home

VBoxTray.exe

VMLite Guest Additions

Remotesoft, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘VBoxTray’.
Publisher:
VMLite, Inc.  (signed by Remotesoft, Inc.)

Product:
VMLite Guest Additions

Description:
VMLite Guest Additions Tray Application

Version:
3.2.6.30480

MD5:
0d8862fdf399426a43e1850f4d0a2167

SHA-1:
a4ff4c1bea22b7acb519b41b00f226d5efe28cc9

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 6:42:02 AM UTC  (today)

File size:
1.2 MB (1,237,096 bytes)

Product version:
3.2.6.30480

Copyright:
Copyright (C) 2010 VMLite, Inc.

Original file name:
VBoxTray.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\vboxtray.exe

Digital Signature
Signed by:
Remotesoft, Inc.

Authority:
GlobalSign nv-sa

Valid from:
7/1/2010 1:37:33 AM

Valid to:
7/2/2011 1:37:29 AM

Subject:
CN="Remotesoft, Inc.", O="Remotesoft, Inc.", L=Fremont, S=CA, C=US

Issuer:
CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:
010000000001298B702EB5

File PE Metadata
Compilation timestamp:
8/21/2010 10:40:27 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
24576:p+N6Alwnm1kmn5uZycUhcGg7jphKd4fvM0x6kS:pa/069nsZycU4HphKd43M0x6N

Entry address:
0x27456

Entry point:
E8, 02, CF, 00, 00, E9, 16, FE, FF, FF, 8B, 44, 24, 0C, 53, 85, C0, 74, 52, 8B, 54, 24, 08, 33, DB, 8A, 5C, 24, 0C, F7, C2, 03, 00, 00, 00, 74, 16, 8A, 0A, 83, C2, 01, 32, CB, 74, 72, 83, E8, 01, 74, 32, F7, C2, 03, 00, 00, 00, 75, EA, 83, E8, 04, 72, 12, 57, 8B, FB, C1, E3, 08, 03, DF, 8B, FB, C1, E3, 10, 03, DF, EB, 1B, 5F, 83, C0, 04, 74, 0E, 8A, 0A, 83, C2, 01, 32, CB, 74, 40, 83, E8, 01, 75, F2, 5B, C3, 83, E8, 04, 72, E5, 8B, 0A, 33, CB, BF, FF, FE, FE, 7E, 03, F9, 83, F1, FF, 33, CF, 83, C2, 04, 81...
 
[+]

Code size:
296 KB (303,104 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
VBoxTray

Command:
C:\Windows\System32\vboxtray.exe


Scan VBoxTray.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.