home

PCClient.exe

Policy Central Enterprise

Forensic Software Limited

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PCE Client’.
Publisher:
Forensic Software Ltd  (signed by Forensic Software Limited)

Product:
Policy Central Enterprise

Description:
PCClient

Version:
3, 1, 0, 2

MD5:
540a856f5fcc80f072cba86b25e0f123

SHA-1:
aa3a95c8cdaec1f9aec3a4bc69b3a1b1012c8da6

SHA-256:
2754ada25bead576fa3f884435497d863f93cc7d544db462becefcd34834efe2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 5:58:14 AM UTC  (today)

File size:
1.8 MB (1,932,416 bytes)

Product version:
3, 1, 0, 2

Copyright:
Forensic Software Ltd © 2009

Original file name:
PCClient.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\pcent\pcclient.exe

Digital Signature
Signed by:
Forensic Software Limited

Authority:
The USERTRUST Network

Valid from:
3/12/2010 12:00:00 AM

Valid to:
3/12/2011 11:59:59 PM

Subject:
CN=Forensic Software Limited, O=Forensic Software Limited, STREET=Albury Lodge, STREET=The Street, L=Albury, S=Surrey, PostalCode=GU5 9AE, C=GB

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
00913651B3B739F16092EC3D5FC3F1EF38

File PE Metadata
Compilation timestamp:
3/31/2010 7:40:40 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:0f1M+JDJJSZKFBZpmsvaVljmEjNU+V7ALw8y5Fw:0ZJkZK7ZrSHjmRy5F

Entry address:
0x5FDE0

Entry point:
E8, A2, F8, 00, 00, E9, 16, FE, FF, FF, 8B, 44, 24, 04, 66, 8B, 08, 40, 40, 66, 85, C9, 75, F6, 2B, 44, 24, 04, D1, F8, 48, C3, 68, C0, EE, 45, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 20, 19, 50, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 50, 64, FF, 35, 00, 00, 00...
 
[+]

Entropy:
4.7382

Code size:
624 KB (638,976 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PCE Client

Command:
"C:\Program Files\pcent\pcclient.exe"


Scan PCClient.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.