home

msfmon64.exe

MySecretFolder x64 Edition

WinAbility Software Corp.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘MSF_Monitor’.
Publisher:
WinAbility® Software Corporation  (signed by WinAbility Software Corp.)

Product:
MySecretFolder x64 Edition

Description:
MySecretFolder Application

Version:
4.32

MD5:
47714b5f22661c9852f338e54caecc73

SHA-1:
fed63179fcf1d174d9b972275cef811e202914cd

SHA-256:
7563af46892dbc96a552a07a718c47309e9bccf21481b36279a9c86dfa408419

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/27/2024 12:45:28 AM UTC  (today)

File size:
89.8 KB (91,976 bytes)

Product version:
4.32

Copyright:
Copyright © 2008 WinAbility® Software Corporation. All rights reserved.

Trademarks:
MySecretFolder[TM] and WinAbility® are registered trademarks or trademarks of WinAbility Software Corporation and/or its suppliers.

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Digital Signature
Signed by:
WinAbility Software Corp.

Authority:
VeriSign, Inc.

Valid from:
11/4/2007 4:00:00 PM

Valid to:
1/3/2009 3:59:59 PM

Subject:
CN=WinAbility Software Corp., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=WinAbility Software Corp., L=Rockville, S=Utah, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
65E7339101C05FBC43340A9FA8BDBA93

File PE Metadata
Compilation timestamp:
1/7/2008 10:54:55 AM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1536:FvwFnzjJSwcaa/mfEmeT5wrWnwRsHq8+sj5mYDDE:NwF59EmfEmeT5EgZdK

Entry address:
0x14C8

Entry point:
48, 83, EC, 28, E8, EF, 24, 00, 00, 48, 83, C4, 28, E9, 16, FE, FF, FF, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 6C, 24, 10, 48, 89, 74, 24, 18, 57, 48, 83, EC, 20, 48, 8D, 59, 1C, 48, 8B, E9, BE, 01, 01, 00, 00, 48, 8B, CB, 4C, 8B, C6, 33, D2, E8, 87, 25, 00, 00, 45, 33, DB, 48, 8D, 7D, 10, 41, 8D, 4B, 06, 41, 0F, B7, C3, 44, 89, 5D, 04, 44, 89, 5D, 08, 44, 89, 5D, 0C, 66, F3, AB, 48, 8D, 3D, E2, 8A, 00, 00, 48, 2B, FD, 8A, 04, 1F, 88, 03, 48, FF, C3, 48, 83, EE, 01, 75, F2, 48, 8D, 8D, 1D, 01, 00, 00, BA, 00...
 
[+]

Entropy:
5.6652

Code size:
23.5 KB (24,064 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
MSF_Monitor

Command:
C:\mysecretfolder\msfmon64.exe \start


Scan msfmon64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.