CmdID / Files

wshqos.dll

QoS Winsock2 Helper DLL file version info

Library on Windows 2 known copies with hashes

Is it the real wshqos.dll?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionQoS Winsock2 Helper DLL

2 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wshqos.dll · signed by Microsoft Windows

SHA-2565629ca2140054a5eac5a386e5f6c94dbfa2136b379ceef3afedb15d02bed39f8SHA-1ecbe49d4d73991618485c6c6141d7a03c0e23aaaMD5cef31f926688b0821b1bc2ba2b782de9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wshqos.dll · signed by Microsoft Windows

SHA-256a20a818e0536aa4fd1c167dc2c2d49ab6e94bee92381d408f6bbaaccefac4837SHA-10ff8c450b6865cd92db89e6c2f18515f5630d312MD5462b3c2cd0418b2c594118109fadf00e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.