407e40c837ef097f6b424bac5e45373d42e99a60aa45e2aebf178b9a1e99835a
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2077-Jan-02 05:05:33 |
| Debug artifacts |
C:\agent\_work\1\s\win-app-omen\Source\Application\Background\OmenInstallMonitor\obj\x64\MSIX_Release\OmenInstallMonitor.pdb
|
| Comments | |
| CompanyName | HP Inc. |
| FileDescription | HP.OMEN.OMENInstallMonitor |
| FileVersion | 1101.2504.8.0 |
| InternalName | OmenInstallMonitor.exe |
| LegalCopyright | Copyright (c) 2022, HP Development Company, L.P. |
| LegalTrademarks | |
| OriginalFilename | OmenInstallMonitor.exe |
| ProductName | HP.OMEN.OMENInstallMonitor |
| ProductVersion | 1101.2504.8.0 |
| Assembly Version | 1101.2504.8.0 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to security software:
|
| Suspicious | The PE is possibly packed. | The PE only has 0 import(s). |
| Info | The PE is digitally signed. |
Signer: HP Inc.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| Safe | VirusTotal score: 0/70 (Scanned on 2026-11-05 09:11:28) | All the AVs think this file is safe. |
Hashes
| MD5 | 022e0fd5e7ab697681a6a2a6e5d0a9b4 🔍 |
|---|---|
| SHA1 | 5d6c93f0e5e85f41c3f3c0311109cb8cf8e0d247 🔍 |
| SHA256 | 407e40c837ef097f6b424bac5e45373d42e99a60aa45e2aebf178b9a1e99835a 🔍 |
| SHA3 | 14ff5e91b465f12d50f6a5e2bee861e4cf34abee14bb7b9a6beeb6634cb10c14 🔍 |
| SSDeep | 768:XAufbZ7b/uzy6Xd9cP5xh2qLvwE+fP5xh2qLv4H8EN/YivaI2Ew:3TNb/16Xd9Khcbh8H8EN/7j2 🔍 |
| Imports Hash | d41d8cd98f00b204e9800998ecf8427e 🔍 |
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 2 |
| TimeDateStamp | 2077-Jan-02 05:05:33 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0xbe00 |
| SizeOfInitializedData | 0x3200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000000000 (Section: ?) |
| BaseOfCode | 0x2000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x12000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0x17844 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x400000 |
| SizeofStackCommit | 0x4000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x2000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
| MD5 | 7ce9b23ff3f0b4376cf94c229176d0c6 🔍 |
|---|---|
| SHA1 | e7bf7e3e4981b09c5953ae663b9375aa24fc9df2 🔍 |
| SHA256 | f193e4f11819848dc5503bf8fa940817a80740f89396efd6fe989c509754e6d8 🔍 |
| SHA3 | 3656e10420cdc560d584b49516f900b246beaf0c0d13048f290691bed7409514 🔍 |
| VirtualSize | 0xbc51 |
| VirtualAddress | 0x2000 |
| SizeOfRawData | 0xbe00 |
| PointerToRawData | 0x200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.44491 |
.rsrc
| MD5 | 4e260cf47735db14f27c10a74a0c07ae 🔍 |
|---|---|
| SHA1 | fbe40dcffbd122c7d602d46435064549598fd2eb 🔍 |
| SHA256 | 0e6a1f61e39ba53f13bff1970d692ebc4e6e0da0b498b2ff6bd91c69a5f4cd5a 🔍 |
| SHA3 | d1885b0778689650799dee386615206eca85bdb4be4e150db87c3365aa8e991b 🔍 |
| VirtualSize | 0x311c |
| VirtualAddress | 0xe000 |
| SizeOfRawData | 0x3200 |
| PointerToRawData | 0xc000 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 7.56105 |
Imports
Delayed Imports
1
| Type |
RT_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x29ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.88181 |
| Detected Filetype | PNG graphic file |
| MD5 | 28c75c844c1ade586573b2e3659516e9 🔍 |
| SHA1 | e2cbe384886ecd799063138f5f5e1e7dfba4b04c 🔍 |
| SHA256 | 110c88f25ccf676521acfd9ff73d78f56207d0c1a57b56a6ddfecc362452aac6 🔍 |
| SHA3 | b4b983e2a2caaf6f5e3a35d40f6e3628bef479f68d046f4c554d7178e5e1fa06 🔍 |
32512
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x14 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 1.51664 |
| Detected Filetype | Icon file |
| MD5 | bdd4ee3c5909a33ddc53d174cbc3cade 🔍 |
| SHA1 | 68d215548bce79af9ba4ba43cd69f30021bf4733 🔍 |
| SHA256 | 68c7b9c467eec2529f1dd2e67ff98a01e8d5314fa527c09c6a7497eb65e712f1 🔍 |
| SHA3 | c9db3bc4a1455f6283e49cac4cec5d01a8c14dd0d78db58c18b43c4256805c27 🔍 |
1 (#2)
| Type |
RT_VERSION
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x3fc |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.44738 |
| MD5 | ece28ecd9732209095b64c28ab8624f3 🔍 |
| SHA1 | ab5e7077066d4da882f9010fa3270a7c3747f172 🔍 |
| SHA256 | 52d6ebef7cb9fcff2c519c8ebd065b690d91f3372d4d6e893d26c38a37889cf8 🔍 |
| SHA3 | 983cddaf18de8df33bae2312d2f6d4e2f485eda322b91aedfbef3fdce13cfd75 🔍 |
1 (#3)
| Type |
RT_MANIFEST
|
|---|---|
| Language | UNKNOWN |
| Codepage | UNKNOWN |
| Size | 0x1ea |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.00112 |
| MD5 | b7db84991f23a680df8e95af8946f9c9 🔍 |
| SHA1 | cac699787884fb993ced8d7dc47b7c522c7bc734 🔍 |
| SHA256 | 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍 |
| SHA3 | 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍 |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1101.2504.8.0 |
| ProductVersion | 1101.2504.8.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | HP Inc. |
| FileDescription | HP.OMEN.OMENInstallMonitor |
| FileVersion (#2) | 1101.2504.8.0 |
| InternalName | OmenInstallMonitor.exe |
| LegalCopyright | Copyright (c) 2022, HP Development Company, L.P. |
| LegalTrademarks | |
| OriginalFilename | OmenInstallMonitor.exe |
| ProductName | HP.OMEN.OMENInstallMonitor |
| ProductVersion (#2) | 1101.2504.8.0 |
| Assembly Version | 1101.2504.8.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2073-Sep-28 08:12:24 |
| Version | 0.0 |
| SizeofData | 149 |
| AddressOfRawData | 0xdbbc |
| PointerToRawData | 0xbdbc |
| Referenced File | C:\agent\_work\1\s\win-app-omen\Source\Application\Background\OmenInstallMonitor\obj\x64\MSIX_Release\OmenInstallMonitor.pdb |
UNKNOWN
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 0 |
| AddressOfRawData | 0 |
| PointerToRawData | 0 |
TLS Callbacks
Load Configuration
RICH Header
Errors
Leave a comment
No comments yet.