The ntoskrnl exe (NT Kernel & System) Microsoft Corporation File Malware Analysis
Gridinsoft Logo

The ntoskrnl.exe (NT Kernel & System) File Analysis

Updated 6 months ago
Checked by Malware Check
ntoskrnl.exe

Technical Analysis

File Name ntoskrnl.exe
File Type
PE32+ executable (native) x86-64, for MS Windows
Scanner Version 1.0.210.174
Database Version 2025-03-13 00:00:48 UTC
✓

Clean File

No threats detected by our scanner

0%
Detection Rate
10,873,864
File Size (bytes)
2025-03-13
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
69cd64e3fb9aa35a9a7525dcb9e37e51
SHA1
3c908405db496205d0ad7057dad7b7ad85dae8a9
SHA256
00bddcb825d2bbc566c6ffd80b5d41db1c49dba3f6dae68b3dc66676040a5bd3
SHA512
a6b712a82f2e2d2f65a6ec3c2ff31488a17c4f6cb8056b66052c3befa45bd6d998829ae8b6c7445a4ea914859f474ad12d3326ce507badb3c05e88fee6255d0e
ImpHash
e0e869bbd92f59b58e146ba81eee3f6d

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x140993010
Compilation Time 2023-09-26 06:53:33
Checksum 0x00a6c1a4 (Actual: 0x00a6c1a4)
OS Version 10.0
PEiD Signatures PE32+ executable (native) x86-64, for MS Windows
PDB Path ntkrnlmp.pdb
Digital Signature OK
Imports 17 libraries
Exports 3093 functions
Resources 10 Resources
Sections 33 Sections

Version Information

▼
CompanyName Microsoft Corporation
FileDescription NT Kernel & System
FileVersion 10.0.19041.5486 (WinBuild.160101.0800)
InternalName ntkrnlmp.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ntkrnlmp.exe
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.5486
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.rdata 0x00001000 819,872 bytes 820,224 bytes 5.88 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ 2D53922B7D20EE461FF1F3560A13A917
.pdata 0x000ca000 424,416 bytes 424,448 bytes 6.54 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ DD830BDC22FBC741FA8A4C1298A3B0B4
.idata 0x00132000 8,386 bytes 8,704 bytes 4.76 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ 4F14B29BEB7F0E2E44288AE25925C434
.edata 0x00135000 101,758 bytes 101,888 bytes 6.03 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CFBD95741A52C890F04B5C4D71A38C93
PROTDATA 0x0014e000 1 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ BF619EAC0CDF3F68D496EA9344137E8B
GFIDS 0x0014f000 35,912 bytes 36,352 bytes 5.41 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 4CF1A4C679D771E4AAC9784B1ACFE5B4
Pad1 0x00158000 688,128 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.text 0x00200000 3,985,769 bytes 3,985,920 bytes 6.54 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 033B8D3DA648D0C2FB00308927E7F1C5
PAGE 0x005ce000 3,951,350 bytes 3,951,616 bytes 6.50 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ FD5D9618C60137458BDF8086BE83A4B8
PAGELK 0x00993000 151,300 bytes 151,552 bytes 6.54 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ BD28331E179C6E1DBDB23A568C5406E3
POOLCODE 0x009b8000 1,163 bytes 1,536 bytes 5.14 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 74B3E29376397AE907C3BDF6F820162B
PAGEKD 0x009b9000 23,442 bytes 23,552 bytes 6.49 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 0443949D764DBF79F3074A1A80FD64F3
PAGEVRFY 0x009bf000 205,068 bytes 205,312 bytes 6.41 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 2F30ACABC0780D7F62E41C1840856537
PAGEHDLS 0x009f2000 9,686 bytes 9,728 bytes 6.28 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ EDC12BB904154D84D41258C01A636F5C
PAGEBGFX 0x009f5000 27,098 bytes 27,136 bytes 6.55 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 2112A49F6A6B9573A7244A28155200BF
INITKDBG 0x009fc000 103,866 bytes 103,936 bytes 6.29 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 132BD1321C2B98EBE6700F947897A7A6
TRACESUP 0x00a16000 5,979 bytes 6,144 bytes 6.21 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 002161DB8C7DC616649D23962904457A
KVASCODE 0x00a18000 9,259 bytes 9,728 bytes 5.40 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ DA23309E877325ECCD06C9125449A019
RETPOL 0x00a1b000 1,824 bytes 2,048 bytes 4.64 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7476413DAD08097E4708671966C48AAB
MINIEX 0x00a1c000 9,646 bytes 9,728 bytes 5.93 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 43C06F6F07DD23927B5695F4BEA561D9
INIT 0x00a1f000 567,080 bytes 567,296 bytes 6.40 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 085E8C34299565E7FCFF52307725C0C4
Pad2 0x00aaa000 1,400,832 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.data 0x00c00000 1,025,424 bytes 77,824 bytes 1.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 25E228245701E54552550DE892A9B867
ALMOSTRO 0x00cfb000 160,480 bytes 5,120 bytes 2.83 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 56E686C96781267783E1DDA6D4A48D5E
CACHEALI 0x00d23000 37,568 bytes 512 bytes 0.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 8F35CB33CC79A0D5EB136F8B15785BD3
PAGEDATA 0x00d2d000 83,472 bytes 6,144 bytes 2.17 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D2BC23BD5C237CE20596DBC644750FA5
PAGEVRFD 0x00d42000 89,344 bytes 32,768 bytes 2.89 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B4CA172CBF0A41540A3B5A9ECAFE6B87
INITDATA 0x00d58000 113,732 bytes 2,048 bytes 2.38 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 25C7D86DC11AF4943C51BCD20760CFC3
Pad3 0x00d74000 573,440 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
CFGRO 0x00e00000 7,368 bytes 7,680 bytes 0.11 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E633F078657052BF3AFA259CD4304E52
Pad4 0x00e02000 2,088,960 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rsrc 0x01000000 241,720 bytes 242,176 bytes 2.19 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 16DC94E4858FAE510C8F251E45B9F1B4
.reloc 0x0103c000 40,032 bytes 40,448 bytes 5.83 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0296118517D50B84F5F1CCDA09899613
Entropy Analysis Alert

5 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 10 (241,076 bytes)
Resource Type Count Total Size Percentage
RT_BITMAP 7 190,520 bytes
79%
RT_RCDATA 1 32,312 bytes
13.4%
RT_MESSAGETABLE 1 17,320 bytes
7.2%
RT_VERSION 1 924 bytes
0.4%

Certificate Chain Analysis

▼
Certificate Information
Product Microsoft® Windows® Operating System
Description NT Kernel & System
File Version 10.0.19041.5486 (WinBuild.160101.0800)
Original Name ntkrnlmp.exe
Signing Date 05:01 AM 01/23/2025 (234 days ago)
Verification Status Signed
Signers Microsoft Windows; Microsoft Windows Production PCA 2011; Microsoft Root Certificate Authority 2010
Counter Signers Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010
Internal Name ntkrnlmp.exe
Copyright © Microsoft Corporation. All rights reserved.
Certificate Chain Summary
Microsoft Windows #1 Primary
Validity Period: 2024-09-12 20:04:06 → 2025-09-11 20:04:06
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 04 A7 04 3E E4 22 C8 34 FA FC 00 00 00 00 04 A7
Microsoft Windows Production PCA 2011 #2 Chain
Validity Period: 2011-10-19 18:41:42 → 2026-10-19 18:51:42
Signature Algorithm: sha256RSA
Serial Number: 61 07 76 56 00 00 00 00 00 08
Microsoft Time-Stamp Service #3 Chain
Validity Period: 2024-07-25 18:31:09 → 2025-10-22 18:31:09
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 01 F9 1F 67 8D 75 AB A4 F1 B1 00 01 00 00 01 F9
Microsoft Time-Stamp PCA 2010 #4 Chain
Validity Period: 2021-09-30 18:22:25 → 2030-09-30 18:32:25
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
This file passed all security checks, but stay vigilant. New malware variants appear daily that can evade detection. Always verify files come from official sources and check digital signatures when available.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware