mergemod.dll

MSM Merge Tool COM Server file version info

Library on Windows 4 known copies with hashes

Is it the real mergemod.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductWindows Installer - Unicode, Microsoft Corporation

DescriptionMSM Merge Tool COM Server

4 known copies

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\mergemod.dll · signed by Microsoft Corporation

76a2bd10e8a512c3fe1125c17ff9802af5e07fe5244c7a60bc5440607f462f99

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\mergemod.dll · signed by Microsoft Corporation

91965eec07885fae9e707e6ede6b2c204bcd808fadcad5ca2a80fffd0de67d15

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\mergemod.dll · signed by Microsoft Windows Kits Publisher

b2ce0034efb923930a2cf71ea3f4a1493765e93fcf75776f8555b3d9b07a8bb5

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\mergemod.dll · signed by Microsoft Windows Kits Publisher

f6ab3d5300f7e1acac42c8d12a9ba2c0f71aa305392543cc841a4bbe593f0b11

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.