WerFaultSecure.exe

File Path: C:\WINDOWS\system32\WerFaultSecure.exe
Description: Windows Fault Reporting

Hashes

Type	Hash
MD5	`C9654E9C20C631371F68BE0467B670C3`
SHA1	`47C5A99498F120C3290A8E0CF91969152D23AC2A`
SHA256	`1C3EEA1093A1D691E30003B6373C7BFACDD90EBA181C387BD2B7EFEEEE252B64`
SHA384	`77DA8DF5E676C6BED94F401A22BBAF2E3AD2376BBBB19193C17C44CE966E31985EC4F71F3432F772ED6BE27BD567CBDD`
SHA512	`CF64A324F2501434CD3639850925E5C29D26199CC376DB9B17BD44648C49231B210669E57976EDA09258CEA6EEA895602026B8623B682B0E68636BDE3BF08925`
SSDEEP	`3072:ZpB4NXbe8vKBBN9rrk4aAuwZkXcYuMaoVFJ+yC3pwRb6JPqB604HHy7hRCd39vMa:ZLk6J9rrsBwusYuzVJyB60OHyLC7vh`
IMP	`B274A714343129BE4DFA6CC9B356CA9B`
PESHA1	`5CCE140F89BBCD985E39DFE2F848791BA3C6F972`
PE256	`EF166A588C9DE3F6746A3911C3158E316C898B9F201A876CD06D9DA4ECEB2C7A`

Signature

Status: Signature verified.
Serial: 33000002ED2C45E4C145CF48440000000002ED
Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: WerFaultSecure.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.22000.1 (WinBuild.160101.0800)
Product Version: 10.0.22000.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/73
VirusTotal Link: https://www.virustotal.com/gui/file/1c3eea1093a1d691e30003b6373c7bfacdd90eba181c387bd2b7efeeee252b64/detection

File Similarity (ssdeep match)

File	Score
C:\Windows\system32\Faultrep.dll	36
C:\windows\system32\WerFault.exe	35
C:\Windows\system32\WerFault.exe	32
C:\Windows\system32\WerFault.exe	33
C:\Windows\system32\WerFault.exe	46
C:\Windows\system32\WerFaultSecure.exe	61
C:\Windows\system32\WerFaultSecure.exe	58
C:\WINDOWS\system32\WerFaultSecure.exe	61
C:\Windows\system32\WerFaultSecure.exe	57
C:\Windows\system32\WerFaultSecure.exe	60
C:\Windows\system32\WerFaultSecure.exe	60
C:\Windows\system32\WerFaultSecure.exe	63
C:\Windows\system32\WerFaultSecure.exe	60
C:\Windows\system32\WerFaultSecure.exe	60
C:\Windows\system32\wermgr.exe	44
C:\Windows\system32\wermgr.exe	49
C:\Windows\system32\wermgr.exe	58
C:\WINDOWS\system32\wermgr.exe	49
C:\WINDOWS\system32\wermgr.exe	47
C:\Windows\system32\wermgr.exe	44
C:\Windows\system32\wermgr.exe	58
C:\Windows\system32\wermgr.exe	44
C:\Windows\system32\wermgr.exe	55
C:\Windows\system32\wermgr.exe	47
C:\Windows\system32\wermgr.exe	54
C:\windows\system32\wermgr.exe	58
C:\Windows\system32\werui.dll	47
C:\Windows\SysWOW64\WerFault.exe	50
C:\windows\SysWOW64\WerFault.exe	24
C:\Windows\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\WerFaultSecure.exe	52
C:\Windows\SysWOW64\WerFaultSecure.exe	58
C:\Windows\SysWOW64\WerFaultSecure.exe	52
C:\WINDOWS\SysWOW64\WerFaultSecure.exe	61
C:\WINDOWS\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\WerFaultSecure.exe	58
C:\Windows\SysWOW64\WerFaultSecure.exe	58
C:\Windows\SysWOW64\WerFaultSecure.exe	55
C:\Windows\SysWOW64\WerFaultSecure.exe	60
C:\Windows\SysWOW64\wermgr.exe	58
C:\windows\SysWOW64\wermgr.exe	58
C:\Windows\SysWOW64\wermgr.exe	36
C:\Windows\SysWOW64\wermgr.exe	40
C:\Windows\SysWOW64\wermgr.exe	32
C:\WINDOWS\SysWOW64\wermgr.exe	38
C:\Windows\SysWOW64\wermgr.exe	40
C:\Windows\SysWOW64\wermgr.exe	41
C:\WINDOWS\SysWOW64\wermgr.exe	49
C:\Windows\SysWOW64\wermgr.exe	43
C:\Windows\SysWOW64\wermgr.exe	43
C:\Windows\SysWOW64\wermgr.exe	44
C:\Windows\SysWOW64\werui.dll	50