nlmsprep.dll
Network List Manager Sysprep Module file version info
Library on Windows 2 known copies with hashes
Is it the real nlmsprep.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNetwork List Manager Sysprep Module
2 known copies
10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\nlmsprep.dll · signed by Microsoft Windows
197603b7a71f6fc59077175423bc391204f6c804a234ad1a4fed90ce79eb5c9210.0.19041.117 (WinBuild.160101.0800) · C:\Windows\SysWOW64\nlmsprep.dll · signed by Microsoft Windows
a748f8aa6937cbaf35ef29fbe15377cfa276ff9ecd6ba1dacb3f5294e21e238bFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.