CmdID

CmdID / Files

microsoft.mbn.dll

Library on Windows 4 known copies with hashes

Is it the real microsoft.mbn.dll?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\Redist\MBN\arm64\
C:\Program Files (x86)\Windows Kits\10\Redist\MBN\arm\
C:\Program Files (x86)\Windows Kits\10\Redist\MBN\x64\
Signed byMicrosoft Windows Kits Publisher

4 known copies

10.0.0.0 · C:\Program Files (x86)\Windows Kits\10\Redist\MBN\arm64\microsoft.mbn.dll · signed by Microsoft Windows Kits Publisher

0252f976c07349e1f9ba33875271917ed9384e34518ae18eb64d600eff70d73b

10.0.0.0 · C:\Program Files (x86)\Windows Kits\10\Redist\MBN\arm\microsoft.mbn.dll · signed by Microsoft Windows Kits Publisher

14e9b7912fd1cdc809b26bbfa0cadb859285f49ea1f172b4f4ffd0e9c9083ab2

10.0.0.0 · C:\Program Files (x86)\Windows Kits\10\Redist\MBN\x64\microsoft.mbn.dll · not signed

744afc85b3aaa5186d02d5bb65b116838cd1a63b416e543265df08952d23d867

10.0.0.0 · C:\Program Files (x86)\Windows Kits\10\Redist\MBN\x86\microsoft.mbn.dll · not signed

ebc539381856bd4525a0f8e7ee05d03d2c700fbcd490c724c9b7d28ef270f12b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.