vsssampleprovider.dll

VSS Sample Hardware Provider. Supports extended hardware interface. file version info

Library on Windows 3 known copies with hashes

Is it the real vsssampleprovider.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\

Signed byMicrosoft Corporation

ProductMicrosoft Volume Shadow Copy (VSS) Sample Hardware Provider, Microsoft Corporation

DescriptionVSS Sample Hardware Provider. Supports extended hardware interface.

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\vsssampleprovider.dll · signed by Microsoft Corporation

8de7c13d260ebc60515230b8a0d0731f106606b36050f331c3d9f2b505da09e3

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\vsssampleprovider.dll · signed by Microsoft Corporation

b5a418ea0fe9bc10c5e87b078df7dcfac766b7fe68744bf34f4e94b4502403c1

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\vsssampleprovider.dll · signed by Microsoft Windows Kits Publisher

be60d340972beceadc26c1ce5dee7db673d1d0fcbf04d49f4c5e88ef8f9ca8e9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.