SrpUxNativeSnapIn.dll
Application Control Policies Group Policy Editor Extension file version info
Library on Windows 2 known copies with hashes
Is it the real SrpUxNativeSnapIn.dll?
Original name
srpuxgp.dll in the file’s header: a renamed copy still carries itInstalled in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApplication Control Policies Group Policy Editor Extension
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SrpUxNativeSnapIn.dll · signed by Microsoft Windows
1a2917483af68dc9280d373e21e67414c24139ef55cbfc6542debc4f4e673d5010.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SrpUxNativeSnapIn.dll · signed by Microsoft Windows
5b4c3880659ac07412b68b91f7d4cf7ce8dd58c3a4ab5cab5c4591a707533dfcFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.