wudfext.dll

Windows Usermode Driver Framework Debugger Extensions file version info

Library on Windows 4 known copies with hashes

Is it the real wudfext.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winxp\
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\

Signed byMicrosoft Windows Kits Publisher

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Usermode Driver Framework Debugger Extensions

4 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winxp\wudfext.dll · signed by Microsoft Corporation

49d8bfad0be79e29f7f2b1087d75d9e7dca7a68a03efc3edc01af3a7dadf48e5

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\winxp\wudfext.dll · signed by Microsoft Windows Kits Publisher

4c6420fb74de48f314dff0311af5bcfefc9d3375d79d82091376f994382b59d5

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winxp\wudfext.dll · signed by Microsoft Corporation

a5ade71f1bec0d09f6a7b9ba2035e8b117194c218bdb3219f18030301f348c3a

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\winxp\wudfext.dll · signed by Microsoft Windows Kits Publisher

f5d8c80313309b048f4bb27afc790c3240c38586ce62339977045ca6c7aeab7b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.