» folderclone.exe
Overview
Analysis
File Details
Behaviors (1)

folderclone.exe

FolderClone

Salty Brine Software

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘folderclone’.

File name:

folderclone.exe

Publisher:

Salty Brine Software (signed and verified)

Product:

FolderClone

Version:

2.00.0001

MD5:

8d4731f5bf89eab266280bdf31bc9054

SHA-1:

7f2d50562aeecdfd952cbc079a36b05d67c553b8

SHA-256:

b869b68aad0729fe46fdc71ee4612ffda32dccf79f65481b50d26e99834a9adf

Scanner detections:

2 / 68

Status:

Clean (2 probable false positive detections)

Explanation:

These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:

4/25/2024 11:15:00 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Quick Heal

(Suspicious) - DNAScan

7.16.-

Sophos

Sus/ComPack

16.07.24

File size:

782.6 KB (801,344 bytes)

Product version:

2.00.0001

Original file name:

folderclonepro.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\folderclone\folderclone.exe

Digital Signature

Signed by:

Salty Brine Software

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

12/1/2007 12:44:17 AM

Valid to:

11/30/2008 12:44:17 AM

Subject:

CN=Salty Brine Software, OU=Secure Application Development, O=Salty Brine Software, L=Palm Coast, S=Florida, C=US

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

04F5C76E5DCC156D8410AB2138DB4B67

File PE Metadata

Compilation timestamp:

9/5/2008 10:50:53 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

24576:JrcxaLkVRJFUwNUaoL2dMEktfOumvwRGf1BX98:TCJe0oL2CxOTvwe1D8

Entry address:

0x2CCEE9

Entry point:

E8, 3B, FF, FF, FF, 05, 28, 1B, 00, 00, FF, E0, E8, 2F, FF, FF, FF, 05, 9D, 05, 00, 00, FF, E0, E8, 04, 00, 00, 00, FF, FF, FF, FF, 5E, C3, 00, 25, 4A, EF, B2, E0, F5, 30, 42, 38, C4, D2, 38, AC, 71, B0, 4F, 36, 9A, EB, 21, A0, 19, 77, 9E, E3, 00, 9B, 91, 7F, 6B, CF, 19, B7, FD, 6E, DB, A7, DE, 3E, C4, 74, AE, AE, E1, 86, 85, 8C, 2E, CF, 8E, FF, 3C, B9, F2, 5C, ED, 37, 22, BC, A0, 7E, 71, 84, C9, 50, EB, F5, 20, 89, 0D, B2, C6, 1C, A9, 6E, 88, DF, 43, DC, 64, 65, 0B, C7, 01, 3A, EE, 1F, F1, 30, 09, 8B, F2... 
[+]

Entropy:

7.9872 (probably packed)

Code size:

1.7 MB (1,781,760 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

folderclone

Command:

C:\Program Files\folderclone\folderclone.exe

Scan folderclone.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.