msra.exe

  • File Path: C:\Windows\SysWOW64\msra.exe
  • Description: Windows Remote Assistance

Hashes

Type Hash
MD5 DAE6D5681EAFB97B23DC1C4E08A848C6
SHA1 870C65AD92465E66DE346C9574581DF8E3FE3FB3
SHA256 D15D547A3496907C8B5128F7D9219BC2E043B5C476D6C34B84C9280159280F93
SHA384 AF452C122AC5FC083969F36EDDCD1C849D375A5C090924C6458B19B57242B2DF0DCED4F76ED5CC934CB4A1471BF23772
SHA512 49DD6B96BE6941D06D66BA53FB561435D8FDF0DC6F6954F81DD6144483B087F8557F7F9C2F3B60015F5CA301EF690223F5465ED6299CBB6CC7ECBDCD9D402C34
SSDEEP 1536:iELhsFjazinQ+dYxfNJK02oM8kIcnmPkkSTst7vIyR:iqKASX8jn6KvI
IMP 3A9CFBE2704D53479014B87DF3DAF578
PESHA1 7062EAB2AE80E226D358BD83D846B46C4A48E14B
PE256 984B6D264A5517E807EBB5E8BC88099C0FB46F386B41C7784D4F2AEB8225A499

Runtime Data

Child Processes:

msra.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\msra.exe.mui File
(R-D) C:\Windows\System32\en-US\propsys.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\1\BaseNamedObjects\UrlZonesSM_user Section
\Sessions\1\BaseNamedObjects\windows_shell_global_counters Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\msra.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002EC6579AD1E670890130000000002EC
  • Thumbprint: F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: msra.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1110 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1110
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/d15d547a3496907c8b5128f7d9219bc2e043b5c476d6c34b84c9280159280f93/detection

File Similarity (ssdeep match)

File Score
C:\WINDOWS\SysWOW64\msra.exe 88
C:\WINDOWS\SysWOW64\msra.exe 86
C:\Windows\SysWOW64\msra.exe 91

MIT License. Copyright (c) 2020-2021 Strontic.