Microsoft.WindowsErrorReporting.PowerShell.dll

WerCmdlets file version info

Library on Windows 2 known copies with hashes

Is it the real Microsoft.WindowsErrorReporting.PowerShell.dll?

file version info and known copies

Installed inC:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\

Signed byMicrosoft Windows

ProductMicrosoft (R) Windows (R) Operating System, Microsoft Corporation

DescriptionWerCmdlets

2 known copies

10.0.19041.1 · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll · signed by Microsoft Windows

15c35e3cab31bdce2a3ac0dcbcbf1f596b14c0cec533b9667005d876d1c8bee3

10.0.19041.1 · C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll · signed by Microsoft Windows

e75f6efa0094332812bc74691d6cd57615d0e14f85a726e8c432f096cbad16b1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.