vdswmi.dll
WMI Provider for VDS file version info
Library on Windows 2 known copies with hashes
Is it the real vdswmi.dll?
Installed in
C:\Windows\system32\wbem\C:\Windows\SysWOW64\wbem\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Provider for VDS
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\vdswmi.dll · signed by Microsoft Windows
747d1d9cf72ba6e401e7795c5a6d7c90dd33c7d3bbbee91ddeeef3b7a45752bb10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\vdswmi.dll · signed by Microsoft Windows
c96deafb57a4e027c054b6dfcb7f89cb57062e5a63ab5e264c0d491d54f0e8b4From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.