home

tray.exe

Simple Driver Updater

Vapc Lux Sarl

The application tray.exe by Vapc Lux Sarl has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This file is typically installed with the program Simple Driver Updater by SimpleStar. While running, it connects to the Internet address bam-3.nr-data.net on port 443.
Publisher:
Vapc Lux Sarl  (signed and verified)

Product:
Simple Driver Updater

Version:
5,15,1,2

MD5:
f82ac5dcfb42512fee0040a812395509

SHA-1:
70c15cbb085aa11a5255266e33b81fe25ead937d

SHA-256:
fd95b43f380df1bb2abd23936fb35687f5d0fbd0e02f757fe89816c8d2528031

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/22/2024 10:13:26 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.SimpleStar (L)
16.12.13.21

File size:
2.4 MB (2,515,928 bytes)

Product version:
5.15.1.2

Copyright:
Copyright © 2016 SimpleStar. All Rights Reserved.

Original file name:
SimpleDriverUpdater.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\simple driver updater\tray.exe

Digital Signature
Signed by:
Vapc Lux Sarl

Authority:
GlobalSign nv-sa

Valid from:
2/11/2016 10:11:14 AM

Valid to:
2/10/2017 10:57:32 AM

Subject:
E=Ludovic.trogliero@vapc.lu, CN=Vapc Lux Sarl, O=Vapc Lux Sarl, L=Luxembourg, C=LU

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130BA28CC6DC89090DD3923776478D67D

File PE Metadata
Compilation timestamp:
12/12/2016 9:51:48 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

Entry address:
0x56C0C

Entry point:
E8, 32, C4, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 8B, 73, 08, 33, 35, 18, 0B, 4C, 00, 57, 8B, 06, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8D, 7B, 10, 83, F8, FE, 74, 0D, 8B, 4E, 04, 03, CF, 33, 0C, 38, E8, 9D, F4, FF, FF, 8B, 4E, 0C, 8B, 46, 08, 03, CF, 33, 0C, 38, E8, 8D, F4, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, 19, 01, 00, 00, 8B, 4D, 10, 8D, 55, E8, 89, 53, FC, 8B, 5B, 0C, 89, 45, E8, 89, 4D, EC, 83, FB, FE, 74...
 
[+]

Entropy:
4.8328

Code size:
563 KB (576,512 bytes)

The file tray.exe has been discovered within the following program.

Simple Driver Updater  by SimpleStar
www.simplestar.com/support/simple-driver-updater
About 5% of users remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-52-2-143-52.compute-1.amazonaws.com  (52.2.143.52:80)

TCP (HTTP):
Connects to ec2-54-85-189-79.compute-1.amazonaws.com  (54.85.189.79:80)

TCP (HTTP):
Connects to a23-67-59-9.deploy.static.akamaitechnologies.com  (23.67.59.9:80)

TCP (HTTP):
Connects to ec2-52-21-13-167.compute-1.amazonaws.com  (52.21.13.167:80)

TCP (HTTP SSL):
Connects to bam-2.nr-data.net  (50.31.164.166:443)

TCP (HTTP SSL):
Connects to bam-6.nr-data.net  (162.247.242.18:443)

TCP (HTTP SSL):
Connects to bam-7.nr-data.net  (162.247.242.19:443)

TCP (HTTP SSL):
Connects to bam-3.nr-data.net  (50.31.164.173:443)

TCP (HTTP SSL):
Connects to bam-8.nr-data.net  (162.247.242.20:443)

TCP (HTTP SSL):
Connects to bam-4.nr-data.net  (50.31.164.174:443)

TCP (HTTP):
Connects to ec2-52-7-8-20.compute-1.amazonaws.com  (52.7.8.20:80)

TCP (HTTP):
Connects to a23-55-155-27.deploy.static.akamaitechnologies.com  (23.55.155.27:80)

TCP (HTTP SSL):
Connects to lr-in-f95.1e100.net  (209.85.233.95:443)

TCP (HTTP SSL):
Connects to cache.google.com  (193.212.4.117:443)

TCP (HTTP):
Connects to a23-59-139-27.deploy.static.akamaitechnologies.com  (23.59.139.27:80)

TCP (HTTP):
Connects to a23-51-123-27.deploy.static.akamaitechnologies.com  (23.51.123.27:80)

TCP (HTTP):
Connects to a23-50-155-27.deploy.static.akamaitechnologies.com  (23.50.155.27:80)

TCP (HTTP):
Connects to a23-49-139-27.deploy.static.akamaitechnologies.com  (23.49.139.27:80)

TCP (HTTP):
Connects to a23-44-155-27.deploy.static.akamaitechnologies.com  (23.44.155.27:80)

TCP (HTTP):
Connects to a23-37-43-27.deploy.static.akamaitechnologies.com  (23.37.43.27:80)

Remove tray.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.