cancelautoplay.exe

ZTE CORPORATION

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘CancelAutoPlay.exe’.
Scan cancelautoplay.exe - Powered by Reason Core Security
Publisher:
ZTE CORPORATION  (signed and verified)

MD5:
8a6f221ba8ad1cee191f21595331b530

SHA-1:
cdd1f59e78a035f088c71bb6d7518e91e06b533a

SHA-256:
a0882966c2d0b812b07b2b4d6a5144afcbe6814a89d852a8566b435b0f6e1171

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/6/2016 7:24:11 AM UTC  (today)

File size:
73.6 KB (75,328 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\une 4g revolution\bin\cancelautoplay.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
3/8/2012 7:00:00 PM

Valid to:
4/25/2015 6:59:59 PM

Subject:
CN=ZTE CORPORATION, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=ZTE CORPORATION, L=Shenzhen, S=Guangdong, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
48D6383A8D149C1CDCE69A728BDD24F6

File PE Metadata
Compilation timestamp:
8/31/2011 3:13:36 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1536:eA0pV7CNz6HRPVuLi7V3H4xCymdkrcNQ5nJxdi:MntVuLXC18WQ5ng

Entry address:
0x20A4

Entry point:
E8, A8, 45, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 08, 11, 41, 00, 89, 0D, 04, 11, 41, 00, 89, 15, 00, 11, 41, 00, 89, 1D, FC, 10, 41, 00, 89, 35, F8, 10, 41, 00, 89, 3D, F4, 10, 41, 00, 66, 8C, 15, 20, 11, 41, 00, 66, 8C, 0D, 14, 11, 41, 00, 66, 8C, 1D, F0, 10, 41, 00, 66, 8C, 05, EC, 10, 41, 00, 66, 8C, 25, E8, 10, 41, 00, 66, 8C, 2D, E4, 10, 41, 00, 9C, 8F, 05, 18, 11, 41, 00, 8B, 45, 00, A3, 0C, 11, 41, 00, 8B, 45, 04, A3, 10, 11, 41, 00, 8D, 45, 08, A3, 1C, 11, 41...
 
[+]

Code size:
42.5 KB (43,520 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
CancelAutoPlay.exe

Command:
"C:\Program Files\une 4g revolution\bin\cancelautoplay.exe"


Scan cancelautoplay.exe - Powered by Reason Core Security