CmdID / Files

rometadata.dll

Microsoft MetaData Library file version info

Library on Windows 2 known copies with hashes

Is it the real rometadata.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft MetaData Library

2 known copies

4.8.3673.0 built by: NET48REL1 · C:\Windows\system32\rometadata.dll · signed by Microsoft Windows

0455a236233fd1c285fde9a6b1e5e1c9c3d81981948a3d4c006fa6c8e89728fb

4.8.3673.0 built by: NET48REL1 · C:\Windows\SysWOW64\rometadata.dll · signed by Microsoft Windows

2b35b287fd0658f568bca4a0392d2d99efeee1ab90d748e790cd793c2565e3fc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.