CmdID / Files

mspatchc.dll

Microsoft Patch Creation Engine file version info

Library on Windows 2 known copies with hashes

Is it the real mspatchc.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Patch Creation Engine

2 known copies

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mspatchc.dll · signed by Microsoft Windows

ca94401d7739df4a4e7e8759aa66cb640334ba248b4f8655805410a575dcbcb3

5.00 (WinBuild.160101.0800) · C:\Windows\system32\mspatchc.dll · signed by Microsoft Windows

f6e55c768589f6b84ab2193f9da5b76ec11b691b702363f033f51ac13e2dc5c3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.