home

AVDm.exe

彩りプラスの設定

NEC Personal Computers, Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘AVDM’.
Publisher:
NEC Personal Computers, Ltd.  (signed and verified)

Product:
彩りプラスの設定

Version:
3, 1, 0, 4

MD5:
6cfa0ea9555bd08ae1c9f4055f49e710

SHA-1:
6c8aa094a0a2e13a9f933e209655b25f20b4f617

SHA-256:
cfa5ad0e0f9cb429262067520e16dcfed2571be1d21a254b8e7ac3f3921b6657

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 1:39:06 PM UTC  (today)

File size:
887.3 KB (908,592 bytes)

Product version:
3.0.0.0

Copyright:
Copyright (C) NEC Personal Computers, Ltd. 2008-2014

Original file name:
AVDm.exe

File type:
Executable application (Win64 EXE)

Common path:
C:\Program Files\avdm\avdm.exe

Digital Signature
Signed by:
NEC Personal Computers, Ltd.

Authority:
VeriSign, Inc.

Valid from:
5/24/2013 9:00:00 AM

Valid to:
6/13/2014 8:59:59 AM

Subject:
CN="NEC Personal Computers, Ltd.", OU=PDD3, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="NEC Personal Computers, Ltd.", L=Shinagawa-ku, S=Tokyo, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
01A96959CA187E666DB195ECBC99A549

File PE Metadata
Compilation timestamp:
2/17/2014 12:13:53 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:042n3jXqvgHy2h54gvfWKvPeibhCH+6N4BV784ybgOQuzTCJx7JteEPku2uj:0gg7Egvd2NA784ybgOQuGXbd

Entry address:
0x65490

Entry point:
48, 83, EC, 28, E8, A7, 69, 00, 00, 48, 83, C4, 28, E9, 0E, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 48, 89, 5C, 24, 08, 57, 48, 83, EC, 20, 48, 8D, 05, 37, 8F, 02, 00, 8B, DA, 48, 8B, F9, 48, 89, 01, E8, 32, 6A, 00, 00, F6, C3, 01, 74, 08, 48, 8B, CF, E8, 61, 39, FD, FF, 48, 8B, C7, 48, 8B, 5C, 24, 30, 48, 83, C4, 20, 5F, C3, CC, CC, CC, CC, CC, CC, CC, 4C, 8D, 41, 11, 48, 83, C2, 11, 4C, 2B, C2, 66, 90, 66, 66, 90, 0F, B6, 0A, 42, 0F, B6, 04, 02, 2B, C8, 75, 08, 48, 83, C2, 01...
 
[+]

Entropy:
6.2685

Code size:
524.5 KB (537,088 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
AVDM

Command:
C:\Program Files\avdm\avdm.exe \resident


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.