Gridinsoft Logo
File Icon

The ProcessHacker.exe (Process Hacker) File Analysis

Updated 10 months ago
Checked by Malware Check
ProcessHacker.exe

Technical Analysis

File Name ProcessHacker.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (GUI) x86-64, for MS Windows
SSDEEP Hash
24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
Scanner Version 1.0.185.174
Database Version 2024-08-28 00:00:30 UTC
⚠

Suspicious File Detected

Detected by 32 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
44%
Detection Rate
1,719,840
File Size (bytes)
32/72
Engines Detected
2024-08-28
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
b365af317ae730a67c936f21432b9c71
SHA1
a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA256
bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
SHA512
cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
ImpHash
3695333c60dedecdcaff1590409aa462

Security Engines with Detections (32 of 72)

Bkav
W32.Common.29828E3F Malicious
Lionic
Riskware.Win32.ProcessHacker.1!c Malicious
DrWeb
Tool.ProcessHacker.6 Malicious
FireEye
Application.ProcessHacker.1 Malicious
CAT-QuickHeal
Hacktool.ProcHacker.P7 Malicious
Malwarebytes
RiskWare.ProcessHacker Malicious
Sangfor
HackTool.Win32.ProcessHacker.uwccg Malicious
K7AntiVirus
Unwanted-Program ( 005447321 ) Malicious
K7GW
Unwanted-Program ( 005447321 ) Malicious
Symantec
Hacktool.ProcHack!g1 Malicious
Elastic
malicious (high confidence) Malicious
Cynet
Malicious (score: 100) Malicious
Kaspersky
not-a-virus:HEUR:RiskTool.Win32.ProcHack.gen Malicious
BitDefender
Application.ProcessHacker.1 Malicious
Tencent
Malware.Win32.Gencirc.10be95ec Malicious
Emsisoft
Application.ProcessHacker.1 (B) Malicious
VIPRE
Application.ProcessHacker.1 Malicious
TrendMicro
PUA.Win64.ProcHack.YACIU Malicious
Sophos
Process Hacker (PUA) Malicious
GData
Application.ProcessHacker.1 Malicious
Webroot
Pua.Riskware.Phacker Malicious
Antiy-AVL
RiskWare[RiskTool]/Win32.ProcHack Malicious
Arcabit
Application.ProcessHacker.1 Malicious
ZoneAlarm
not-a-virus:HEUR:RiskTool.Win32.ProcHack.gen Malicious
ALYac
Misc.Riskware.ProcessHacker Malicious
Cylance
unsafe Malicious
Panda
HackingTool/ProcHack Malicious
TrendMicro-HouseCall
PUA.Win64.ProcHack.YACIU Malicious
MaxSecure
Trojan.Malware.10181834.susgen Malicious
Fortinet
Riskware/ProcHackTool Malicious
DeepInstinct
MALICIOUS Malicious
CrowdStrike
win/grayware_confidence_100% (W) Malicious
40 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 269727acacba789cd7a93601617416ed
Fuzzy: c2b74ba8bb134400487ce1be7b5c9c96
dHash: f8a48686aeb6f3e0
Image Base 0x140000000
Entry Point 0x1400e2efc
Compilation Time 2016-03-29 01:34:01
Checksum 0x001b2b53 (Actual: 0x001b2b53)
OS Version 5.2
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path D:\Projects\processhacker2\bin\Release64\ProcessHacker.pdb
Digital Signature OK
Imports 13 libraries
Exports 740 functions
Resources 161 Resources
Sections 7 Sections

Version Information

▼
CompanyName wj32
FileDescription Process Hacker
FileVersion 2.39.0.124
InternalName Process Hacker
LegalCopyright Licensed under the GNU GPL, v3.
OriginalFilename ProcessHacker.exe
ProductName Process Hacker
ProductVersion 2.39.0.124
Translation 0x0c09 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,047,968 bytes 1,048,064 bytes 6.43 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ ECA8352520F4B9DDA07E80BC8229743E
.rdata 0x00101000 329,190 bytes 329,216 bytes 5.32 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ EFC4EC8CC481B183BD5C0E824CBF9354
.data 0x00152000 54,288 bytes 26,624 bytes 2.71 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C14BD08711B2FE07B9F5AC5A3730770F
.pdata 0x00160000 48,192 bytes 48,640 bytes 6.11 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F0AE2A668F95D86B63C06F8315AEEC2A
.gfids 0x0016c000 216 bytes 512 bytes 2.19 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1729715966E7FAED8F4FF77B63FFDFC0
.rsrc 0x0016d000 244,976 bytes 245,248 bytes 5.75 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E8B0EDE1D50F51F153B90FB261B2E8CC
.reloc 0x001a9000 5,376 bytes 5,632 bytes 5.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 934C7B774E3832420945C4F0F141A311

Resource Analysis

▼
Total Resources: 161 (236,615 bytes)
Resource Type Count Total Size Percentage
AFX_DIALOG_LAYOUT 13 26 bytes
0%
RT_BITMAP 2 2,128 bytes
0.9%
RT_ICON 45 173,267 bytes
73.2%
RT_MENU 18 7,350 bytes
3.1%
RT_DIALOG 70 50,432 bytes
21.3%
RT_ACCELERATOR 2 216 bytes
0.1%
RT_GROUP_ICON 9 684 bytes
0.3%
RT_VERSION 1 756 bytes
0.3%
RT_MANIFEST 1 1,756 bytes
0.7%

Certificate Chain Analysis

▼
Certificate Information
Product Process Hacker
Description Process Hacker
File Version 2.39.0.124
Original Name ProcessHacker.exe
Signing Date 01:35 AM 03/29/2016 (3386 days ago)
Verification Status Signed
Signers Wen Jia Liu; DigiCert High Assurance Code Signing CA-1; DigiCert
Counter Signers DigiCert Timestamp Responder; DigiCert Assured ID CA-1; DigiCert
Internal Name Process Hacker
Copyright Licensed under the GNU GPL, v3.
Certificate Chain Summary
Wen Jia Liu #1 Primary
Validity Period: 2013-10-30 00:00:00 → 2017-01-04 12:00:00
Signature Algorithm: sha1RSA
Serial Number: 0F F1 EF 66 BD 62 1C 65 B7 4B 4D E4 14 25 71 7F
DigiCert Timestamp Responder #2 Chain
Validity Period: 2014-10-22 00:00:00 → 2024-10-22 00:00:00
Signature Algorithm: sha1RSA
Serial Number: 03 01 9A 02 3A FF 58 B1 6B D6 D5 EA E6 17 F0 66
DigiCert High Assurance Code Signing CA-1 #3 Chain
Validity Period: 2011-02-11 12:00:00 → 2026-02-10 12:00:00
Signature Algorithm: sha1RSA
Serial Number: 02 C4 D1 E5 8A 4A 68 0C 56 8D A3 04 7E 7E 4D 5F
DigiCert Assured ID CA-1 #4 Chain
Validity Period: 2006-11-10 00:00:00 → 2021-11-10 00:00:00
Signature Algorithm: sha1RSA
Serial Number: 06 FD F9 03 96 03 AD EA 00 0A EB 3F 27 BB BA 1B
Wen Jia Liu #5 Chain
Validity Period: 2013-10-30 00:00:00 → 2017-01-04 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 04 0C B4 1E 4F B3 70 C4 5C 43 44 76 51 62 58 2F
DigiCert SHA2 High Assurance Code Signing CA #6 Chain
Validity Period: 2013-10-22 12:00:00 → 2028-10-22 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 0B 7E 10 90 3C 38 49 0F FA 2F 67 9A 87 A1 A7 B9
DigiCert SHA2 Timestamp Responder #7 Chain
Validity Period: 2015-12-24 00:00:00 → 2025-01-07 00:00:00
Signature Algorithm: sha256RSA
Serial Number: 02 CE 42 94 59 02 A4 F3 C0 40 B0 FF 77 93 D1 4F
DigiCert SHA2 Assured ID Timestamping CA #8 Chain
Validity Period: 2016-01-07 12:00:00 → 2031-01-07 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 0A A1 25 D6 D6 32 1B 7E 41 E4 05 DA 36 97 C2 15

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
32 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware