nvkd.dll

Network Virtualization Kernel Debugger Extension file version info

Library on Windows 3 known copies with hashes

Is it the real nvkd.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winxp\

Signed byMicrosoft Corporation

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNetwork Virtualization Kernel Debugger Extension

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winxp\nvkd.dll · signed by Microsoft Corporation

85a9de78902d379ce90d4615edf23600974e9aeecf894f9aaf3781f712b8f1ec

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\nvkd.dll · signed by Microsoft Corporation

8aa2bc505e158af5d814b2ff32055f7d549a6113e30a1698ab195d4286954b99

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\nvkd.dll · signed by Microsoft Windows Kits Publisher

bc41e9b5840b9c284f1f826dd9fec11f78b79fdb0d400acdded2186d6faf31d3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.