ProgModCon Posted September 5, 2015 ID:987269 Share Posted September 5, 2015 Please review attached file. This started happening today.Thank youpupilicensemanagergui.zippupilicensemanagergui.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 5, 2015 Staff ID:987270 Share Posted September 5, 2015 Do you have a scan log or what program this is part of? Link to post Share on other sites More sharing options...
ProgModCon Posted September 5, 2015 Author ID:987272 Share Posted September 5, 2015 Hi, I used virustotal.com This is the additional information:MD5 d4a49931af3c098db50b3842a3f7ce79SHA1 8548d1b8e79614d1beea2224fc55b6efa4120905SHA256 02bc963b117488d6106b4c2882620789a7e6e440166ec354fb1b9311a504fd5fssdeep768:GFJrEL8d+GxaIE5TZq9rvKq8bm7oLcHOAK9S+rD3OdEh5CK4MNvYAgRcK7hK8T4n:Ar0AaIE5QVmb2js8+rr4MqKMh+moy820authentihash 172f077e582e5dd57c5a05ab60283d6792140b3e43568697fae26777692e0eafimphash f34d5f2d4577ed6d9ceec516c1f5a744File size 64.0 KB ( 65544 bytes )File type Win32 EXEMagic literalPE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly TrID Generic CIL Executable (.NET, Mono, etc.) (51.3%) Win64 Executable (generic) (19.3%) Win32 EXE Yoda's Crypter (18.6%) Win32 Dynamic Link Library (generic) (4.6%) Win32 Executable (generic) (3.1%) Tagspeexe assembly overlay VirusTotal metadataFirst submission 2015-09-04 12:51:59 UTC ( 1 day, 5 hours ago )Last submission 2015-09-05 17:53:25 UTC ( 0 minutes ago ) File names pupilicensemanagergui.exe And the file info:The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem. FileVersionInfo propertiesCopyrightCopyright © 2014Product AeijOriginal name pupilicensemanagergui.exeInternal name pupilicensemanagergui.exeFile version 1.0.0.0Description Aeij PE header basic informationTarget machine Intel 386 or later processors and compatible processorsCompilation timestamp 2015-08-06 02:42:01Entry Point 0x0000C9BENumber of sections 3 .NET detailsModule Version ID 335e45d6-69ba-4d0b-b837-12f04ed0067bTypeLib ID 385d3d05-b8cc-47d8-854f-0877f9d00fcb PE sectionsName Virtual address Virtual size Raw size Entropy MD5.text 8192 43460 43520 7.47 40dd753a94a6ce4de66e957674dcacba.rsrc 57344 20932 20992 7.78 6a091433e0d80a58bd9566b0c1d7915f.reloc 81920 12 512 0.08 d3fb05a2ed8c79f4b6357f822b08e82e OverlaysMD5 4e136e9d316116d4b1ad565b73d2ef4cFile type dataOffset 65536Size 8Entropy 3.00 PE imports[+] mscoree.dll Number of PE resources by typeRT_MANIFEST 1RT_VERSION 1APPRES 1 Number of PE resources by languageNEUTRAL 3 ExifTool file metadataSubsystemVersion4.0LinkerVersion8.0ImageVersion0.0FileSubtype0FileVersionNumber1.0.0.0UninitializedDataSize0LanguageCodeNeutralFileFlagsMask0x003fCharacterSetUnicodeInitializedDataSize21504EntryPoint0xc9beOriginalFileNamepupilicensemanagergui.exeMIMETypeapplication/octet-streamLegalCopyrightCopyright 2014FileVersion1.0.0.0TimeStamp2015:08:06 03:42:01+01:00FileTypeWin32 EXEPETypePE32InternalNamepupilicensemanagergui.exeProductVersion1.0.0.0FileDescriptionAeijOSVersion4.0FileOSWin32SubsystemWindows GUIMachineTypeIntel 386 or later, and compatiblesCodeSize43520ProductNameAeijProductVersionNumber1.0.0.0FileTypeExtensionexeObjectFileTypeExecutable applicationAssemblyVersion1.0.0.0 Link to post Share on other sites More sharing options...
ProgModCon Posted September 5, 2015 Author ID:987273 Share Posted September 5, 2015 the program is a license manager and it runs independently. Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 5, 2015 Staff ID:987274 Share Posted September 5, 2015 A license manager for what program? Trying to document. So this wasnt from a scan of your computer? Link to post Share on other sites More sharing options...
ProgModCon Posted September 5, 2015 Author ID:987275 Share Posted September 5, 2015 It is the license manager for a library called PUPI: visualprogramminglanguage.comI can download Malwarebytes and run a scan if that helps. Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 5, 2015 Staff ID:987276 Share Posted September 5, 2015 Thanks. This will be fixed next update. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now