wmitrace.dll

Microsoft Kernel Debugger Extensions (WMI Tracing) file version info

Library on Windows 4 known copies with hashes

Is it the real wmitrace.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Kernel Debugger Extensions (WMI Tracing)

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winxp\wmitrace.dll · signed by Microsoft Windows Kits Publisher

02c4d3fdac2109dc3560529387ddd208151cbc770c991f0bd8c63aec85097a00

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\wmitrace.dll · signed by Microsoft Windows Kits Publisher

06cced1ef0d8ee14145782f5c0d600cf8a34aed01b377d674029d581e44a497e

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\wmitrace.dll · signed by Microsoft Corporation

528b1ac6d0803c9fe935b867b1cddedce1540ac1d4d7401c7b5e3f2107b78ac8

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winxp\wmitrace.dll · signed by Microsoft Corporation

d5aeb458add457abd031a9c078600a20aaef972dabf3592b0d3aa4d419da2a55

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.