What’s INISAFETrayEX.exe (INISAFE CrossWeb EX Client Tray)? Is it safe or a virus?

INISAFETrayEX.exe is a process associated with the INISAFE CrossWeb EX Client Tray from INITECH Co., Ltd. This application is designed to provide users with a secure and efficient web browsing experience by offering various security features and tools.

While researching this executable I found a troubling article at the ahnlab.com website. AhnLab claimed this executable can be related to malware. Ahnlab wrote: "The AhnLab ASEC analysis team has discovered that there are 47 companies and institutions—including defense companies—infected with the malware distributed by the Lazarus group in the first quarter of 2022. Considering the severity of the situation, the team has been monitoring the infection cases. In systems of the organizations infected with the malware, it was found that malicious behaviors stemmed from the process of INITECH (inisafecrosswebexsvc.exe), the security company."

Ahnlab listed the hash "MD5: 4541efd1c54b53a3d11532cb885b2202" as one you could check to see if you are infected by this malware.

The executable INISAFETrayEX.exe doesn't seem to be the specific malware that Ahnlab reports, but the app description of INISAFETrayEX.exe does mention "CrossWeb EX" which Ahnlab refers to in their report.

We at SpyShelter were unable to confirm if INISAFETrayEX.exe is malware, but we did find the above information (reported by Ahnlab) that may be useful if you have this executable on your PC.

Researched by Carl @ SpyShelter Labs