home

lsass.exe

Local Security Authority Process

Microsoft Corporation

It runs as a windows Service named “Encrypting File System (EFS)”.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Microsoft® Windows® Operating System

Description:
Local Security Authority Process

 
Part of the Windows Operating System

Version:
10.0.10586.0 (th2_release.151029-1700)

MD5:
889459f1fddc5ec58b437aa6c436f33f

SHA-1:
c6c9e1e362ee3e93d41b4eac492797d52e43c739

SHA-256:
8acc32c88d81943a8a90fdaf4772c3ede06cab5f489f59525bea7aab99daae73

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
8/9/2026 8:35:40 AM UTC  (today)

File size:
56.6 KB (57,912 bytes)

Product version:
10.0.10586.0

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
lsass.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\lsass.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/8/2015 1:28:14 PM

Valid to:
7/8/2016 1:28:14 PM

Subject:
CN=Microsoft Windows Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
3300000080E0B6EB3DEB7C8CCB000000000080

File PE Metadata
Compilation timestamp:
10/29/2015 7:36:54 PM

OS version:
10.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
12.10

CTPH (ssdeep):
1536:6EmgmSbQneA1FpEoqO1XrQNHTfN0kkjPlSAs3:6BSbdV+9jjs3

Entry address:
0x4560

Entry point:
48, 83, EC, 28, E8, 63, 00, 00, 00, 48, 83, C4, 28, E9, 62, FF, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 66, 66, 0F, 1F, 84, 00, 00, 00, 00, 00, 48, 3B, 0D, 69, 7A, 00, 00, 75, 10, 48, C1, C1, 10, 66, F7, C1, FF, FF, 75, 01, C3, 48, C1, C9, 10, E9, 32, 01, 00, 00, CC, CC, CC, CC, CC, CC, FF, 25, CE, 1A, 00, 00, CC, CC, CC, CC, CC, CC, FF, 25, BA, 1A, 00, 00, CC, CC, CC, CC, CC, CC, 48, 89, 5C, 24, 20, 55, 48, 8B, EC, 48, 83, EC, 20, 48, 83, 65, 18, 00, 48, BB...
 
[+]

Entropy:
5.8602

Code size:
19 KB (19,456 bytes)

Service
Display name:
Encrypting File System (EFS)

Service name:
EFS

Description:
Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. If this service is stopped or disabled, applications will be unable to access encrypted files.

Type:
Win32ShareProcess

Depends on:
RPCSS


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.