PayloadRestrictions.dll

  • File Path: C:\Windows\SysWOW64\PayloadRestrictions.dll
  • Description: Payload Restrictions Mitigation Provider

Hashes

Type Hash
MD5 E62EFF6EC61A570DDBA9C02D2D763097
SHA1 0F37456FDC30F6541C27CDA80CE465FE8FB1DC26
SHA256 FB9F0ADADC6E8402CBED0A94B1635C8E13AA3CF45D0001BF700FA9DA2BA60A13
SHA384 8FA31D59D07D02F3B1F181C1D3A7CA98DFEFF162AFFB611182C047E4401D6E1EB8EC766E4E6B1D59B95D8DCE3CBD440C
SHA512 D9149A3ED770729FBEF164A8E3B0017FC2485D3835A5F9C31A42FA4C61570AC2C327C89C411E75A3B8B9F6C6F681C64083D2860A6E16D65111E20D661F0AE011
SSDEEP 12288:nWomHvVL/olqLjhuyN+RNSTCmelehLyZFyybDAny34dygO71EUr3HjsQG2k/8opy:fAT6leKFyLnS4dyf71EUr3Hj6lpy
IMP 90B0E60284558849C93F12BCF0085517
PESHA1 5FC9EB7181500C8A930365019D20B84367D699EE
PE256 BCF10BDAF7469E30D0D86CE78ACB52C39F09892CFDF6D63D4F7781B9CDA746DC

DLL Exports:

Function Name Ordinal Type
MitLibUninitialize 3 Exported Function
MitLibQueryMitigations 2 Exported Function
MitLibInitialize 1 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: PayloadRestrictions.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/71
  • VirusTotal Link: https://www.virustotal.com/gui/file/fb9f0adadc6e8402cbed0a94b1635c8e13aa3cf45d0001bf700fa9da2ba60a13/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\PayloadRestrictions.dll 21

MIT License. Copyright (c) 2020-2021 Strontic.