PhotoMetadataHandler.dll
Photo Metadata Handler file version info
Library on Windows 2 known copies with hashes
Is it the real PhotoMetadataHandler.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPhoto Metadata Handler
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PhotoMetadataHandler.dll · signed by Microsoft Windows
79246d97c7d612cc0c3c1d9ce29ede3ea26744fd47796b0ff14888396fbe3ce410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PhotoMetadataHandler.dll · signed by Microsoft Windows
fcd54d27e9377aabc1b27aa6cf10fa5bc19354bc02b67e547afe6578328a9991From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.