» PIconStartup.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

PIconStartup.exe

Intel PIconStartup

Intel Corporation

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘IMSS’. This is installed with Intel(R) Management Engine Components.

File name:

PIconStartup.exe

Publisher:

Intel Corporation (signed and verified)

Product:

Intel(R) PIconStartup

Description:

PIcon startup utility

Version:

8.1.0.1281

MD5:

4c7c4cadd2515329d9d40d7dc91c5930

SHA-1:

ea261ea4272825dc631a284aa8414085b4b39655

SHA-256:

7f0bb59df698c949217036f12579ffeddd3444cfa26376824314e88e563eef0d

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

6/3/2026 12:00:24 AM UTC (today)

File size:

130.3 KB (133,440 bytes)

Product version:

8.1.0.1281

Original file name:

PIconStartup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\intel\intel(r) management engine components\imss\piconstartup.exe

Digital Signature

Signed by:

Intel Corporation

Authority:

VeriSign, Inc.

Valid from:

3/7/2011 6:00:00 PM

Valid to:

4/22/2014 6:59:59 PM

Subject:

CN=Intel Corporation, OU=ISWQL, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Intel Corporation, L=Folsom, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

10021A27D28312885C613AA498580F6F

File PE Metadata

Compilation timestamp:

7/18/2012 1:53:35 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

1536:/bqw/kSiZ/xiKb7vB3hkfn5nYfw9/RcpZp+8:OGkVV17vKSw95cpZN

Entry address:

0x1C05

Entry point:

E8, 3F, 21, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, B4, E3, 40, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 54, E0, 40, 00, C9, C2, 08, 00, B8, 8E, 48, 40, 00, A3, 50, 22, 41, 00, C7, 05, 54, 22, 41, 00, 84, 3F, 40, 00, C7, 05, 58, 22, 41, 00, 38, 3F, 40, 00, C7, 05, 5C, 22, 41, 00, 71, 3F, 40, 00, C7, 05... 
[+]

Entropy:

5.9123

Code size:

50 KB (51,200 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

IMSS

Command:

"C:\Program Files\intel\intel(r) management engine components\imss\piconstartup.exe"

The file PIconStartup.exe has been discovered within the following programs.

Intel(R) Management Engine Components by Intel Corporation

This program provides the Intel Management Engine Components Driver for supported notebooks with supported operating systems. The Intel management Components monitor the installed Intel hardware, such as chip sets, storage, and other components.

downloadcenter.intel.com/Detail_Desc.aspx?lang=eng&DwnldID=20402

10% remove it

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.