home

thidpatch.exe

HIDPATCH

Magic Control Technology Corp.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘THIDPATCH’.
Publisher:
Generic Provider  (signed by Magic Control Technology Corp.)

Product:
HIDPATCH

Version:
1.0.0.2

MD5:
5ca8048b67ad41a844c2f352b83a001b

SHA-1:
61e65956b928d20ade06e5cdf56f37eef1c5a243

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 5:53:53 PM UTC  (today)

File size:
247.7 KB (253,608 bytes)

Product version:
1.0.0.2

Copyright:
2006 (c) <Generic Provider>. All rights reserved.

Original file name:
HIDPATCH.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\thidpatch.exe

Digital Signature
Signed by:
Magic Control Technology Corp.

Authority:
VeriSign, Inc.

Valid from:
7/25/2006 2:00:00 AM

Valid to:
7/27/2009 1:59:59 AM

Subject:
CN=Magic Control Technology Corp., OU=GM' Secretary, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Magic Control Technology Corp., L=Chungho City, S=Chung Ho, C=TW

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7D7A597CA6054D9ED70BE941566CEE85

File PE Metadata
Compilation timestamp:
11/24/2006 4:34:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
6144:Y2sIkbm1uJdx9zTT6IvF/VEDYimoy0J5SE3EPf:Y5dbmMJ/9zT+g/rzz0J5lEPf

Entry address:
0xCEB2

Entry point:
6A, 60, 68, 80, A2, 42, 00, E8, 1A, 15, 00, 00, BF, 94, 00, 00, 00, 8B, C7, E8, 46, FF, FF, FF, 89, 65, E8, 8B, F4, 89, 3E, 56, FF, 15, B8, 71, 42, 00, 8B, 4E, 10, 89, 0D, 30, 51, 43, 00, 8B, 46, 04, A3, 3C, 51, 43, 00, 8B, 56, 08, 89, 15, 40, 51, 43, 00, 8B, 76, 0C, 81, E6, FF, 7F, 00, 00, 89, 35, 34, 51, 43, 00, 83, F9, 02, 74, 0C, 81, CE, 00, 80, 00, 00, 89, 35, 34, 51, 43, 00, C1, E0, 08, 03, C2, A3, 38, 51, 43, 00, 33, F6, 56, 8B, 3D, EC, 71, 42, 00, FF, D7, 66, 81, 38, 4D, 5A, 75, 1F, 8B, 48, 3C, 03...
 
[+]

Entropy:
6.2237

Developed / compiled with:
Microsoft Visual C++ v7.0

Code size:
152 KB (155,648 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
THIDPATCH

Command:
C:\Windows\System32\thidpatch.exe


Scan thidpatch.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.