How to remove gsam.exe

gsam.exe

The module gsam.exe has been detected as Suspicious Object

gsam.exe

gsam.exe is a Windows file recorded in the ThreatInfo database. It is associated with Gridinsoft® Anti-Malware. The reported company name is Gridinsoft LLC. The current detection status is Suspicious Object, based on the latest analysis from 2024-08-10 23:01:09 (2 years ago).

If gsam.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Suspicious Object.

Product Name: Gridinsoft® Anti-Malware
Company Name: Gridinsoft LLC
MD5: 0c17e11087b9743bd06f68e5bb2096b0
Size: 25 MB
First Published: 2024-08-10 23:01:09 (2 years ago)
Latest Published: 2024-08-10 23:01:09 (2 years ago)
Status: Suspicious Object (on last analysis)
Analysis Date: 2024-08-10 23:01:09 (2 years ago)
Signed By: GRIDINSOFT, TOV
Status: Valid

The signature on gsam.exe is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

%startup%

ThreatInfo has observed gsam.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is Barbados with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for gsam.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

gsam.exe is identified as pe for 64 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000000400000
Entry Address: 0x00ee0f40

PE Sections:

Name Size of data MD5
.text 15806464 ffeafb9d1b6a679ca9e7ef71bdd8e585
.data 1403392 38659487a69ec5f0ef51e03aefc62aa7
.bss 0 d41d8cd98f00b204e9800998ecf8427e
.idata 37888 76c2e1578d9bd3c142f8c9d0d0372ee2
.didata 6144 9b759dacd1a6f34bbec69a5a41228b71
.edata 512 b2af9dd004fe5a515caa08072cccc426
.tls 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 512 7f56411ba46ba6d44619e3b8cf87b261
.reloc 759296 1c61007c8fddd896d6c632c4bdee795b
.pdata 800256 831ce3ec95da13bfdb1fcfa58eb0f328
.rsrc 8303104 faf5e0bfbc565a54d097af1c7521fd43

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information:

Download GridinSoft Anti-Malware - Removal tool for gsam.exe