wlanext.exe

  • File Path: C:\Windows\system32\wlanext.exe
  • Description: Windows Wireless LAN 802.11 Extensibility Framework

Hashes

Type Hash
MD5 D178119D8DE4E18B05C3DEFB22B6D3CC
SHA1 0CBF3F61C88E7A944294D8E577011F44DD99A9B4
SHA256 8456099DEB994F309FDE890E4F0E571A0A67F9B7DD079516905175CD1500FA52
SHA384 89748309A3C9179084972E211638F875820D609D9FA5272370E6FFA937376211EE6685001F73F03161EC6480D374EBC1
SHA512 EA97A93C3B6E9ADA6ACEB6DBA358C9E4A6EE4EDF1228942378C8879ECA8A60A6B85112D11E0DB387999729203707A0D4292CC80697CBB8CF42B4BE2202762E44
SSDEEP 1536:Q9XHUkfBwkQ1meRIZN1Y8t93q91YI/JIq7cNn5LfDb5s:QR1fOkby8tyL/JZsnJu
IMP 93B58E7D480A8A2281EAE5DDF5F178F2
PESHA1 6954EAC024A4EB84BF40A5C28C124ECA14D49434
PE256 0AEBFBC212F66DAE1A8A80CA460C6842FADEB8C8B3471333015F551CBCF21A90

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\wlanext.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: wlanext.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/8456099deb994f309fde890e4f0e571a0a67f9b7dd079516905175cd1500fa52/detection

Possible Misuse

The following table contains possible examples of wlanext.exe being misused. While wlanext.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_creation_system_file.yml - '\wlanext.exe' DRL 1.0
sigma proc_creation_win_system_exe_anomaly.yml - '\wlanext.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.