MdRes.exe

  • File Path: C:\Windows\system32\MdRes.exe
  • Description: Windows Memory Diagnostic

Hashes

Type Hash
MD5 0C523F617F069E18124660A1486D6B6F
SHA1 3753404A31A30F60B5E246579DEEB7BD8A3B3F29
SHA256 017F58759130EB04830148C5F71D866D9D9C0A231CA67440D335B8790C19AFE0
SHA384 EB1ABDA55BFA9EE171763013A58748236ED58C57209F3C53644862F7FACA5C2F451805CE5E40CA3525DBAFD773E37F27
SHA512 B40FEA55BBBC473207F3046DC42CE495C047E57C42624EF6B0A74A78CB961FCE8D494DC463A2507E6A507DC663D053E8B36A029B7D3779914BC4FCE594937E24
SSDEEP 1536:bKH1/nfGLm+65tFI720+VpmDOzc4JNWxwB1MjVJmRc:uteLe/FO+VQDUcUNWs+jm6
IMP 3D553FEF2350214DF4679F35FF59A173
PESHA1 0FF8C4B9198275AB696FBFEC70BD635BB5879284
PE256 B5EC96063D421CF6127DE49E64F7C9DE244998582E3C8678B99C6ACC006C7401

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\MdRes.exe
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: MdRes.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/017f58759130eb04830148c5f71d866d9d9c0a231ca67440d335b8790c19afe0/detection

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\MdRes.exe 85
C:\Windows\system32\MdRes.exe 85
C:\windows\system32\MdRes.exe 80
C:\WINDOWS\system32\MdRes.exe 82
C:\Windows\system32\MdRes.exe 83
C:\Windows\system32\MdSched.exe 80
C:\windows\system32\MdSched.exe 82
C:\Windows\system32\MdSched.exe 86
C:\Windows\system32\MdSched.exe 83
C:\WINDOWS\system32\MdSched.exe 80
C:\WINDOWS\system32\MdSched.exe 75

MIT License. Copyright (c) 2020-2021 Strontic.