» reg.exe
Overview
Analysis
File Details
Programs (1)

reg.exe

Crystal Office

Crystal Office Systems

This file is installed with the program Crystal Office.

File name:

reg.exe

Publisher:

Crystal Office Systems (signed and verified)

Product:

Crystal Office

Description:

Crystal Office Registration

Version:

1.0.1.0

MD5:

5386c54325f46063d998af58bc0e1f84

SHA-1:

8730c31fec86e00eccc811c66d3e9288215a5d2b

SHA-256:

e5045edf30e82842660ac13330ab4984dbcee2c7e60402be77d6a3a3c13adc0a

Scanner detections:

2 / 68

Status:

Clean (2 probable false positive detections)

Explanation:

These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:

4/19/2024 9:18:51 AM UTC (today)

Scan engine

Detection

Engine version

Clam AntiVirus

PUA.Packed.ASPack

0.98/17411

Quick Heal

(Suspicious) - DNAScan

11.15.11.00

File size:

568.8 KB (582,480 bytes)

Product version:

1.01

Original file name:

reg.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\crystal office\reg.exe

Digital Signature

Signed by:

Crystal Office Systems

Authority:

The USERTRUST Network

Valid from:

2/20/2011 7:00:00 PM

Valid to:

2/21/2012 6:59:59 PM

Subject:

CN=Crystal Office Systems, O=Crystal Office Systems, STREET="Kantemirovskaya street, 53-1-51", L=Moscow, S=RU, PostalCode=115477, C=RU

Issuer:

CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:

00C7DF5EC2BCD9DEA8C0BEBD21B0B003DD

File PE Metadata

Compilation timestamp:

2/25/2011 8:58:33 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

5.0

CTPH (ssdeep):

12288:1WJL43ModQ8jVg4X7ruHK/lGRgOUqmq9kR6lhKXYsSFflqGKsKnincZdt:1WN2ModQ8O4rrQK/cRgOnmq9g69NlqfH

Entry address:

0x1000

Entry point:

68, 01, E0, 4A, 00, E8, 01, 00, 00, 00, C3, C3, 72, A1, C9, E2, 0A, B5, 76, 5C, 1B, 92, FD, 9C, 0C, C4, 8D, 43, 4A, C3, E0, 5A, C8, A1, 76, D9, 2B, B3, 56, 84, 2E, 34, 8F, 34, D1, 4E, E2, 78, AA, 06, BD, BB, 30, E7, E7, 3C, F9, E2, 0E, 3C, 72, FD, 5C, 14, 0A, B0, 5D, 84, 90, 99, 5F, E3, B3, A1, B2, D3, EF, BF, 61, 18, 6C, B9, 7C, 54, CB, A0, 93, 2F, 3F, AB, E2, A8, 85, 87, 18, E6, E2, 17, 5D, 6A, 50, 0C, 77, 40, DE, 9E, 70, 32, 9B, DE, 3A, 29, 09, 32, 5C, 42, B5, AC, 14, A2, 9A, 5A, 71, 19, C5, 51, C3, BB... 
[+]

Entropy:

7.8655

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

488 KB (499,712 bytes)

The file reg.exe has been discovered within the following program.

Crystal Office by Crystal Office Systems

Publisher's description - “Crystal Office is is the essential office suite ideal for home and business users, delivering more tools that make your work go faster and your life go easier. Find all the essential office software to complete routine tasks faster and with better results.”

www.crystaloffice.com/office

4% remove it

Scan reg.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.