home

hscrollfun.exe

HScroll Application

Chicony Electronics Co., Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘aHScrollutility’. This is installed with ThinkPad Compact Keyboard with TrackPoint driver.
Publisher:
Lenovo  (signed by Chicony Electronics Co., Ltd.)

Product:
HScroll Application

Version:
1.2.0.5

MD5:
fd29a319369f06dd429ebc04041c94dd

SHA-1:
e237ac1de8526e5a4a61738269f7d699e5366803

SHA-256:
ac2b5ad0d20589c83c5e739c9d7b44659822568dc8063a139bf8d3bfc5c5b6ec

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 8:49:54 PM UTC  (today)

File size:
70.3 KB (72,016 bytes)

Product version:
1.2.0.5

Copyright:
Copyright (C) 2013

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\lenovo\thinkpad compact keyboard with trackpoint driver\hscrollfun.exe

Digital Signature
Signed by:
Chicony Electronics Co., Ltd.

Authority:
VeriSign, Inc.

Valid from:
10/3/2012 9:00:00 AM

Valid to:
10/3/2015 8:59:59 AM

Subject:
CN="Chicony Electronics Co., Ltd.", OU=Keyboard, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Chicony Electronics Co., Ltd.", L=Taipei, S=Taiwan, C=TW

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7A329B53E3FBF61A1B815EFF620FDC85

File PE Metadata
Compilation timestamp:
6/16/2015 5:27:42 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
768:zD/fb7UPYoSEVQuWHKkt21Tgg/Vn45A7DPVT/k29ohTzIbyFEtOFNTE:vfoSECVHKkkxP/VnV7Dtkya4jtOFNw

Entry address:
0x4144

Entry point:
E8, 9D, 1B, 00, 00, E9, 16, FE, FF, FF, 56, 6A, 01, 68, 64, E0, 40, 00, 8B, F1, E8, 1D, 1C, 00, 00, C7, 06, 6C, B6, 40, 00, 8B, C6, 5E, C3, C7, 01, 6C, B6, 40, 00, E9, 78, 1C, 00, 00, 56, 8B, F1, C7, 06, 6C, B6, 40, 00, E8, 6A, 1C, 00, 00, F6, 44, 24, 08, 01, 74, 07, 56, E8, 21, FC, FF, FF, 59, 8B, C6, 5E, C2, 04, 00, 56, FF, 74, 24, 08, 8B, F1, E8, F2, 1B, 00, 00, C7, 06, 6C, B6, 40, 00, 8B, C6, 5E, C2, 04, 00, 55, 8B, EC, 83, EC, 0C, EB, 0D, FF, 75, 08, E8, BF, 1E, 00, 00, 85, C0, 59, 74, 0F, FF, 75, 08...
 
[+]

Entropy:
6.0470

Code size:
40 KB (40,960 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
aHScrollutility

Command:
C:\Program Files\lenovo\thinkpad compact keyboard with trackpoint driver\hscrollfun.exe


The file hscrollfun.exe has been discovered within the following program.

 
Powered by Should I Remove It?

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.