» AgendaAP32.exe
Overview
Analysis
File Details
Behaviors (1)

AgendaAP32.exe

AKS

AGENDA Informationssysteme GmbH & Co. KG

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Agenda-Arbeitsplatz’.

File name:

AgendaAP32.exe

Publisher:

AGENDA Informationssysteme GmbH & Co. KG (signed and verified)

Product:

AKS

Description:

AGENDA-AP

Version:

15.0.1.6986

MD5:

007a3d6cde204ac64c9065cbe89bdc52

SHA-1:

58f142815a9b6a8667d0664df2f6be3097a1141a

SHA-256:

fb34ecff8a90497c9dc12645974e872a28fbbb296b9969dd071d1d524ac8916e

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/24/2024 10:28:25 PM UTC (today)

File size:

28.7 MB (30,084,688 bytes)

Product version:

15.0.1.6986

Trademarks:

Agenda

Original file name:

AgendaAP32.exe

File type:

Executable application (Win32 EXE)

Language:

German (Germany)

Digital Signature

Signed by:

AGENDA Informationssysteme GmbH & Co. KG

Authority:

Thawte, Inc.

Valid from:

5/22/2012 2:00:00 AM

Valid to:

7/24/2014 1:59:59 AM

Subject:

CN=AGENDA Informationssysteme GmbH & Co. KG, OU=Technik, O=AGENDA Informationssysteme GmbH & Co. KG, L=Rosenheim, S=Bayern, C=DE

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

236DF731C2BF52345C1C84B287F5F6EA

File PE Metadata

Compilation timestamp:

5/23/2014 2:27:52 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

393216:j+OYRi36mBrVQbcdkFBSKlpJF0dSz8t/mN8Z8Ni7xW0OFEcR7ZZJRtMsIFjrFj3V:jsiv+AdPf8Yxs9rAwRJ6

Entry address:

0x15EC37C

Entry point:

55, 8B, EC, 83, C4, E8, 53, 33, C0, 89, 45, EC, 89, 45, E8, B8, 48, 43, 9C, 01, E8, A3, 0B, A2, FE, 33, C0, 55, 68, 63, C5, 9E, 01, 64, FF, 30, 64, 89, 20, 8D, 55, E8, 33, C0, E8, 17, 8B, A1, FE, 8B, 45, E8, 8D, 55, EC, E8, 74, 80, A3, FE, 8D, 45, EC, BA, 7C, C5, 9E, 01, E8, B7, D0, A1, FE, 8B, 4D, EC, B2, 01, A1, B4, 2D, 47, 00, E8, 94, 6D, A8, FE, A3, F4, F9, B0, 01, 33, C0, 55, 68, 4C, C4, 9E, 01, 64, FF, 30, 64, 89, 20, B8, F8, F9, B0, 01, E8, EF, 19, 27, FF, 6A, 01, 8B, 0D, F8, F9, B0, 01, BA, A8, C5... 
[+]

Developed / compiled with:

Microsoft Visual C++

Code size:

21.9 MB (22,983,680 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Agenda-Arbeitsplatz

Command:

C:\agenda\agendaap\prog\agendaap32.exe

Scan AgendaAP32.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.