CmdID / Files

wshunix.dll

AF_UNIX Winsock2 Helper DLL file version info

Library on Windows 2 known copies with hashes

Is it the real wshunix.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionAF_UNIX Winsock2 Helper DLL

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wshunix.dll · signed by Microsoft Windows

SHA-25658c9e6e865eeaea8f970a09b6d784e9a3bc12827b855d62349eea9e486058a92SHA-18ffd5bcea3b6ed65a3af231f8b38252ad4e2a04cMD57f03605772f3583000dc96e85c792644

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wshunix.dll · signed by Microsoft Windows

SHA-256be52aa534821bdbddff9a5b0f47b2bd27fccb0e12c88aed8e80374e0438056c8SHA-17ac05de00728dcb3f75275d253b80a47045cb6e2MD50e9aa258b21bbb572d1540bbed595d86

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.