wscadminui.exe

File Path: C:\Windows\SysWOW64\wscadminui.exe
Description: Windows Security Center Elevated UI App

Hashes

Type	Hash
MD5	`9D156054E1754EDF164F6CF5537B2EE4`
SHA1	`4565BDA12BD284EDBEC91E2A07C3EEB944FC12F7`
SHA256	`88CD7DF8A66E4D061BD9CD1FAA2B4FE2A56D5D27644C19DF8DA54D46FE7E5B3A`
SHA384	`1067965A025B1636716BB36F726197660F369061A159D1E5C240323FEF8E3C420AFF1C45ABB747ED33A8C88C4CA06D76`
SHA512	`B09F622C80C0B1B09C51A85BB1ED2AD66116B192072E129D5AF773C5360EF173C6340BD9C646199AAC6CA3B2CE770F1ADB3789B6848FD7A98E077FB9AC5A1E41`
SSDEEP	`96:eqB4XrXXYtsp20nGDrDGjQ5HEJuDWfMu1qEWehRWwcRF:1KrXXYwx7exDWfMu13WehRWtRF`
IMP	`3D14FF3AED50FB9C7612F737F4A41021`
PESHA1	`D0106906FF9D524BE79B6836BFD326920422263C`
PE256	`BB6513FB36A72F2F2E7066C7CA1BD77FE8996ABC0C412B854A0950ADFE4D517E`

Runtime Data

Child Processes:

explorer.exe

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\wscadminui.exe

Signature

Status: Signature verified.
Serial: 330000026551AE1BBD005CBFBD000000000265
Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: wscadminui.exe
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.19041.1 (WinBuild.160101.0800)
Product Version: 10.0.19041.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 32-bit

File Scan

VirusTotal Detections: 0/75
VirusTotal Link: https://www.virustotal.com/gui/file/88cd7df8a66e4d061bd9cd1faa2b4fe2a56d5d27644c19df8da54d46fe7e5b3a/detection

File Similarity (ssdeep match)

File	Score
C:\Windows\system32\wscadminui.exe	30
C:\Windows\SysWOW64\wscadminui.exe	82

MIT License. Copyright (c) 2020-2021 Strontic.