CmdID

CmdID / Files

mssign32.dll

Microsoft Trust Signing APIs file version info

Library on Windows 7 known copies with hashes

Is it the real mssign32.dll?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\App Certification Kit\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
Signed byMicrosoft Corporation
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Trust Signing APIs

7 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm64\mssign32.dll · signed by Microsoft Windows Kits Publisher

259fd7a0ef4afaa9b2dfb6efd7fc833c4d1bebdebe4efd45a8f3db1bc46ff4f5

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\mssign32.dll · signed by Microsoft Corporation

2774b7853fd10bd2cc60baf7c5e5496e42a76bfc1321f6f09473ce012262310f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mssign32.dll · signed by Microsoft Windows

3689d9c9bd5cd8c68a4fcfda3544df478e86e13bc5666d511d00bc4da424f607

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\mssign32.dll · signed by Microsoft Windows Kits Publisher

3865e0d38d438434047e3e017b65062643a2668f78b91dfd1e30c89ca66d4369

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\App Certification Kit\mssign32.dll · signed by Microsoft Corporation

4f95503ad1fcf00ef78b89bbefc699b2a55e85628c3e628cc78b4b13902c276b

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\mssign32.dll · signed by Microsoft Corporation

c542e209e4d126d84b98a9efbb4bf1df7a2a9d7b2efde6a47dade55cad2c8f39

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mssign32.dll · signed by Microsoft Windows

d8632345802607314f5c4d1fd05c82181321b2a0ba7f355735f61be639ae6a64

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.