home

Vcrmon.exe

Vcrmon

New Tech Wave Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Vcrmon’.
Publisher:
Scanny Grobal Research Insutitute.  (signed by New Tech Wave Inc.)

Product:
Vcrmon

Description:
Vcrmon POSBANK

Version:
5, 0, 9099, 4006

MD5:
8247cf3a4767ac5663a47d7edc69c533

SHA-1:
fc0cf28515be9cc7f0638c7198527da11da74a0a

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/15/2025 9:14:50 AM UTC  (today)

Scan engine
Detection
Engine version

F-Prot
W32/Heuristic-245!Eldorado (not disinfectable)
4.6.5.141

File size:
75 KB (76,832 bytes)

Product version:
5, 0, 9099, 4006

Copyright:
Copyright (C) 2005 Scanny Grobal Research Insutitute.

Trademarks:
Virus Chaser

Original file name:
Vcrmon.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\virus chaser\vcrmon.exe

Digital Signature
Signed by:
New Tech Wave Inc.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
9/3/2007 6:28:48 PM

Valid to:
9/2/2009 6:28:48 PM

Subject:
CN=New Tech Wave Inc., OU=Software Development Department, O=New Tech Wave Inc., L=Geuncheon-Gu, S=Seoul, C=KR

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
40E0AA3C615C4992C84D5C899F1D7EFF

File PE Metadata
Compilation timestamp:
4/9/2009 1:29:02 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x32620

Entry point:
60, BE, 00, 30, 42, 00, 8D, BE, 00, E0, FD, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Entropy:
7.6524

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
64 KB (65,536 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Vcrmon

Command:
"C:\Program Files\virus chaser\vcrmon.exe"


Scan Vcrmon.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.