winver.exe

  • File Path: C:\Windows\SysWOW64\winver.exe
  • Description: Version Reporter Applet

Screenshot

winver.exe winver.exe winver.exe winver.exe

Hashes

Type Hash
MD5 D0CD7E799CC087F0F3630AF45F4CAB5A
SHA1 DF90A5AEA9FC189E55C5D9176F648A537CEF79DD
SHA256 97C23B8888FFE8F4A9D9A0DE8EDA27CBE029049CF07E1164C2E79C3623139E42
SHA384 46DE14EAD7FDCD59BE9C68E407C37B99FD4351E1E807BF9CE7A88B8FB636B4159D62623F404CCE7E70CEDA24907E1B06
SHA512 411DCB4E9D7D84CAC5F5145381D016AA04EFB0CDC9BE7A525AA4DED30B47412AB0ADEFBAB8F617CF0BA3024C88DC4166D8CE6BFC7A444C6F64301270E0BFFF15
SSDEEP 768:AqVcU4yi+GSkVhWakkbB5eT905WGnUKxHUe7n8jKBFFptX/7wUXj1:AZyi+xakkn6oYY0ewiP82
IMP 6F6011B78CCFE72E1E21C99F70873A70
PESHA1 241A5898FF2784205BFA6A3CA7AD8AF92364AA39
PE256 E66F859D2BF020BFFCD202C4B1E6417ABAA01447C7797B6C7DAA52FD3D84D501

Runtime Data

Window Title:

About Windows

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\shell32.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\winver.exe.mui File
(R-D) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_3c26ab8c9470805a\comctl32.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_3c26ab8c9470805a File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_261b62a767ca4e6d File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme2131664586 Section
\Windows\Theme966197582 Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\winver.exe

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: WINVER.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/97c23b8888ffe8f4a9d9a0de8eda27cbe029049cf07e1164c2e79c3623139e42/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\RunLegacyCPLElevated.exe 65
C:\Windows\system32\RunLegacyCPLElevated.exe 60
C:\Windows\system32\RunLegacyCPLElevated.exe 57
C:\windows\system32\RunLegacyCPLElevated.exe 83
C:\WINDOWS\system32\RunLegacyCPLElevated.exe 65
C:\Windows\system32\winver.exe 86
C:\Windows\system32\winver.exe 82
C:\Windows\system32\winver.exe 82
C:\WINDOWS\system32\winver.exe 82
C:\windows\system32\winver.exe 82
C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 75
C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 72
C:\windows\SysWOW64\RunLegacyCPLElevated.exe 82
C:\WINDOWS\SysWOW64\RunLegacyCPLElevated.exe 72
C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 77
C:\windows\SysWOW64\winver.exe 82
C:\Windows\SysWOW64\winver.exe 85
C:\WINDOWS\SysWOW64\winver.exe 86
C:\Windows\SysWOW64\winver.exe 85

MIT License. Copyright (c) 2020-2021 Strontic.