home

StatusTray.exe

Provisioning Services

Citrix Systems, Inc

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘StatusTray’.
Publisher:
Citrix, Systems Inc.  (signed by Citrix Systems, Inc)

Product:
Provisioning Services

Description:
vDisk Status

Version:
5.6.0.1028

MD5:
596b9906b7d609c7bef16a522c80a258

SHA-1:
d54ca85a6a5292d24bbd78004f1b43204ad46d2c

SHA-256:
51ad5013d139e217edc2b175dc36a4cf847834219cac0b1c2ef84490800db1db

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/20/2024 2:45:55 AM UTC  (today)

File size:
80.4 KB (82,304 bytes)

Product version:
5.6.0

Copyright:
© 2001-2010 Citrix Systems, Inc. All rights reserved.

Original file name:
StatusTray.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\citrix\provisioning services\statustray.exe

Digital Signature
Signed by:
Citrix Systems, Inc

Authority:
VeriSign, Inc.

Valid from:
8/24/2009 7:00:00 PM

Valid to:
8/25/2011 6:59:59 PM

Subject:
CN="Citrix Systems, Inc", OU=Virtualization and Management Division, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Citrix Systems, Inc", L=Bedford, S=Massachusetts, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
26007A7721F30F5C55305B1DC02156DD

File PE Metadata
Compilation timestamp:
5/12/2010 1:29:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
1536:vua3rTRMHKDeAMYOKht+r/oHP8dNgve7MDOXNtHubLQa4C:vua3rTRMHoeebht+r/Ul2ADOXNtHuvh

Entry address:
0x8483

Entry point:
E8, 9C, 06, 00, 00, E9, D8, FC, FF, FF, CC, FF, 25, 1C, A1, 40, 00, FF, 25, 14, A1, 40, 00, FF, 25, 10, A1, 40, 00, FF, 25, 0C, A1, 40, 00, 3B, 0D, 1C, E2, 40, 00, 75, 02, F3, C3, E9, 05, 07, 00, 00, CC, FF, 25, 08, A1, 40, 00, 8B, C1, C7, 00, DC, BC, 40, 00, C2, 04, 00, 8B, FF, 55, 8B, EC, F6, 45, 08, 02, 57, 8B, F9, 74, 25, 56, 68, 2A, 8D, 40, 00, 8D, 77, FC, FF, 36, 6A, 0C, 57, E8, BA, 02, 00, 00, F6, 45, 08, 01, 74, 07, 56, E8, 90, F6, FF, FF, 59, 8B, C6, 5E, EB, 14, E8, 2B, 08, 00, 00, F6, 45, 08, 01...
 
[+]

Entropy:
5.9626

Code size:
35 KB (35,840 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
StatusTray

Command:
C:\Program Files\citrix\provisioning services\statustray.exe -autorun


herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.