CmdID / Files

Windows.Management.SecureAssessment.Diagnostics.dll

Diagnostic event channel for Secure Assessment file version info

Library on Windows 1 known copy with hashes

Is it the real Windows.Management.SecureAssessment.Diagnostics.dll?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionDiagnostic event channel for Secure Assessment

1 known copy

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Windows.Management.SecureAssessment.Diagnostics.dll · signed by Microsoft Windows

e536ea7ef35d45aff700a67ac6d73dcc95bf7fefcd45f90d0016c9afd4ef976e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.