CmdID / Files

winsku.dll

Windows SKU Library file version info

Library on Windows 2 known copies with hashes

Is it the real winsku.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows SKU Library

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winsku.dll · signed by Microsoft Windows

8a8612f70751c24a5f559a0750e77854cd7173c7858f728d91a343aed1f81456

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winsku.dll · signed by Microsoft Windows

aa66d33b8aed35dab086d11181e5b10f66726187d19a20b9fe0cb8aef604cec1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.