We don't even need to reverse anything at this point, we will just have a look at the strings inside the benchmark executable: But that doesn't hinder us to run a reverse engineering tool (Ollydbg or IDA will do). The file's properties show that it was digitally signed to avoid modification. So "p95-bench", huh? Could this be Prime95? Let's grab the file during a benchmark run and have a look at it. After the benchmark run these files will be deleted again. The ProgramData folder and the temporary benchmark executables are marked as "hidden", so be sure to enable the setting to show hidden files in Windows Explorer to view them. It can be found in a temporary folder called: C:\ProgramData\Intel\Intel Extreme Tuning Utility\Temp This file is the actual benchmark that is being called 20 times for the whole run, once for each movement of the blue process bar.
The selected row shows the creation of a file called p95-bench(32-bit).exe or p95-bench(64-bit).exe depending on the OS and detected hardware. ProcessMonitor monitoring PerfTune.exe, the main executable of XTU
0 kommentar(er)
