CmdID / Files

nsi.dll

NSI User-mode interface DLL file version info

Library on Windows 2 known copies with hashes

Is it the real nsi.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNSI User-mode interface DLL

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\nsi.dll · signed by Microsoft Windows

a82c3f5cd65d3fdacb5576bd55aaea87de5ccea44125eba6e6e4d92be5acd7e6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\nsi.dll · signed by Microsoft Windows

c93062ec30d82b39f9362c80e216d122543b459829588f54262df4488c4cf705

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.