MdSched.exe

  • File Path: C:\Windows\system32\MdSched.exe
  • Description: Windows Memory Diagnostics Tool

Hashes

Type Hash
MD5 4FF2CCEEDC45B573012B35E6DCA467AA
SHA1 409D14B3AEB39D8480EAF5B981D3E009276EE5B3
SHA256 043CF5DA5A37A30ECC4BF526A811E7C474843FD25E45C691B82C1458318686E8
SHA384 397AB51878D65A6FB7424CDF90EDF340CBADF9D0F0E1CBD48C9B2DC1342225AAB273BD7742598ECD0915F75CB3D9785A
SHA512 3EBA3F25115950BD98AAC4D9112D716E965ED0D08F86DB35BD48525EDDDD781A24A2FFDAAA03D7B38DB5F55B782EDED6FEAF241A46D2677AC736810167298F2E
SSDEEP 1536:j60HWG8IvGm+65tFI720+VpmDOzc4JNWxwB1MjVJmRc:tHfvGe/FO+VQDUcUNWs+jm6
IMP AAA5D23775A803F6978426A3C7A1F259
PESHA1 306B935F9F03B0FB0ABB90204A94537FCFAC461B
PE256 A1D7A2D6A43ECE27E189889353475EC2F15D41608F2E61066AC18568F75E27B0

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\system32\bcd.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\MdSched.exe
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: MdSched.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/043cf5da5a37a30ecc4bf526a811e7c474843fd25e45c691b82c1458318686e8/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\MdRes.exe 86
C:\WINDOWS\system32\MdRes.exe 83
C:\Windows\system32\MdRes.exe 85
C:\windows\system32\MdRes.exe 79
C:\WINDOWS\system32\MdRes.exe 80
C:\Windows\system32\MdRes.exe 85
C:\Windows\system32\MdSched.exe 83
C:\windows\system32\MdSched.exe 77
C:\Windows\system32\MdSched.exe 82
C:\WINDOWS\system32\MdSched.exe 83
C:\WINDOWS\system32\MdSched.exe 75

MIT License. Copyright (c) 2020-2021 Strontic.