home

hscrollfun.exe

HScroll Application

Chicony Electronics Co., Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘aHScrollutility’. This is installed with ThinkPad Compact Keyboard with TrackPoint driver.
Publisher:
Lenovo  (signed by Chicony Electronics Co., Ltd.)

Product:
HScroll Application

Version:
1.2.0.7

MD5:
042827ad38920bfbf61c0fd81c566abc

SHA-1:
c40c21c1e47682a0949bbcc0fc0ecc91f4b1016a

SHA-256:
a359df6efa9a3d616b46ccd0b60ea2512d79e2e929fb30ea7c388d0db4331604

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
7/3/2025 10:26:05 PM UTC  (today)

File size:
71.6 KB (73,344 bytes)

Product version:
1.2.0.7

Copyright:
Copyright (C) 2016

File type:
Executable application (Win32 EXE)

Language:
Chinese (Traditional, Taiwan)

Common path:
C:\Program Files\lenovo\thinkpad compact keyboard with trackpoint driver\hscrollfun.exe

Digital Signature
Signed by:
Chicony Electronics Co., Ltd.

Authority:
DigiCert Inc

Valid from:
9/30/2015 2:00:00 AM

Valid to:
9/28/2018 2:00:00 PM

Subject:
CN="Chicony Electronics Co., Ltd.", O="Chicony Electronics Co., Ltd.", L=New Taipei City, C=TW, PostalCode=248, STREET="No.25,Wugong 6th Rd.", SERIALNUMBER=20954200, OID.1.3.6.1.4.1.311.60.2.1.3=TW, OID.2.5.4.15=Private Organization

Issuer:
CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0EA288BFFBD933A1AF0AA0DA16C0C36C

File PE Metadata
Compilation timestamp:
3/11/2016 7:58:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
1536:n3wKomECSOKrTEKQv/VzVnjpnknyLjtu8DNPUC:ngKoz9GD/XtusN

Entry address:
0x40C4

Entry point:
E8, 9D, 1B, 00, 00, E9, 16, FE, FF, FF, 56, 6A, 01, 68, 64, E0, 40, 00, 8B, F1, E8, 1D, 1C, 00, 00, C7, 06, 4C, B6, 40, 00, 8B, C6, 5E, C3, C7, 01, 4C, B6, 40, 00, E9, 78, 1C, 00, 00, 56, 8B, F1, C7, 06, 4C, B6, 40, 00, E8, 6A, 1C, 00, 00, F6, 44, 24, 08, 01, 74, 07, 56, E8, 21, FC, FF, FF, 59, 8B, C6, 5E, C2, 04, 00, 56, FF, 74, 24, 08, 8B, F1, E8, F2, 1B, 00, 00, C7, 06, 4C, B6, 40, 00, 8B, C6, 5E, C2, 04, 00, 55, 8B, EC, 83, EC, 0C, EB, 0D, FF, 75, 08, E8, BF, 1E, 00, 00, 85, C0, 59, 74, 0F, FF, 75, 08...
 
[+]

Code size:
40 KB (40,960 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
aHScrollutility

Command:
C:\Program Files\lenovo\thinkpad compact keyboard with trackpoint driver\hscrollfun.exe


The file hscrollfun.exe has been discovered within the following program.

 
Powered by Should I Remove It?

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.