home

INCMAIL.EXE

IncrediMail

IncrediMail, Inc.

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘IncrediMail’.
Publisher:
IncrediMail Ltd.  (signed by IncrediMail, Inc.)

Product:
IncrediMail

Description:
IncrediMail Application

Version:
6, 6, 0, 5328

MD5:
6e04667c83ac550e6a3880cb73a41482

SHA-1:
2a46f3e7f5976b7d5c988ae4cff9656fcb64c80b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/3/2024 12:55:01 AM UTC  (today)

File size:
434 KB (444,424 bytes)

Product version:
6, 6, 0, 5328

Copyright:
Copyright © 2000 IncrediMail Ltd.

Original file name:
INCMAIL.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\incredimail\bin\incmail.exe

Digital Signature
Signed by:
IncrediMail, Inc.

Authority:
Symantec Corporation

Valid from:
1/10/2016 2:00:00 AM

Valid to:
1/11/2018 1:59:59 AM

Subject:
CN="IncrediMail, Inc.", OU=IncrediMail2016, O="IncrediMail, Inc.", L=Redmond, S=Washington, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
1530D5A53D788F05F7FE4F109407DB21

File PE Metadata
Compilation timestamp:
3/31/2016 5:17:39 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

Entry address:
0x2A304

Entry point:
E8, 0F, 08, 00, 00, E9, DA, FC, FF, FF, FF, 25, 70, 39, 43, 00, FF, 25, 78, 39, 43, 00, FF, 25, 7C, 39, 43, 00, FF, 25, 80, 39, 43, 00, FF, 25, 84, 39, 43, 00, FF, 25, 88, 39, 43, 00, FF, 74, 24, 10, FF, 74, 24, 10, FF, 74, 24, 10, FF, 74, 24, 10, 68, 5C, A3, 42, 00, 68, 04, 46, 45, 00, E8, 5B, 08, 00, 00, 83, C4, 18, C3, CC, FF, 25, 8C, 39, 43, 00, 3B, 0D, 04, 46, 45, 00, 75, 02, F3, C3, E9, 47, 08, 00, 00, 8B, C1, C7, 00, DC, B5, 43, 00, C2, 04, 00, 53, 8A, 5C, 24, 08, F6, C3, 02, 56, 8B, F1, 74, 24, 57...
 
[+]

Entropy:
6.1076

Code size:
200 KB (204,800 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
IncrediMail

Command:
C:\Program Files\incredimail\bin\incmail.exe \c


Scan INCMAIL.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.