PowerToys.exe

  • File Path: C:\Program Files\PowerToys\PowerToys.exe
  • Description: PowerToys Runner

Hashes

Type Hash
MD5 9AF4545C8798CC3366870504BC9A8821
SHA1 F8147FAE0B21499921377630F9BD02A07E083F04
SHA256 4FE089B9A2F007B07537EF682C92BCC5EED2AED4DECE0034FB4F340405680AEB
SHA384 8D74D13E115FA4FB52852EC5934F66E4F66FA54A868ACBF263AE0F230E17275B4AFDCB02F526B2E809F0C6E76074360D
SHA512 6755BC0567A3A2213EB9D20BB2EEA6B35FCE6300E25FB94BE2EF65BFDB2C54613325728AF3508C27091DC5ABB87968ED235F677742FB969942AE4D0877695736
SSDEEP 12288:29xRHHU81FNR+xWijXiUM615eGYnVTcmicZomYL3C8FGp0bPU:2DRSWoiUT5KnVTc9sGL3C8Fjc
IMP 6ED8EE6B7E669389A675C4783F2A263F
PESHA1 5EC65203F6F1B8C50134B0D9C089C6DC37367DC4
PE256 5ACBDD4A847E9AF96B6719186086701B6ECA60765B56E31D903F16C68806C907

Runtime Data

Child Processes:

ColorPicker.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\propsys.dll.mui File
(RW-) C:\Program Files\PowerToys File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.572_none_fae9a23b76193bbb File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\1\BaseNamedObjects\SessionImmersiveColorPreference Section
\Sessions\1\BaseNamedObjects\UrlZonesSM_user Section
\Sessions\1\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\1\Windows\Theme289354956 Section
\Windows\Theme1665484522 Section

Loaded Modules:

Path
C:\Program Files\PowerToys\PowerToys.exe
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\bcrypt.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\msi.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\SYSTEM32\ntmarta.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\SHELL32.dll
C:\Windows\System32\SHLWAPI.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000001864D2175A0D907BE2C000000000186
  • Thumbprint: 8EE1E4E037942BE5BC7E58B061FB559BDC381D82
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: PowerToys.exe
  • Product Name: PowerToys
  • Company Name: Microsoft Corporation
  • File Version: 0.23.2.0
  • Product Version: 0.23.2.0
  • Language: English (United States)
  • Legal Copyright: Copyright (C) 2020 Microsoft Corporation
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/68
  • VirusTotal Link: https://www.virustotal.com/gui/file/4fe089b9a2f007b07537ef682c92bcc5eed2aed4dece0034fb4f340405680aeb/detection/

MIT License. Copyright (c) 2020-2021 Strontic.