home

qpmenroll.exe

Quest Password Manager

Quest Software, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘QPMEnroll’.
Publisher:
Quest Software, Inc.  (signed and verified)

Product:
Quest Password Manager

Version:
4.5.1.1690

MD5:
39f81a70e9e2a9344acdace0c3e6fbe9

SHA-1:
312e35f21c98fda1cfca8ac18fdbb610d43baf7f

SHA-256:
5b4ea4d8857edf75cde9d0ea4dd434969ca908af24192623d2bef17203e837d0

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 7:15:38 AM UTC  (today)

File size:
187.3 KB (191,792 bytes)

Product version:
4.5.1.1690

Copyright:
Copyright © 1999-2008 Quest Software, Inc.

Original file name:
QPMEnrol.exe

File type:
Executable application (Win64 EXE)

Language:
Language Neutral

Common path:
C:\Windows\System32\qpmenroll.exe

Digital Signature
Signed by:
Quest Software, Inc.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
4/23/2008 5:30:00 AM

Valid to:
4/24/2010 5:29:59 AM

Subject:
CN="Quest Software, Inc.", OU=R&D15, O="Quest Software, Inc.", L=Aliso Viejo, S=California, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
42BD42EAC9611EBDCA8B028F8EC8D80C

File PE Metadata
Compilation timestamp:
3/30/2009 5:04:50 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
3072:3KsxWKLSLPaGtY0XOPWPqd1TGIV9K36O6bpZu31ToL3V7U5msnOcjptUI:37QKrnPEqrGQp4TozV7z4OcjP

Entry address:
0x7C10

Entry point:
48, 83, EC, 28, E8, B7, A1, 00, 00, 48, 83, C4, 28, E9, 0E, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 40, 53, 48, 83, EC, 60, 48, 8B, 05, 23, 7A, 01, 00, 48, 8B, DA, 48, 8D, 54, 24, 20, 48, 89, 02, 48, 8B, 05, 19, 7A, 01, 00, 48, 89, 42, 08, 48, 8B, 05, 16, 7A, 01, 00, 48, 89, 42, 10, 48, 8B, 05, 13, 7A, 01, 00, 48, 89, 42, 18, 48, 8B, 05, 10, 7A, 01, 00, 48, 89, 42, 20, 48, 8B, 05, 0D, 7A, 01, 00, 48, 89, 42, 28, 48, 8B, 05, 0A, 7A, 01, 00, 48, 89, 42, 30, 48, 8B, 05, 07, 7A, 01...
 
[+]

Entropy:
5.9369

Code size:
119.5 KB (122,368 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
QPMEnroll

Command:
C:\Windows\System32\qpmenroll.exe


Scan qpmenroll.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.