» PFolder32.sys
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

PFolder32.sys

Private Folder

eMing Software Inc.

It runs as a Windows 64-bit kernel mode device driver named “PFolder”. This is installed with Private Folder 1.1.

File name:

PFolder32.sys

Publisher:

eMing Software Inc. (signed and verified)

Product:

Private Folder

Description:

Private Folder Kernel Driver

Version:

1.1.0.70

MD5:

1290f01f1be0db56aee1f964f838365d

SHA-1:

4e1ae2d1cb43a3de4799762baca8e3c1b75824e3

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/25/2024 7:24:01 PM UTC (today)

File size:

44.5 KB (45,544 bytes)

Product version:

1.1.0.70

Original file name:

PFolder32.sys

File type:

Driver (Win64 SYS)

Language:

English (United States)

Common path:

C:\Windows\System32\drivers\pfolder32.sys

Digital Signature

Signed by:

eMing Software Inc.

Authority:

GlobalSign nv-sa

Valid from:

5/1/2010 11:23:31 PM

Valid to:

5/1/2013 11:23:27 PM

Subject:

CN=eMing Software Inc., O=eMing Software Inc., L=Irvine, S=CA, C=US

Issuer:

CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:

0100000000012855F725CB

File PE Metadata

OS bitness:

Win64

CTPH (ssdeep):

768:hqt2nF9cvvpvxd1bjn0V+xaF9HpwAiGIOiRm1N1fi24:hRnF9cHp1n4ZiRINZi24

Entry point:

55, 8B, EC, 51, 51, C7, 45, FC, 82, 01, 00, C0, FF, 75, 0C, FF, 75, 08, E8, 93, FE, FF, FF, 89, 45, FC, 83, 7D, FC, 00, 0F, 85, 60, 01, 00, 00, 8B, 45, 08, 83, C0, 38, 89, 45, F8, 8B, 45, F8, C7, 40, 6C, 50, 55, 01, 00, 8B, 45, F8, 8B, 4D, F8, 8B, 49, 6C, 89, 48, 5C, 8B, 45, F8, 8B, 4D, F8, 8B, 49, 5C, 89, 48, 58, 8B, 45, F8, 8B, 4D, F8, 8B, 49, 58, 89, 48, 68, 8B, 45, F8, 8B, 4D, F8, 8B, 49, 68, 89, 48, 64, 8B, 45, F8, 8B, 4D, F8, 8B, 49, 64, 89, 48, 60, 8B, 45, F8, 8B, 4D, F8, 8B, 49, 60, 89, 48, 54, 8B... 
[+]

Entropy:

6.1942

Developed / compiled with:

Microsoft Visual C++

Driver

Display name:

PFolder

Type:

Kernel device driver (KernelDriver)

Group:

FSFilter Activity Monitor

Depends on:

FltMgr

The file PFolder32.sys has been discovered within the following program.

Private Folder 1.1 by eMing Software Inc.

Publisher's description - “Private Folder is a free tool which can hide or create password and protect your private folder.”

www.emingsoftware.com

About 1% of users remove it

Scan PFolder32.sys - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.