home

etagclient.exe

eTag

Best Buy Co, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘eTag’.
Publisher:
Yougetitback Limited  (signed by Best Buy Co, Inc.)

Product:
eTag

Description:
eTagClient

Version:
1, 5, 1, 0

MD5:
a4de321bed57e3396e78c566ca58dbb1

SHA-1:
c545868ae1d902624939239f2a76a3de83b4ef31

SHA-256:
b9aa686d96737674ed2e38f9d27acf2cfc906d9bb4e1bf1f730998d5dd3bf508

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/28/2024 8:01:26 AM UTC  (today)

File size:
650.9 KB (666,520 bytes)

Product version:
1, 5, 1, 0

Copyright:
Copyright (C) 2011

Original file name:
eTagClient

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\Program Files\inhance technology\geek squad app\etagclient.exe

Digital Signature
Signed by:
Best Buy Co, Inc.

Authority:
VeriSign, Inc.

Valid from:
7/16/2013 7:00:00 PM

Valid to:
7/18/2014 6:59:59 PM

Subject:
CN="Best Buy Co, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Geek Squad, O="Best Buy Co, Inc.", L=Richfield, S=Minnesota, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0BB471E59E8FD0D0C932F1BD75661551

File PE Metadata
Compilation timestamp:
7/29/2013 3:52:21 AM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:Uzz+NYa4a/W0FNsXaNTK6RkDUuzd0T9JB:UzzNuhPQivRaUuzWJ

Entry address:
0x114D0

Entry point:
48, 83, EC, 28, E8, 5B, 04, 00, 00, 48, 83, C4, 28, E9, F6, FC, FF, FF, CC, CC, 40, 53, 48, 83, EC, 20, 45, 8B, 18, 48, 8B, DA, 4C, 8B, C9, 41, 83, E3, F8, 41, F6, 00, 04, 4C, 8B, D1, 74, 13, 41, 8B, 40, 08, 4D, 63, 50, 04, F7, D8, 4C, 03, D1, 48, 63, C8, 4C, 23, D1, 49, 63, C3, 4A, 8B, 14, 10, 48, 8B, 43, 10, 8B, 48, 08, 48, 03, 4B, 08, F6, 41, 03, 0F, 74, 0C, 0F, B6, 41, 03, 83, E0, F0, 48, 98, 4C, 03, C8, 4C, 33, CA, 49, 8B, C9, 48, 83, C4, 20, 5B, E9, 79, FA, FF, FF, CC, 48, 83, EC, 28, 4D, 8B, 41, 38...
 
[+]

Entropy:
5.9809

Code size:
210 KB (215,040 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
eTag

Command:
C:\Program Files\inhance technology\geek squad app\etagclient.exe \auto


Scan etagclient.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.