File scan report
Verdict Safe
Is Reg
No antivirus engine flagged this verified Microsoft-signed RegAsm executable, and its prevalence, sandbox result, host checks, and signer history support legitimate software.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Microsoft Corporation
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the file, and its Microsoft Corporation signature verifies against a trusted publisher. One sandbox produced no malicious verdict, all three observed domains received complete reputation checks without adverse findings, and five recent signer-matched files received clean assessments.
The strongest evidence is the verified Microsoft Corporation signature combined with zero detections among 75 engines. The file is established rather than newly encountered, with 117 submitters and 135 submissions. One completed sandbox run returned a clean result, while all three observed domains were covered by the host-reputation check without malicious or suspicious matches. and provide some behavioral caution, but no process injection or persistence was recorded. Five recent signer-matched files also received clean assessments, and the antivirus analysis found no packing or high-entropy code.
What We Detected
None of the 71 antivirus engines that checked it flagged RegAsm.exe. The executable carries a verified Microsoft Corporation signature that matches a trusted publisher, and 30 of 31 historical samples associated with this signer received clean assessments. Five recent signer-matched files were also assessed as clean.
Threat Behavior
One completed sandbox run returned a clean result. It mapped T1562.001 and T1620, but recorded no injected processes, persistence indicators, malicious child verdicts, or hostile host-reputation matches. All three observed domains were inspected, and none matched known malicious or suspicious entries. The antivirus analysis found no packer, high-entropy code, or other packing indication.
What To Do Now
The evidence supports normal use when the file came from Windows or another trusted Microsoft distribution channel. If it appeared in an unexpected location or was supplied by an untrusted party, verify its digital signature and compare it with the expected system copy before execution.
Where this verdict could be wrong3 caveats
- The sandbox mapped and T1620, techniques that can indicate defense impairment and reflective code loading, but it returned a clean result and recorded no injected processes or persistence.
- Microsoft Corporation signer history includes 1 malicious verdict among 31 samples, so the signature is strong rather than absolute assurance.
- Two written files it created lack saved verdicts; this is incomplete file it created coverage, not evidence that either child is harmful.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- The digital signature is valid and belongs to trusted publisher Microsoft Corporation.
- The signer has a 30-of-31 clean historical record.
- One sandbox run returned a clean result, with no process injection or persistence observed.
- All three observed domains were checked without malicious or suspicious reputation matches.
- The sandbox mapped defense-impairment and reflective-loading techniques, although it did not record injection, persistence, or a malicious outcome.
- Two written files it created do not have saved assessments, leaving their individual status unconfirmed.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 2spawned processes
- 0network contacts
- 3filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1045
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1198
- T1497· Sandbox evasion
- T1562.001· Disables security
- T1620· In-memory loading
Observed activity
Processes started
2Programs the file ran, with their command lines.
regasm.exe"C:\Users\<USER>\Desktop\regasm.exe"regasm.exe"C:\Users\user\Desktop\regasm.exe"
Files
3Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\regasm.exe.log - Written
\Device\ConDrv - Written
\Device\ConDrv\\Connect
Sandbox background — not the file
4The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
x1.c.lencr.org - VM host
crl.root-x1.letsencrypt.org.edgekey.net - VM host
e8652.dscx.akamaiedge.net
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- d8988d672d6915b46946…cc146bNot checkedno saved verdict
- 66a1d539f7b1920191fc…9a17b0Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 6:56 PM UTC
- SHA-256
3e26a8ba9db5d89b5732dbc47ec4f08f4e7375b425cba857d788668ce1cd9fc3- SHA-1
39f023d15556f2b0d323cc58897112ff31c45578- MD5
9727eea0e1ec68fe51355caa6dbb7876
About this file
RegAsm.exe is a Win32 EXE file of 58.0 kB.
- Type and size
- Win32 EXE · 58.0 kB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Oct 11, 2025On VirusTotal.
- Submitted by
- 117 distinct sources
- Packer
- None detected
- Entropy
- 5.36 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is RegAsm.exe safe?
What is RegAsm.exe?
How many antivirus engines detected RegAsm.exe?
Is RegAsm.exe digitally signed?
What is the SHA-256 hash of RegAsm.exe?
Is it safe to run RegAsm.exe?
How up to date is this analysis of RegAsm.exe?
Community
Member reviews and reports for this exact file hash.