home

StatusTray.exe

Provisioning Services

Citrix Systems, Inc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘StatusTray’.
Publisher:
Citrix, Systems Inc.  (signed by Citrix Systems, Inc)

Product:
Provisioning Services

Description:
vDisk Status

Version:
5.6.0.1028

MD5:
24439858f420cbac8971689e47ec61b6

SHA-1:
1166e322f0f591012d41ff17ceb0eca6fdac6a3d

SHA-256:
c9374abe323071e9dc250c38646333f01b423ee2ac7662392ca4978cddd6168a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/25/2024 2:26:05 PM UTC  (today)

File size:
100.9 KB (103,296 bytes)

Product version:
5.6.0

Copyright:
© 2001-2010 Citrix Systems, Inc. All rights reserved.

Original file name:
StatusTray.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\Program Files\citrix\provisioning services\statustray.exe

Digital Signature
Signed by:
Citrix Systems, Inc

Authority:
VeriSign, Inc.

Valid from:
8/25/2009 7:00:00 AM

Valid to:
8/26/2011 6:59:59 AM

Subject:
CN="Citrix Systems, Inc", OU=Virtualization and Management Division, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Citrix Systems, Inc", L=Bedford, S=Massachusetts, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
26007A7721F30F5C55305B1DC02156DD

File PE Metadata
Compilation timestamp:
5/13/2010 1:31:21 AM

OS version:
5.2

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1536:BA2ij7yb0Wan+/S/+LAMqDJ5iOJxtIZ2SdLBa4C:Br0WanP+WUOJxtIZFps

Entry address:
0x9268

Entry point:
48, 83, EC, 28, E8, BF, 05, 00, 00, 48, 83, C4, 28, E9, 92, FC, FF, FF, FF, 25, C0, 1F, 00, 00, 48, 8D, 05, C9, 4F, 00, 00, 48, 89, 01, 48, 8B, C1, C3, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 8B, F2, 48, 8B, D9, F6, C2, 02, 74, 2A, 44, 8B, 41, F8, 4C, 8D, 0D, 98, 07, 00, 00, BA, 18, 00, 00, 00, E8, 22, 03, 00, 00, 40, F6, C6, 01, 74, 09, 48, 8D, 4B, F8, E8, 13, F6, FF, FF, 48, 8D, 43, F8, EB, 16, E8, 74, 07, 00, 00, 40, F6, C6, 01, 74, 08, 48, 8B, CB, E8, FA, F5, FF, FF, 48, 8B...
 
[+]

Entropy:
5.6480

Code size:
39.5 KB (40,448 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
StatusTray

Command:
C:\Program Files\citrix\provisioning services\statustray.exe -autorun


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.