home

regutility_v4_1_serial_number_downloader.exe

The application regutility_v4_1_serial_number_downloader.exe has been detected as a potentially unwanted program by 20 anti-malware scanners. It uses the ExpressFiles installer to bundle additional adware offers such as toolbars and web browser addons.
MD5:
923af5d6082098ac1dad388672a49aef

SHA-1:
294c5807ef94b42e1d249ffe77e308504a7de4ac

SHA-256:
875465d869f2e40d62b2242cc7ea21fe58371054c19c02071a27b966ab44268f

Scanner detections:
20 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 11:01:48 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.ExpressFiles
2013.12.17

Avira AntiVirus
Adware/ExpressFiles.A
7.11.110.156

avast!
Win32:PUP-gen [PUP]
2014.9-140501

AVG
Skodna.Generic_r
2015.0.3488

Baidu Antivirus
Trojan.Win32.YourFileDownloader
4.0.3.1451

Bkav FE
W32.Clod57e.Trojan
1.3.0.4923

Dr.Web
Adware.Downware.825
9.0.1.0121

Emsisoft Anti-Malware
Trojan.Generic.10243911
8.14.05.01.12

ESET NOD32
Win32/ExpressDownloader (variant)
8.9698

Fortinet FortiGate
Adware/YourFileDownloader
5/1/2014

IKARUS anti.virus
AdWare.ExpressFiles
t3scan.2.2.29

K7 AntiVirus
Unwanted-Program
13.174.10509

Malwarebytes
PUP.Optional.GoForFiles.A
v2014.05.01.12

McAfee
Artemis!6A4B4457BD04
5600.7144

Qihoo 360 Security
Malware.QVM10.Gen
1.0.0.1015

Rising Antivirus
PE:PUF.GoForFiles!1.9F70
23.00.65.14429

Sophos
Go For Files
4.91

Trend Micro House Call
TROJ_GEN.F47V0808
7.2.121

Trend Micro
TROJ_SPNR.08BK13
10.465.01

VIPRE Antivirus
ExpressFiles Installer
20612

File size:
1 MB (1,098,323 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\regutility_v4_1_serial_number_downloader.exe

File PE Metadata
Compilation timestamp:
4/16/2014 11:07:39 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:efktKPJqwPyFWRIbTSwHBwO32nj4fb/zE98GAFFwAy29JNQJGWPNQ:eMYqwPeWkTSwHuO3Swb7q8GeFw29DQg1

Entry address:
0x33946

Entry point:
E8, CE, CD, 00, 00, E9, 89, FE, FF, FF, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, E4, 7B, 46, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, E0, 5C, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, C0, 3A, 43, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF, 24, 85, D4, 39...
 
[+]

Entropy:
7.7028  (probably packed)

Code size:
312.5 KB (320,000 bytes)

Remove regutility_v4_1_serial_number_downloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.