ndiskd.dll

Kernel Debugger Extensions for Ndis file version info

Library on Windows 4 known copies with hashes

Is it the real ndiskd.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionKernel Debugger Extensions for Ndis

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winxp\ndiskd.dll · signed by Microsoft Windows Kits Publisher

31e333fda8269b46cd6a4fd4af6e1a48458823db9a5957fec7e35aee3c28e5f8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\ndiskd.dll · signed by Microsoft Corporation

3c13100ddf3fa6a1ef21a330795367cd66b3b9a9f8b509e3459fdba813fc7746

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\ndiskd.dll · signed by Microsoft Windows Kits Publisher

784d775662ed3480c941785ecade972a46e1bed46c86b601bb67b19504162ee0

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winxp\ndiskd.dll · signed by Microsoft Corporation

ed3c498f9240ebd8aa21aad4776ac430a1ea609644e6b6df32d715acda00d2bc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.