CmdID / Files

RpcNs4.dll

Remote Procedure Call Name Service Client file version info

Library on Windows 2 known copies with hashes

Is it the real RpcNs4.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionRemote Procedure Call Name Service Client

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RpcNs4.dll · signed by Microsoft Windows

ada416d1e94295a64f60c9c51a6bd282e7183c93e069fc2121cdbd541ba1dcfb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\RpcNs4.dll · signed by Microsoft Windows

ee77d6d28c29407d35f7ad8771b0d60fc9e4b6bb99af966a14553691ca74a2a3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.