GridinSoft Threat Intelligence
TSRegCleaner64bit.exe threat report
GridinSoft Anti-Malware detection
Detected by GridinSoft before you download
The current ThreatInfo record shows this exact file hash detected as Ransom.Occamy. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.
- Detection name
- Ransom.Occamy
- Recommended action
- Scan and remove
- Last analysis
- 2022-03-03 23:21:17 (4 years ago)
- File hash
- 47db7b2dbbc19f7d3197828510bb5963
Why it matters
Why GridinSoft flags this file
GridinSoft identifies the sample as Ransom.Occamy.
First seen 2020-11-27 18:21:55 (5 years ago); latest analysis 2022-03-03 23:21:17 (4 years ago).
Company metadata: Gosuto. Product metadata: Turbo Studio Registry Cleaner.
Signed by Gosuto. The signature is reported as valid, but signed files can still be bundled or abused.
ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.
Recommended action
What to do next
- Compare the MD5 above with the file found on the device.
- Check whether the file appears in the observed locations or under one of the alternate names.
- Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.
File context
TSRegCleaner64bit.exe is a Windows file recorded in the ThreatInfo database. It is associated with Turbo Studio Registry Cleaner. The reported company name is Gosuto. The current detection status is Ransom.Occamy, based on the latest analysis from 2022-03-03 23:21:17 (4 years ago).
If TSRegCleaner64bit.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Ransom.Occamy.
File Details
| Product Name: | Turbo Studio Registry Cleaner |
| Company Name: | Gosuto |
| MD5: | 47db7b2dbbc19f7d3197828510bb5963 |
| Size: | 224 KB |
| First Published: | 2020-11-27 18:21:55 (5 years ago) |
| Latest Published: | 2022-03-03 23:21:17 (4 years ago) |
| Status: | Ransom.Occamy (on last analysis) | |
| Analysis Date: | 2022-03-03 23:21:17 (4 years ago) |
Detection screenshot
The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.
Overview
| Signed By: | Gosuto |
| Status: | Valid |
The signature on TSRegCleaner64bit.exe is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.
Common Places:
| %sysdrive% |
| %desktop%\corel draw 2019 (1)\corel draw 2019\ativador |
ThreatInfo has observed TSRegCleaner64bit.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.
Geographic signal
Observed country distribution
ThreatInfo has seen TSRegCleaner64bit.exe across 2 countries. Use this signal to compare local evidence with where the sample is most often reported.
The strongest geographic signal for this file is Colombia with 66.7% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.
OS Version:
The most common operating system signal for TSRegCleaner64bit.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.
Analysis
TSRegCleaner64bit.exe is identified as pe for 64-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.
PE Sections:
Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.
67148b353f988201a752112cf6062f0e
827d4c4a075c0722ab787d8ab5a1c3e5
d41d8cd98f00b204e9800998ecf8427e
b348e8d075e40e1ba1ecdd168ac3c74c
b2be80826bd766c2bcf80a5cd9156ee3
d41d8cd98f00b204e9800998ecf8427e
4a97a418fdd7c9c7df76f04b550ed63d
809f038f1c9ce9d8e08a18422e40e351
f75a46579141979a8ba63648361034ff
PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.
Report conclusion
GridinSoft detects this file as Ransom.Occamy
This report identifies TSRegCleaner64bit.exe by MD5 47db7b2dbbc19f7d3197828510bb5963. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.