PowerToys.exe
- File Path:
C:\Program Files\PowerToys\PowerToys.exe - Description: PowerToys Runner
Hashes
| Type | Hash |
|---|---|
| MD5 | 9AF4545C8798CC3366870504BC9A8821 |
| SHA1 | F8147FAE0B21499921377630F9BD02A07E083F04 |
| SHA256 | 4FE089B9A2F007B07537EF682C92BCC5EED2AED4DECE0034FB4F340405680AEB |
| SHA384 | 8D74D13E115FA4FB52852EC5934F66E4F66FA54A868ACBF263AE0F230E17275B4AFDCB02F526B2E809F0C6E76074360D |
| SHA512 | 6755BC0567A3A2213EB9D20BB2EEA6B35FCE6300E25FB94BE2EF65BFDB2C54613325728AF3508C27091DC5ABB87968ED235F677742FB969942AE4D0877695736 |
| SSDEEP | 12288:29xRHHU81FNR+xWijXiUM615eGYnVTcmicZomYL3C8FGp0bPU:2DRSWoiUT5KnVTc9sGL3C8Fjc |
| IMP | 6ED8EE6B7E669389A675C4783F2A263F |
| PESHA1 | 5EC65203F6F1B8C50134B0D9C089C6DC37367DC4 |
| PE256 | 5ACBDD4A847E9AF96B6719186086701B6ECA60765B56E31D903F16C68806C907 |
Runtime Data
Child Processes:
ColorPicker.exe
Open Handles:
| Path | Type |
|---|---|
| (R-D) C:\Windows\System32\en-US\propsys.dll.mui | File |
| (RW-) C:\Program Files\PowerToys | File |
| (RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_ca04af081b815d21 | File |
| (RW-) C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.572_none_fae9a23b76193bbb | File |
| \BaseNamedObjects__ComCatalogCache__ | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 | Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
| \BaseNamedObjects\windows_shell_global_counters | Section |
| \Sessions\1\BaseNamedObjects\SessionImmersiveColorPreference | Section |
| \Sessions\1\BaseNamedObjects\UrlZonesSM_user | Section |
| \Sessions\1\BaseNamedObjects\windows_shell_global_counters | Section |
| \Sessions\1\Windows\Theme289354956 | Section |
| \Windows\Theme1665484522 | Section |
Loaded Modules:
| Path |
|---|
| C:\Program Files\PowerToys\PowerToys.exe |
| C:\Windows\System32\ADVAPI32.dll |
| C:\Windows\System32\bcrypt.dll |
| C:\Windows\System32\combase.dll |
| C:\Windows\System32\GDI32.dll |
| C:\Windows\System32\gdi32full.dll |
| C:\Windows\System32\IMM32.DLL |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\SYSTEM32\msi.dll |
| C:\Windows\System32\msvcp_win.dll |
| C:\Windows\System32\msvcrt.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\SYSTEM32\ntmarta.dll |
| C:\Windows\System32\ole32.dll |
| C:\Windows\System32\OLEAUT32.dll |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\sechost.dll |
| C:\Windows\System32\shcore.dll |
| C:\Windows\System32\SHELL32.dll |
| C:\Windows\System32\SHLWAPI.dll |
| C:\Windows\System32\ucrtbase.dll |
| C:\Windows\System32\USER32.dll |
| C:\Windows\System32\win32u.dll |
Signature
- Status: Signature verified.
- Serial:
33000001864D2175A0D907BE2C000000000186 - Thumbprint:
8EE1E4E037942BE5BC7E58B061FB559BDC381D82 - Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: PowerToys.exe
- Product Name: PowerToys
- Company Name: Microsoft Corporation
- File Version: 0.23.2.0
- Product Version: 0.23.2.0
- Language: English (United States)
- Legal Copyright: Copyright (C) 2020 Microsoft Corporation
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/68
- VirusTotal Link: https://www.virustotal.com/gui/file/4fe089b9a2f007b07537ef682c92bcc5eed2aed4dece0034fb4f340405680aeb/detection/
MIT License. Copyright (c) 2020-2021 Strontic.