oobeldr.exe
- File Path:
C:\Windows\system32\oobe\oobeldr.exe - Description: OOBE Loader
Screenshot
Hashes
| Type | Hash |
|---|---|
| MD5 | DE9B192E6C5A074140CED7E1CD21B7C7 |
| SHA1 | 3B643412D6F7AF2ED16AF08DE65CA0D41A8E423B |
| SHA256 | B5F65B8BC7DCB4F000E14D71CCC27CAED1CE7F6F26D95B3E3F7A84B802275451 |
| SHA384 | D7EC0857CF854DA0B6FD627627569A4752D4F74C35181DEA6092523FC0B8471E08CDE5BF04B88AA751ECDC90ACDC28E1 |
| SHA512 | 417E8E614F3EFD8637C1BD052173A1C0F7D8A686B45940356596544B949BB0976EF669B57A11DEA7431F5E2A19CAF489E6AA50E094C120F34DD17F7798EDA1FF |
| SSDEEP | 1536:SWqPBtQdTxbukmowj4WKWl8qBvxaiMFL:5aOddbukfwMlWltBvopN |
| IMP | DAD05B0B0EA99D1FEA639B69E3E8A735 |
| PESHA1 | 41681C637711556B7EB562150D6FC4D208F9E131 |
| PE256 | 75B7333282F47EFAA47E95CD587E05D72BD1ABB6F24117E2D8EDC88DFD117F12 |
Runtime Data
Window Title:
Install Windows
Open Handles:
| Path | Type |
|---|---|
| (R-D) C:\Windows\Fonts\StaticCache.dat | File |
| (R-D) C:\Windows\System32\oobe\en-US\oobeldr.exe.mui | File |
| (RW-) C:\Users\user\Documents | File |
| (RW-) C:\Windows\Panther\UnattendGC\diagerr.xml | File |
| (RW-) C:\Windows\Panther\UnattendGC\diagwrn.xml | File |
| (RW-) C:\Windows\Panther\UnattendGC\setupact.log | File |
| (RW-) C:\Windows\Panther\UnattendGC\setuperr.log | File |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
| \BaseNamedObjects\SetupLogSection | Section |
| \Sessions\1\Windows\Theme1703657751 | Section |
| \Windows\Theme1455388728 | Section |
Loaded Modules:
| Path |
|---|
| C:\Windows\SYSTEM32\ActionQueue.dll |
| C:\Windows\System32\combase.dll |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\System32\msvcp_win.dll |
| C:\Windows\System32\msvcrt.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\OLEAUT32.dll |
| C:\Windows\system32\oobe\oobeldr.exe |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\shcore.dll |
| C:\Windows\System32\ucrtbase.dll |
| C:\Windows\SYSTEM32\UNATTEND.DLL |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: OOBELDR.EXE.MUI
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/66
- VirusTotal Link: https://www.virustotal.com/gui/file/b5f65b8bc7dcb4f000e14d71ccc27caed1ce7f6f26d95b3e3f7a84b802275451/detection/
MIT License. Copyright (c) 2020-2021 Strontic.