» kfiwizard.dll
Overview
Analysis
File Details
Behaviors (1)

kfiwizard.dll

KFI Wizard

TrigoldCrystal

File name:

kfiwizard.dll

Publisher:

Trigold (signed by TrigoldCrystal)

Product:

KFI Wizard

Version:

9.01.0022

MD5:

80feba4b1b1481fd501e471e00b24ed4

SHA-1:

3a822f7484488c7ecce4a0280fa41d766a1d18ed

SHA-256:

6b42275d6a1aea35cb1a1b78bb719496c51ba55fa74709ba4df57af26181cf4f

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/24/2024 10:47:00 AM UTC (today)

File size:

7.5 MB (7,906,376 bytes)

Product version:

9.01.0022

Original file name:

kfiwizard.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\trigoldcrystal\prospector\kfiwizard.dll

Digital Signature

Signed by:

TrigoldCrystal

Authority:

Thawte, Inc.

Valid from:

6/25/2012 1:00:00 AM

Valid to:

8/6/2013 12:59:59 AM

Subject:

CN=TrigoldCrystal, O=TrigoldCrystal, L=Bromsgrove, S=Worcestershire, C=GB

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

7FD523E0F42E19F9A9BAD0BAC2409DA6

Registration

CLSIDs:

{0CAFC2B8-28D0-44C2-B0DA-8F1EA638EEF9}, {35C341B6-C282-4F5B-9FBF-C42EAD51A1E4}, {4085EE89-62E7-4769-80FC-DA8CE03A2840}, {6854E48F-91F7-41DC-B9BE-84A737189FAE}, {6A287FA3-8F23-45FE-A5BB-2CD1F31DDE72}, {A56356DC-66D4-468C-B7D0-243B8CBF7D0E}

ProgIDs:

KFIWizard.clsKFI, KFIWizard.CLaunchKFI, KFIWizard.CAutomation

COM registered:

Yes

File PE Metadata

Compilation timestamp:

9/19/2012 10:19:08 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

196608:ITe0Mbxh0sohf2OcmckS2Z2HJpRN3qKwhbWmUtLP9beqPzRvXKK:IypWKwhbWmy1tXKK

Entry address:

0x2CCD4

Entry point:

5A, 68, 0C, DC, 71, 11, 68, 10, DC, 71, 11, 52, E9, E7, FF, FF, FF, 00, 00, 00, 48, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 49, C8, D8, A2, B2, 41, 10, 41, 83, 41, 00, B3, E7, A4, 46, B7, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 42, 00, 06, 50, 83, 01, 4B, 46, 49, 57, 69, 7A, 61, 72, 64, 00, 00, 00, 44, FE, 91, 01, 00, 00, 00, 00, 10, DE, FD, 00, B0, 00, 00, 00, 90, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 7E, 00, 00, 00, 73, 12, 80, F8, 38, 77, D0, 46, 87, 51, 1D, C1, EA, 00, 3D, 24... 
[+]

Entropy:

6.1561

Developed / compiled with:

Microsoft Visual Basic v6.0

Code size:

7.1 MB (7,397,376 bytes)

Automation Object

CLSID:

{0CAFC2B8-28D0-44C2-B0DA-8F1EA638EEF9}

CLSID name:

KFIWizard.clsKFI

Scan kfiwizard.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.