Should I block it?

No, this file is 100% safe to run.

Additional versions

6c617	66.67%
1aa28	33.33%

(Note, Koshy John publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

diskmax.exe (by Koshy John)

PE file structure

Show functions

Import table

advapi32.dll

RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl

comctl32.dll

ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy

comdlg32.dll

GetSaveFileNameW, GetOpenFileNameW

gdi32.dll

DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx

kernel32.dll

DllMain

mpr.dll

WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW

ole32.dll

OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize

psapi.dll

EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules

shell32.dll

DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish

user32.dll

DllMain

userenv.dll

CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

wininet.dll

InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable

winmm.dll

timeGetTime, waveOutSetVolume, mciSendStringW

memclean.exe

By Koshy John (Signed)

Remove memclean.exe

MD5:	6c617b3ab87487b6646cb71e56a2954a
SHA1:	bbce9716e155242ba271abb99b39f14df0af39a7
SHA256:	a738a014cf752914601f1acb6a3401fa0a3ec318757393ce96b6a93664e7e491

Overview

memclean.exe executes as a process with the local user's privileges. It is set to be run when the PC boots and the user logs into Windows (added to the Run registry key for the current user). The file is digitally signed by Koshy John which was issued by the COMODO CA Limited certificate authority (CA).

Details

File name:	memclean.exe
Typical file path:	C:\users\user\appdata\roaming\koshyjohn.com\memclean\memclean.exe
Size:	773.01 KB (791,560 bytes)
Build date:	1/15/2010 11:09 AM
Certificate
Issued to:	Koshy John
Authority (CA):	COMODO CA Limited
Effective date:	Friday, February 1, 2013
Expiration date:	Sunday, February 2, 2014
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Startup files (user) run

Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'Memory Cleaner' → C:\users\user\appdata\Roaming\KoshyJohn.com\MemClean\MemClean.exe boot

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00280450%	0.028634%
Kernel CPU:	0.00202528%	0.013761%
User CPU:	0.00077922%	0.014873%
Kernel CPU time:	10,172 ms/min	100,923,805ms/min
CPU cycles:	26,199,728/sec	17,470,203/sec
Context switches:	117/sec	284/sec
Memory
Private memory:	7.46 MB	21.59 MB
Private (maximum):	7.33 MB
Private (minimum):	3.01 MB
Non-paged memory:	7.46 MB	21.59 MB
Virtual memory:	120.96 MB	140.96 MB
Virtual memory (peak):	140.13 MB	169.69 MB
Working set:	3.2 MB	18.61 MB
Working set (peak):	11.78 MB	37.95 MB
Page faults:	37,252/min	2,039/min
I/O
I/O read transfer:	120.02 KB/sec	1.02 MB/min
I/O read operations:	4/sec	343/min
I/O write transfer:	4.99 KB/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	2.4 KB/sec	448.09 KB/min
I/O other operations:	111/sec	1,671/min
Resource allocations
Threads:	1	12
Handles:	147	600
GUI GDI count:	57	103
GUI GDI peak:	71	142
GUI USER count:	52	49
GUI USER peak:	56	71