» traydownloader.exe
Overview
Analysis
File Details
Programs (1)

traydownloader.exe

Tray downloader

Taiwan Shui Mu Chih Ching Technology Limited

The application traydownloader.exe, “downloader component” by Taiwan Shui Mu Chih Ching Technology Limited has been detected as adware by 4 anti-malware scanners. This file is typically installed with the program Picexa by Taiwan Shui Mu Chih Ching Technology Limited..

File name:

traydownloader.exe

Publisher:

Taiwan Shui Mu Chih Ching Technology Limited (signed and verified)

Product:

Tray downloader

Description:

downloader component

Version:

1.1.5.1

MD5:

cfdf97ede350e44fad948b786702c5a4

SHA-1:

7e06f28a107f0848972d7c119f12a4a83a24a6cd

SHA-256:

1765c085a11d99b1ad08b3f710010c4e4ef42ea50326df26a4e08f4752c42491

Scanner detections:

4 / 68

Status:

Adware

Analysis date:

11/27/2024 1:38:31 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic

2016.0.3122

Bkav FE

W32.HfsAdware

1.3.0.6379

Dr.Web

Adware.Mutabaha.229

9.0.1.0121

Reason Heuristics

PUP.Thinknice.TaiwanShuiMuChihChingTechnology

15.5.1.17

File size:

220.7 KB (225,976 bytes)

Product version:

1.1.5.1

Original file name:

TrayDown.exe

File type:

Executable application (Win32 EXE)

Language:

Chinese

Common path:

C:\Program Files\picexa\traydownloader.exe

Digital Signature

Signed by:

Taiwan Shui Mu Chih Ching Technology Limited

Authority:

GlobalSign nv-sa

Valid from:

3/4/2015 10:26:37 AM

Valid to:

3/4/2016 10:26:37 AM

Subject:

CN=Taiwan Shui Mu Chih Ching Technology Limited, O=Taiwan Shui Mu Chih Ching Technology Limited, L=Taipei City, S=Taiwan, C=TW

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121003857AB2AD439A7293EF2F1A8B3DCB6

File PE Metadata

Compilation timestamp:

3/12/2015 10:12:03 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:qEK3YJlrPOAtHQazgcIsrs3weOQ0f+OqQFN68YgcX:qEK3+rPOmwazgcNsg/+OFFN6t

Entry address:

0xE951

Entry point:

E8, A3, 46, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, F4, 97, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 3C, 91, 41, 00, C9, C2, 08, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81... 
[+]

Code size:

95 KB (97,280 bytes)

The file traydownloader.exe has been discovered within the following program.

Picexa by Taiwan Shui Mu Chih Ching Technology Limited.

About 2% of users remove it

Remove traydownloader.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.