CmdID / Files

WsmAgent.dll

WinRM Agent file version info

Library on Windows 2 known copies with hashes

Is it the real WsmAgent.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWinRM Agent

2 known copies

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\WsmAgent.dll · signed by Microsoft Windows

SHA-256939572b764800c7820b5fd2782297b2640e423c99f7d0e36436e2386a79da46fSHA-1db13ad18dde93c2e0c704392a6426e4f77b1c240MD5aa4cbfda34606aa6508bbfe2080585d4

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WsmAgent.dll · signed by Microsoft Windows

SHA-256a05f56e1017a33b42623c2214eeeb073556bd1822f7d31707322b7118f2e913dSHA-13ce654fe87e940b683ac21b1c5608c86f94f7275MD528692c5343eb47a999ba1d64da128f94

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.