home

folderclone.exe

FolderClone

Salty Brine Software

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘folderclone’.
Publisher:
Salty Brine Software  (signed and verified)

Product:
FolderClone

Version:
2.01

MD5:
793c8e5746d15b951932e7c5383f1c7c

SHA-1:
79d30dfaf398ff14aac809cd93a841018e6c8be6

SHA-256:
e46ec0d6f906c672ee23f299579bd3ad1605de82d64403eaa304c44f75983260

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 4:21:06 AM UTC  (today)

File size:
1.2 MB (1,226,656 bytes)

Product version:
2.01

Original file name:
folderclonepro.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\folderclone\folderclone.exe

Digital Signature
Signed by:
Salty Brine Software

Authority:
COMODO CA Limited

Valid from:
8/11/2014 4:00:00 AM

Valid to:
8/11/2016 3:59:59 AM

Subject:
CN=Salty Brine Software, OU=Salty Brine Software, O=Salty Brine Software, STREET=PO Box 353326, STREET=Palm Coast, L=Art Araya, S=FL, PostalCode=32135, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00A553424F4B641712FEBE04340D6B73FE

File PE Metadata
Compilation timestamp:
8/26/2014 3:25:14 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:D/GAAO0L4vSvG3TdUeVw1KwjuMLDFa1XImp7fdRhkcAyT:DGAbyY3ZUxcwjuMP8Yg6ct

Entry address:
0x470472

Entry point:
E8, 3B, FF, FF, FF, 05, 16, 04, 00, 00, FF, E0, E8, 2F, FF, FF, FF, 05, 8B, 06, 00, 00, FF, E0, E8, 04, 00, 00, 00, FF, FF, FF, FF, 5E, C3, 00, FE, 7A, CC, 6D, 0E, 75, C9, A5, C4, 78, 81, 7C, 8F, 9D, F7, 71, CA, FF, 52, 2D, 1B, 90, 6B, C5, 25, AB, 75, 80, 51, 0C, 13, DA, 82, 79, 92, 3A, E9, 0E, 28, 7F, B3, 64, 47, 22, D7, 67, F8, A6, 1E, 04, 1C, C9, AA, 3A, 4B, FA, 47, 48, D8, 68, 01, 0A, 54, A6, 5E, 19, 97, FC, 7A, 35, BA, FC, A0, E5, 6F, 19, 4B, 8D, F8, 0C, 62, 99, 90, 5C, 3A, 80, DD, CF, 8E, 1F, 22, 6B...
 
[+]

Entropy:
7.9905  (probably packed)

Code size:
2.9 MB (3,063,808 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
folderclone

Command:
C:\Program Files\folderclone\folderclone.exe


Scan folderclone.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.