sfc.dll
- File Path:
C:\Windows\system32\sfc.dll - Description: Windows File Protection
Hashes
| Type | Hash |
|---|---|
| MD5 | A710AB1DBCED5492897FC008F4E87A84 |
| SHA1 | 46A78C533A8DE5D46439A1635A69AF17DD28FDB0 |
| SHA256 | EB997884595E1FA751C3257057689A6190287A507BC59CDE6EE8B81B779553D9 |
| SHA384 | 525E58B1F25D025D955EC320E6F527BAC6DB87DE632CE17199F891DE9D0F301D0D50C523CE8A840DA9880877C114BAF0 |
| SHA512 | 0ACBE8E3842EF94286923DC29D0635C5435FBE013CFB2B834982EAADA9C211C01CE980980799D9004E3578DE650A7149F503E0D39BD64CDEA19BC1CDF3D6B66E |
| SSDEEP | 192:BhyWjvWjJD1S8f4DBQABJJJ2D8KN3qnajV2MVorA:BhyWjvWjJD1IDBRJJJt2lxnorA |
| PESHA1 | 1D58AAD33D250DFEC8E69B1DE06612F169890F11 |
| PE256 | E7D0B3899551F2F51F2FDCB7B8E81CEF04DED4661A089D1FDB64D84B37B73F7A |
DLL Exports:
| Function Name | Ordinal | Type |
|---|---|---|
SRSetRestorePoint |
10 | Exported Function |
SfpVerifyFile |
16 | Exported Function |
SRSetRestorePointW |
12 | Exported Function |
SRSetRestorePointA |
11 | Exported Function |
SfcGetNextProtectedFile |
13 | Exported Function |
Ordinal1 |
1 | Exported Function |
SfcIsKeyProtected |
15 | Exported Function |
SfcIsFileProtected |
14 | Exported Function |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: sfc.dll
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/66
- VirusTotal Link: https://www.virustotal.com/gui/file/eb997884595e1fa751c3257057689a6190287a507bc59cde6ee8b81b779553d9/detection/
File Similarity (ssdeep match)
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
sfc
Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
Scans and verifies the integrity of all protected system files and replaces incorrect versions with correct versions. If this command discovers that a protected file has been overwritten, it retrieves the correct version of the file from the systemroot\system32\dllcache folder, and then replaces the incorrect file.
[!IMPORTANT] You must be logged on as a member of the Administrators group to run this command.
Syntax
sfc [/scannow] [/verifyonly] [/scanfile=<file>] [/verifyfile=<file>] [/offwindir=<offline windows directory> /offbootdir=<offline boot directory>]
Parameters
| Parameter | Description |
|---|---|
| /scannow | Scans the integrity of all protected system files and repairs files with problems when possible. |
| /verifyonly | Scans the integrity of all protected system files, without performing repairs. |
/scanfile <file> |
Scans the integrity of the specified file (full path and filename) and attempts to repair any problems if they’re detected. |
/verifyfile <file> |
Verifies the integrity of the specified file (full path and filename), without performing repairs. |
/offwindir <offline windows directory> |
Specifies the location of the offline windows directory, for offline repair. |
/offbootdir <offline boot directory> |
Specifies the location of the offline boot directory for offline repair. |
| /? | Displays help at the command prompt. |
Examples
To verify the kernel32.dll file, type:
sfc /verifyfile=c:\windows\system32\kernel32.dll
To set up the offline repair of the kernel32.dll file with an offline boot directory set to D:* and an offline windows directory set to *D:\windows, type:
sfc /scanfile=D:\windows\system32\kernel32.dll /offbootdir=D:\ /offwindir=d:\windows
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.