efscore.dll

• File Path: C:\Windows\system32\efscore.dll
• Description: EFS Core Library

Hashes

Type	Hash
MD5	57CA05C6396EE2A08019FEC1243F68BB
SHA1	56E273B4E0E948ED6AA6F68A029F335C93EC1D09
SHA256	6EEE058FB679E49D0BB344AD984B4FF12AD80A5296EB8E26CC6639C0FBFB2D57
SHA384	A28C8CA98C0A61822364B23CF2B73EB6BC53DD93BCE1449DF1307F4F50E25980242C670A447FD7E78310717609219F0A
SHA512	A79C83196B85D3936B119DE9F3DE87E5768FCF6D439D65C68916C82A8A4A1DE67F7B36EC008134FFFFDF8A714D5CEDA8AF4D3B8074D7B8F503B474DEFEB557AC
SSDEEP	24576:N7FgOWmk3efHBm4cWgxYTM0bLKnetFcjVcQmq3wAgYXeS:Nhdm4cOXtG53qAgYXeS
IMP	E2052D27238A836F255A7DFDDBAC56D9
PESHA1	13DA1E015AE2552555435049A6091A8EFEF46214
PE256	BE66FC94B413B0FE89DE2C32CD060058FC365370E7E03704C18756F71858A4DE

DLL Exports:

Function Name	Ordinal	Type
EfsDllMarkFileForDelete	49	Exported Function
EfsDllOefsAcquireExclusiveOperation	50	Exported Function
EfsDllIsNonEfsSKU	47	Exported Function
EfsDllLoadUserProfile	48	Exported Function
EfsDllOefsCheckSupportByFilePath	51	Exported Function
EfsDllOnSessionUserChange	54	Exported Function
EfsDllOpenFileRaw	55	Exported Function
EfsDllOefsReleaseExclusiveOperation	52	Exported Function
EfsDllOnSessionChange	53	Exported Function
EfsDllFreeHeap	40	Exported Function
EfsDllFreeUserInfo	41	Exported Function
EfsDllErrorToNtStatus	38	Exported Function
EfsDllFileKeyInfoSrv	39	Exported Function
EfsDllGetLocalFileName	42	Exported Function
EfsDllGetVolumeRoot	45	Exported Function
EfsDllIsConsumerProtectionEnforced	46	Exported Function
EfsDllGetLogFile	43	Exported Function
EfsDllGetUserInfo	44	Exported Function
EfsDllValidateEfsStream	67	Exported Function
EfsDllWriteEncryptedFileWithHeader	68	Exported Function
EfsDllUnloadUserProfile	65	Exported Function
EfsDllUsePinForEncryptedFilesSrv	66	Exported Function
EfsDllWriteFileRaw	69	Exported Function
EfsUnInitialize	72	Exported Function
EfsValidateEfsStream	73	Exported Function
EfsInitialize	70	Exported Function
EfsProcessRecoveryPolicy	71	Exported Function
EfsDllQueryUsersOnFileSrv	58	Exported Function
EfsDllReadFileRaw	59	Exported Function
EfsDllQueryProtectorsSrv	56	Exported Function
EfsDllQueryRecoveryAgentsSrv	57	Exported Function
EfsDllRemoveUsersFromFileSrv	60	Exported Function
EfsDllShareDecline	63	Exported Function
EfsDllSsoFlushUserCache	64	Exported Function
EfsDllReprotectFile	61	Exported Function
EfsDllSetFileEncryptionKeySrv	62	Exported Function
EfsDllEncryptFileSrv	37	Exported Function
EdpDllGetCredServiceState	13	Exported Function
EdpDllGetLockSessionUnwrappedKey	14	Exported Function
EdpDllDplUserUnlockComplete	11	Exported Function
EdpDllDplUserUnlockStart	12	Exported Function
EdpDllGetLockSessionWrappedKey	15	Exported Function
EdpDllQueryDplEnforcedPolicyOwnerIds	18	Exported Function
EdpDllQueryRevokedPolicyOwnerIds	19	Exported Function
EdpDllGetTfaCache	16	Exported Function
EdpDllPurgeAppLearningEvents	17	Exported Function
EdpDllCredentialDelete	5	Exported Function
EdpDllCredentialExists	6	Exported Function
EdpDllAllowFileAccessForProcess	2	Exported Function
EdpDllCredentialCreate	4	Exported Function
EdpDllCredentialQuery	7	Exported Function
EdpDllDplUpgradeVerifyUser	9	Exported Function
EdpDllDplUserCredentialsSet	10	Exported Function
EdpDllCredSvcControl	3	Exported Function
EdpDllDplUpgradePinInfo	8	Exported Function
EfsDllCloseFileRaw	31	Exported Function
EfsDllConstructEFS	32	Exported Function
EfsDllAllocateHeap	29	Exported Function
EfsDllCheckFileAccess	30	Exported Function
EfsDllDecryptFek	33	Exported Function
EfsDllDplAppKeyCachingFeatureEnabled	1	Exported Function
EfsDllDuplicateEncryptionInfoFileSrv	36	Exported Function
EfsDllDecryptFileSrv	34	Exported Function
EfsDllDisabled	35	Exported Function
EdpDllRmsContainerizeFile	22	Exported Function
EdpDllRmsDecontainerizeFile	23	Exported Function
EdpDllQueueFileForEncryption	20	Exported Function
EdpDllRmsClearKeys	21	Exported Function
EdpDllRmsGetContainerIdentity	24	Exported Function
EdpWriteSiteLearningLog	27	Exported Function
EfsDllAddUsersToFileSrv	28	Exported Function
EdpDllServiceFileEncryptionQueue	25	Exported Function
EdpWriteAppLearningLog	26	Exported Function

Signature

• Status: Signature verified.
• Serial: 3300000266BD1580EFA75CD6D3000000000266
• Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
• Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: EFSCORE.DLL.MUI
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 10.0.19041.1 (WinBuild.160101.0800)
• Product Version: 10.0.19041.1
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.
• Machine Type: 64-bit

File Scan

• VirusTotal Detections: 0/72
• VirusTotal Link: https://www.virustotal.com/gui/file/6eee058fb679e49d0bb344ad984b4ff12ad80a5296eb8e26cc6639c0fbfb2d57/detection/

MIT License. Copyright (c) 2020-2021 Strontic.