WWAHost.exe

  • File Path: C:\Windows\system32\WWAHost.exe
  • Description: Microsoft WWA Host

Hashes

Type Hash
MD5 06C544C90C0720263D257A8DE3202E21
SHA1 C152255542244C1F51D086E77A54052D3D65C76A
SHA256 DBA38DB00810A4321E7E97DCFD50C8BB12F24BC919E6222FFE08A48C0C0D0A8A
SHA384 3DC398D4FE8ED008851904E0CAE83C812B5B4FD9340E07DB5220D34470E52EC0BB1F985F9B58CC9B960F814A062B7602
SHA512 4C829454D546CFBE3197A98835B8D6627F68B15FC6244A86E735FD5CE308192EF85215D510884B751A5EB1B97FFC956FAFCE13E2088CE3130F277EADA08C1564
SSDEEP 12288:CM1NnWpAJfOGFpRTLVvFbpi8q+MnN0SN8JklYQ2Q9ncfG3LaLpLbLvL4LHKLAL1M:ZPuGBfLvbpWZ6ylhfWLTZ

Runtime Data

Child Processes:

WWAHost.exe WerFault.exe

Open Handles:

Path Type
(RW-) C:\Users\user File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{F79646A6-8BE5-443B-A98F-AD03D667F646}.2.ver0x0000000000000001.db Section
\Sessions\1\BaseNamedObjects\SessionImmersiveColorPreference Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\apphelp.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\WWAHost.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: WWAHost.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\WWAHost.exe 40
C:\Windows\system32\WWAHost.exe 32

MIT License. Copyright (c) 2020-2021 Strontic.