CmdID / Files

Windows.Media.FaceAnalysis.dll

Microsoft (R) Face Detection DLL file version info

Library on Windows 2 known copies with hashes

Is it the real Windows.Media.FaceAnalysis.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft (R) Face Detection DLL

2 known copies

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Windows.Media.FaceAnalysis.dll · signed by Microsoft Windows

3051e0cf42c0eb6e169b5a166540cf9bf6ff0bde10d859e079bc9ba59afc31a8

10.0.19041.388 (WinBuild.160101.0800) · C:\Windows\system32\Windows.Media.FaceAnalysis.dll · signed by Microsoft Windows

c23d166f43ad2ac72f750074f614feaaf0110cab09f4e4247b7e08bad033a63a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.