home

change guid.exe

ChangeID

Product:
ChangeID

Version:
1.0.0.0

MD5:
7f2daddd318c367525a760d318301208

SHA-1:
c187e718abed58b835646f9d6fa924971a3a6c0b

SHA-256:
a9ced8c4a9859678461425bdb2d73a860e1faa41b2fae8c9667d90bb5ee11236

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 1:48:42 AM UTC  (today)

File size:
411 KB (420,864 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
ChangeID.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\change guid.exe

File PE Metadata
Compilation timestamp:
10/10/2013 2:07:23 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:Z7PlJE/bBsI9Yg7FcFY0YUIu9UYT7PlJE/bBsI9Yg71cFY0YUIu9UYzA:plJE5YmcbYUN9UQlJE5YmsbYUN9Up

Entry address:
0x35D1E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.6458

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
207.5 KB (212,480 bytes)

The file change guid.exe has been seen being distributed by the following URL.

https://s04.tenlua.vn/.../532fe22cbe5133591864397d30ab6dd1363bf581af10fe4ce96a93789a404c12343865e0e02c6eeb4976fdf10c6d5f02056b4890e1e35e253609c34ae99f9ad592c1bfdcc444c6aae0273603e4159c79c1088a22b20f516a85072fd6066147bcbf72e37c48562dfd8a99a2235d28842fbe74a9491a48333f17216195c7adae73ee8d02633a77e094702e8a6588c721a6e70b4f97b21cc795db9852a897fd9ddbdd97b387e0aaa512bbba39281806be3eb8fef8378122627128a7d867ce80d759fdf7caa10ceeb7942850eef1e2236e8e95c4e57e233b8385d96b93cb27bc435c4d0c11e7848041dc68519b64b2cb839f1c7b1ee2c223a9f90a1c6aba672007f561d9c1e495628d04b5670df3db83a91d0e980ff420f68c21ae0d60fc3bb3ff67993621dcd7b2b40ecba45d7ea6e853440ed079f34f14c1d2a08d94770c1b3898ccf8f55022faf13943b6b51b10873d9994dd2c6a2c6f316649731f2272c38a5040389f10f7e8d25431b59d95e79280ebc3c8dfa86a6defe15d99b0649a9927e5ad3f88a9e6426fa8a319fb656b99b9912cadec5b5fea1a6ef8a29067f6c9309c64b1250d49530371a756290166703f7a1bcbaf068cdfbf4d7206

Scan change guid.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.