winhttp.dll: genuine Windows HTTP Services file, or a copy next to a program?

What winhttp.dll does, and why programs load other copies of it

winhttp.dll is Windows HTTP Services, usually called WinHTTP. Microsoft documents it as the HTTP client interface for services and server applications: a program opens a session, connects to a web server, sends a request and reads the answer, with HTTPS, authentication and proxy support handled by the library. Windows ships it in every release and updates it together with Windows.

Because winhttp.dll is not on the short list of libraries Windows always takes from System32, a program looks for it in its own folder first. A tool author builds a library with the same name and the same exported functions, puts it next to the .exe, and the program loads it at start. The copy passes the real web calls on to the Windows file, so the program works normally, and in the same moment runs the tool's own code inside it.

BepInEx, an open-source mod loader for Unity games, does this on purpose: its documentation says the Doorstop proxy it uses is usually named winhttp.dll. Attackers use the same technique, called DLL side-loading. HijackLibs, a public list of DLL hijacking cases, names 21 programs that load winhttp.dll this way: 20 Windows programs such as mstsc.exe, netsh.exe, mshta.exe and msdt.exe when they are copied out of System32, and the Minecraft Launcher, signed by Mojang AB.

So the question is never whether winhttp.dll is a virus, but which winhttp.dll you are looking at. The copies in the Windows folders are Microsoft's. A copy next to a program is whatever the person who made it put into it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to tell Windows' winhttp.dll from a copy next to a program

A DLL is not listed in Task Manager as a process, so use the folder, the neighbouring files, PowerShell or Process Explorer.

1. Where the file is. List every copy with the command below. C:\Windows\System32 and C:\Windows\SysWOW64 are Windows' copies, and copies under C:\Windows\WinSxS belong to Windows' component store. Every other path is a copy that something installed.

   Get-ChildItem C:\ -Recurse -Filter winhttp.dll -ErrorAction SilentlyContinue | Select-Object FullName, Length, @{n='Description';e={$_.VersionInfo.FileDescription}}

2. What sits next to it. A BepInEx folder and a doorstop_config.ini next to a game's .exe mean the BepInEx loader, which you or a mod manager installed. A Windows program such as mstsc.exe, netsh.exe or msdt.exe outside C:\Windows, or any signed .exe in Temp, AppData or Downloads with a winhttp.dll beside it, is the pattern of a side-load package.
3. The Description field and the size. Right-click the file, Properties, Details. The genuine file says Windows HTTP Services, with Microsoft Corporation as the company and a Windows version number such as 10.0.26100. It is about a megabyte or more in Windows 10 and Windows 11. A copy can fake these fields, so this check only rules files out.
4. The digital signature. Windows' copy is signed by Microsoft through a catalog rather than inside the file, so the Properties window may show no Digital Signatures tab. PowerShell reads both kinds. Valid with a Microsoft signer means genuine; NotSigned or another signer means a third-party file.

   Get-AuthenticodeSignature 'C:\path\to\folder\winhttp.dll' | Format-List Status, SignatureType, SignerCertificate

5. What the program loads. Start the program, then open Process Explorer from Microsoft Sysinternals, choose Find > Find Handle or DLL, type winhttp.dll and press Search. The path column shows which copy each process really loaded. A path outside the Windows folders means that copy is running inside the program.
6. Compare the hash with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with 360 known Microsoft builds. A matching copy outside the Windows folders is an unneeded Windows file; one that does not match is a third-party file.

A match to a Microsoft build proves the file is Microsoft's. A file that does not match is not automatically malicious: most game folder copies are the BepInEx proxy, doing exactly what its documentation says. What decides is whether you chose to install that mod loader, from where, and whether the folder it sits in makes sense.

Warning signs and what they mean

Programs that have been made to load a fake winhttp.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted winhttp.dll. Usually the attacker copies the program into another folder and puts a fake winhttp.dll next to it: Windows looks in the program's own folder first. A winhttp.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine winhttp.dll belongs: C:\Windows\System32C:\Windows\SysWOW64

The genuine winhttp.dll is signed by: Microsoft Windows, a Windows catalog signature (Properties shows no Digital Signatures tab; check it with Get-AuthenticodeSignature)

and 11 more programs. Source: the HijackLibs entry for winhttp.dll, 4 public reports.

Everyday problems with winhttp.dll

winhttp.dll versions by Windows release

The newest build indexed for each release, and the update that delivered it. 360 Microsoft builds in total are known.

Known versions of winhttp.dll

A public DLL catalogue lists 17 versions of winhttp.dll, from 5.1.2600.2180 to 10.0.18362.778, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix winhttp.dll errors on uGetFix

Questions people ask