home

registryquick_setup.exe

My Company, Inc.

The application registryquick_setup.exe, “ReQuick Setup ” has been detected as a potentially unwanted program by 34 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.registryquick.net.
Publisher:
My Company, Inc.

Description:
ReQuick Setup

MD5:
40766ff27b19da4d579480034234c894

SHA-1:
91c311321dcdd15c639435d552d3dd3554ae0808

SHA-256:
9a1d79ff045757a665b3458965bde165ea6ed916ea658d9eef18e91ca341e3e5

Scanner detections:
34 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
8/5/2025 7:48:58 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Sality.3
5744357

Agnitum Outpost
Win32.Sality.BL
7.1.1

AhnLab V3 Security
Win32/Kashu.E
2015.10.21

Avira AntiVirus
W32/Sality.AT
8.3.2.2

Arcabit
Win32.Sality.3
1.0.0.585

avast!
Win32:SaliCode
151004-0

AVG
Win32/Sality
2015.0.4435

Baidu Antivirus
Virus.Win32.Sality.$Emu
4.0.3.151021

Bitdefender
Win32.Sality.3
1.0.20.1470

Comodo Security
Virus.Win32.Sality.gen
23452

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
11.2015-21-10_4

G Data
Win32.Sality
15.10.25

IKARUS anti.virus
Virus.Sality
t3scan.1.9.5.0

K7 AntiVirus
Virus
13.211.17595

Kaspersky
Virus.Win32.Sality
15.0.0.463

McAfee
Program.Artemis!D952CBD99FEA
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.207.3491.0

MicroWorld eScan
Win32.Sality.3
16.0.0.882

NANO AntiVirus
Virus.Win32.Sality.beygb
0.30.26.3947

Norman
Win32.Sality.3
10.10.2015 03:41:45

Panda Antivirus
W32/Sality.AA
15.10.21.12

Quick Heal
W32.Sality.U
10.15.14.00

Rising Antivirus
PE:Virus.Sality!1.A09C[F1]
23.00.65.151019

Sophos
Virus 'Mal/Sality-D'
5.15

Total Defense
Win32/Sality.AA
37.1.62.1

Trend Micro House Call
PE_SALITY.RL
7.2.294

Trend Micro
PE_SALITY.RL
10.465.21

Vba32 AntiVirus
Virus.Win32.Sality.bakc
3.12.26.4

VIPRE Antivirus
Threat.4721115
43798

ViRobot
Win32.Sality.Gen.A[h]
2014.3.20.0

File size:
1.2 MB (1,290,586 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\registryquick_setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:7btnh4+avAzlMJmqCyCY0fqvgvWp9N1JyoDecvFnwzEt/WcesONI5EeYw:vt2FvAxMJ/CyCzCY+p9N3yCeMnScT0ez

Entry address:
0x922C

Entry point:
FF, CF, 0F, BF, F8, 86, D1, 56, 69, D7, 18, 37, FB, 29, 84, DF, 8D, 2D, D7, BC, 46, 50, 0D, 4F, 14, 5C, 0C, FF, CF, 0F, AF, C2, B0, 48, 57, 77, 09, 81, E2, E2, AE, C6, CF, 47, 8B, C8, E8, 16, 00, 00, 00, 89, F5, B3, 21, F3, FE, CD, F7, C5, 83, 75, 07, 66, 76, 01, F3, 81, FE, 62, 29, 00, 00, F3, 8D, 35, E3, 49, E0, 8B, 8D, 0D, B4, B9, C9, EB, 18, EA, 81, FB, FD, E9, 00, 00, 74, 03, 0F, AF, C9, 8B, F1, 89, EA, C7, C3, 35, D0, FE, 43, 81, DA, 49, F3, EA, 85, 84, D9, 2B, EE, 88, F3, 5A, 72, 06, C7, C6, DF, 39...
 
[+]

Code size:
34.5 KB (35,328 bytes)

The file registryquick_setup.exe has been seen being distributed by the following URL.

http://www.registryquick.net/.../RegistryQuick_setup.exe

Remove registryquick_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.