» awtray.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

awtray.exe

AdminWorks

LANDesk Software, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘AdminWorks Tray’.

File name:

awtray.exe

Publisher:

OSA Technologies Inc., An Avocent Company (signed by LANDesk Software, Inc.)

Product:

AdminWorks

Description:

AdminWorks Tray Program

Version:

1.5.35.83

MD5:

b39b25824c3f70d420689933fd11cf5a

SHA-1:

2651026d2ba0d7f4b1d1b592ce5f589f3b235762

SHA-256:

fdc439456f1a8fefcd5ef688d12b4b07d1823bbd9ac44fde4f793570554db77d

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/25/2024 3:47:19 AM UTC (today)

File size:

1.4 MB (1,461,048 bytes)

Product version:

1.5

Original file name:

awtray.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Digital Signature

Signed by:

LANDesk Software, Inc.

Authority:

VeriSign, Inc.

Valid from:

9/10/2007 1:00:00 AM

Valid to:

10/8/2008 12:59:59 AM

Subject:

CN="LANDesk Software, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="LANDesk Software, Inc.", L=South Jordan, S=Utah, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

5B7D805BC1A12CE98146905AE9B3F19A

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:tRL0QRzL7oU9QSQrVJU56glAg8n/ggVc7ltPz6SIYn49m:tRL0Qd7njYRglA7gn7VIxm

Entry address:

0xA2C60

Entry point:

55, 8B, EC, 83, C4, F0, 53, B8, D8, 25, 4A, 00, E8, DB, E7, F5, FF, 8B, 1D, AC, 5C, 4A, 00, 33, C9, BA, 14, 2D, 4A, 00, B8, 28, 2D, 4A, 00, E8, 64, DB, F7, FF, 84, C0, 75, 77, 8B, 03, E8, 45, EA, F5, FF, 8B, 03, BA, 54, 2D, 4A, 00, E8, 19, EA, F5, FF, 8B, 0D, CC, 3A, 4A, 00, 8B, 03, 8B, 15, C0, 01, 4A, 00, E8, 2E, EA, F5, FF, 8B, 0D, 24, 3B, 4A, 00, 8B, 03, 8B, 15, 0C, C7, 49, 00, E8, 1B, EA, F5, FF, 8B, 0D, 2C, 3A, 4A, 00, 8B, 03, 8B, 15, 24, C2, 49, 00, E8, 08, EA, F5, FF, 8B, 0D, 08, 3B, 4A, 00, 8B, 03... 
[+]

Entropy:

6.6985

Developed / compiled with:

Microsoft Visual C++

Code size:

647.5 KB (663,040 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

AdminWorks Tray

Command:

"C:\acer\lanscope agent\awtray.exe"

The file awtray.exe has been discovered within the following program.

Acer LANScope Agent by Acer Incorporated

Acer LANScope Agent is a white label version of the Avocent AdminWorks Agent. The program communicates with AdminWorks software on the same network.

www.acer.com

11% remove it

Scan awtray.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.