» Telenorhjelpen.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

Telenorhjelpen.exe

Telenorhjelpen

Emotum Pty Ltd

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Telenorhjelpen’. This is installed with Telenorhjelpen.

File name:

Telenorhjelpen.exe

Publisher:

Telenor NO (signed by Emotum Pty Ltd)

Product:

Telenorhjelpen

Version:

1, 0, 0, 0

MD5:

b12958f9c13ab4e7ac68c4c0ad87948e

SHA-1:

034e2fa35cd0673abfb15444563d2dc1720fe40a

SHA-256:

c117532a512bc0ff92a9e1931eb987adc38bf76107af5b3505e10334dbcf35ff

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

7/5/2025 5:58:11 AM UTC (today)

File size:

87 KB (89,088 bytes)

Product version:

3, 0, 0, 0

Original file name:

Telenorhjelpen.exe

File type:

Executable application (Win32 EXE)

Language:

norsk bokmål (Norge)

Common path:

C:\Program Files\telenor norway\telenorhjelpen\telenorhjelpen.exe

Digital Signature

Signed by:

Emotum Pty Ltd

Authority:

Symantec Corporation

Valid from:

2/20/2015 1:00:00 AM

Valid to:

4/21/2016 1:59:59 AM

Subject:

CN=Emotum Pty Ltd, O=Emotum Pty Ltd, L=Sydney, S=New South Wales, C=AU

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

45072A3B56EB8D2D528189F709A5FD7A

File PE Metadata

Compilation timestamp:

11/25/2015 5:34:40 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

1536:uEbGcLtpX8i8g5K34Z8JxdsUlEnSZxGkH+WTrf3eQbTAJV2cIqCB9PUP2222222W:u6GcLtpsiHZ8JxdsUmnoGOTrPeQbTAJF

Entry address:

0x1245

Entry point:

E8, B2, 15, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 58, AD, 40, 00, 89, 0D, 54, AD, 40, 00, 89, 15, 50, AD, 40, 00, 89, 1D, 4C, AD, 40, 00, 89, 35, 48, AD, 40, 00, 89, 3D, 44, AD, 40, 00, 66, 8C, 15, 70, AD, 40, 00, 66, 8C, 0D, 64, AD, 40, 00, 66, 8C, 1D, 40, AD, 40, 00, 66, 8C, 05, 3C, AD, 40, 00, 66, 8C, 25, 38, AD, 40, 00, 66, 8C, 2D, 34, AD, 40, 00, 9C, 8F, 05, 68, AD, 40, 00, 8B, 45, 00, A3, 5C, AD, 40, 00, 8B, 45, 04, A3, 60, AD, 40, 00, 8D, 45, 08, A3, 6C, AD, 40... 
[+]

Code size:

24.5 KB (25,088 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Telenorhjelpen

Command:

"C:\Program Files\telenor norway\telenorhjelpen\telenorhjelpen.exe" -autorun

The file Telenorhjelpen.exe has been discovered within the following program.

Telenorhjelpen by Telenor

25% remove it

Scan Telenorhjelpen.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.