» UpDates.exe
Overview
Analysis
File Details
Programs (1)

UpDates.exe

RegistryReviver Updates

ReviverSoft LLC

The application UpDates.exe, “Registry Reviver for Registry Cleaner” by ReviverSoft has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Registry Reviver by ReviverSoft LLC.

File name:

UpDates.exe

Publisher:

ReviverSoft LLC. (signed by ReviverSoft LLC)

Product:

RegistryReviver Updates

Description:

Registry Reviver for Registry Cleaner

Version:

1.1.28.0

MD5:

161acf7b3be28d64c8057c0b45e304e5

SHA-1:

4cca3acc46b32251d2df17fe6a8ee39cd0acab26

SHA-256:

e8236b6dba0df5f7221735eea9ab2545665ece3b44e97ed9f035a2653e5c3003

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

4/19/2024 3:01:06 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

Win32.Generic

16.2.6.5

File size:

946.1 KB (968,848 bytes)

Product version:

1.1.28.0

Original file name:

UpDates.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\reviversoft\registryreviver\updates.exe

Digital Signature

Signed by:

ReviverSoft LLC

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

10/29/2009 1:00:00 AM

Valid to:

10/27/2010 1:59:59 AM

Subject:

CN=ReviverSoft LLC, OU=Secure Application Development, O=ReviverSoft LLC, L=Walnut Creek, S=California, C=US

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

63EB81EA551540406D7B7123BD90D4C3

File PE Metadata

Compilation timestamp:

10/16/2009 12:57:09 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:uWbU1srBdC/U+dFpEt3+U2Ybsljz45ygLacU7k6uOIuKkwsS9:uWdC/U4+/eH45ygGcU7k6JAOS9

Entry address:

0x20819

Entry point:

E8, 82, 4F, 00, 00, E9, 79, FE, FF, FF, 3B, 0D, F4, 45, 44, 00, 75, 02, F3, C3, E9, 04, 50, 00, 00, 8B, FF, 51, C7, 01, 5C, 8C, 43, 00, E8, FC, 50, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, E5, 32, FE, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 83, C1, 09, 51, 83, C0, 09, 50, E8, 38, 51, 00, 00, F7, D8, 59, 1B, C0, 59, 40, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 83, EC, 20, 53, 33, DB, 39, 5D, 14, 75, 20, E8, 91, 10, 00, 00, 53... 
[+]

Code size:

206.5 KB (211,456 bytes)

The file UpDates.exe has been discovered within the following program.

Registry Reviver by ReviverSoft LLC

Registry Reviver is registry utility whose purported purpose is to remove redundant items from the Windows registry.

www.reviversoft.com/registry-reviver

48% remove it

Remove UpDates.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.