Overview

overview

8

Static

static

3

AviraPhant...08.exe

windows7-x64

8

AviraPhant...08.exe

windows10-2004-x64

8

AviraPhant...on.cmd

windows7-x64

8

AviraPhant...on.cmd

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 00:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AviraPhantomVPNPro/Avira Phantom VPN Pro/Silent Installation.cmd
  • Size 803B
  • Sample240614-agbrpaxarc
  • SHA256 be3dda89063e6e6cefba5c8242bb33f0979a7cf2bf09cbe47ff2ee8f62a217d5
  • MD5 SHA1 SHA512
Score
8/10
discoveryevasionexecutionpersistencespywarestealer

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Silent Installation.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe
      "Avira Phantom VPN Pro 2.44.1.19908.exe" /VERYSILENT
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\AppData\Local\Temp\is-PCQ8V.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-PCQ8V.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp" /SL5="$501DA,4884611,248832,C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe" /VERYSILENT
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Avira.WebAppHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3196
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Avira.VPN.Notifier.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4420
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Avira.NetworkBlocker.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1784
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" stop AviraPhantomVPN
          4⤵
          • Launches sc.exe
          PID:644
        • C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\tapinstall.exe
          "C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\tapinstall.exe" install "C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\OemVista.inf" "phantomtap"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4240
        • C:\Windows\SysWOW64\sc.exe
          "sc" create "AviraPhantomVPN" displayname= "Avira Phantom VPN" start= auto binPath= "C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"
          4⤵
          • Launches sc.exe
          PID:2512
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start "AviraPhantomVPN"
          4⤵
          • Launches sc.exe
          PID:1456
        • C:\Windows\SysWOW64\sc.exe
          "sc" description "AviraPhantomVPN" "AviraPhantomVPN"
          4⤵
          • Launches sc.exe
          PID:372
        • C:\Windows\SysWOW64\sc.exe
          "sc" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000
          4⤵
          • Launches sc.exe
          PID:2356
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=in action=allow program="C:\Program Files (x86)\Avira\VPN\OpenVpn\phantomvpn.exe" enable=yes profile=any name="Avira Phantom VPN"
          4⤵
          • Modifies Windows Firewall
          PID:3264
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=out action=allow program="C:\Program Files (x86)\Avira\VPN\OpenVpn\phantomvpn.exe" enable=yes profile=any name="Avira Phantom VPN"
          4⤵
          • Modifies Windows Firewall
          PID:1460
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C TIMEOUT 10
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4772
          • C:\Windows\SysWOW64\timeout.exe
            TIMEOUT 10
            5⤵
            • Delays execution with timeout.exe
            PID:2700
        • C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
          "C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe" /migrateSettings
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3148
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5e1d55c3-4ad7-0348-a43b-99b57954b7d8}\oemvista.inf" "9" "457afe35b" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\avira\vpn\openvpn\tap\win10\amd64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:700
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:phantomtap.ndi:9.24.2.601:phantomtap," "457afe35b" "000000000000014C"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
  • C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
    "C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"
    1⤵
    • Executes dropped EXE
    • Checks for any installed AV software in registry
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
      "C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe" delete
      2⤵
      • Executes dropped EXE
      PID:3700

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        is-ERH97.tmp
        • Path C:\Program Files (x86)\Avira\VPN\App\images\png\regions\is-ERH97.tmp
        • Size 743B
        • SHA256 3cf52e677d7f7be201cbf6e3ec56ed1f48b95c47e5969ef2c2510e270133c4f0
        • MD5 SHA1 SHA512
        Submit Download

        Avira.Acp.Common.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Common.dll
        • Size 14KB
        • SHA256 793dc8d33fd8190c6d87c39a860ae4d67c6f02a19b573087831b18202f8e413e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.Acp.Resources.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Resources.dll
        • Size 54KB
        • SHA256 839942ba4c0e36ad27355f65acf6520bbd6fa0967bfd3d9d6ddec520ca4fc3c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.Acp.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.dll
        • Size 151KB
        • SHA256 4c20af4eb824f54308a3d0fcb1e0c02705e36f4066a96d3187ff61cbd324bfbf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.Common.Acp.AppClient.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Acp.AppClient.dll
        • Size 43KB
        • SHA256 c09d32229c51eb1f4bfb7132002e68acc61883fda68365fcd274439eda332af7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.Common.Core.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Core.dll
        • Size 67KB
        • SHA256 48d0e13ee24af3fe5bd666b410b59f6a12dceca0fabb3038cf29779cbede835a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.Messaging.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.Messaging.dll
        • Size 46KB
        • SHA256 58d3cc5b59d8f9eb3a187de1377cd40ebf38852944b6d7d59abae64be5416cb0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.NetworkBlocker.exe
        • Path C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
        • Size 236KB
        • SHA256 f9e95d2d3760b2b56f70daad4db65781b090ff014029c6b4e2b7897d0e685cf8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VPN.Acp.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Acp.dll
        • Size 31KB
        • SHA256 4f1da0dff5d32ef6150a6de7e37907d810f55f4f5e2aa870c4225488af2a3c3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VPN.Core.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Core.dll
        • Size 143KB
        • SHA256 fb7c8fa2243822e609f44e3a0de1f7c6fb03e4c9325d1065f44302ffac494eff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VPN.NotifierClient.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.NotifierClient.dll
        • Size 27KB
        • SHA256 b267d1b02da761ff4b2ab2cc72904eab942692929155da7c09e7368492646b89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VPN.OeConnector.dll
        • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.OeConnector.dll
        • Size 40KB
        • SHA256 b818007801ca7f12c18695aafb18475898f692c0c76a352b49167c57095999b4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VpnService.exe
        • Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
        • Size 380KB
        • SHA256 dea6fa4e7ccb8f10846c14500d88d17f2a0a678ae0648ae768965f18450b6aa9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VpnService.exe.config
        • Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe.config
        • Size 8KB
        • SHA256 05210b2ddc6846c10a95b1f0874240930771c0f4383b60478fbf9585b3a67c61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.WebAppHost.exe
        • Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
        • Size 815KB
        • SHA256 0a2d4aaab11291d99542e74689bc6265bb2a7922d8870167bdcc3210f0627273
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.WebAppHost.exe.config
        • Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe.config
        • Size 3KB
        • SHA256 a2b68cd7ad5e1158d182d59131488a0aa84c106f142ab62451bc284c72218216
        • MD5 SHA1 SHA512
        Submit Download

        ProductSettings.json
        • Path C:\Program Files (x86)\Avira\VPN\Defaults\ProductSettings.json
        • Size 1KB
        • SHA256 7e84e38c4b147fa13e871249a9986c4621176ed0afc88c999901e354f603d096
        • MD5 SHA1 SHA512
        Submit Download

        Messaging.dll
        • Path C:\Program Files (x86)\Avira\VPN\Messaging.dll
        • Size 36KB
        • SHA256 304c76f16380cdfbe2a1adbbd36f3a9e3a9bcd8c6901a400f0add66027f885b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Program Files (x86)\Avira\VPN\Newtonsoft.Json.dll
        • Size 693KB
        • SHA256 cdf68de50fc05055120968d89dfa40f0dcd0a052fe381de1daa312e84b6e41f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OemVista.inf
        • Path C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\OemVista.inf
        • Size 7KB
        • SHA256 427f9551921202143ba72f8d3abec45ad7c887a827fac2864a501551ce309685
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tapinstall.exe
        • Path C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\tapinstall.exe
        • Size 482KB
        • SHA256 85ab4bbb77ab248956d0da02ace1a2bc58ce6c6db9f421808ef03ed31bbcf3b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Serilog.Sinks.File.dll
        • Path C:\Program Files (x86)\Avira\VPN\Serilog.Sinks.File.dll
        • Size 35KB
        • SHA256 d1a929b7aa1b1cfa330a33b3c1f238fb1fcf73c7bd9d43bc3579ad8a9625d824
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Serilog.dll
        • Path C:\Program Files (x86)\Avira\VPN\Serilog.dll
        • Size 150KB
        • SHA256 f14f61e815adbb6403ff70941c7d98f1836792dcd4cdf1fbc77f9164694fc932
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ServiceStack.Text.dll
        • Path C:\Program Files (x86)\Avira\VPN\ServiceStack.Text.dll
        • Size 199KB
        • SHA256 93003778ab63e158cc18b86066e8fbb2c0104cae570dc3f53aa56b38faf41817
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SharpRaven.dll
        • Path C:\Program Files (x86)\Avira\VPN\SharpRaven.dll
        • Size 100KB
        • SHA256 5521dc13a0264e2f178e205b2fbf76c57ed34ef650bd7508348cba0c9f6b2dd6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Program Files (x86)\Avira\VPN\System.Diagnostics.DiagnosticSource.dll
        • Size 169KB
        • SHA256 30fbf5b1aa8736badeebb85a2e630dc44b65659564d6e8399a71a887e2244b98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VPN.Core.dll
        • Path C:\Program Files (x86)\Avira\VPN\VPN.Core.dll
        • Size 179KB
        • SHA256 13db96190d32798a2a1224b309991a69300424f5345d83684ed13c074371dd67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira.VpnService.resources.dll
        • Path C:\Program Files (x86)\Avira\VPN\en-US\Avira.VpnService.resources.dll
        • Size 21KB
        • SHA256 57b7256eec2eb64deb1f52ecc3ea529c061b99ae009e4a28f70ad76ce565cbc4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VpnPrivateSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
        • Size 6KB
        • SHA256 8cd642c39ec85d454ff8a598279fff07e10c7b59fa5802118146ef6bb261850b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VpnPrivateSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
        • Size 5KB
        • SHA256 c857556ab65c621b08109260f612a4e657e46bd381d14ef7abe2d3fb143c8c55
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VpnPrivateSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
        • Size 5KB
        • SHA256 7148e6bf62c0b420e5f317234c111546a5b0083e233637337dc14035b544fa9a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VpnPrivateSettings.config
        • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
        • Size 6KB
        • SHA256 2fde44bd25894e3a626297de734fe83736bd4d970a86895c59a330a19dcb3d5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 d5f583076f67c3266c4b975b8c938359c75b70fdc95332bd583d9f358032effb
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 0340cafe82ffc079ff28e98b5a3ffe8875e61ded167eb91e92f12d6b0368d49f
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 eceb73be340def4af0c105baf8cdfe040d625cf586b2912d1529fa4c7833f441
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 25f3b5e2ebce60ca4ea46e9f96bc5c209bc4c4dea45ee101c83d68bca637a57f
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 0f506c494fc17cf8c461117ed76aecc36ce54f5be4d091ea38870012a0aa9c8f
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 a08ccf8dec253206f77ffe05e7068140ac24f0db1c6f6cfc7a5653b2d21181f2
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.backup
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
        • Size 1KB
        • SHA256 30812fcbbf5c1f320a606b4ed9334bc33eeb2be0d270218edc5fc58d1cfc665b
        • MD5 SHA1 SHA512
        Submit Download

        VpnSharedSettings.config
        • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.config
        • Size 1KB
        • SHA256 abd246496373cd49bfcd63bc2d740874dde83c11598137526e9ff75056cfb58f
        • MD5 SHA1 SHA512
        Submit Download

        vpndbg.log
        • Path C:\ProgramData\Avira\VPN\vpndbg.log
        • Size 4KB
        • SHA256 84da43fa9a994e52ff6db6432aec2f984cd3a6c7655c9e5a038d09bb7ee95935
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Avira Phantom VPN Pro 2.44.1.19908.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-PCQ8V.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp
        • Size 1.5MB
        • SHA256 02febfffcac96296e9cbad84cccf0153a11c051e0f2421e86360eccfc21f7f4d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PHANTO~1.SYS
        • Path \??\c:\PROGRA~2\avira\vpn\openvpn\tap\win10\amd64\PHANTO~1.SYS
        • Size 49KB
        • SHA256 2f7801552ae07f3c3d1ed3ea62a3eb3f7ddeda1cee20123eadc4e416a4550e3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        phantomtap.cat
        • Path \??\c:\program files (x86)\avira\vpn\openvpn\tap\win10\amd64\phantomtap.cat
        • Size 10KB
        • SHA256 c0de7a55d22d85605e2342e63f35e774d5c35dbeccaef4ade98e0be8482077cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3008-0-0x0000000000400000-0x0000000000447000-memory.dmp
        Download

        memory/3008-1119-0x0000000000400000-0x0000000000447000-memory.dmp
        Download

        memory/3008-1083-0x0000000000400000-0x0000000000447000-memory.dmp
        Download

        memory/3008-2-0x0000000000401000-0x0000000000417000-memory.dmp
        Download

        memory/3148-1092-0x000002A523440000-0x000002A52350E000-memory.dmp
        Download

        memory/4164-1118-0x0000000000400000-0x0000000000593000-memory.dmp
        Download

        memory/4164-6-0x0000000000400000-0x0000000000593000-memory.dmp
        Download

        memory/4164-1088-0x0000000000400000-0x0000000000593000-memory.dmp
        Download

        memory/4748-1002-0x00000197EB2E0000-0x00000197EB30A000-memory.dmp
        Download

        memory/4748-1057-0x00000197ECAF0000-0x00000197ECB9A000-memory.dmp
        Download

        memory/4748-1052-0x00000197EC940000-0x00000197EC94E000-memory.dmp
        Download

        memory/4748-1056-0x00000197EC950000-0x00000197EC958000-memory.dmp
        Download

        memory/4748-1050-0x00000197EC9A0000-0x00000197EC9B2000-memory.dmp
        Download

        memory/4748-1048-0x00000197EC970000-0x00000197EC99A000-memory.dmp
        Download

        memory/4748-1054-0x00000197ECA00000-0x00000197ECA36000-memory.dmp
        Download

        memory/4748-1059-0x00000197EC960000-0x00000197EC96A000-memory.dmp
        Download

        memory/4748-1046-0x00000197EC930000-0x00000197EC93C000-memory.dmp
        Download

        memory/4748-1044-0x00000197EC920000-0x00000197EC92E000-memory.dmp
        Download

        memory/4748-1082-0x00000197ECDF0000-0x00000197ECE3A000-memory.dmp
        Download

        memory/4748-1038-0x00000197EB4D0000-0x00000197EB4DA000-memory.dmp
        Download

        memory/4748-1036-0x00000197EB430000-0x00000197EB43E000-memory.dmp
        Download

        memory/4748-1029-0x00000197EB390000-0x00000197EB398000-memory.dmp
        Download

        memory/4748-1028-0x00000197EB440000-0x00000197EB46E000-memory.dmp
        Download

        memory/4748-1026-0x00000197EB370000-0x00000197EB380000-memory.dmp
        Download

        memory/4748-1024-0x00000197EB3F0000-0x00000197EB40C000-memory.dmp
        Download

        memory/4748-1010-0x00000197EB3D0000-0x00000197EB3E4000-memory.dmp
        Download

        memory/4748-1008-0x00000197EB290000-0x00000197EB29C000-memory.dmp
        Download

        memory/4748-1006-0x00000197EB3A0000-0x00000197EB3C2000-memory.dmp
        Download

        memory/4748-1004-0x00000197EBBB0000-0x00000197EBC62000-memory.dmp
        Download

        memory/4748-1000-0x00000197EB330000-0x00000197EB364000-memory.dmp
        Download

        memory/4748-998-0x00000197EB2B0000-0x00000197EB2DA000-memory.dmp
        Download

        memory/4748-996-0x00000197EA8D0000-0x00000197EA934000-memory.dmp
        Download