home

EmsService.exe

Credant External Media Shield

Credant Technologies

It runs as a separate (within the context of its own process) windows Service named “EMS”.
Publisher:
CREDANT Technologies, Inc.  (signed by Credant Technologies)

Product:
Credant External Media Shield

Description:
External Media Encryption Service.

Version:
7.3.0.7359

MD5:
a5d55bb9217ca9b416ff59087f2e0905

SHA-1:
810b90de60244f6f53dc79c7fe4869b18329562b

SHA-256:
5d53e7649a6029486a6026177dd4a36887c17bea3d963676183388360af6acc3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/1/2024 6:57:55 AM UTC  (today)

File size:
1.9 MB (1,947,480 bytes)

Product version:
7.3.0.7359

Copyright:
Copyright© 2002-2012 CREDANT Technologies, Inc.

Trademarks:
CREDANT®, CREDANT Technologies®, and the CREDANT logo® tagline are registered trademarks of CREDANT Technologies, Inc. All other trademarks used herei

Original file name:
EmsService.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\emsservice.exe

Digital Signature
Signed by:
Credant Technologies

Authority:
VeriSign, Inc.

Valid from:
7/6/2014 5:00:00 PM

Valid to:
8/1/2017 4:59:59 PM

Subject:
CN=Credant Technologies, O=Credant Technologies, L=Addison, S=Texas, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
59D03504CC1EE9298C29FC88AB37A703

File PE Metadata
Compilation timestamp:
10/8/2015 8:38:27 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows Console

Linker version:
8.0

CTPH (ssdeep):
49152:VRwCOpY1rCxZO9alIiqhsdbKPjKf25rZe224woM5XNG0Tfnmn9c:VRwCOpY1rCxZOElIiqhsdbKrKkAr

Entry address:
0xA1280

Entry point:
48, 83, EC, 28, E8, 37, 0C, 01, 00, 48, 83, C4, 28, E9, 4E, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 0F, B7, 01, 66, 85, C0, 74, 12, 66, 3B, C2, 74, 12, 66, 8B, 41, 02, 48, 83, C1, 02, 66, 85, C0, 75, EE, 66, 39, 11, 75, 04, 48, 8B, C1, C3, 33, C0, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 44, 0F, B7, 09, 66, 45, 85, C9, 74, 39, 44, 0F, B7, 12, 66, 90, 66, 45, 85, D2, 4C, 8B, C2, 74, 1B, 41, 0F, B7, C2, 66, 66, 90, 66, 41, 3B, C1, 74, 20, 66, 41, 8B, 40, 02, 49, 83, C0, 02, 66...
 
[+]

Entropy:
6.1179

Code size:
1.2 MB (1,249,280 bytes)

Service
Display name:
EMS

Description:
Encrypts files on external media

Type:
Win32OwnProcess

Group:
Device Security

Depends on:
CmgShieldCEF


Scan EmsService.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.