The Procmon.exe (Process Monitor) File Analysis

Updated 9 days ago

Checked by Malware Check

Procmon.exe

Technical Analysis

File Name	Procmon.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.221.174
Database Version	2025-07-23 23:00:31 UTC

✓

Clean File

No threats detected by our scanner

0%

Detection Rate

4,124,696

File Size (bytes)

2025-07-23

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	c3e77b6959cc68baee9825c84dc41d9c
SHA1	bc18a67ad4057dd36f896a4d411b8fc5b06e5b2f
SHA256	3b7ea4318c3c1508701102cf966f650e04f28d29938f85d74ec0ec2528657b6e
SHA512	f825521149f4e771c9f51abaa4fa956258a5393754ec7422692dc0c24c120ed9f103dd3953b47b7bb331dd4095b3e97b95fb35c4dfe03ce39574ba4b39b76d7d
ImpHash	b6b70847ec4b6d39f641691853d7b02b

PE Analysis

Basic Information

▼

Icon	Hash: 41c71ebe6dbfbbc3b6eb27a42f034ada Fuzzy: 9239c7fc3c314c1879f3945a0f53f974 dHash: 00a20a33ad8bb1c2
Image Base	`0x00400000`
Entry Point	`0x004a7f70`
Compilation Time	2024-06-20 16:54:12
Checksum	0x003fafd7 (Actual: 0x003fafd7)
OS Version	6.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`C:\__w\1\s\exe\Win32\Release\Procmon.pdb`
Digital Signature	OK
Imports	16 libraries
Exports	0 functions
Resources	286 Resources
Sections	5 Sections

Version Information

▼

CompanyName	Sysinternals - www.sysinternals.com
FileDescription	Process Monitor
FileVersion	4.01
InternalName	Process Monitor
LegalCopyright	Copyright © 1996-2024 Mark Russinovich
OriginalFilename	Process Monitor
ProductName	Sysinternals Procmon
ProductVersion	4.01
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	895,514 bytes	896,000 bytes	6.49 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`C6ED2F3BBF67E568C851504195AFFBCD`
`.rdata`	`0x000dc000`	238,162 bytes	238,592 bytes	4.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`597AEFE050C33B81855E0890CBEC24F5`
`.data`	`0x00117000`	101,584 bytes	26,624 bytes	4.77 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A0C8C3B820A7E23DC0D75AFA2C1FC5B8`
`.rsrc`	`0x00130000`	2,893,344 bytes	2,893,824 bytes	4.89 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6497C002C68058FA59AE5F89FCA62712`
`.reloc`	`0x003f3000`	57,972 bytes	58,368 bytes	6.70 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3A0BF19774A737279730A0B246265FEB`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 286 (2,878,080 bytes)

Resource Type	Count	Total Size	Percentage
AFX_DIALOG_LAYOUT	31	1,910 bytes	0.1%
BINRES	2	2,212,808 bytes	76.9%
INI	1	1,175 bytes	0%
RT_CURSOR	2	616 bytes	0%
RT_ICON	160	619,805 bytes	21.5%
RT_MENU	6	3,342 bytes	0.1%
RT_DIALOG	38	30,338 bytes	1.1%
RT_STRING	9	2,440 bytes	0.1%
RT_ACCELERATOR	2	280 bytes	0%
RT_GROUP_CURSOR	2	40 bytes	0%
RT_GROUP_ICON	31	2,426 bytes	0.1%
RT_VERSION	1	816 bytes	0%
RT_MANIFEST	1	2,084 bytes	0.1%

Certificate Chain Analysis

▼

Certificate Information

Product	Sysinternals Procmon
Description	Process Monitor
File Version	4.01
Original Name	Process Monitor
Signing Date	04:54 PM 06/20/2024 (407 days ago)
Verification Status	Signed
Signers	Microsoft Corporation; Microsoft Code Signing PCA 2011; Microsoft Root Certificate Authority 2011
Counter Signers	Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010
Internal Name	Process Monitor
Copyright	Copyright © 1996-2024 Mark Russinovich

Certificate Chain Summary

Microsoft Windows Hardware Compatibility Publisher #1 Primary

Validity Period: 2023-10-19 19:50:13 → 2024-10-16 19:50:13

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 01 0A F9 67 00 02 A9 7C BC D3 00 00 00 00 01 0A

Microsoft Windows Third Party Component CA 2012 #2 Chain

Validity Period: 2012-04-18 23:48:38 → 2027-04-18 23:58:38

Signature Algorithm: sha256RSA

Serial Number: 61 0B AA C1 00 00 00 00 00 09

Microsoft Time-Stamp Service #3 Chain

Validity Period: 2023-12-06 18:45:34 → 2025-03-05 18:45:34

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 01 EB E0 18 6C B5 B6 EF 38 ED 00 01 00 00 01 EB

Microsoft Time-Stamp PCA 2010 #4 Chain

Validity Period: 2021-09-30 18:22:25 → 2030-09-30 18:32:25

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

Microsoft Time-Stamp Service #5 Chain

Validity Period: 2023-10-12 19:07:09 → 2025-01-10 19:07:09

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 01 DD 5D 57 1D 95 D4 AD AA 1B 00 01 00 00 01 DD

Microsoft Corporation #6 Chain

Validity Period: 2023-11-16 19:09:00 → 2024-11-14 19:09:00

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 03 AF 30 40 0E 4C A3 4D 05 41 00 00 00 00 03 AF

Microsoft Code Signing PCA 2011 #7 Chain

Validity Period: 2011-07-08 20:59:09 → 2026-07-08 21:09:09

Signature Algorithm: sha256RSA

Serial Number: 61 0E 90 D2 00 00 00 00 00 03

Microsoft Time-Stamp Service #8 Chain

Validity Period: 2023-10-12 19:07:25 → 2025-01-10 19:07:25

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 01 E2 99 99 95 F1 DC E3 20 EB 00 01 00 00 01 E2

Microsoft Time-Stamp Service #9 Chain

Validity Period: 2023-12-06 18:45:51 → 2025-03-05 18:45:51

Signature Algorithm: sha256RSA

Serial Number: 33 00 00 01 F0 2A 7C 1D 59 3B E6 1F AD 00 01 00 00 01 F0

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

This file passed all security checks, but stay vigilant. New malware variants appear daily that can evade detection. Always verify files come from official sources and check digital signatures when available.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now

Gridinsoft Anti-Malware