mpnotify.exe
- File Path:
C:\Windows\system32\mpnotify.exe
- Description: Windows NT Multiple Provider Notification Application
Hashes
| Type |
Hash |
| MD5 |
EC713E42A58FCC6F32A8AF42601A6943 |
| SHA1 |
0D6AFD1BF684F4DD4BC823C3489EA12EFB0DFB28 |
| SHA256 |
909BD459E937642E17C188C998FE0A6E228C4E48CDF8F0645168D4F09A97DAC2 |
| SHA384 |
416E0469F25F3EE2008D9C9883E8E4A34F1B83D7BF6EB3C971E7A416D420402503B419CF957BB45B8E4E07F594F1DD46 |
| SHA512 |
1C3DBC3985231D22E74019A7B1CBDC586EA1723BFCC0FD19B80BAE3C1BE5CD0E714AFF8FDD891AF63E5B50B6D05DC48129CFA651CE62AFF887990FFDEC1724EE |
| SSDEEP |
384:q1nTPEzAbWLzC6qOA4yziiWdYD0MZLqTWAjW:2nT8kbW2Lz+ZMZG/ |
| IMP |
CD22AC47106D5026EA3B26DED33E58CD |
| PESHA1 |
A75231085B02F577C365EA1B17CCFD7C9EC57E12 |
| PE256 |
EB332C8067DB9C7110A4E55D4F7A7E5D6F1E03CF6EFB68388A50DC546BA204BA |
Runtime Data
Open Handles:
| Path |
Type |
| (RW-) C:\Users\user |
File |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db |
Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro |
Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 |
Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 |
Section |
| \RPC Control\DSECB00 |
Section |
Loaded Modules:
| Path |
| C:\Windows\System32\ADVAPI32.dll |
| C:\Windows\System32\bcryptPrimitives.dll |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\system32\mpnotify.exe |
| C:\Windows\System32\msvcrt.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\sechost.dll |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266
- Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: mpnotify.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.17763.1075 (WinBuild.160101.0800)
- Product Version: 10.0.17763.1075
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/70
- VirusTotal Link: https://www.virustotal.com/gui/file/909bd459e937642e17c188c998fe0a6e228c4e48cdf8f0645168d4f09a97dac2/detection/
MIT License. Copyright (c) 2020-2021 Strontic.