home

hscrollfun.exe

HScroll Application

Chicony Electronics Co., Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘aHScrollutility’. This is installed with ThinkPad Compact Keyboard with TrackPoint driver.
Publisher:
Lenovo  (signed by Chicony Electronics Co., Ltd.)

Product:
HScroll Application

Version:
1.2.0.2

MD5:
586cf387dc7b333224bc8e730aece33f

SHA-1:
68d82d97e216cd4e926422351f0b7fb7011842ab

SHA-256:
529d241559ce7b43735da434a58bb78d2b34f0ab3dcf39268f8e7ac5935cbe17

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
7/4/2025 12:06:45 AM UTC  (today)

File size:
70.3 KB (72,016 bytes)

Product version:
1.2.0.2

Copyright:
Copyright (C) 2013

File type:
Executable application (Win32 EXE)

Language:
Taiwanese

Common path:
C:\Program Files\lenovo\thinkpad compact keyboard with trackpoint driver\hscrollfun.exe

Digital Signature
Signed by:
Chicony Electronics Co., Ltd.

Authority:
VeriSign, Inc.

Valid from:
10/2/2012 9:00:00 PM

Valid to:
10/2/2015 8:59:59 PM

Subject:
CN="Chicony Electronics Co., Ltd.", OU=Keyboard, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Chicony Electronics Co., Ltd.", L=Taipei, S=Taiwan, C=TW

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7A329B53E3FBF61A1B815EFF620FDC85

File PE Metadata
Compilation timestamp:
3/24/2013 3:24:36 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
768:RNov/65KlmtMPSdErRaxq9ECzKuGfrCbB3C1Mi4qk7HUjViPjKdEtdcFsL:O/SdEspG+jEoVkw5+ftdceL

Entry address:
0x3DF9

Entry point:
E8, 98, 1B, 00, 00, E9, 16, FE, FF, FF, 6A, 0C, 68, 98, CF, 40, 00, E8, 91, 19, 00, 00, 8B, 75, 08, 85, F6, 74, 75, 83, 3D, A8, FA, 40, 00, 03, 75, 43, 6A, 04, E8, C8, 1D, 00, 00, 59, 83, 65, FC, 00, 56, E8, 36, 1E, 00, 00, 59, 89, 45, E4, 85, C0, 74, 09, 56, 50, E8, 52, 1E, 00, 00, 59, 59, C7, 45, FC, FE, FF, FF, FF, E8, 0B, 00, 00, 00, 83, 7D, E4, 00, 75, 37, FF, 75, 08, EB, 0A, 6A, 04, E8, B6, 1C, 00, 00, 59, C3, 56, 6A, 00, FF, 35, 9C, F7, 40, 00, FF, 15, 94, B0, 40, 00, 85, C0, 75, 16, E8, EB, 1B, 00...
 
[+]

Code size:
40 KB (40,960 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
aHScrollutility

Command:
C:\Program Files\lenovo\thinkpad compact keyboard with trackpoint driver\hscrollfun.exe


The file hscrollfun.exe has been discovered within the following programs.

 
Powered by Should I Remove It?

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.