Should I block it?

90%

90% of PCs block this file from running.

Possible reason:

Multiple malware detections

Additional versions

2, 91, 0, 0	3.03%
2, 90, 0, 0	3.03%
2, 88, 0, 0	9.09%
2, 87, 0, 0	6.06%
2, 84, 0, 0	9.09%
2, 83, 0, 0	6.06%
2, 81, 0, 0	3.03%
2, 79, 0, 0	6.06%
2, 78, 0, 0	27.27%
2, 76, 0, 0	12.12%
2, 74, 0, 0	6.06%
2, 72, 0, 0	3.03%
2, 70, 0, 0	6.06%

Relationships

Child process

fbwmgr.exe (by AnchorFree Inc)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegCreateKeyExW, RegSetValueExA, RegCloseKey, RegOpenKeyExA, RegEnumKeyExA, AdjustTokenPrivileges, RegQueryValueExA, RegQueryValueExW, RegDeleteKeyW, RegCreateKeyExA, RegDeleteValueW, RegOpenKeyExW, RegEnumKeyExW, RegSetValueExW, OpenProcessToken, LookupPrivilegeValueW, GetUserNameW

gdi32.dll

CreateDIBSection, CreateDCW, CreateICW, GetDIBits, ExtCreateRegion, GetStockObject, GetObjectW, CreateSolidBrush, GetDeviceCaps, BitBlt, CreateCompatibleDC, CreateCompatibleBitmap, DeleteDC, SelectObject, DeleteObject, CreatePatternBrush

iphlpapi.dll

GetAdaptersInfo

kernel32.dll

DllMain

ole32.dll

CoReleaseServerProcess, CoAddRefServerProcess, CoRevokeClassObject, OleUninitialize, CreateStreamOnHGlobal, CoTaskMemAlloc, CoCreateInstance, CLSIDFromString, CLSIDFromProgID, CoGetClassObject, OleLockRunning, StringFromGUID2, OleInitialize, CoInitializeEx, CoUninitialize

psapi.dll

GetModuleFileNameExW, EnumProcesses, GetProcessMemoryInfo

shell32.dll

CommandLineToArgvW, SHGetFolderPathW, Shell_NotifyIconW, SHGetFolderPathA, ShellExecuteExW

shlwapi.dll

PathIsRootW, PathIsDirectoryW, PathAppendW, PathFileExistsW, PathBuildRootW, PathAddBackslashW

user32.dll

CreatePopupMenu, AppendMenuW, UnregisterClassA, UpdateLayeredWindow, GetWindowThreadProcessId, PostMessageW, GetSystemMetrics, DestroyWindow, SetWindowLongW, GetWindowLongW, GetWindowRect, DestroyMenu, SetForegroundWindow, TrackPopupMenu, LoadIconW, PostQuitMessage, MessageBoxW, DialogBoxParamW, LoadStringW, SetDlgItemTextW, BringWindowToTop, FindWindowW, IsZoomed, MonitorFromWindow, GetMonitorInfoW, MapWindowPoints, LoadImageW, SetWindowRgn, GetCursorPos, ShowWindow, PostThreadMessageW, GetMessageW, GetActiveWindow, TranslateAcceleratorW, TranslateMessage, DispatchMessageW, IsRectEmpty, SendDlgItemMessageW, EndDialog, MapDialogRect, CreateDialogIndirectParamW, RegisterWindowMessageW, GetWindowTextLengthW, GetWindowTextW, SetWindowTextW, IsIconic, CreateAcceleratorTableW, CreateWindowExW, RegisterClassExW, LoadCursorW, GetClassInfoExW, IsWindow, SendMessageW, SetFocus, GetFocus, DestroyAcceleratorTable, GetDesktopWindow, BeginPaint, EndPaint, CallWindowProcW, FillRect, ReleaseCapture, GetClassNameW, GetDlgItem, GetParent, IsChild, SetCapture, RedrawWindow, InvalidateRgn, ReleaseDC, GetDC, ScreenToClient, ClientToScreen, GetClientRect, MoveWindow, CharNextW, GetSysColor, GetForegroundWindow, GetWindow, DefWindowProcW, IsWindowVisible, SetWindowPos, EqualRect, SetParent, InvalidateRect, SetWindowContextHelpId, KillTimer, SetTimer

winhttp.dll

WinHttpCloseHandle, WinHttpReadData, WinHttpQueryDataAvailable, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpOpenRequest, WinHttpConnect, WinHttpOpen

wininet.dll

InternetCrackUrlA, InternetOpenW, InternetCrackUrlW, InternetCloseHandle, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetReadFile, InternetSetOptionW, InternetQueryOptionW

ws2_32.dll

WSASend, WSAWaitForMultipleEvents, WSARecv, WSAAccept, WSACloseEvent, WSAIoctl, WSAEnumNetworkEvents, WSAEventSelect, WSACreateEvent

openvpntray.exe

By AnchorFree Inc (Signed)

Remove openvpntray.exe

Version:	2, 74, 0, 0
MD5:	31073ed092a31b580b0e24de93a9fbb4
SHA1:	01fbffb21060cb09bf94428e35d6a2923d9c086a
SHA256:	01b3247da5b137d7ccb9fdceaf1ed6626ebd910b6901591bb258cce0e7ba2f47

Warning 3 antivirus scanners has detected malware.

What is openvpntray.exe?

Hotspot Shield allows you to create a VPN, or virtual private network, so you can transfer your data securely. When you access the Internet through such connections, you risk having your computer or mobile infected by a virus or even an intruder to enter your system. Moreover, the dangers exist that a malicious person can intercept your information and use it for unfriendly reasons.

About openvpntray.exe (from AnchorFree Inc)

“Hotspot Shield creates a virtual private network (VPN) between your laptop or iPhone and our Internet gateway. This impenetrable tunnel prevents snoopers, hackers, ISP‘s, from viewing your web browsin”

Details

File name:	openvpntray.exe
Publisher:	AnchorFree Inc.
Typical file path:	C:\Program Files\hotspot shield\bin\openvpntray.exe
File version:	2, 74, 0, 0
Size:	1.21 MB (1,269,616 bytes)
Certificate
Issued to:	AnchorFree Inc
Authority (CA):	VeriSign
Effective date:	Monday, March 28, 2011
Expiration date:	Monday, April 14, 2014
Digital DNA
File packed:	No
.NET CLR:	No

More details

Network connections

[UDP] listens on port 49153

[UDP] listens on port 52693

Malware detections

Based on 40+ industry antivirus scanners, 3 of them detected the following malware.

Antivirus engine	Engine version	Detection
nProtect	2013-03-11.01	Trojan/W32.Agent.1269616
Trend Micro	9.740.0.1012	HT_AGENT_BK0841EB.TOMC
Trend Micro HouseCall	9.700.0.1001	HT_AGENT_BK0841EB.TOMC

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.03022040%	0.028634%
Kernel CPU:	0.01427737%	0.013761%
User CPU:	0.01594303%	0.014873%
Kernel CPU time:	8,606 ms/min	100,923,805ms/min
CPU cycles:	1,148,065/sec	17,470,203/sec
Context switches:	85/sec	284/sec
Memory
Private memory:	15.03 MB	21.59 MB
Private (maximum):	14.07 MB
Private (minimum):	9.44 MB
Non-paged memory:	15.03 MB	21.59 MB
Virtual memory:	157.07 MB	140.96 MB
Virtual memory (peak):	158.35 MB	169.69 MB
Working set:	13.96 MB	18.61 MB
Working set (peak):	27.56 MB	37.95 MB
Page faults:	52,662/min	2,039/min
I/O
I/O read transfer:	109 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	52 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	418 Bytes/sec	448.09 KB/min
I/O other operations:	36/sec	1,671/min
Resource allocations
Threads:	22	12
Handles:	368	600
GUI GDI count:	140	103
GUI GDI peak:	144	142
GUI USER count:	68	49
GUI USER peak:	76	71

Process properties

Integrety level:	Medium
Platform:	32-bit
Command lines:	-nolaunchurl "C:\Program Files\hotspot shield\bin\openvpntray.exe"
Owner:	User

Threads