home

phdskmnt.sys

Arsenal Image Mounter

Arsenal Consulting, Inc.

Publisher:
Arsenal Recon  (signed by Arsenal Consulting, Inc.)

Product:
Arsenal Image Mounter

Version:
1.0.6.19

MD5:
c4a67405de2659d8b4a00d63b441bca1

SHA-1:
900c88a532201f234244e5cd69b4e1b1c2c7faaf

SHA-256:
3ff5f12748e974548c092b780b87b1c7c865203e95c5fac9d3c9ce51db97c1d4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 2:19:27 PM UTC  (today)

File size:
37.3 KB (38,152 bytes)

Product version:
1.0.6.19

Copyright:
Copyright: (c) Arsenal Recon. All Rights Reserved.

Original file name:
phdskmnt.sys

File type:
Driver (Win32 SYS)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\win8\x86\phdskmnt.sys

Digital Signature
Signed by:
Arsenal Consulting, Inc.

Authority:
GlobalSign nv-sa

Valid from:
11/21/2013 11:04:56 PM

Valid to:
11/21/2016 11:04:56 PM

Subject:
E=info@ArsenalExperts.com, CN="Arsenal Consulting, Inc.", O="Arsenal Consulting, Inc.", L=Chelsea, S=MA, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121855E05C9ED766EF8E8A7DD69DD25C19B

File PE Metadata
Compilation timestamp:
9/10/2015 10:53:31 PM

OS version:
6.3

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
12.0

CTPH (ssdeep):
768:qAiIZokOMQzvqc1bHxxMDNthH/tjYCwXCEFlXocCdO2wLI:vdOM0tpPM1H/tjUAN

Entry address:
0x58BA

Entry point:
8B, FF, 55, 8B, EC, E8, 4C, 38, 00, 00, 5D, E9, 36, 37, 00, 00, 3B, 0D, 08, 80, 40, 00, 75, 03, C2, 00, 00, E9, 00, 00, 00, 00, 8B, FF, 55, 8B, EC, 51, 89, 4D, FC, 6A, 02, 59, CD, 29, FF, 25, 28, 71, 40, 00, FF, 25, 70, 70, 40, 00, FF, 25, 74, 70, 40, 00, FF, 25, 80, 70, 40, 00, FF, 25, 84, 70, 40, 00, FF, 25, 88, 70, 40, 00, FF, 25, 3C, 71, 40, 00, FF, 25, 30, 71, 40, 00, FF, 25, 34, 71, 40, 00, FF, 25, 38, 71, 40, 00, C3, CC, 50, 68, 44, 73, 6B, 4D, 6E, 74, 3A, 3A, 49, 6D, 53, 63, 73, 69, 55, 6E, 6C, 6F...
 
[+]

Entropy:
6.7500

Code size:
25.5 KB (26,112 bytes)

Scan phdskmnt.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.