home

net1.exe

Wipe, Secret Disk, Prevent Restore, Safe Startup

Yury Saprykin

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Secret Disk Maintance’. The file has been seen being downloaded from software-files-a.cnet.com and multiple other hosts.
Publisher:
www.privacyroot.com  (signed by Yury Saprykin)

Product:
Wipe, Secret Disk, Prevent Restore, Safe Startup

Description:
Application Installer

Version:
2.04.0.0

MD5:
c7828f93d80874250bc99071f8cae46a

SHA-1:
45672ab9dd841034c28e10a5a0e65eddd961277c

SHA-256:
5c78e09c93ac6a038d9f39916e67839bd70bb9d50b7cccdc3dcfb16c91d73633

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 7:32:32 AM UTC  (today)

File size:
529.6 KB (542,360 bytes)

Product version:
2.04.0.0

Copyright:
privacyroot.com 2002 - 2014

Original file name:
NET2.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\secret disk\net1.exe

Digital Signature
Signed by:
Yury Saprykin

Authority:
COMODO CA Limited

Valid from:
3/12/2014 7:00:00 PM

Valid to:
3/12/2017 6:59:59 PM

Subject:
CN=Yury Saprykin, O=Yury Saprykin, STREET=Prospekt Revolucii 25, L=Voronezh, S=VO, PostalCode=394000, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C71956DD75CB37084C7A30D3E4519F3E

File PE Metadata
Compilation timestamp:
10/29/2014 2:21:00 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:T7Av1hiw+DAp+jbAoW/LBKlAZJM3TgI+jW:xk/LJi3TgK

Entry address:
0x7A0FE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.7078

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
480.5 KB (492,032 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Secret Disk Maintance

Command:
"C:\Program Files\secret disk\net1.exe" windowsstartup


The file net1.exe has been discovered within the following programs.

Secret Disk  by PrivacyRoot.com
Publisher's description - “Secret Disk can create additional disk on your PC, which can be invisible and locked with a password within one second. You can make your private files and folders invisible and protected. You don't need to format your hard disk or make any changes to boot sector.”
privacyroot.com
About 2% of users remove it
 
Powered by Should I Remove It?

The file net1.exe has been seen being distributed by the following 2 URLs.

http://software-files-a.cnet.com/s/software/13/92/89/.../setup_secret_disk.exe

https://privacyroot.com/software/.../setup_secret_disk.exe

Scan net1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.