wkspbroker.exe

  • File Path: C:\Windows\system32\wkspbroker.exe
  • Description: RemoteApp and Desktop Connection Runtime Broker

Hashes

Type Hash
MD5 228C4C2AF89A60563609F47A3CA7361B
SHA1 86D2CBDBC7F060971D9CA3A73406C963658B92CA
SHA256 2418929FEC25B3A30C10FE01901F4D75D6895480DF500BEB19717517CCD5BB41
SHA384 D36E08EFDB4C71F93B8487F15598A96BF3106F383D9DFB390090D5D79AD197409F9F06CBE21B238C4058AC0E74DDC373
SHA512 F257BDFA45BC9A79539C65D9CF921A9CC5445B88514B5D4B1B2362FC5793F77978C0658745B872AD4DA6F0E5F44B9A25CF3608FEEECB8164AFC2E24AACFB5FCA
SSDEEP 6144:7ww7aIItFKhjYpOqmjvoJa4XsSgaWyZWR3O:7w7II7jOLjvUa4XZWyn
IMP 7CDC3C5C42F622F28AAA8DD99463C85B
PESHA1 B9D3382655A767B846C2404BFAB4548A600C1DD4
PE256 0D3705B06E875A4F5DE4A99E345FDBE2CB8E1A602B280BE9CD279BE660385796

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\bcryptPrimitives.dll
C:\Windows\System32\cfgmgr32.dll
C:\Windows\System32\combase.dll
C:\Windows\system32\credui.dll
C:\Windows\System32\CRYPT32.dll
C:\Windows\System32\cryptsp.dll
C:\Windows\system32\DNSAPI.dll
C:\Windows\system32\DPAPI.DLL
C:\Windows\system32\DUI70.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\SYSTEM32\IPHLPAPI.DLL
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\ktmw32.dll
C:\Windows\System32\MSASN1.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\System32\Normaliz.dll
C:\Windows\System32\NSI.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\SYSTEM32\ntmarta.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\powrprof.dll
C:\Windows\System32\profapi.dll
C:\Windows\system32\PROPSYS.dll
C:\Windows\system32\RADCUI.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\shlwapi.dll
C:\Windows\system32\SspiCli.dll
C:\Windows\system32\tsworkspace.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll
C:\Windows\System32\windows.storage.dll
C:\Windows\system32\Windows.UI.Immersive.dll
C:\Windows\system32\WINHTTP.dll
C:\Windows\system32\WININET.dll
C:\Windows\system32\wkspbroker.exe
C:\Windows\System32\WS2_32.dll

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: wkspbroker.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/65
  • VirusTotal Link: https://www.virustotal.com/gui/file/2418929fec25b3a30c10fe01901f4d75d6895480df500beb19717517ccd5bb41/detection/

MIT License. Copyright (c) 2020-2021 Strontic.