VSSUIRUN.exe

  • File Path: C:\Windows\SysWOW64\VSSUIRUN.exe
  • Description: Configure Shadow Copies

Screenshot

VSSUIRUN.exe

Hashes

Type Hash
MD5 743C6EAF570F5E54A822D6839C91F308
SHA1 D35264F0AEA682835EEED84AEE0BCF2A724A09F4
SHA256 02E2F77451D995D053E0FD296A1CDEA7C3E3D24933C961987AE672A865A01D60
SHA384 F0ADBB4D8BAB2E4F10EAEBF1247D281A936D1565DE311127991840C28179D007861C255F5B979D4A2F929BD2F3CF220A
SHA512 86E19F3CA29871752DCEAD3A6E9A29F6FA9CEFF9C56110EAD0CC4AE6A9296C0E39D49E5945556AF59227D2787DEE8DA39C1D63C79D97231AE10D7BD33960EECA
SSDEEP 768:fo+ZPJz71JCgUvVOA8zHkqkQWeod/uUOu3jPewyszbkN4dppainbNnnnnnnnnnnZ:xn/Y8zHrYnb3C9sfk64inbsM
IMP 4A312608387D9665CC84921A5E9413F7
PESHA1 4E9B2800C7B393D0D59F4E4B3FD786DFD6F9C657
PE256 E64277BB1D4F7EC4B34D549BBA315F4F4959FF0D6292B7C2615164897308CA81

Runtime Data

Window Title:

Shadow Copies

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\KernelBase.dll.mui File
(R-D) C:\Windows\System32\en-US\MFC42u.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\VSSUI.dll.mui File
(R-D) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_3c26ab8c9470805a\comctl32.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_3c26ab8c9470805a File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_261b62a767ca4e6d File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\RPC Control\DSEC13F8 Section
\Sessions\2\Windows\Theme2131664586 Section
\Windows\Theme966197582 Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\VSSUIRUN.exe

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: VSSUIRUN.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/02e2f77451d995d053e0fd296a1cdea7c3e3d24933c961987ae672a865a01d60/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\VSSUIRUN.exe 40
C:\Windows\system32\VSSUIRUN.exe 41
C:\windows\system32\VSSUIRUN.exe 35
C:\Windows\SysWOW64\VSSUIRUN.exe 50
C:\windows\SysWOW64\VSSUIRUN.exe 49

MIT License. Copyright (c) 2020-2021 Strontic.