File scan report
Verdict Safe
Is Reg
No antivirus engine flagged this verified Microsoft-signed RegAsm executable, and its prevalence, sandbox result, host checks, and signer history support legitimate software.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Microsoft Corporation
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the file, and its Microsoft Corporation signature verifies against a trusted publisher. One sandbox produced no malicious verdict, all three observed domains received complete reputation checks without adverse findings, and five recent signer-matched files received clean assessments.
The strongest evidence is the verified Microsoft Corporation signature combined with zero detections among 75 engines. The file is established rather than newly encountered, with 117 submitters and 135 submissions. One completed sandbox run returned a clean result, while all three observed domains were covered by the host-reputation check without malicious or suspicious matches. and provide some behavioral caution, but no process injection or persistence was recorded. Five recent signer-matched files also received clean assessments, and the antivirus analysis found no packing or high-entropy code.
What We Detected
None of the 71 antivirus engines that checked it flagged RegAsm.exe. The executable carries a verified Microsoft Corporation signature that matches a trusted publisher, and 30 of 31 historical samples associated with this signer received clean assessments. Five recent signer-matched files were also assessed as clean.
Threat Behavior
One completed sandbox run returned a clean result. It mapped T1562.001 and T1620, but recorded no injected processes, persistence indicators, malicious child verdicts, or hostile host-reputation matches. All three observed domains were inspected, and none matched known malicious or suspicious entries. The antivirus analysis found no packer, high-entropy code, or other packing indication.
What To Do Now
The evidence supports normal use when the file came from Windows or another trusted Microsoft distribution channel. If it appeared in an unexpected location or was supplied by an untrusted party, verify its digital signature and compare it with the expected system copy before execution.
Where this verdict could be wrong3 caveats
- The sandbox mapped and T1620, techniques that can indicate defense impairment and reflective code loading, but it returned a clean result and recorded no injected processes or persistence.
- Microsoft Corporation signer history includes 1 malicious verdict among 31 samples, so the signature is strong rather than absolute assurance.
- Two written files it created lack saved verdicts; this is incomplete file it created coverage, not evidence that either child is harmful.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- The digital signature is valid and belongs to trusted publisher Microsoft Corporation.
- The signer has a 30-of-31 clean historical record.
- One sandbox run returned a clean result, with no process injection or persistence observed.
- All three observed domains were checked without malicious or suspicious reputation matches.
- The sandbox mapped defense-impairment and reflective-loading techniques, although it did not record injection, persistence, or a malicious outcome.
- Two written files it created do not have saved assessments, leaving their individual status unconfirmed.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 2spawned processes
- 0network contacts
- 3filesystem & mutex artifacts
Includes the sandbox verdicts, 9 mapped techniques, every process, file, registry and network entry and 2 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 6:56 PM UTC
- SHA-256
3e26a8ba9db5d89b5732dbc47ec4f08f4e7375b425cba857d788668ce1cd9fc3- SHA-1
39f023d15556f2b0d323cc58897112ff31c45578- MD5
9727eea0e1ec68fe51355caa6dbb7876
About this file
RegAsm.exe is a Win32 EXE file of 58.0 kB.
- Type and size
- Win32 EXE · 58.0 kB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Oct 11, 2025On VirusTotal.
- Submitted by
- 117 distinct sources
- Packer
- None detected
- Entropy
- 5.36 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is RegAsm.exe safe?
What is RegAsm.exe?
How many antivirus engines detected RegAsm.exe?
Is RegAsm.exe digitally signed?
What is the SHA-256 hash of RegAsm.exe?
Is it safe to run RegAsm.exe?
How up to date is this analysis of RegAsm.exe?
Community
Member reviews and reports for this exact file hash.