» fpmon.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

fpmon.exe

Folder Phantom Redux

Ziff Davis Media, Inc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘FP_Monitor’. This is installed with Folder Phantom Redux.

File name:

fpmon.exe

Publisher:

Ziff Davis Inc. (signed by Ziff Davis Media, Inc)

Product:

Folder Phantom Redux

Description:

Folder Phantom Redux Application

Version:

2.0

MD5:

900e5f19d5c51627cfe9065f8d4244b1

SHA-1:

cb2972b1b17a7621301136869f199ba19175bbec

SHA-256:

185a7e174a769056e7d4861a14e21c67b5bbc7f5a7632b84a488ba65b0b5df88

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/19/2024 10:24:04 PM UTC (today)

File size:

249.4 KB (255,400 bytes)

Product version:

2.0

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\pc magazine utilities\folder phantom redux\fpmon.exe

Digital Signature

Signed by:

Ziff Davis Media, Inc

Authority:

VeriSign, Inc.

Valid from:

10/29/2009 8:00:00 PM

Valid to:

11/1/2011 7:59:59 PM

Subject:

CN="Ziff Davis Media, Inc", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Ziff Davis Media, Inc", L=New York, S=New York, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

4B0AC40C224C7476FD33786D81EBCAA0

File PE Metadata

Compilation timestamp:

9/25/2011 3:23:11 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

3072:fJLBHp+os/O0qSiiHCzSYGhoeK8pf30JgOfyhNFKq:fJLBTzX8OTGhoeK8pf30JZygq

Entry address:

0x144D

Entry point:

E8, 1A, 21, 00, 00, E9, 79, FE, FF, FF, 2D, A4, 03, 00, 00, 74, 22, 83, E8, 04, 74, 17, 83, E8, 0D, 74, 0C, 48, 74, 03, 33, C0, C3, B8, 04, 04, 00, 00, C3, B8, 12, 04, 00, 00, C3, B8, 04, 08, 00, 00, C3, B8, 11, 04, 00, 00, C3, 8B, FF, 56, 57, 8B, F0, 68, 01, 01, 00, 00, 33, FF, 8D, 46, 1C, 57, 50, E8, 73, 21, 00, 00, 33, C0, 0F, B7, C8, 8B, C1, 89, 7E, 04, 89, 7E, 08, 89, 7E, 0C, C1, E1, 10, 0B, C1, 8D, 7E, 10, AB, AB, AB, B9, 08, A0, 40, 00, 83, C4, 0C, 8D, 46, 1C, 2B, CE, BF, 01, 01, 00, 00, 8A, 14, 01... 
[+]

Entropy:

6.2935

Code size:

25.5 KB (26,112 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

FP_Monitor

Command:

C:\Program Files1\pcmaga~1\folder~1\fpmon.exe \start

The file fpmon.exe has been discovered within the following program.

Folder Phantom Redux by Ziff Davis Media, Inc.

Publisher's description - “Have you ever needed to hide files from prying eyes? Perhaps you have your resumé and cover letters stashed on your machine at work, or maybe a collection of R-rated movies that you don't want your kids to see.”

www.pcmag.com

19% remove it

Scan fpmon.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.