home

VStart.exe

音速启动(VStart)

Shanghai Gaoxin Computer System Co.,ltd

The application VStart.exe by Shanghai Gaoxin Computer System Co.,ltd has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler named VStart2 triggered to execute each time a user logs in.
Publisher:
3L软件工作室(3LSoft)  (signed by Shanghai Gaoxin Computer System Co.,ltd)

Product:
音速启动(VStart)

Description:
音速启动 - 您的启动专家

Version:
5.06

MD5:
458a146c6c8836305df0cc7736534b4c

SHA-1:
5aa07cc64a727da285d1196875ae064f931a5513

SHA-256:
9a344988a264f21eccded3193f5f7f9865753aaad941ac42069df82c3e903121

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/25/2024 11:47:10 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ShanghaiGaoxinComputerSystemColtd.G
14.8.29.1

File size:
2.7 MB (2,815,424 bytes)

Product version:
5.06

Copyright:
http://www.3lsoft.com

Trademarks:
http://www.3lsoft.com

Original file name:
VStart.exe

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
Shanghai Gaoxin Computer System Co.,ltd

Authority:
VeriSign, Inc.

Valid from:
5/7/2013 8:00:00 AM

Valid to:
5/7/2016 7:59:59 AM

Subject:
CN="Shanghai Gaoxin Computer System Co.,ltd", OU=IT, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Shanghai Gaoxin Computer System Co.,ltd", L=Shanghai, S=Shanghai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3252B61CBBBA434FC4C89A24F5ED7D30

File PE Metadata
Compilation timestamp:
5/20/2014 9:43:42 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:VBSXMNXPIqpmhvojxXmmMefrPJkY3UiHz2Xe:YhS9mmMUJ5UiHX

Entry address:
0x12714

Entry point:
68, AC, 39, 41, 00, E8, F0, FF, FF, FF, 00, 00, 40, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, B0, FB, C2, 3A, DD, 25, 6C, 44, A1, 16, 88, 53, 38, BE, C5, 3E, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 0D, 0A, 20, 20, 20, 42, 56, 53, 74, 61, 72, 74, 00, 72, 00, 20, 20, 20, 20, 20, 20, 3D, B0, 00, 00, 00, 88, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 51, 00, 00, 00, 25, 41, 03, 44, 97, BF, 18, 40, 86, E9, 25, DB, 8F, 6E, 73, 37, 01, 00, 00, 00, 90, 00, 00, 00, A0, 00, 00, 00, 01, 00, 00, 00...
 
[+]

Entropy:
6.2353

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
2.5 MB (2,670,592 bytes)

Scheduled Task
Task name:
VStart2

Trigger:
Logon (Runs on logon)


Remove VStart.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.