sessionmsg.exe
- File Path:
C:\Windows\system32\sessionmsg.exe
- Description: Microsoft Remote Desktop Services Session Message Server
Hashes
| Type |
Hash |
| MD5 |
480F710806B68DFE478CA1EC7D7E79CC |
| SHA1 |
B4FC97FED2DBFF9C4874CB65EDE7B50699DB37CD |
| SHA256 |
2416CD4AA577DBB2F8790A61E36FBAB2B30BFF81A4E1F67A5151C2FEC29585BC |
| SHA384 |
428610D3ED584BD950125A3B2665189FE4303A3A981045CA01DADFB1DF8646628935A2CA34B5330BC5589B53AA188DA4 |
| SHA512 |
29D3D234EBC45049A533B6A91B246AC043A56B9AF67276AAF493B014AE34D73000F99A6B0C0B85D2DFB7FBA54811CF8BBDFD167A9EED01A8617B7F05BF2971DB |
| SSDEEP |
1536:exhq/kLcLkFQ+IvSdJ/+WAzCX+AWnMI2A+/aI6ws+2yvOMd0vyUJGPQ+:0FuRvS8/117+r6ws+TvOMOqnI+ |
| IMP |
1F9ABC3E0DF808E5F1C188F772C8385D |
| PESHA1 |
06B82A51F1E19A77DED130978C8C784BDB5806C6 |
| PE256 |
7D169C9CBE1E5E1F3ADDF0DCE0BDC7B2D704C599FB35691C08C5634465467BB3 |
Runtime Data
Open Handles:
| Path |
Type |
| (R-D) C:\Windows\System32\en-US\sessionmsg.exe.mui |
File |
| (RW-) C:\Users\user |
File |
| \BaseNamedObjects__ComCatalogCache__ |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 |
Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 |
Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 |
Section |
Loaded Modules:
| Path |
| C:\Windows\System32\ADVAPI32.dll |
| C:\Windows\System32\GDI32.dll |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\System32\msvcrt.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\sechost.dll |
| C:\Windows\system32\sessionmsg.exe |
| C:\Windows\System32\USER32.dll |
| C:\Windows\System32\win32u.dll |
Signature
- Status: Signature verified.
- Serial:
33000002EC6579AD1E670890130000000002EC
- Thumbprint:
F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: SessionMsg.exe.mui
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/74
- VirusTotal Link: https://www.virustotal.com/gui/file/2416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc/detection
MIT License. Copyright (c) 2020-2021 Strontic.