RasMigPlugin.dll

Microsoft RRAS Server Migration Lib file version info

Library on Windows 3 known copies with hashes

Is it the real RasMigPlugin.dll?

file version info and known copies

Original nameRRASUPG.DLL in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\migwiz\replacementmanifests\Microsoft-Windows-RasServer-MigPlugin\
C:\Windows\system32\setup\
C:\Windows\SysWOW64\setup\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft RRAS Server Migration Lib

3 known copies

7.2.19041.450 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setup\RasMigPlugin.dll · signed by Microsoft Windows

24b7245ec84656dba09047eafb3bc10af35f5a2cd8672e38166f4cc73df6cf9e

7.2.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\migwiz\replacementmanifests\Microsoft-Windows-RasServer-MigPlugin\RasMigPlugin.dll · signed by Microsoft Windows

b7f3d917ba286f613a27ffa8a46657f30e4b1aa69fa88547e1a0a33dc89ddb1d

7.2.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\setup\RasMigPlugin.dll · signed by Microsoft Windows

ccbcdddbcf426f1ca90bf4dbb1c78fb94190cd478d09efc76e9c5d9e6627e4a6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.