{75d18da0-d6da-25a0-4eda-9fd08b43961d}.sys file report

MD5 8f1d927bb531755e54dc23dcfa176a0c
Latest seen 2024-03-25 23:01:25 (2 years ago)
First seen 2024-03-25 23:01:25 (2 years ago)
Size 225 KB
Publisher Gen Digital Inc.
Product Antivirus

Why it matters

Evidence available for this file

Detection

Latest status is clean for this hash.

Timeline

First seen 2024-03-25 23:01:25 (2 years ago); latest analysis 2024-03-25 23:01:25 (2 years ago).

Publisher context

Company metadata: Gen Digital Inc.. Product metadata: Antivirus.

Digital signature

Signed by Microsoft Windows Hardware Compatibility Publisher. ThreatInfo marks this publisher as trusted for this record.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Confirm the hash and publisher match the expected software.
  2. Review the observed locations and signature information below.
  3. Rescan if the file was downloaded from an unknown source or appears in an unusual path.

{75d18da0-d6da-25a0-4eda-9fd08b43961d}.sys is a Windows file recorded in the ThreatInfo database. It is associated with Antivirus. The reported company name is Gen Digital Inc.. The current detection status is Clean, based on the latest analysis from 2024-03-25 23:01:25 (2 years ago).

This record is currently marked as clean, but file reputation can depend on the exact path, hash, and source. Compare the MD5 and publisher data below with the file on your system.

Product Name: Antivirus
Company Name: Gen Digital Inc.
MD5: 8f1d927bb531755e54dc23dcfa176a0c
Size: 225 KB
First Published: 2024-03-25 23:01:25 (2 years ago)
Latest Published: 2024-03-25 23:01:25 (2 years ago)
Status: Clean (on last analysis)
Analysis Date: 2024-03-25 23:01:25 (2 years ago)
Signed By: Microsoft Windows Hardware Compatibility Publisher
Status: Trusted Publisher

ThreatInfo marks this publisher as trusted for this record, but the file hash and source should still match the expected software distribution.

%windir%
%windir%

ThreatInfo has observed {75d18da0-d6da-25a0-4eda-9fd08b43961d}.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is United States with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for {75d18da0-d6da-25a0-4eda-9fd08b43961d}.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

{75d18da0-d6da-25a0-4eda-9fd08b43961d}.sys is identified as pe for 64 systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Native
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000140000000
Entry Address: 0x00069000

PE Sections:

Name Size of data MD5
.text 176640 2670cdd9562ce24d95449215f6b85d56
.rdata 18944 336643c77b315731f410b33d702d194a
.data 3072 a9828ffe6c55ba0a47d551f16ab3527c
.pdata 5632 5b7f4e8d85730b9a69feaaaf58714cbc
PAGE 7680 8e91c6c407b3a3635eec82d0d7e57672
.edata 512 0ff1d26f28e5ed6af9ebd1c8cbb5539c
INIT 5632 0422787cc99d5b914e5de734129ebcc4
.rsrc 1024 fd72326c66ccc688e1a126023de52b54
.reloc 1024 61f95dd965e5721917b823b1fa51581f

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: