» ProduKey.exe
Overview
Analysis
File Details
Programs (2)

ProduKey.exe

ProduKey

NirSoft

File name:

ProduKey.exe

Publisher:

NirSoft

Product:

ProduKey

Version:

1.53

MD5:

12507d0c4b2963ba229e02ff961ec400

SHA-1:

6a9b296e5b614457f106cfc8ed6fc24bd75ba9aa

SHA-256:

bbcb52b0538c81d9ced034e2c0435188bcd1d36f09bce76654f494e4d5dcdb0c

Scanner detections:

15 / 68

Status:

Clean (15 probable false positive detections)

Explanation:

These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:

9/19/2026 6:35:48 AM UTC (today)

Scan engine

Detection

Engine version

AVG

HackTool

2015.0.3596

Baidu Antivirus

Hacktool.Win32.Keyfinder

4.0.3.14113

Comodo Security

ApplicUnsaf.Win32.PSWTool.ProductKey.~A

17590

Dr.Web

Tool.PassSteel.591

9.0.1.013

ESET NOD32

Win32/PSWTool.ProductKey

8.9277

Fortinet FortiGate

Riskware/ProductKey

1/13/2014

Kaspersky

not-a-virus:PSWTool.Win32.ProductKey

14.0.0.4473

Malwarebytes

PUP.PSWTool.ProductKey

v2014.01.13.10

McAfee

Artemis!12507D0C4B29

5600.7252

Microsoft Security Essentials

HackTool:Win32/ProductKey

1.165.247.01

MicroWorld eScan

Win32/PSWTool.ProductKey

15.0.0.39

NANO AntiVirus

Riskware.Win32.ProductKey.hyzon

0.28.0.57029

Sophos

NirSoft

4.96

Trend Micro House Call

HKTL_PASSVIEW

7.2.13

Trend Micro

HKTL_PASSVIEW

10.465.13

File size:

37 KB (37,888 bytes)

Product version:

1.53

Original file name:

ProduKey.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Documents and Settings\{user}\Local settings\temp\{random}.tmp\nirsoft utilities\produkey.exe

File PE Metadata

Compilation timestamp:

8/2/2011 3:37:44 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

768:XfiIU0Se3EW0u5FyJZ6vimApd1+zX8PwEHwQY/+hDkuvvyTfKu:XfijLe3/KZEimS+7JmwCt/vCfKu

Entry address:

0x158A0

Entry point:

60, BE, 00, E0, 40, 00, 8D, BE, 00, 30, FF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

32 KB (32,768 bytes)

The file ProduKey.exe has been discovered within the following programs.

NirSoft ProduKey by NirSoft

Publisher's description - “ProduKey is a small utility that displays the ProductID and the CD-Key of Microsoft Office (Microsoft Office 2003, Microsoft Office 2007), Windows (Including Windows 7 and Windows Vista), Exchange Server, and SQL Server installed on your computer.”

www.nirsoft.net/utils/product_cd_key_viewer.html

6% remove it

ProduKey by NirSoft

About 8% of users remove it

Scan ProduKey.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.