provcommon.dll
Library on Windows 2 known copies with hashes
Is it the real provcommon.dll?
Installed in
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Provisioning\C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\Signed byMicrosoft Windows
ProductMicrosoft (R) Windows (R) Operating System, Microsoft Corporation
2 known copies
10.0.19041.1 · C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Provisioning\provcommon.dll · signed by Microsoft Windows
0575dbb938aa420bc4849d5ab922b6c1118627b78a20d79d18e601f026a1224e10.0.19041.1 · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provcommon.dll · signed by Microsoft Windows
0b5dbee6aea04e8ab95dfae6a1d3883d97f234c061d030f60fe325ae3c4baceeFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.