home

WinSnap.exe

WinSnap

Avdonin Aleksandr Nikolaevich Ip

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘WinSnap’.
Publisher:
NTWind Software  (signed by Avdonin Aleksandr Nikolaevich Ip)

Product:
WinSnap

Version:
4.5.6.0

MD5:
6c34732ee22688a4883f2c4b505bf25b

SHA-1:
807eb48073fb9429366c78551ccb13c45c46bece

SHA-256:
82e0f5b35a86eeb8714a71f01aa7a6b5c21d5f7db6149579516b7a20cecf96ea

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/2/2024 12:55:55 AM UTC  (today)

File size:
4.4 MB (4,588,800 bytes)

Product version:
4.5.6.0

Copyright:
© 2014 NTWind Software

Original file name:
WinSnap.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\winsnap\winsnap.exe

Digital Signature
Signed by:
Avdonin Aleksandr Nikolaevich Ip

Authority:
COMODO CA Limited

Valid from:
4/6/2015 4:00:00 AM

Valid to:
4/6/2020 3:59:59 AM

Subject:
CN=Avdonin Aleksandr Nikolaevich Ip, O=Avdonin Aleksandr Nikolaevich Ip, STREET=Menshikovsky pr. 3-25, L=Saint Petersburg, S=Saint Petersburg, PostalCode=195067, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00A85424288E71BB47FDA0EF066BF39471

File PE Metadata
Compilation timestamp:
8/5/2015 5:09:37 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:LO/vzngLCBfFvEc486+K7sT4lC/q1ICeWUwgNXc0HpN1NY:LKngLY8c4fpsCNeWsJN1a

Entry address:
0x6C3CE

Entry point:
E8, 35, 59, 00, 00, E9, 79, FE, FF, FF, 3B, 0D, C0, 65, 63, 00, 75, 02, F3, C3, E9, B7, 59, 00, 00, 8B, FF, 51, C7, 01, 00, 41, 5C, 00, E8, AF, 5A, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, A6, 4A, FD, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, F3, 5A, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 8B, 75, 14, 57, 33, FF, 3B, F7, 75, 04, 33, C0, EB, 65, 39, 7D...
 
[+]

Code size:
1.7 MB (1,811,968 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
WinSnap

Command:
"C:\Program Files\winsnap\winsnap.exe" \startup


Scan WinSnap.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.