home

VFrtTray.exe

VMFort Guest Additions

VMCraft, Inc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘VFrtTray’.
Publisher:
VMCraft Inc  (signed by VMCraft, Inc)

Product:
VMFort Guest Additions

Description:
VmfortHypr Guest Additions Tray Application

Version:
4.2.4.1481

MD5:
427d4362ea9b44a5e558bd1556c6f89d

SHA-1:
39d095a48f71b7695f3a644f44e54959dc77aa56

SHA-256:
df59c855b736694ed2e0cc6912a2cef86cd9207730035f4270ff5cb2edcf41dd

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
7/8/2025 6:32:00 PM UTC  (today)

File size:
1.1 MB (1,148,624 bytes)

Product version:
4.2.4.1481

Copyright:
Copyright (C) 2009-2014 VMCraft Inc

Original file name:
VFrtTray.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Windows\System32\vfrttray.exe

Digital Signature
Signed by:
VMCraft, Inc

Authority:
VeriSign, Inc.

Valid from:
8/22/2013 9:00:00 AM

Valid to:
10/22/2014 8:59:59 AM

Subject:
CN="VMCraft, Inc", OU=Development, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="VMCraft, Inc", L=Seocho-gu, S=Seoul, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4B4AFECBC25B0CD7A6411B27369111A5

File PE Metadata
Compilation timestamp:
6/18/2014 1:40:24 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:lwbgR0mprnYJImfwGJRqrGCeWSetVZmnGCZyRTXgmSfnJrQKCHl1OyYMgOQpsDbh:lQgR0AnNORuFtVZmnQPOyYV9sDKDBO5

Entry address:
0x10103

Entry point:
E8, A7, 67, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 55, 0C, 56, 8B, 75, 08, 57, 0F, B6, 06, 8D, 48, BF, 46, 83, F9, 19, 77, 03, 83, C0, 20, 0F, B6, 0A, 8D, 79, BF, 42, 83, FF, 19, 77, 03, 83, C1, 20, 85, C0, 74, 04, 3B, C1, 74, DA, 5F, 2B, C1, 5E, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, 53, FF, 75, 10, 8D, 4D, F0, E8, DB, FA, FF, FF, 8B, 5D, 08, 85, DB, 75, 23, E8, 7C, 12, 00, 00, C7, 00, 16, 00, 00, 00, E8, E6, 11, 00, 00, 38, 5D, FC, 74, 07, 8B, 45, F8, 83, 60, 70, FD, B8, FF, FF, FF, 7F, EB...
 
[+]

Entropy:
6.4074

Code size:
302 KB (309,248 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
VFrtTray

Command:
C:\Windows\System32\vfrttray.exe


Scan VFrtTray.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.