home

wsstart.exe

WindowSearch Version Manager

HOW SOFT

The application wsstart.exe by HOW SOFT has been detected as a potentially unwanted program by 8 anti-malware scanners.
Publisher:
HowSoft.  (signed by HOW SOFT)

Product:
WindowSearch Version Manager

Version:
1, 1, 0, 8

MD5:
6ae825027f0769caafcbb1aa8d40cc05

SHA-1:
576b91089689cfc8188663dec5526aa408adc9a0

SHA-256:
0ddb7ba2ff534ea218fb786ad32695945e2788257c0dfb0114a843130c43641d

Scanner detections:
8 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 4:53:22 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.WindowSearch
2015.06.06

avast!
Win32:PUP-gen [PUP]
2014.9-150716

AVG
Generic
2016.0.3047

Comodo Security
ApplicUnwnt
22352

ESET NOD32
Win32/AdWare.Kraddare.JQ (variant)
9.11743

Malwarebytes
Adware.K.WindowSearch
v2015.07.16.07

Reason Heuristics
PUP.Hue Communication.HOWSOFT (M)
15.7.16.7

ViRobot
Adware.Agent.217168[h]
2014.3.20.0

File size:
212.1 KB (217,168 bytes)

Product version:
1, 1, 0, 8

Copyright:
Copyright (c) WindowSearch. All rights reserved.

Original file name:
wsstart.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\windowsearch\wsstart.exe

Digital Signature
Signed by:
HOW SOFT

Authority:
Thawte, Inc.

Valid from:
11/29/2011 9:00:00 AM

Valid to:
1/28/2013 8:59:59 AM

Subject:
CN=HOW SOFT, O=HOW SOFT, L=Guro-gu, S=SEOUL, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
567C8147E85208EFCE0495C1D8AC015F

File PE Metadata
Compilation timestamp:
9/19/2012 6:07:13 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
3072:3OjHYwm9xpbcXGig1Py+pGRRr/k+w9+5dCWFlzCPUlNyRWvFcCVQFFoGmlW:3SYqXwpLp+5dC2z80KFt

Entry address:
0x82DA0

Entry point:
60, BE, 00, 20, 45, 00, 8D, BE, 00, F0, FA, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.8788

Packer / compiler:
UPX 2.90LZMA

Code size:
196 KB (200,704 bytes)

Remove wsstart.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.