• File Path: C:\Windows\SysWOW64\WINSRPC.DLL
  • Description: WINS RPC LIBRARY


Type Hash
MD5 FA11285840DACB31AE53873C62C2D793
SHA1 6299DC622A5D37D51A71C38C1BFBFFED44FC97C8
SHA256 BDF628797EB2D6EB1A960BBC7ADEA95D679857C8D4107A18C7F68C4FFA2EF130
SHA384 384BF3F05D63BD93AF7066C468AF8C0E203258E20F8CB1351C68A2728879447BAC296016E5C93DC331DA49B2E6CE6547
SHA512 EED491C4709820177748B86673CEDBC151F66D841A96B74BB900315F1D1773B3EDB159FF45467A7C71E9A145A571E631EAFDD4D83BFAEC33EAA08EDF1CBBC75F
SSDEEP 192:mZ7A/2s0mT/nz2xShbY0EVs5OkIEzbWDLWWuCqUJrE:mZ7A/0mrzfhbY0ws8kIqWDLWEqq
IMP D6639FCC1A74053F586788FEFDA5F774
PESHA1 B7C7D75C5A3F39B1B0DEED10D4D271F840829CB7
PE256 09DB870A3130C1EB22F5B73F172C1F28B08B0F4946F61F0EB23264C760C95BE4

DLL Exports:

Function Name Ordinal Type
WinsSetPriorityClass 21 Exported Function
WinsStatus 22 Exported Function
WinsStatusNew 23 Exported Function
WinsSetFlags 20 Exported Function
WinsResetCounters 17 Exported Function
WinsRestore 18 Exported Function
WinsRestoreEx 19 Exported Function
WinsStatusWHdl 24 Exported Function
WinsUBind 29 Exported Function
WinsUnbind 30 Exported Function
WinsWorkerThdUpd 31 Exported Function
WinsTrigger 28 Exported Function
WinsSyncUp 25 Exported Function
WinsTerm 26 Exported Function
WinsTombstoneDbRecs 27 Exported Function
WinsRecordAction 16 Exported Function
WinsDelDbRecs 5 Exported Function
WinsDeleteWins 6 Exported Function
WinsDoScavenging 7 Exported Function
WinsCheckAccess 4 Exported Function
WinsABind 1 Exported Function
WinsAllocMem 2 Exported Function
WinsBackup 3 Exported Function
WinsDoScavengingNew 8 Exported Function
WinsGetDbRecsByName 13 Exported Function
WinsGetNameAndAdd 14 Exported Function
WinsPullRange 15 Exported Function
WinsGetDbRecs 12 Exported Function
WinsDoStaticInit 9 Exported Function
WinsFreeMem 10 Exported Function
WinsGetBrowserNames 11 Exported Function


  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: winsrpc.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link:

Possible Misuse

The following table contains possible examples of WINSRPC.DLL being misused. While WINSRPC.DLL is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
malware-ioc nukesped_lazarus .winsrpc.dll`` © ESET 2014-2018

MIT License. Copyright (c) 2020 Strontic.