing.EventSource, Microsoft Corporation

DescriptionMicrosoft.Diagnostics.Tracing.EventSource

4 known copies

1.1.28.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\AccChecker\Microsoft.Diagnostics.Tracing.EventSource.dll · signed by Microsoft Windows Kits Publisher

4c5da4adb76c374e2d86510d3fdd3aa02ccfd19b34c1dc08e2e7bcd2f2ac09f8

1.1.28.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\Microsoft.Diagnostics.Tracing.EventSource.dll · signed by Microsoft Windows

c93bf8ff0e515979213c98b9733b7d4a4a5e63ad70ca3bffe6b6c066826fd9c2

1.1.28.0 · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\AccChecker\Microsoft.Diagnostics.Tracing.EventSource.dll · signed by Microsoft Windows Kits Publisher

d01527ef57259186e309948d0728ff2e06c1f8c772122fd3bdeaa883d466ab3b

1.1.28.0 · C:\Program Files (x86)\Windows Kits\10\App Certification Kit\Microsoft.Diagnostics.Tracing.EventSource.dll · signed by Microsoft Corporation

f9836c19b55583433141cbc1ae4542e65919abb0753e806b29740a732526b685

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.