» vf_host.exe
Overview
Analysis
File Details
Behaviors (1)

vf_host.exe

CyberArk Viewfinity

Viewfinity Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘VfTrayIcon’.

File name:

vf_host.exe

Publisher:

CyberArk Software Ltd. (signed by Viewfinity Inc.)

Product:

CyberArk Viewfinity

Version:

5.5.30.85

MD5:

f41320410ef275950c488f8593711e3b

SHA-1:

0b2258d2fa44cd8eb3bf220721a0e7f2c32cd486

SHA-256:

011791803d341240c8a908ee660ef0300c3819b6f01b4e83c7767fed1e4a9896

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

5/25/2026 9:27:14 AM UTC (today)

File size:

433 KB (443,400 bytes)

Product version:

5.5.30.85

Original file name:

vf_host.exe

File type:

Executable application (Win64 EXE)

Language:

English (United States)

Common path:

C:\Program Files\cyberark\viewfinity\agent\x64\vf_host.exe

Digital Signature

Signed by:

Viewfinity Inc.

Authority:

GlobalSign nv-sa

Valid from:

7/7/2014 6:37:26 AM

Valid to:

10/2/2016 8:31:46 AM

Subject:

CN=Viewfinity Inc., O=Viewfinity Inc., L=Waltham, S=MA, C=US

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11213433C44A1C94CCA12F1E49D5C4FB9372

File PE Metadata

Compilation timestamp:

1/4/2016 2:08:18 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

6144:uyuol3B/6wiJKfTdGOnn1jESPfAd5UdE7h4LTUf1PucnZPM0pPS425SjRLUt/rCS:1uuWa8OO537h4yiSjR4tDC8t

Entry address:

0x24178

Entry point:

48, 83, EC, 28, E8, E3, D9, 00, 00, 48, 83, C4, 28, E9, EA, FD, FF, FF, CC, CC, 48, 83, EC, 18, 66, 0F, 6F, 14, 24, 0F, B7, C2, 4C, 8B, C1, 66, 0F, 6E, C0, 45, 33, C9, F2, 0F, 70, C8, 00, 66, 0F, 70, D9, 00, 49, 8B, C0, 25, FF, 0F, 00, 00, 48, 3D, F0, 0F, 00, 00, 77, 2B, F3, 41, 0F, 6F, 08, 66, 0F, 6F, C2, 66, 0F, EF, C2, 66, 0F, 6F, D0, 66, 0F, 75, D1, 66, 0F, 75, CB, 66, 0F, EB, D1, 66, 0F, D7, C2, 85, C0, 75, 18, 49, 83, C0, 10, EB, C5, 66, 41, 39, 10, 74, 23, 66, 45, 39, 08, 74, 19, 49, 83, C0, 02, EB... 
[+]

Entropy:

6.2622

Code size:

295 KB (302,080 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

VfTrayIcon

Command:

"C:\Program Files\cyberark\viewfinity\agent\x64\vf_host.exe" -trayicon

Scan vf_host.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.