efswrt.dll

  • File Path: C:\Windows\system32\efswrt.dll
  • Description: Storage Protection Windows Runtime DLL

Hashes

Type Hash
MD5 E46F4D5DD777795A76DEAC9B310344BD
SHA1 66CB607C0E559C6AA6252667C82CEFC153C0679C
SHA256 D405C7803A86C75E5D878458C2CCA781AAC426F3DE7FE05D1E968222F9AB0631
SHA384 193019DB4ACD5A714BD9D97B983EA92E01D45AFE244EB3E713E6CC3E5D57E03D2E43E0E78D2417C153CD6EEE994FE5BE
SHA512 651E382E384A8EBE0D4AC8D92B3CA6191623A5E476856EA27D65036D2238741469911A4E7293053FBC3552593AA429F80D33DDA073ED2C9AF3971EF7B7F51178
SSDEEP 12288:8F6baO2KYs594qlfd2TC53hBTwcksGptDQuEGJa+sEgLMX1d:IQaOYs594WNx7LPGptUFXLMX
IMP 00E2795A249257463C9BBE96064306A3
PESHA1 598DA2C5CEA7AA011A911B1E2D33125FC97C3FCD
PE256 A4E3DBFC4F06FBF7953E2FC538781B5837421E477DFACBFEA03545CDE44340A2

DLL Exports:

Function Name Ordinal Type
EnterpriseDataGetStatus 21 Exported Function
EnterpriseDataProtect 22 Exported Function
EnterpriseDataRevoke 23 Exported Function
EnterpriseDataCopyProtection 20 Exported Function
DpmStreamOpenToUnprotect 17 Exported Function
DpmStreamUpdate 18 Exported Function
DpmUnprotectSecret 19 Exported Function
FreeIdentityProtectorList 24 Exported Function
ProtectOrReprotectFileToIdentity 29 Exported Function
QueryIdentityProtectors 30 Exported Function
UnprotectFile 31 Exported Function
ProtectFileToIdentity 28 Exported Function
GetEnterpriseActionForCopy 25 Exported Function
GetEnterpriseIdForNetworkPath 26 Exported Function
ProtectFileToEnterpriseIdentity 27 Exported Function
DpmStreamOpenToProtectToIdentity 16 Exported Function
CdplProtectFileToLevel 5 Exported Function
CdplProtectFileToLevelWithResult 6 Exported Function
CdplProtectKnownUserFolders 7 Exported Function
CdplIsSupported 4 Exported Function
CdplGetFileProtectionLevel 1 Exported Function
CdplIsAppAllowedToRun 2 Exported Function
CdplIsAppDataProtectionSupported 3 Exported Function
CdplProtectSecretToLevel 8 Exported Function
DpmBufferFree 13 Exported Function
DpmProtectSecretToIdentity 14 Exported Function
DpmStreamClose 15 Exported Function
DllGetClassObject 12 Exported Function
CdplUnprotectSecret 9 Exported Function
DllCanUnloadNow 10 Exported Function
DllGetActivationFactory 11 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: efswrt.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.488 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.488
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/67
  • VirusTotal Link: https://www.virustotal.com/gui/file/d405c7803a86c75e5d878458c2cca781aac426f3de7fe05d1e968222f9ab0631/detection/

MIT License. Copyright (c) 2020-2021 Strontic.