home

PCClient.exe

Policy Central Enterprise

Forensic Software Limited

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PCE Client’.
Publisher:
Forensic Software Ltd  (signed by Forensic Software Limited)

Product:
Policy Central Enterprise

Description:
PCClient

Version:
3, 2, 4, 0

MD5:
688892778606607c65ab947849e873aa

SHA-1:
e257b29434bd1a5be51c4b2bf1d36bc437a13f4e

SHA-256:
eca3c668f5d564892cb76fb3454b38b4ad03707178700dde4f02c0e8602766d2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 3:13:12 AM UTC  (today)

File size:
1.8 MB (1,932,416 bytes)

Product version:
3, 2, 4, 0

Copyright:
Forensic Software Ltd © 2010

Original file name:
PCClient.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\pcent\pcclient.exe

Digital Signature
Signed by:
Forensic Software Limited

Authority:
The USERTRUST Network

Valid from:
3/12/2010 12:00:00 AM

Valid to:
3/12/2011 11:59:59 PM

Subject:
CN=Forensic Software Limited, O=Forensic Software Limited, STREET=Albury Lodge, STREET=The Street, L=Albury, S=Surrey, PostalCode=GU5 9AE, C=GB

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
00913651B3B739F16092EC3D5FC3F1EF38

File PE Metadata
Compilation timestamp:
10/7/2010 6:25:16 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:s/YOIQeNFFuHD6u6cfaVhLjFNU+V7ALw8y5Fh:sQ1JzFue6CnLjgy5F

Entry address:
0x60030

Entry point:
E8, A2, F8, 00, 00, E9, 16, FE, FF, FF, 8B, 44, 24, 04, 66, 8B, 08, 40, 40, 66, 85, C9, 75, F6, 2B, 44, 24, 04, D1, F8, 48, C3, 68, 10, F1, 45, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 20, 19, 50, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 50, 64, FF, 35, 00, 00, 00...
 
[+]

Entropy:
4.7399

Code size:
624 KB (638,976 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PCE Client

Command:
"C:\Program Files\pcent\pcclient.exe"


Scan PCClient.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.