WerFaultSecure.exe

File Path: C:\Windows\system32\WerFaultSecure.exe
Description: Windows Fault Reporting

Hashes

Type	Hash
MD5	`31AB2E1751E5E446961BF169962EE1C4`
SHA1	`DCD724261283C0F830260258B9CA21C772743169`
SHA256	`1C35464F9A39DA371549D8B44EF7838F6B8E17AC1D0AAFD8A5593EB7CA960CBB`
SHA384	`3A02A4D7BE8435103DCE2B65860182DFB13402C9FA9FC1916BAEF5210D320D62B742B38439D415BAAE5E205805C6FF16`
SHA512	`C58377203EE48D5D9195A6510C431F6053FF4AA5D46EF83A861E5C6AABD042AE150FD6CEC18478E03FD1838FE0F70EAC45395E1B5FF1BF23D67735D20611EE89`
SSDEEP	`3072:GUZH/OJkaZUkkKqjS8Q7am6FJ+yC3pwRb6JPqB604HHy7hRCd39vo4bcoy:GE/OJfUkkKYkbBVJyB60OHyLC7vT1y`
IMP	`238B416AE1929D60DF85CAC4307083D4`
PESHA1	`6AA5F47C285B484421676C2DE09EECDD0A1C8A9F`
PE256	`109CF1F008CE66AB7C70C9286686098C1424ADE753AE6A0DA6496BCF420B38B1`

Signature

Status: Signature verified.
Serial: 33000002EC6579AD1E670890130000000002EC
Thumbprint: F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: WerFaultSecure.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.19041.1 (WinBuild.160101.0800)
Product Version: 10.0.19041.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/73
VirusTotal Link: https://www.virustotal.com/gui/file/1c35464f9a39da371549d8b44ef7838f6b8e17ac1d0aafd8a5593eb7ca960cbb/detection

File Similarity (ssdeep match)

File	Score
C:\Windows\system32\Faultrep.dll	43
C:\windows\system32\WerFault.exe	38
C:\Windows\system32\WerFault.exe	33
C:\Windows\system32\WerFault.exe	33
C:\Windows\system32\WerFault.exe	46
C:\Windows\system32\WerFaultSecure.exe	61
C:\WINDOWS\system32\WerFaultSecure.exe	57
C:\Windows\system32\WerFaultSecure.exe	63
C:\Windows\system32\WerFaultSecure.exe	60
C:\Windows\system32\WerFaultSecure.exe	65
C:\Windows\system32\WerFaultSecure.exe	65
C:\Windows\system32\WerFaultSecure.exe	71
C:\WINDOWS\system32\WerFaultSecure.exe	58
C:\Windows\system32\WerFaultSecure.exe	83
C:\Windows\system32\wermgr.exe	50
C:\Windows\system32\wermgr.exe	49
C:\Windows\system32\wermgr.exe	66
C:\WINDOWS\system32\wermgr.exe	46
C:\WINDOWS\system32\wermgr.exe	47
C:\Windows\system32\wermgr.exe	40
C:\Windows\system32\wermgr.exe	54
C:\Windows\system32\wermgr.exe	52
C:\Windows\system32\wermgr.exe	54
C:\Windows\system32\wermgr.exe	55
C:\Windows\system32\wermgr.exe	54
C:\windows\system32\wermgr.exe	61
C:\Windows\system32\werui.dll	50
C:\Windows\SysWOW64\WerFault.exe	44
C:\windows\SysWOW64\WerFault.exe	29
C:\Windows\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\WerFaultSecure.exe	55
C:\Windows\SysWOW64\WerFaultSecure.exe	61
C:\Windows\SysWOW64\WerFaultSecure.exe	57
C:\WINDOWS\SysWOW64\WerFaultSecure.exe	61
C:\WINDOWS\SysWOW64\WerFaultSecure.exe	58
C:\Windows\SysWOW64\WerFaultSecure.exe	61
C:\Windows\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\wermgr.exe	60
C:\windows\SysWOW64\wermgr.exe	60
C:\Windows\SysWOW64\wermgr.exe	38
C:\Windows\SysWOW64\wermgr.exe	36
C:\Windows\SysWOW64\wermgr.exe	33
C:\WINDOWS\SysWOW64\wermgr.exe	40
C:\Windows\SysWOW64\wermgr.exe	40
C:\Windows\SysWOW64\wermgr.exe	44
C:\WINDOWS\SysWOW64\wermgr.exe	54
C:\Windows\SysWOW64\wermgr.exe	41
C:\Windows\SysWOW64\wermgr.exe	44
C:\Windows\SysWOW64\wermgr.exe	41
C:\Windows\SysWOW64\werui.dll	47