home

CGServiSignKeeper.exe

CGServiSignKeeper.exe

Changing Information Technology Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘CGServiSign’.
Publisher:
Changing Information Technology Inc.  (signed and verified)

Product:
CGServiSignKeeper.exe

Version:
1.0.16.0826

MD5:
5aa53ed6fc3b09fdde1e238e66fbe66d

SHA-1:
42a14ae185b7d09681b8ef52851c19c6ba9c8479

SHA-256:
4f8df24273a0cc42fb0577ca6437ab3c8e14b8d31a275d63abd16d0e565fa232

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 6:18:10 PM UTC  (today)

File size:
168.5 KB (172,584 bytes)

Product version:
1.0.16.0826

Copyright:
Changing Information Technology Inc.

Original file name:
CGServiSignKeeper.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\changingtec\cgservisign\cgservisignkeeper.exe

Digital Signature
Signed by:
Changing Information Technology Inc.

Authority:
Symantec Corporation

Valid from:
4/10/2015 8:00:00 AM

Valid to:
6/9/2017 7:59:59 AM

Subject:
CN=Changing Information Technology Inc., O=Changing Information Technology Inc., L=Hsinchu, S=Taiwan, C=TW

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
7365EDE7F8FBB1476702D29308396F51

File PE Metadata
Compilation timestamp:
9/1/2016 4:09:02 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0x7B9E

Entry point:
E8, C4, 54, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 38, 31, 42, 00, E8, EC, 3D, 00, 00, E8, 95, 56, 00, 00, 0F, B7, F0, 6A, 02, E8, 57, 54, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 1E, 3C, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.5318

Code size:
105.5 KB (108,032 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
CGServiSign

Command:
"C:\Program Files\changingtec\cgservisign\cgservisignkeeper.exe"


Scan CGServiSignKeeper.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.