home

ExpandITClientManager.exe

ExpandIT Client Manager

ExpandIT Development Aps

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ExpandIT Client Manager - Desktop Client’.
Publisher:
ExpandIT Development Aps  (signed and verified)

Product:
ExpandIT Client Manager

Version:
5.0.0.71

MD5:
0a643735e62cacb5fd13fdfacb879352

SHA-1:
ff419c394c9d8ea92abb6a7e342a6c2d6c17b4fb

SHA-256:
db6c4e384f9a4a50a681e1ef4750c3da90fba9ce9bd694b22b7d4ea3058af0d9

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
7/13/2025 9:48:59 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
W32/Ramnit.A
7.11.30.172

File size:
503.1 KB (515,128 bytes)

Product version:
5.0.0.71

Copyright:
Copyright © ExpandIT Development 2015

Original file name:
ExpandITClientManager.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\expandit\client manager - desktop client\expanditclientmanager.exe

Digital Signature
Signed by:
ExpandIT Development Aps

Authority:
Thawte, Inc.

Valid from:
11/5/2013 1:00:00 AM

Valid to:
11/5/2015 12:59:59 AM

Subject:
CN=ExpandIT Development Aps, OU=SECURE APPLICATION DEVELOPMENT, O=ExpandIT Development Aps, L=Hoersholm, S=Copenhagen, C=DK

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2E68CE3CC8FF2D8FCDD7F339CD22AE06

File PE Metadata
Compilation timestamp:
5/26/2015 10:48:08 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:8I7iU11O/TK7KQycxq0V1I6rQwusq2cuKEs7nR3VxU/CGZtHn0iArQwusq2cu8:rxq0PIbwuFY8RnTSRnFwuFY8

Entry address:
0x6531E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
397 KB (406,528 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ExpandIT Client Manager - Desktop Client

Command:
"C:\Program Files\expandit\client manager - desktop client\expanditclientmanager.exe"


Scan ExpandITClientManager.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.