CmdID / Files

wiashext.dll

Imaging Devices Shell Folder UI file version info

Library on Windows 2 known copies with hashes

Is it the real wiashext.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionImaging Devices Shell Folder UI

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wiashext.dll · signed by Microsoft Windows

SHA-256d79f557b2b0bcebddd814427aeba88d8ee3dbc053b9f9fd34eb753dc79116d5dSHA-1e15631d40aa7f5b0aee654fd357b0ef225c9d8acMD503bdecee26989eec0e3818906ae8cd0e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wiashext.dll · signed by Microsoft Windows

SHA-256dae8c83e70740a70d863f290237b4d1f01786893b7f974377038ea4a3f901870SHA-10449e3b00f7e4899158893fb0652951c393ae776MD54112e5076043e28e7eaa0d075dc58dac

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.