home

WatAdminSvc.exe

Windows Activation Technologies Service

Microsoft Corporation

It runs as a scheduled task under the Windows Task Scheduler named ValidationTask triggered to automatically run when the computer boots.
Publisher:
Microsoft Corporation

Product:
Microsoft® Windows® Operating System

Description:
Windows Activation Technologies Service

Version:
7.1.7600.16395 (win7_gdr_oob_gaoob(wmbla).100127-1757)

MD5:
2eea96d75066f9c4dea0a4bd6877e0ac

SHA-1:
1d90f1779aaae3d6647a159223249aec53030801

SHA-256:
d3e8da61dcda914af102be9636435a8d2ee1e18ce9d30477e89d11971548195e

Scanner detections:
2 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
5/1/2024 7:18:21 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Xpirat-B
160917-0

Dr.Web
Win32.Expiro.100
9.0.1.05190

File size:
1.8 MB (1,910,272 bytes)

Product version:
7.1.7600.16395

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
WatAdminSvc.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\wat\watadminsvc.exe

File PE Metadata
Compilation timestamp:
12/23/2009 4:38:10 AM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

Entry address:
0x1499D

Entry point:
51, 52, 56, 57, BE, EC, 83, 02, 00, 8D, 15, 00, 60, 1D, 01, 8D, 0D, E1, 7E, 00, 00, 8D, 3D, 2D, 02, 00, 00, 0F, AF, CF, 81, C1, C4, 79, 00, 00, E8, 19, 00, 00, 00, BE, B8, CF, 00, 00, BA, 00, D0, 2E, 01, B9, 51, 0D, 17, 01, E8, 05, 00, 00, 00, 5F, 3B, CA, 75, 23, 8B, 39, 81, F7, 49, 95, 67, 7C, 89, 3A, 4E, 41, 4E, 41, 81, C2, 04, 00, 00, 00, 4E, 4E, 41, 41, 83, FE, 00, 74, 05, E9, DE, FF, FF, FF, C3, 57, 8D, 15, 00, 60, 1D, 01, BE, 32, 03, 00, 00, B9, 00, 00, 00, 10, BF, 05, 00, 00, 00, 0F, AF, F7, 81, C6...
 
[+]

Entropy:
7.8897  (probably packed)

Code size:
1 MB (1,078,272 bytes)

Scheduled Task
Task name:
ValidationTask

Path:
\Microsoft\Windows\Windows Activation Technologies\ValidationTask

Trigger:
Boot (Runs on boot)

Description:
Microsoft Update KB971033


Scan WatAdminSvc.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.