home

ProcessClean.exe

ProcessClean Application

Process Clean Corp

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ProcessClean’.
Publisher:
ProcessClean  (signed by Process Clean Corp)

Product:
ProcessClean Application

Version:
2.2.4.8

MD5:
43b9419f1e0341da63b6d791cd4abb43

SHA-1:
a2d9015539a1ef56f2e68aa2ac6eab4d24ab6a04

SHA-256:
867ea7864ded23ef991822902abada1b11be88d92835f0100acc28d590fde883

Scanner detections:
8 / 68

Status:
Clean  (8 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/26/2024 8:00:51 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.ProcessClean
2015.03.22

Comodo Security
Heur.Suspicious
22223

IKARUS anti.virus
Trojan-PWS.Agent
t3scan.1.9.5.0

Sophos
Mal/Generic-L
4.98

Trend Micro House Call
ADW_KRADARE.AH
7.2.236

Trend Micro
ADW_KRADARE.AH
10.465.24

VIPRE Antivirus
Trojan.Win32.Generic!SB.0
26624

ViRobot
Adware.Agent.3890960[h]
2014.3.20.0

File size:
3.1 MB (3,247,304 bytes)

Product version:
2.2.4.8

Copyright:
Copyright (c) 2012 ProcessClean, All right

Original file name:
ProcessClean.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\processclean\processclean.exe

Digital Signature
Signed by:
Process Clean Corp

Authority:
Thawte, Inc.

Valid from:
5/21/2012 9:00:00 AM

Valid to:
5/22/2014 8:59:59 AM

Subject:
CN=Process Clean Corp, O=Process Clean Corp, L="Yeongju Si ", S=GYEONGSANGBUK-DO, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
476625C5531BFCE9A4340ADFE494739F

File PE Metadata
Compilation timestamp:
9/29/2012 3:35:40 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:FOouqBWVlrKR/vwZJri+1WmQf1DPIDzcs/+puRa58ILSRRgu3+LM3DZTw8E2JF/O:i6ryJe51DAj+I8lO6uMMCOEPWxc1N

Entry address:
0x122398

Entry point:
55, 8B, EC, B9, 05, 00, 00, 00, 6A, 00, 6A, 00, 49, 75, F9, 53, B8, E0, F0, 51, 00, E8, AE, 4B, EE, FF, 8B, 1D, 04, A1, 52, 00, 33, C0, 55, 68, 70, 25, 52, 00, 64, FF, 30, 64, 89, 20, A1, E0, A0, 52, 00, 80, 38, 00, 0F, 85, 81, 01, 00, 00, 8B, 03, E8, B5, 0D, F5, FF, E8, C8, 0F, EE, FF, 83, F8, 03, 7C, 44, 8D, 55, EC, B8, 01, 00, 00, 00, E8, 16, 10, EE, FF, 8B, 45, EC, BA, 88, 25, 52, 00, E8, 6D, 2D, EE, FF, 75, 28, 8B, 03, B2, 01, E8, 3E, 2C, F5, FF, 8B, 0D, 80, A0, 52, 00, 8B, 03, 8B, 15, C8, 2C, 4F, 00...
 
[+]

Entropy:
6.3065

Developed / compiled with:
Microsoft Visual C++

Code size:
1.1 MB (1,183,232 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ProcessClean

Command:
"C:\Program Files\processclean\processclean.exe"


Scan ProcessClean.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.