» themopl.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

themopl.exe

The Mop

Alexander Salnicoff

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘TheMop’. This file is installed with the program The Mop.

File name:

themopl.exe

Publisher:

The Mop Team (signed by Alexander Salnicoff)

Product:

The Mop

Description:

The Mop utility launcher

Version:

6.0.21.0

MD5:

e16898be62cae643795063b32a32f6cb

SHA-1:

429b8438876f3e6d66006382bb6a8fd4dbafafcf

SHA-256:

03ee0c2444046b4f37f42baa7d4169ebc3a905d6f6b72dc73c8733a6cc557d9f

Scanner detections:

2 / 68

Status:

Clean (2 probable false positive detections)

Explanation:

These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:

4/26/2024 10:30:37 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Packed/Execryptor

7.1.1

Trend Micro House Call

TROJ_GEN.F47V0108

7.2.74

File size:

171.3 KB (175,416 bytes)

Product version:

2010.0.21.0

Trademarks:

The Mop (tm)

Original file name:

themopl.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\Program Files\the mop team\the mop 6\themopl.exe

Digital Signature

Signed by:

Alexander Salnicoff

Authority:

The USERTRUST Network

Valid from:

3/17/2011 7:00:00 AM

Valid to:

3/17/2012 6:59:59 AM

Subject:

CN=Alexander Salnicoff, O=Alexander Salnicoff, STREET="67-17, proyezd Podvoyskogo", L=Yaroslavl, S=Yaroslavsky region, PostalCode=150057, C=RU

Issuer:

CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:

00A4C0E4F2B426565A3AFFBE1EDF466B7D

File PE Metadata

Compilation timestamp:

3/20/2011 10:56:13 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

3072:saw888888888888W88888888888ORhw5yk6AgssTC88ZzGwFqdhw66+nB2tOCXT:G888888888888W888888888886q6AgsR

Entry address:

0x5C99F

Entry point:

E8, 3B, FF, FF, FF, 05, B5, 1F, 00, 00, FF, E0, E8, 2F, FF, FF, FF, 05, BA, 06, 00, 00, FF, E0, E8, 2E, 01, 00, 00, E5, 91, 45, 00, 0D, 3F, 81, 18, 0E, 45, 12, 1B, 21, 2F, 5C, 07, 11, 07, 0D, 08, 17, 0F, 1D, 38, 39, 10, 22, FE, 4D, 00, 44, 03, 34, 15, 17, 6C, 1A, 24, 2B, 2C, 37, 11, 0E, 1B, 65, 20, 54, 7B, 11, 49, 08, 0F, 1F, 2D, 70, 81, 06, 0F, 68, 50, 17, 51, 1B, 1F, 10, 6F, 53, 0F, 0A, 0B, 16, 8A, 01, 51, 2A, 62, 23, 12, 25, 2F, 3A, 28, 53, 0D, 18, 08, 0E, 14, 2A, 93, 08, 28, 19, 10, 56, 0F, 22, 01, 39... 
[+]

Code size:

131 KB (134,144 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

TheMop

Command:

C:\Program Files\the mop team\the mop 6\themopl.exe

The file themopl.exe has been discovered within the following programs.

The Mop by The Mop Team

Publisher's description - “The Mop is easy-to-use disk cleaner able to search garbage files in all folders on all hard disk. The Mop shows the decrease of performance made by garbage files. Using this tool can speed up the computer and get more free space to keep useful files.”

www.the-mop.com

24% remove it

Scan themopl.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.