» WindowsClear.exe
Overview
Analysis
File Details
Programs (1)

WindowsClear.exe

WeiSiTianYu Software Develop Service Center

The application WindowsClear.exe by WeiSiTianYu Software Develop Service Center has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program WindowsClear 5.2 by Weskysoft Inc..

File name:

WindowsClear.exe

Publisher:

Miracle Technologies (signed by WeiSiTianYu Software Develop Service Center)

Description:

WindowsClear

Version:

5.2.6.335

MD5:

e73218557305eb5c42cb31714cf2d6a9

SHA-1:

c1014f24f34b7d68ab1cb9a0cd05ebe95bee1c7e

SHA-256:

f039a1e0b8fcd5f95fe15c3b9426d4ab1274059894fe3c5307d2d8e0965682a9

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/25/2024 4:25:05 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.PCOptimizer.Optional.Meta (L)

16.3.13.11

File size:

6 MB (6,291,128 bytes)

Product version:

5.2

Trademarks:

Miracle

Original file name:

WindowsClear.exe

File type:

Executable application (Win32 EXE)

Language:

English (United Kingdom)

Common path:

C:\Program Files\windowsclear\windowsclear.exe

Digital Signature

Signed by:

WeiSiTianYu Software Develop Service Center

Authority:

WoSign, Inc.

Valid from:

7/27/2010 6:00:00 PM

Valid to:

7/28/2011 5:59:59 PM

Subject:

CN=WeiSiTianYu Software Develop Service Center, OU=WoSign Class 3 Code Signing, O=WeiSiTianYu Software Develop Service Center, L=Beijing, S=Beijing, C=CN

Issuer:

CN=WoSign Code Signing Authority, O="WoSign, Inc.", C=US

Serial number:

00AE328C1100741D85A6AF7D045D09EDB0

File PE Metadata

Compilation timestamp:

5/6/2010 3:11:22 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:YC9wAsnYSpFPfeP7u59ZXoA7uKdEf88grsMwJE0c/u96CI+RwQwrU3ZWaWvb47OP:YC9w876ZXcKdEf8TrsMlF+7okPAr104

Entry address:

0x407C6C

Entry point:

55, 8B, EC, 83, C4, E0, 33, C0, 89, 45, E0, 89, 45, EC, 89, 45, E4, 89, 45, E8, B8, 7C, 89, 7F, 00, E8, 96, 45, C0, FF, 33, C0, 55, 68, 9A, 7E, 80, 00, 64, FF, 30, 64, 89, 20, E8, 4F, CE, BF, FF, 85, C0, 7E, 47, 8D, 55, E8, B8, 01, 00, 00, 00, E8, 9E, CE, BF, FF, 8B, 45, E8, 8D, 55, EC, E8, 6F, E7, C0, FF, 8B, 45, EC, 50, 8D, 55, E4, B8, B4, 7E, 80, 00, E8, 5E, E7, C0, FF, 8B, 45, E4, 5A, E8, C5, 11, C0, FF, 85, C0, 7E, 11, BA, 80, C2, 81, 00, B8, 01, 00, 00, 00, E8, 66, CE, BF, FF, EB, 0C, B8, 80, C2, 81... 
[+]

Entropy:

6.7364

Developed / compiled with:

Microsoft Visual C++

Code size:

4 MB (4,220,928 bytes)

The file WindowsClear.exe has been discovered within the following program.

WindowsClear 5.2 by Weskysoft Inc.

www.WindowsClear.com

About 6% of users remove it

Remove WindowsClear.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.