home

vpnconf.exe

ZyWALL IPSec VPN Client

TheGreenBow

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘TgbVpn’.
Publisher:
ZyXEL  (signed by TheGreenBow)

Product:
ZyWALL IPSec VPN Client

Version:
2.2.204.61

MD5:
5592986d3304147527f7d5c4945ed58c

SHA-1:
677784b7cbdb0145a2ea35d2573c9ce636d00124

SHA-256:
3d1f171b0cbb143106ba496776ea4d7f2a986aaff734cad7d22b0d626cf3659b

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 12:56:25 AM UTC  (today)

File size:
507 KB (519,152 bytes)

Product version:
4.50

Copyright:
© ZyXEL 2008

Original file name:
ZyWALL_IPSec_VPN_Client.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\zyxel\zywall vpn client\vpnconf.exe

Digital Signature
Signed by:
TheGreenBow

Authority:
VeriSign, Inc.

Valid from:
7/29/2008 2:00:00 AM

Valid to:
8/24/2009 1:59:59 AM

Subject:
CN=TheGreenBow, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=TheGreenBow, L=Paris, S=Paris, C=FR

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0C3719482F1F6EE2297F9F9E0FE42B4F

File PE Metadata
Compilation timestamp:
11/12/2008 10:38:02 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:tW52b/iYPrRHRnJFrvH+O3gyGAjPjBGLgHW7ZUy+QPcqMcQp:AIFbFTpQLgHW7OyjPcNcQp

Entry address:
0x17A310

Entry point:
60, BE, 00, D0, 50, 00, 8D, BE, 00, 40, EF, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.7154

Packer / compiler:
UPX 2.90LZMA

Code size:
440 KB (450,560 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
TgbVpn

Command:
"C:\Program Files\zyxel\zywall vpn client\vpnconf.exe"


Scan vpnconf.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.