WMIMigrationPlugin.dll
WMI Repository Migration Plugin file version info
Library on Windows 2 known copies with hashes
Is it the real WMIMigrationPlugin.dll?
Installed in
C:\Windows\system32\migration\C:\Windows\SysWOW64\migration\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Repository Migration Plugin
2 known copies
10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\migration\WMIMigrationPlugin.dll · signed by Microsoft Windows
c57e54bffb5fad7323cfdffb0f978d99a19d9015c4f49dd4a7c7a542be5cb2ee10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\migration\WMIMigrationPlugin.dll · signed by Microsoft Windows
f5087e2205b0dc538ceb689ea0a886433de31d29f1b2a4a0da864a51af11f328From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.