» es4.runtask.exe
Overview
Analysis
File Details
Behaviors (1)

es4.runtask.exe

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Unattend0000000001{40F3AF95-C2BF-4272-BD81-D24F81FF353F}’.

File name:

es4.runtask.exe

Description:

RunTask.Null.Exe - iTianKong.com

Version:

1.0.2.6

MD5:

b5cd242124951360780192e75306fd8a

SHA-1:

83589762f5d7652a4bb8797e299f6371e1484e2f

SHA-256:

5a3877b29a389f27a8c9ac430cc5100903d9845102ac1e8d68594b4bb2e7a4bc

Scanner detections:

3 / 68

Status:

Inconclusive (not enough data for an accurate detection)

Analysis date:

7/29/2026 5:43:47 AM UTC (today)

Scan engine

Detection

Engine version

herdProtect (fuzzy)

variant of fss.exe

2015.10.22.20

IKARUS anti.virus

Trojan.SuspectCRC

t3scan.1.9.2.0

Rising Antivirus

PE:Trojan.Win32.Injector.fw!1075357566

23.00.65.15824

File size:

522 KB (534,528 bytes)

Product version:

1.0

File type:

Executable application (Win32 EXE)

Language:

Chinese (Simplified, China)

Common path:

C:\windows\es4\es4.runtask.exe

File PE Metadata

Compilation timestamp:

12/11/2014 10:05:11 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:cOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPioQ5PMye9X:cq5TfcdHj4fmbW5PMyel

Entry address:

0x105F60

Entry point:

60, BE, 00, 20, 4B, 00, 8D, BE, 00, F0, F4, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

340 KB (348,160 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Unattend0000000001{40F3AF95-C2BF-4272-BD81-D24F81FF353F}

Command:

C:\windows\es4\es4.runtask.exe -gotodesktop

Scan es4.runtask.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.