CmdID / Files

WsUpgrade.dll

Winsock Upgrade Plugin file version info

Library on Windows 2 known copies with hashes

Is it the real WsUpgrade.dll?

file version info and known copies

Installed inC:\Windows\system32\migration\
C:\Windows\SysWOW64\migration\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWinsock Upgrade Plugin

2 known copies

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\migration\WsUpgrade.dll · signed by Microsoft Windows

21bf554fd8d8892a75c5e724429e8d3175ddb4fd7bac3c2bcdbeae647d0da2bd

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\migration\WsUpgrade.dll · signed by Microsoft Windows

4ea80246371c4fc3dfdeba822760268e9aaa41f5c62a94ccc7cafa0eb5243b73

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.