msisip.dll

MSI Signature SIP Provider file version info

Library on Windows 6 known copies with hashes

Is it the real msisip.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\

Signed byMicrosoft Windows Kits Publisher

ProductWindows Installer - Unicode, Microsoft Corporation

DescriptionMSI Signature SIP Provider

6 known copies

5.0.19041.450 (WinBuild.160101.0800) · C:\Windows\system32\msisip.dll · signed by Microsoft Windows

7e376248349668ca4639dc40716b74aed1eb60077944d04c771991029e4d8979

5.0.19041.450 (WinBuild.160101.0800) · C:\Windows\SysWOW64\msisip.dll · signed by Microsoft Windows

c73cdde7e2aa02a43b725e878a9f9bcecbf39edac3a8d7abbf7c16c25709c450

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\msisip.dll · signed by Microsoft Corporation

06fbee0142e96fa9cdbff1e22201e06b2c499dfcba49f39edbfff3632a970417

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\msisip.dll · signed by Microsoft Windows Kits Publisher

d3b959079acd544662e9e39f63660391c0263b44541fb0572bc7783f4efc00cc

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\msisip.dll · signed by Microsoft Corporation

e27880d20e16f672703f02bc035ba551c9194ede35f3915f21f7b7fbf8666010

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\msisip.dll · signed by Microsoft Windows Kits Publisher

fdee461ab14e195faffcca32c005d15b3b9137882076117c9e68bbb709478b6d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.