CmdID / Files

spbcd.dll

BCD Sysprep Plugin file version info

Library on Windows 2 known copies with hashes

Is it the real spbcd.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionBCD Sysprep Plugin

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\spbcd.dll · signed by Microsoft Windows

67c0803b2bc4e5bb817c5e46bc8c0e80e6b20d6cf55430cc461f9e7b5b275ae3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\spbcd.dll · signed by Microsoft Windows

ca0ab273cf8a97180cd4985e2c4b54563a09d4045fa1921a89e8836bf4b01cd3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.