wowreg32.exe

  • File Path: C:\Windows\system32\wowreg32.exe
  • Description: SetupAPI 64-bit Surrogate

Hashes

Type Hash
MD5 EF57EBA23AAD7A90C533F74E8F0D6092
SHA1 CBF3FBE7621557793C46D8D0389F6B75D84EBB29
SHA256 0A3D73C61D5FF6A7E477EBC5BB2746D091599A75D218999A5C8DB1CD7D54171C
SHA384 7B403F5387AAB9FED6960334CC2D7B416B12A8E2A746114A460B271EED0D23690D260D1B7AED06CB5007D36FCDBAEF86
SHA512 8E55BDEE99DA795A61D7ABD12482C5B3135C2A4820858362F4298BFDBAAB39240A0EA8D0BD0B8DD73D2EE6650374D7411A724C1257D66B4252A1E1DC09FD5F0D
SSDEEP 384:YnIC7v6gy817zhiel+5OtLeCxNY3s4VLrWgTZjHW:YnIC7v658lzhhgIeC8ZBZj
IMP 9E395710D74BF587FAC4F5CA37BF2548
PESHA1 94CCC3420893421BC2D814C774B64E5EF8A9C768
PE256 036F9CAAC16F3DA97EFC56F48E23D5B645FA97B6C20C30B4846F9D9C9EE9E847

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\wowreg32.exe

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: WOWREG32.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/70
  • VirusTotal Link: https://www.virustotal.com/gui/file/0a3d73c61d5ff6a7e477ebc5bb2746d091599a75d218999a5c8db1cd7d54171c/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\wowreg32.exe 55
C:\Windows\system32\wowreg32.exe 60

MIT License. Copyright (c) 2020-2021 Strontic.