home

ren2cap.sys

Prosoft Engineering, Inc.

It runs as a Windows kernel mode device driver named “Hear”.
Publisher:
Prosoft Engineering, Inc.  (signed and verified)

MD5:
1a04f508769c150b04d231b2f49a2d70

SHA-1:
6435c6e97424106a99eb3acd8eef725ca6b1a1cc

SHA-256:
75680881ef8de3b7c700b2a33bd8879457bded16566081563065b4e213f5d2b8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/6/2024 6:09:31 PM UTC  (today)

File size:
31.1 KB (31,816 bytes)

File type:
Driver (Win32 SYS)

Common path:
C:\Windows\System32\drivers\ren2cap.sys

Digital Signature
Signed by:
Prosoft Engineering, Inc.

Authority:
GoDaddy.com, Inc.

Valid from:
2/3/2016 5:33:38 AM

Valid to:
5/3/2019 4:18:38 AM

Subject:
CN="Prosoft Engineering, Inc.", O="Prosoft Engineering, Inc.", L=Livermore, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4040AD38094C880F

File PE Metadata
Compilation timestamp:
6/15/2016 5:49:08 AM

OS version:
10.0

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
14.0

CTPH (ssdeep):
384:syNAp4qud4TbgvYYW3K1qU1Z+hztEQy0Nk/cRC5CfcGQJ2sMKZOnYPLVd5Gn9MfO:s8SuwKhT+QQdN0pHysMKoqGz

Entry address:
0x9018

Entry point:
8B, FF, 55, 8B, EC, E8, 06, 00, 00, 00, 5D, E9, D8, FF, FF, FF, 8B, FF, 55, 8B, EC, 51, 51, A1, 68, 76, 40, 00, B9, 4E, E6, 40, BB, 85, C0, 74, 04, 3B, C1, 75, 15, 0F, 31, 35, 68, 76, 40, 00, A3, 68, 76, 40, 00, 75, 07, 8B, C1, A3, 68, 76, 40, 00, F7, D0, A3, 6C, 76, 40, 00, 8B, E5, 5D, C3, CC, CC, CC, 4C, 91, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 2C, 92, 00, 00, 98, 60, 00, 00, C8, 90, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 84, 94, 00, 00, 14, 60, 00, 00, B4, 90, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.5369

Code size:
17 KB (17,408 bytes)

Driver
Display name:
Hear

Service name:
REN2CAP_DRIVER

Type:
Kernel device driver (KernelDriver)


Scan ren2cap.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.