» rcleaner.exe
Overview
Analysis
File Details
Programs (1)

rcleaner.exe

Registry Repair Wizard

CleanMyPC Technology Limited

The application rcleaner.exe by CleanMyPC Technology Limited has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Registry Repair Wizard by SmartPCTools.

File name:

rcleaner.exe

Publisher:

SmartPC Tools (signed by CleanMyPC Technology Limited)

Product:

Registry Repair Wizard

Version:

2012, 6, 7, 2

MD5:

40be31c71f3362ed473672cba74213d8

SHA-1:

45ab532a4a87a75dc1baa0c63cb9b46df6774b7c

SHA-256:

81d91ccea1b3eca717753f3bb960d57240296730bd713988abb2af369d3ea455

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

12/25/2024 1:07:17 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Optional.CleanMyPCTechnology

15.4.1.17

File size:

3.4 MB (3,537,688 bytes)

Product version:

2012, 6, 7, 2

Trademarks:

Registry Repair Wizard

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\smartpctools\registry repair wizard\rcleaner.exe

Digital Signature

Signed by:

CleanMyPC Technology Limited

Authority:

COMODO CA Limited

Valid from:

3/28/2012 8:00:00 PM

Valid to:

3/29/2017 7:59:59 PM

Subject:

CN=CleanMyPC Technology Limited, O=CleanMyPC Technology Limited, STREET="ROOM C1D 6/F, WING HING INDUSTRIAL BUILDING", STREET=14 HING YIP STREET, STREET="KWUN TONG, KOWLOON", L=HONG KONG, S=NA, PostalCode=NA, C=HK

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00B22D5ED33A336918E76BE3A5C6CB25F1

File PE Metadata

Compilation timestamp:

6/10/2012 6:01:11 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

83.82

CTPH (ssdeep):

49152:zlZaSbTLk849AS+mqfI+kx2BzM/klt/U+9I5ioP7/DU1EnKw7Zq0uX+l79IHyVwR:56KDk/kXc+9I5i4Eb

Entry address:

0x19A000

Entry point:

60, E8, 00, 00, 00, 00, 5D, 50, 51, 0F, CA, F7, D2, 9C, F7, D2, 0F, CA, EB, 0F, B9, EB, 0F, B8, EB, 07, B9, EB, 0F, 90, EB, 08, FD, EB, 0B, F2, EB, F5, EB, F6, F2, EB, 08, FD, EB, E9, F3, EB, E4, FC, E9, 9D, 0F, C9, 8B, CA, F7, D1, 59, 58, 50, 51, 0F, CA, F7, D2, 9C, F7, D2, 0F, CA, EB, 0F, B9, EB, 0F, B8, EB, 07, B9, EB, 0F, 90, EB, 08, FD, EB, 0B, F2, EB, F5, EB, F6, F2, EB, 08, FD, EB, E9, F3, EB, E4, FC, E9, 9D, 0F, C9, 8B, CA, F7, D1, 59, 58, 50, 51, 0F, CA, F7, D2, 9C, F7, D2, 0F, CA, EB, 0F, B9, EB... 
[+]

Entropy:

7.1757

Packer / compiler:

ASPack v1.08.04

Code size:

444 KB (454,656 bytes)

The file rcleaner.exe has been discovered within the following program.

Registry Repair Wizard by SmartPCTools

SmartPCTools Registry Repair Wizard is registry utility whose purported purpose is to remove redundant items from the Windows registry.

www.registryrepair.net

51% remove it

Remove rcleaner.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.