home

qm.exe

Quick Macros

Gintaras Didzgalvis

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Quick Macros’.
Publisher:
Gintaras Didzgalvis  (signed and verified)

Product:
Quick Macros

Version:
2, 2, 1, 5

MD5:
3f5d224905bbcac8845e27a292a01bad

SHA-1:
408197d77b790d7345906986797a099194dbfc9f

SHA-256:
bcba3d139c995b11ff0bc48a566061f48e6b628cbb5d21d8cad50cee32af2875

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 11:45:01 AM UTC  (today)

File size:
1.1 MB (1,164,856 bytes)

Product version:
2, 2, 1, 5

Copyright:
Copyright © 2001-2006 Gintaras Didzgalvis

Original file name:
qm.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\quick macros 2\qm.exe

Digital Signature
Signed by:
Gintaras Didzgalvis

Authority:
GlobalSign nv-sa

Valid from:
1/26/2007 3:24:34 PM

Valid to:
1/26/2008 3:24:34 PM

Subject:
E=support@quickmacros.com, CN=Gintaras Didzgalvis, C=LT

Issuer:
CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:
010000000001105ECB1E2A

File PE Metadata
Compilation timestamp:
12/31/2007 9:39:54 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
24576:Gf4QN0Qi1+fel825GSxCFewNYfjhm61WtbvQ:S4F445NENTaWtbvQ

Entry address:
0xC65B6

Entry point:
6A, 60, 68, 18, 9C, 4E, 00, E8, 46, 10, 00, 00, BF, 94, 00, 00, 00, 8B, C7, E8, 22, DE, FF, FF, 89, 65, E8, 8B, F4, 89, 3E, 56, FF, 15, 8C, 73, 4D, 00, 8B, 4E, 10, 89, 0D, 9C, 0F, 50, 00, 8B, 46, 04, A3, A8, 0F, 50, 00, 8B, 56, 08, 89, 15, AC, 0F, 50, 00, 8B, 76, 0C, 81, E6, FF, 7F, 00, 00, 89, 35, A0, 0F, 50, 00, 83, F9, 02, 74, 0C, 81, CE, 00, 80, 00, 00, 89, 35, A0, 0F, 50, 00, C1, E0, 08, 03, C2, A3, A4, 0F, 50, 00, 33, F6, 56, 8B, 3D, 90, 73, 4D, 00, FF, D7, 66, 81, 38, 4D, 5A, 75, 1F, 8B, 48, 3C, 03...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v7.0

Code size:
856 KB (876,544 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Quick Macros

Command:
"C:\Program Files\quick macros 2\qm.exe" s


Scan qm.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.