The MsMpEng.exe File Analysis

Updated on 2023-11-01 (6 months ago)

Online Virus Checker	v.1.0.144.174
DB Version:	2023-11-01 12:03:30

The MsMpEng.exe Is Safe File

File	MsMpEng.exe
Checked	2023-11-01 12:42:31
MD5	ca2de21d04a42228b707abce64ebbc8b
SHA1	85536ad6afee43b728ed12ee8cffca41f74f6446
SHA256	2ccb6063389f3512be2ef169e236c7474380c542abd82b4b6bcaa8dee2e3dcbe
SHA512	4ac30b417f90157d641fc3c29b2da36b95128ead0d44bc9c9c5b5bddf4ee2576549fd8332d03762b4d9c4f615e194d82881b353278d2639998f0db83ea05ea81
Imphash	e568a0358c31b8910dc7fff649d3fe0d
File Size	103384 bytes

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

Signers

Microsoft Windows Production PCA 2011	Microsoft Corporation (US)
Microsoft Root Certificate Authority 2010	Microsoft Corporation (US)
Verification	OK

File Version Information

CompanyName	Microsoft Corporation
FileDescription	Antimalware Service Executable
FileVersion	4.18.1909.6 (WinBuild.160101.0800)
InternalName	MsMpEng.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	MsMpEng.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	4.18.1909.6
Translation	0x0409 0x04b0

Portable Executable Info

Image Base:	0x140000000
Entry Point:	0x14000b650
Compilation:	1993-01-18 16:54:13
Checksum:	0x00027311 (Actual: 0x00027311)
OS Version:	10.0
PDB Path:	MsMpEng.pdb
PEiD:	PE32+ executable (GUI) x86-64, for MS Windows
Sign:	OK
Sections:	6
Imports:	ADVAPI32, KERNEL32, api-ms-win-crt-string-l1-1-0, api-ms-win-core-winrt-l1-1-0, ntdll, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-locale-l1-1-0, api-ms-win-crt-heap-l1-1-0, api-ms-win-crt-convert-l1-1-0, CRYPT32, WINTRUST,
Exports:	0
Resources:	2

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x0000e482	0x0000e600	68f82f39fef09efc8465e570e3715486	6.30
.rdata	0x00010000	0x0000590e	0x00005a00	7a67d4b2b181c2d33ff4093335bfcf2f	4.16
.data	0x00016000	0x00001528	0x00000c00	c3319475d4b4077f1f464aaa353ebde9	3.98
.pdata	0x00018000	0x00000f60	0x00001000	7dbb6118a0fb00c2c09cc948ff4cc273	4.80
.rsrc	0x00019000	0x00000a18	0x00000c00	2f6c73e20c4d4b3c917915803ed764c3	4.37
.reloc	0x0001a000	0x00000160	0x00000200	10bb397bec7f40cd6eb205a2d338c0e3	4.02

Using this site