» PCTuneUp.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

PCTuneUp.exe

PC Tune-Up

NNJ Corporation

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘MRC’. This file is installed with the program PC Tune-Up.

File name:

PCTuneUp.exe

Publisher:

Large Software (signed by NNJ Corporation)

Product:

PC Tune-Up

Version:

2.3.1.0

MD5:

6dd5bc481765ddb8ae68b89fa7716907

SHA-1:

b61eda56082b01294c918c44299ff620d1e3728b

SHA-256:

99e9411d4d27248b24bd9cbb0195a758d1b189e2aa5cef9f5fe385c0728dda80

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

4/25/2024 6:59:54 AM UTC (today)

Scan engine

Detection

Engine version

Sophos

PC Tune-up

4.98

File size:

2.8 MB (2,966,312 bytes)

Product version:

2.3.1.0

Large Software

Trademarks:

Large Software

Original file name:

PCTuneUp.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\pc tune-up\pctuneup.exe

Digital Signature

Signed by:

NNJ Corporation

Authority:

VeriSign, Inc.

Valid from:

2/9/2013 1:00:00 AM

Valid to:

3/12/2014 12:59:59 AM

Subject:

CN=NNJ Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=NNJ Corporation, L=San Diego, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0CA0F8D3426AB62D5B9FEBFDDD65377D

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:hZMnKJVPYM2pLVIup2LkZWvY0DNFcicW5ckBb9ZOboKaJqlhgT:XvVPYRtp2t67WGkBxZOUZJqlhgT

Entry address:

0x1000

Entry point:

68, 01, A0, 83, 00, E8, 01, 00, 00, 00, C3, C3, F7, 70, 6A, 6C, 2D, 6B, E7, 98, 16, 87, 3E, 0E, 71, 7B, C9, 9F, E6, 8C, EF, A0, AD, AE, 4A, ED, 47, E7, 21, 48, DF, 51, 1B, A0, BD, 2D, BF, 8C, AB, 94, FD, 9E, 12, 54, 23, BC, 71, 51, ED, 26, 72, 45, F6, DE, D9, C7, ED, 56, A6, 16, 68, 7E, DC, CD, 64, F3, 26, 65, 1F, BC, 59, AD, 82, F6, 16, 4D, 96, 95, 19, 5D, DE, 39, 11, 35, 45, 18, 43, 4D, CE, 49, 4C, BC, 48, A4, 8A, 48, F0, 8F, BB, 01, 21, 87, 9C, A0, BE, 12, B7, A1, 9B, A4, DE, BD, 00, CE, C6, BE, 46, EC... 
[+]

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

2.1 MB (2,203,648 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

MRC

Command:

"C:\Program Files\pc tune-up\pctuneup.exe" \mbrstart

The file PCTuneUp.exe has been discovered within the following program.

PC Tune-Up by Large Software

Publisher's description - “The registry is one of the most essential components of Windows OS, critical to proper functioning of any PC computer.”

www.elcor.net/ard.php

39% remove it

Scan PCTuneUp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.