oobeldr.exe

  • File Path: C:\Windows\system32\oobe\oobeldr.exe
  • Description: OOBE Loader

Screenshot

oobeldr.exe

Hashes

Type Hash
MD5 2732C095AEF4D22F65E7D77695F170EE
SHA1 77E15FB86BE3C30836FE72DC77AA22C223B2CC29
SHA256 454D43D4370925D8306AC185714E0AEBA0280E854A804348079DD8B48BE641A1
SHA384 9F36051A63079B16E7D0A68C649D847FE8D7569B8C6E99E023B18B790E498A1C603321E6C41E86794B9A7BA8C8BC02CC
SHA512 3872FE419FCEDAE2044754B7298D4A82D0C4671CDE3CA90BCFB80143C407DAF0450A396B13F8ED415809C518FC0497211F1CC77D50C5E3AD78657B13EB47666E
SSDEEP 1536:4rc8tR9tVOxTCVvR83A13XIHGTZFmo7/bcpQPVHgxXiHp:4Y09rOdkp83A13XIHGTZFf7/bcpwA1i
IMP 056DD64EBE1622D153F1DA843F487C05
PESHA1 2F61E9284F7DA84E373AA125076C1E9F5D63B913
PE256 DF9673041027EA69B7847445DD51FBB60BAA5E93BD05B209F91018620E554F42

Runtime Data

Window Title:

Install Windows

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\oobe\en-US\oobeldr.exe.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows\Panther\UnattendGC\diagerr.xml File
(RW-) C:\Windows\Panther\UnattendGC\diagwrn.xml File
(RW-) C:\Windows\Panther\UnattendGC\setupact.log File
(RW-) C:\Windows\Panther\UnattendGC\setuperr.log File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\SetupLogSection Section
\Sessions\1\Windows\Theme449731986 Section
\Windows\Theme1396518710 Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ActionQueue.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\system32\oobe\oobeldr.exe
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\SYSTEM32\UNATTEND.DLL

Signature

  • Status: Signature verified.
  • Serial: 33000002EC6579AD1E670890130000000002EC
  • Thumbprint: F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: OOBELDR.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/454d43d4370925d8306ac185714e0aeba0280e854a804348079dd8b48be641a1/detection

MIT License. Copyright (c) 2020-2021 Strontic.