home

nCryptedBox.exe

nCrypted Cloud, LLC

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘nCryptedCloud’.
Publisher:
nCryptedCloud  (signed by nCrypted Cloud, LLC)

Product:
nCryptedCloud

Version:
1.1.20.5

MD5:
2902296a6af3f27011cdf604f93a0f96

SHA-1:
d544ba12dd273c0920dff91a63662292d8dc2f1b

SHA-256:
ed9450504ececf6da4ab63a71094fd600947168abc21fbc0aa34b9d4a09a9ad4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/6/2024 10:24:00 PM UTC  (today)

File size:
16.1 MB (16,912,504 bytes)

Product version:
1.1

Copyright:
Copyright © 2012-2015 nCryptedCloud

Original file name:
nCryptedBox.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\roaming\ncryptedcloud\bin\ncryptedbox.exe

Digital Signature
Signed by:
nCrypted Cloud, LLC

Authority:
DigiCert Inc

Valid from:
9/1/2015 8:00:00 PM

Valid to:
9/28/2016 8:00:00 AM

Subject:
CN="nCrypted Cloud, LLC", O="nCrypted Cloud, LLC", L=Belmont, S=Massachusetts, C=US

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0184F93AE5DB9FEF25EF28131E1A6969

File PE Metadata
Compilation timestamp:
6/2/2016 9:36:09 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
393216:cobCq/WqEwpA4FCNJsv6tWKFdu9CK9hwQ:5n/WqEwFN

Entry address:
0xA23DBF

Entry point:
E8, 78, 7F, 01, 00, E9, 89, FE, FF, FF, 3B, 0D, 44, D2, 36, 01, 75, 02, F3, C3, E9, FF, 7F, 01, 00, 8B, FF, 55, 8B, EC, 83, EC, 0C, 53, 57, 8B, 7D, 08, 33, DB, 3B, FB, 75, 18, E8, F2, 5F, 00, 00, C7, 00, 16, 00, 00, 00, E8, 7F, EC, 00, 00, 83, C8, FF, E9, 65, 01, 00, 00, 56, 57, E8, B2, 90, 00, 00, 8B, F0, 59, 89, 75, F8, 39, 5F, 04, 7D, 03, 89, 5F, 04, 6A, 01, 53, 56, E8, 31, 81, 01, 00, 83, C4, 0C, 89, 45, FC, 3B, C3, 0F, 8C, FB, 00, 00, 00, 8B, 57, 0C, F7, C2, 08, 01, 00, 00, 75, 08, 2B, 47, 04, E9, 25...
 
[+]

Entropy:
6.6289

Code size:
11.4 MB (11,908,608 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
nCryptedCloud

Command:
"C:\users\{user}\appdata\roaming\ncryptedcloud\bin\ncryptedbox.exe" update


Scan nCryptedBox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.