- File Path:
C:\Windows\system32\TransformationRulesParser.exe
- Description: TransformationRulesParser
Hashes
| Type |
Hash |
| MD5 |
1A3266306B27DC557CD74C4712AC6A47 |
| SHA1 |
EE2A16F668544EFFF99BE6B94F3F0430CBA1BD49 |
| SHA256 |
4AB6123FF2985C545292FC6A195BA0A0D35D725997A4975335A970AC085A21DC |
| SHA384 |
5830F942FC3070F5E04A13A166BB1020D88EC9AAB36753CADD94F2B18FC4F953F4631F92D0419823CD6F68D1194F287A |
| SHA512 |
6B69A777CC7BB7EB33E4B1BA4C726CB3534A2EE552D6059D3017BA62CA2E84B330E62379A55901381AD6EB423506F8E59D17B303E5F94D08558349A1D4F385E3 |
| SSDEEP |
384:exEeXRhEp1X8F3d8ZwUhj2pops/pqpPf3gylfEevwgcNBv0oVWCGWI:ezRwuFtkySp3d3Ce40e |
Runtime Data
Child Processes:
conhost.exe
Open Handles:
| Path |
Type |
| (RW-) C:\Users\user\Documents |
File |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 |
Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 |
Section |
| \RPC Control\DSEC490 |
Section |
Loaded Modules:
| Path |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\system32\TransformationRulesParser.exe |
Signature
- Status: Signature verified.
- Serial:
33000001C422B2F79B793DACB20000000001C4
- Thumbprint:
AE9C1AE54763822EEC42474983D8B635116C8452
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: TransformationRulesParser.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.17763.1 (WinBuild.160101.0800)
- Product Version: 10.0.17763.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
MIT License. Copyright (c) 2020-2021 Strontic.