File scan report
Verdict Safe
Is Reg
One of the 71 antivirus engines that checked it raised a generic alert, while long-term prevalence, major silence, and the absence of corroborating hostile activity support a…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 15y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
SentinelOne alone flagged the executable with a generic suspicious-file label; none of the 18 major antivirus engines detected it. The file has been submitted by 137 sources since it was first seen on Jun 9, 2011, and the sandbox summary recorded no corroborated high-risk technique or named injection target.
Only 1 of the 71 antivirus engines that checked it flagged the file, and the label is generic rather than a named malware family. All 18 major antivirus engines were silent, which weighs strongly against the isolated alert. The file also has substantial history: 137 distinct sources submitted it 150 times after it was first seen on Jun 9, 2011. No malware-specific community rule, public sample-database entry, malicious child, packing indicator, or brand mismatch corroborates the detection. The executable is unsigned and a complete contacted-address reputation result is unavailable, but these limitations do not outweigh the broad benign evidence.
What We Detected
SentinelOne was the only engine to flag the file, using a generic suspicious-PE label. None of the 18 major antivirus engines detected it, and no engine identified a real malware family.
Threat Behavior
The sandbox summary included mappings associated with process injection and defence impairment, but it recorded neither a named injection target nor an artefact demonstrating those actions. No corroborated high-risk technique, malicious dropped file, persistence indicator, or sample-originated domain contact was identified. A complete reputation result for every contacted address was not available.
What To Do Now
The isolated generic detection is most consistent with a false positive, particularly given 137 distinct submitters and a history dating to Jun 9, 2011. Keep security software enabled and obtain the executable from its expected source before running it; if its origin is unclear, verify its hash with the distributor.
Where this verdict could be wrong3 caveats
- SentinelOne reports a generic suspicious-PE detection.
- The executable is unsigned, so there is no verified publisher identity anchoring it.
- A complete reputation check was not available for every contacted address.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 major antivirus engines detected the file.
- The file has been submitted by 137 distinct sources and was first seen on Jun 9, 2011.
- The sandbox summary recorded no named process-injection target or corroborated high-risk technique.
- No malware-specific community rules or public malware-sample listing matched the hash.
- The executable does not appear packed and contains no high-entropy code section.
- The executable has no verified digital signature.
- SentinelOne reports a generic suspicious-file detection.
- A complete reputation check was unavailable for every contacted address.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 2spawned processes
- 4network contacts
- 24filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1087
- T1106
- T1562.001· Disables security
Observed activity
Processes started
2Programs the file ran, with their command lines.
software.exe"C:\Users\<USER>\Desktop\software.exe"1284106bcfc820bc983810a3bacbfc8f3db96af945013642a6078e594cfd076b.exe%SAMPLEPATH%\1284106bcfc820bc983810a3bacbfc8f3db96af945013642a6078e594cfd076b.exe
Network contacts
44 hosts, listed as 4 addresses. Links show the host and path only.
- IP address
72.21.81.240 - IP address
23.40.197.184 - IP address
23.198.146.35 - IP address
23.216.147.56
Files
17Files the file created, changed or deleted.
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Users\user\AppData\Roaming - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E60.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E61.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F3C.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6C.tmp.txt
Show all 17 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F3B.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F7C.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER439B.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4486.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER44B6.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A63.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A73.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A74.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DD3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EAE.tmp.csv
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 7 entries for mutexes
MSCTF.Shared.MUTEX.EBH
Sandbox background — not the file
12The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM host
a83f:8110:9d59:ff:995a:ff:9759:ff - VM host
20.99.132.105 - VM host
192.229.211.108 - VM host
20.99.133.109 - VM host
20.99.184.37
Show all 12 entries for sandbox background — not the file
- VM host
a83f:8110:0:0:64ca:1f00:0:0 - VM host
20.99.185.48 - VM host
20.99.186.246 - VM host
a83f:8110:0:0:b00:b00:2800:1800 - VM host
192.168.0.47 - VM host
23.216.81.152
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- SentinelOneStatic AI - Suspicious PE
File fingerprint
- Last analyzed
- May 22, 2026, 11:03 AM UTC
- SHA-256
1284106bcfc820bc983810a3bacbfc8f3db96af945013642a6078e594cfd076b- SHA-1
2e210eb46ec87c901205d9bf818de13f25b10f1d- MD5
31d2286967caddc168b2a08845cd36ad
About this file
RegOwnit.exe is a Win32 EXE file of 3.8 MB.
- Type and size
- Win32 EXE · 3.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 9, 2011On VirusTotal.
- Submitted by
- 137 distinct sources
- Packer
- None detected
- Entropy
- 6.07 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines1flagged
- Low-trust17 engines0flagged
View all 75 engine results
- SentinelOneMalicious: Static AI - Suspicious PE
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is RegOwnit.exe safe?
What is RegOwnit.exe?
How many antivirus engines detected RegOwnit.exe?
What is the SHA-256 hash of RegOwnit.exe?
Is it safe to run RegOwnit.exe?
How up to date is this analysis of RegOwnit.exe?
Community
Member reviews and reports for this exact file hash.