home

PCClient.exe

Policy Central Enterprise

Forensic Software Limited

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PCE Client’.
Publisher:
Forensic Software Ltd  (signed by Forensic Software Limited)

Product:
Policy Central Enterprise

Description:
PCClient

Version:
3, 3, 3, 0

MD5:
e0778d689fd38713135983b47f38ced8

SHA-1:
aff6de65934641060614eaddd2c6ff4bc841a92c

SHA-256:
5fa6120cd486c4e99b4cd8a62235b75b3e0d0d2c8162563b1758639b8bd4ced1

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/6/2024 9:03:36 AM UTC  (today)

File size:
1.8 MB (1,934,728 bytes)

Product version:
3, 3, 3, 0

Copyright:
Forensic Software Ltd © 2010

Original file name:
PCClient.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\pcent\pcclient.exe

Digital Signature
Signed by:
Forensic Software Limited

Authority:
VeriSign, Inc.

Valid from:
10/1/2010 1:00:00 AM

Valid to:
10/2/2011 12:59:59 AM

Subject:
CN=Forensic Software Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Forensic Software Limited, L=Send, S=Surrey, C=GB

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0FE4AB257198C21A057BA14AEA8A0ADD

File PE Metadata
Compilation timestamp:
12/14/2010 4:53:10 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:0xxy0byapVa5FiXd+cfaV0Ce7NU+V7ALw8y5FBQO:nMVa7KHCGCeOy5FCO

Entry address:
0x60060

Entry point:
E8, A3, F8, 00, 00, E9, 16, FE, FF, FF, 8B, 44, 24, 04, 66, 8B, 08, 40, 40, 66, 85, C9, 75, F6, 2B, 44, 24, 04, D1, F8, 48, C3, 68, 40, F1, 45, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 20, 19, 50, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 50, 64, FF, 35, 00, 00, 00...
 
[+]

Entropy:
4.7454

Code size:
624 KB (638,976 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PCE Client

Command:
"C:\Program Files\pcent\pcclient.exe"


Scan PCClient.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.