Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	3.70%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.10%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.15%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.05%
6.2.9200.16384 (win8_rtm.120725-1247)	2.00%
6.2.9200.16384 (win8_rtm.120725-1247)	6.68%
6.2.9200.16384 (win8_rtm.120725-1247)	0.10%
6.2.9200.16384 (win8_rtm.120725-1247)	3.17%
6.2.9200.16384 (win8_rtm.120725-1247)	0.39%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.10%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.10%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.05%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.10%
6.1.7600.16385 (win7_rtm.090713-1255)	1.95%
6.1.7600.16385 (win7_rtm.090713-1255)	2.83%
6.1.7600.16385 (win7_rtm.090713-1255)	0.10%
6.1.7600.16385 (win7_rtm.090713-1255)	0.68%
6.1.7600.16385 (win7_rtm.090713-1255)	3.51%
6.1.7600.16385 (win7_rtm.090713-1255)	0.15%
6.1.7600.16385 (win7_rtm.090713-1255)	0.19%
6.1.7600.16385 (win7_rtm.090713-1255)	1.80%
6.1.7600.16385 (win7_rtm.090713-1255)	2.39%
6.1.7600.16385 (win7_rtm.090713-1255)	9.75%
6.1.7600.16385 (win7_rtm.090713-1255)	1.07%
6.1.7600.16385 (win7_rtm.090713-1255)	1.90%
View more
6.1.7600.16385 (win7_rtm.090713-1255)	3.22%
6.1.7600.16385 (win7_rtm.090713-1255)	0.10%
6.1.7600.16385 (win7_rtm.090713-1255)	0.05%
6.1.7600.16385 (win7_rtm.090713-1255)	0.05%
6.1.7600.16385 (win7_rtm.090713-1255)	9.16%
6.1.7600.16385 (win7_rtm.090713-1255)	3.07%
6.1.7600.16385 (win7_rtm.090713-1255)	15.79%
6.1.7600.16385 (win7_rtm.090713-1255)	0.10%
6.0.6000.16386 (vista_rtm.061101-2205)	0.19%
6.0.6000.16386 (vista_rtm.061101-2205)	0.39%
6.0.6000.16386 (vista_rtm.061101-2205)	4.09%
6.0.6000.16386 (vista_rtm.061101-2205)	0.44%
6.0.6000.16386 (vista_rtm.061101-2205)	0.10%
6.0.6000.16386 (vista_rtm.061101-2205)	0.34%
6.0.6000.16386 (vista_rtm.061101-2205)	0.73%
6.0.6000.16386 (vista_rtm.061101-2205)	0.78%
6.0.6000.16386 (vista_rtm.061101-2205)	0.10%
6.0.6000.16386 (vista_rtm.061101-2205)	0.54%
6.0.6000.16386 (vista_rtm.061101-2205)	0.15%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.10%
5.1.2600.5988 (xpsp_sp3_qfe.100525-1915)	0.05%
5.1.2600.5512 (xpsp.080413-2113)	10.82%
5.1.2600.5512 (xpsp.080413-2113)	0.88%
5.1.2600.5512 (xpsp.080413-2113)	0.58%
5.1.2600.5512 (xpsp.080413-2113)	0.10%
5.1.2600.5512 (xpsp.080413-2113)	0.58%
22 other versions

PE file structure

Show functions

Import table

advapi32.dll

OpenServiceW, GetKernelObjectSecurity, AdjustTokenPrivileges, OpenProcessToken, IsValidSecurityDescriptor, GetSecurityDescriptorOwner, GetSecurityDescriptorGroup, GetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetSecurityDescriptorSacl, SetNamedSecurityInfoW, DuplicateTokenEx, MD5Init, MD5Update, MD5Final, SystemFunction036, RegOpenKeyExA, RegQueryValueExA, GetTokenInformation, RegEnumValueW, QueryServiceStatusEx, QueryServiceConfigW, OpenSCManagerW, EnumServicesStatusW, CloseServiceHandle, ConvertStringSidToSidW, GetNamedSecurityInfoW, GetAce, EqualSid, RegOpenKeyExW, RegQueryValueExW, RegQueryInfoKeyW, RegEnumKeyW, RegDeleteKeyW, RegCloseKey, RegCreateKeyExW, RegCreateKeyW, SetThreadToken, RegisterServiceCtrlHandlerExW, SetServiceStatus, OpenThreadToken, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, RegisterEventSourceW, ReportEventW, DeregisterEventSource

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI, DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-1.dll

SetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLastError

api-ms-win-core-file-l1-2-0.dll

ReadFile, SetEndOfFile, DeleteFileW, CreateFileW, FindFirstFileW, SetFileAttributesW, FindNextFileW, FindClose, SetFilePointer, GetFileSize, FindNextChangeNotification, FindFirstChangeNotificationW, FindCloseChangeNotification, GetFileAttributesW, WriteFile, CompareFileTime, CreateDirectoryW

api-ms-win-core-handle-l1-1-0.dll

DuplicateHandle, CloseHandle

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalSize, LocalReAlloc, LocalFree, LocalAlloc

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedDecrement, InterlockedIncrement, InterlockedExchange, InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-1.dll

FreeLibraryAndExitThread, FreeLibrary, DisableThreadLibraryCalls, GetModuleHandleExW

api-ms-win-core-memory-l1-1-1.dll

VirtualQuery, VirtualAlloc, VirtualProtect

api-ms-win-core-processenvironment-l1-2-0.dll

ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1.dll

OpenThreadToken, SetThreadStackGuarantee, GetCurrentThread, SetThreadToken, OpenProcessToken, GetCurrentThreadId, GetCurrentProcessId, ExitThread, TerminateProcess, GetCurrentProcess, CreateThread, OpenProcess

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegQueryValueExW, RegQueryValueExA, RegCloseKey, RegOpenKeyExW, RegOpenKeyExA

api-ms-win-core-synch-l1-2-0.dll

AcquireSRWLockExclusive, ReleaseSRWLockShared, InitializeSRWLock, AcquireSRWLockShared, ReleaseSRWLockExclusive, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, Sleep, SetEvent, CreateEventA, WaitForSingleObjectEx, CreateEventW

api-ms-win-core-sysinfo-l1-2-0.dll

GetTickCount, GetSystemInfo, GetSystemTimeAsFileTime

api-ms-win-core-threadpool-legacy-l1-1-0.dll

UnregisterWaitEx

api-ms-win-core-threadpool-private-l1-1-0.dll

RegisterWaitForSingleObjectEx

api-ms-win-security-base-l1-2-0.dll

SetFileSecurityW, IsValidSid, FreeSid, CopySid, GetSidSubAuthorityCount, GetSidIdentifierAuthority, GetSidSubAuthority, GetFileSecurityW, EqualSid, GetLengthSid, GetTokenInformation, RevertToSelf, GetSecurityDescriptorSacl, ImpersonateSelf, GetAce, AllocateAndInitializeSid

crypt32.dll

CryptMemAlloc, I_CertSrvProtectFunction, CryptStringToBinaryW, CryptDecodeObjectEx, CryptQueryObject, CertEnumCRLsInStore, CertFreeCRLContext, CertCloseStore, I_CryptFindLruEntry, I_CryptGetLruEntryData, I_CryptEnumMatchingLruEntries, CryptMemFree, I_CryptRemoveLruEntry, I_CryptCreateLruEntry, I_CryptInsertLruEntry, I_CryptReleaseLruEntry, I_CryptFreeLruCache, I_CryptCreateLruCache, CryptHashCertificate, CertCreateContext, CertFreeCTLContext, CryptDecodeObject, RegOpenHKCUKeyExU, CryptInitOIDFunctionSet, CryptGetDefaultOIDDllList, CryptGetDefaultOIDFunctionAddress, CryptFreeOIDFunctionAddress

cryptnet.dll

I_CryptNetSetUrlCachePreFetchInfo, I_CryptNetSetUrlCacheFlushInfo, CryptRetrieveObjectByUrlW

kernel32.dll

WaitForMultipleObjectsEx, lstrlenW, CompareStringW, LCMapStringW, SetUnhandledExceptionFilter, ReleaseMutex, TerminateProcess, GetCurrentProcessId, GetCurrentThreadId, HeapFree, GetThreadLocale, RaiseException, FileTimeToSystemTime, FileTimeToLocalFileTime, GetSystemWindowsDirectoryW, GetModuleHandleW, GetFullPathNameW, FlushFileBuffers, GetVersionExW, UnhandledExceptionFilter, GetFileAttributesExW, DisableThreadLibraryCalls, CloseHandle, GetCurrentThread, SetEvent, LocalAlloc, LocalFree, LocalSize, LocalReAlloc, GetLastError, UnregisterWaitEx, RegisterWaitForSingleObject, CreateEventW, FreeLibrary, GetProcAddress, LoadLibraryW, SetLastError, WideCharToMultiByte, GetACP, CreateFileW, MoveFileW, DeleteFileW, GetTempFileNameW, LeaveCriticalSection, EnterCriticalSection, GetSystemDirectoryA, GetSystemDirectoryW, FindClose, FindNextFileW, FindFirstFileW, GetFileAttributesW, QueryPerformanceCounter, QueryPerformanceFrequency, LoadLibraryExW, GetModuleFileNameW, WaitForSingleObject, SetThreadPriority, FormatMessageW, SetFileAttributesW, CreateDirectoryW, DeleteFileA, UnmapViewOfFile, CompareFileTime, InterlockedExchange, HeapReAlloc, CopyFileW, GetFileSize, ExitThread, FreeLibraryAndExitThread, ResumeThread, CreateThread, GetTickCount, InitializeCriticalSection, DeleteCriticalSection, GetWindowsDirectoryW, ExpandEnvironmentStringsW, Sleep, DelayLoadFailureHook, InterlockedCompareExchange, LoadLibraryExA, WriteFile, SetEndOfFile, SetFilePointer, OutputDebugStringA, GetDateFormatA, GetTimeFormatA, GetLocalTime, ReadFile, GetModuleHandleExW, InterlockedIncrement, InterlockedDecrement, FindNextChangeNotification, GetSystemTimeAsFileTime, FindCloseChangeNotification, FindFirstChangeNotificationW, WaitForSingleObjectEx, CreateEventA, DuplicateHandle, GetCurrentProcess, OpenProcess, CreateMutexW, MapViewOfFile, CreateFileMappingW, HeapAlloc, GetProcessHeap, CreateFileMappingA, WaitForMultipleObjects, LoadLibraryA

msvcrt.dll

DllMain

ntdll.dll

ShipAssert, EtwEventRegister, EvtIntReportEventAndSourceAsync, EtwEventUnregister, RtlNtStatusToDosError, RtlAllocateHeap, RtlFreeHeap, RtlReAllocateHeap, RtlRaiseStatus, DbgUserBreakPoint, RtlImageNtHeader

ole32.dll

CoInitialize, CoInitializeEx, CoCreateInstance, CoUninitialize

rpcrt4.dll

NdrServerCall2, I_RpcBindingInqLocalClientPID, RpcRevertToSelf, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcServerUnregisterIf, RpcImpersonateClient, RpcRevertToSelfEx, I_RpcBindingIsClientLocal, RpcServerRegisterIf3

user32.dll

CharNextW, CharPrevW, CharLowerW

vssapi.dll

CreateWriterEx

Export table

CryptServiceMain

SvchostPushServiceGlobals

cryptsvc.dll

Cryptographic Services by Microsoft

Remove cryptsvc.dll

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	18918613e63f387cde4d95ca7d49dcf7
SHA1:	b1e1780f818be2a2d0629980cd40c4641a71df0e
SHA256:	ae2e35b183e4d517b6ce4e83b850b892e852a2e96d2488254675ec416ea57f75

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is cryptsvc.dll?

The Cryptographic Application Programming Interface (also known variously as CryptoAPI, Microsoft Cryptography API, MS-CAPI or simply CAPI) is an application programming interface included with Microsoft Windows operating systems that provides services to enable developers to secure Windows-based applications using cryptography.

About cryptsvc.dll (from Microsoft)

“Cryptography is the use of codes to convert data so that only a specific recipient will be able to read it, using a key. Microsoft cryptographic technologies include CryptoAPI, Cryptographic Service”

Details

File name:	cryptsvc.dll
Publisher:	Microsoft Corporation
Product name:	Cryptographic Services
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\cryptsvc.dll
Original name:	cryptsvc.dll.mui
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	163 KB (166,912 bytes)
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Hosted services

Runs as a shared service under the Windows svcHost

Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'
Shared name is 'CryptSvc'

Distribution by Windows OS

OS version	distribution
Windows 7 Ultimate	37.50%
Windows 7 Ultimate N	28.00%
Windows 8 Pro	10.50%
Windows 7 Home Premium	8.00%
Windows 7 Professional	4.50%
Windows Vista Home Premium	2.50%
Windows 8 Pro with Media Center	1.50%
Windows 8	1.50%
Windows 7 Home Basic	1.00%
Windows Vista Ultimate	1.00%
Windows 8 Enterprise	1.00%
Windows Vista Business	0.50%
Windows 8 Pro N	0.50%
Windows 8 Enterprise Evaluation	0.50%
Windows 7 Starter	0.50%
Windows Vista™ Home Premium	0.50%
Microsoft Windows 7 Professional	0.50%

Distribution by country

United States installs about 41.48% of Cryptographic Services.

Distribution by PC manufacturer

PC Manufacturer	distribution
Acer	17.82%
Dell	17.82%
Hewlett-Packard	16.83%
ASUS	11.88%
Toshiba	9.90%
Lenovo	5.94%
Sony	3.96%
MSI	3.96%
GIGABYTE	2.97%
American Megatrends	1.98%
Intel	1.98%
Gateway	1.98%
Samsung	0.99%
Sahara	0.99%
Packard Bell	0.99%

Remove Adware and Spyware Programs, FREE Download!