318b16bcf20c1fe089cf34941441a2908b159e3890b48b3fda7b49b0a2f7999e

Analysis

max time kernel
149s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VpnInstaller.exe
Size 6.7MB
Sample260415-pg7xfsdx2m
SHA256 318b16bcf20c1fe089cf34941441a2908b159e3890b48b3fda7b49b0a2f7999e
MD5 3ac52ca5386234239ae8a00de39db7fc
SHA1 237a9e1926b2a8722fc8dd82fd46ef14631bca10
SHA512 14e2627305c2f8465da72d401e6b1fd92eafd46a775bb5feff62219b8306a417b7d8dee03ed5ee754e9464e1764f2c7252bed48d5797577f71deb346f8f66265
SSDEEP 98304:94K1aSBRkqjhbS6Cv2fGW+qE9ZsPWIRpYqHi52vKzPYb6vEHvmPceDCt8:9ZakvJCefGW+FgRubRgeMPdeX
TLSH
T1666633CF07A0A12FCF2B1FB7545F0947EEE32F290A62814C4AAD909D6C5375D6198B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AviraPhantomVPN\ImagePath = "\"C:\\Program Files (x86)\\Avira\\VPN\\Avira.VpnService.exe\""	VpnInstaller.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Security	VpnInstaller.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Benchmark	Avira.VpnService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\hr.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\il.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\la.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\Serilog.dll	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\wifi-disconnected-dark.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mt.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\to.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\pulsar.html	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\Templates\images\FTU-gfx-screen-1.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\zh-TW\Avira.VpnService.resources.dll	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\arm64\phantomtap.sys	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\Defaults\ProductSettings.json	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ge.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gu.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ki.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\li.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ls.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\sx.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\cf.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gn.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\lb.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mp.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mz.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\sb.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\sr.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\tw.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ke.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\en-US\Avira.VpnService.resources.dll	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\am.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\cd.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\fi.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\jo.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mv.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\om.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ps.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ro.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\fonts\KievitWeb-Light.eot	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\fonts\KievitWebPro-Bold.woff	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\purchase\[email protected]	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\bs.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\fj.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\nu.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ph.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\data_usage_popup.html	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\i386\phantomtap.sys	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ck.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gd.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\js\vpn-vendor-1.0.0.min.js	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\regions_lock.html	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\sent_diagnostic_data.html	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\tr-TR\Avira.VpnService.resources.dll	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\JWT.dll	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\ref-copy.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gh.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\pt.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\za.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\zm.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\regions.html	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\settings.html	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\Avira.VPN.Core.dll.config	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ax.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ee.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\images\png\regions\va.png	VpnInstaller.exe
File created	C:\Program Files (x86)\Avira\VPN\App\views\directives\start_diagnostic_data.html	VpnInstaller.exe

Executes dropped EXE 3 IoCs

pid	Process
5500	Avira.VpnService.exe
3572	Avira.WebAppHost.exe
5604	Avira.NetworkBlocker.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5244	sc.exe

Loads dropped DLL 16 IoCs

pid	Process
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VpnInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avira.NetworkBlocker.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Avira.VpnService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Avira.VpnService.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Avira.VpnService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Avira.VpnService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Avira.VpnService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Avira.VpnService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Avira.VpnService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Avira.VpnService.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\telemetry = "49e25b657d54406c9a2397f349540d4f52f86469"	Avira.VpnService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\machine = "63a221d8b5e947978a7c913aa2001a730bff6385"	Avira.VpnService.exe
Key created	\REGISTRY\MACHINE\Software\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}	Avira.VpnService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\vpnclient = "b24186d8534a4d32ab2aaf9ce1fe341fcd9c4a3c"	Avira.VpnService.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
4800	VpnInstaller.exe
5500	Avira.VpnService.exe
3572	Avira.WebAppHost.exe
5500	Avira.VpnService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5500	Avira.VpnService.exe
Token: SeDebugPrivilege	3572	Avira.WebAppHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 5244	4800	VpnInstaller.exe	78
PID 5500 wrote to memory of 5604	5500	Avira.VpnService.exe	82

C:\Users\Admin\AppData\Local\Temp\VpnInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VpnInstaller.exe"
1⤵
- Sets service image path in registry
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\system32\sc.exe" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5244

C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
"C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"
1⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
  "C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe" delete
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5604

C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
"C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe" /migrateSettings
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

no.png

Path C:\Program Files (x86)\Avira\VPN\App\images\png\regions\no.png
Size 743B
SHA256 3cf52e677d7f7be201cbf6e3ec56ed1f48b95c47e5969ef2c2510e270133c4f0
MD5 d3b58f803a9a01a59210dd673998a229
SHA1 6caddb6c8e749e9c5b786a3984bb7bdbba2bafc5
SHA512 88aade4affd629926e473df3d26ecca5ba49c4b77da9343e58729cf3a2b1cd0b9d27d9e019018455bffd18b7a7570a5c14d918eff46deecc5821903f76094988
TLSH
T15501B5C7A78024A68B3ECA3B40066A23976B28186E26100C5128A9BD02C21ED3D50BFC
MD5 SHA1 SHA512 TLSH

Submit Download

Avira.Acp.Common.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Common.dll
Size 17KB
SHA256 b738ee32b11a58b74686ccd551d0d33b58c3b335d9ba8998ba291c805340c455
MD5 c24b22b9cf851bcafac9f095dc845f7e
SHA1 8eab085e3dfe6b6799c66f576697fe7a17c9afbf
SHA512 dbefb4c2183068c8d61c29b5594cd676ac8e14176b961ad326190afe3f3710a6564c67507af7f32c31e46f279ffc97a3640f8648fb02eb0a846f5e28548349c0
SSDEEP 384:GFIAHpwK37Ts5x6xldei2WSx7bLkPZLqi:GFjRgJAmbLUd
TLSH
T1A0727D873F346523EE8B4E38F0C69BA31C71B2B1AF62458754318649EC177E22B2556F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.Acp.Resources.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Resources.dll
Size 54KB
SHA256 839942ba4c0e36ad27355f65acf6520bbd6fa0967bfd3d9d6ddec520ca4fc3c9
MD5 318f261f2875d1b6ad27afd9aebce1da
SHA1 6230901e4b145e7ea66160e9726951931a00b7de
SHA512 379c89f2d165a1551c459984f3aeec556499c2cc7346f4a346d5b651f5a729c44b0f84c68b48f120f8c5ddaba0bfa2895421acb7261f266dd5743ce8fa6a6c80
SSDEEP 768:X+8ePSjZKaZXrcIA0wPmC2Nx4aeKDFTaYix0PZAMxkEw:X+8TBJrcIA9atDFTa7xsBx8
TLSH
T1B843D822C778C76DD71E0A32B4E04A3A45B1D24F3161DAE5CB60F45B3F627817E1A8B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.Acp.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.dll
Size 154KB
SHA256 19f6be72656bc0df0ab8849ed1e87f92af256228a569fcc330c7d836527176c2
MD5 dac7dfa8663bcc02569c8add3e8b95b4
SHA1 2780e12bc08348f1a9fdfebec1022e8250ad52c3
SHA512 d2a80dd7eefab588a2ce8bd894fb9e7dade29ae6993b78cce3a82f5dc3e0fbe74f862c90db69819cfc3e0e26a05be995a8b765c5ddc28be2a34ea4c9f7f52b33
SSDEEP 3072:qEVpdvBxV2NuMJ9eiqO4I/rwHviUoR+Tc37cNtfX6KmhbZJVeGeq1Vlf:TLvzE9WTSVlf
TLSH
T17BF36D13175C8B26DBFF097AF161012287F1E117B162E79A8D80B8ED1DABB41D9207B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.Common.Acp.AppClient.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Acp.AppClient.dll
Size 45KB
SHA256 61a6f383852f1c2e9699c6c8c4e77580eb102d3c8ff653c27179b36d364b4ba0
MD5 8aa11811eada16cee053b782116005d8
SHA1 6e71a5a862833db0fd129c13c06af7da510553be
SHA512 1d0759149bf3acba6968cd312a27333a6895e8ea0ad9c59291f33a31f7852461e730254b67e2be304f826c3b6fb38385def622634e2801b747a6118ba5bc8c58
SSDEEP 768:4koqab4+w581Qs8XeC9bP/dwL+lXf3oqAmbLVI:K94+w58rieebNw6lXf3hVNI
TLSH
T1C1237D073B4C8B23CF9F0F3DB49155530BB2E2566913E79698CCF5C699677A01A203AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.Common.Core.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Core.dll
Size 69KB
SHA256 6c5b87fad485e497d5e197a7b13da27ea4facde695cd05dd6edef2e4ae3247ad
MD5 7eeebd2e69833aaa313e5a170b58de8d
SHA1 58e62e1ac5c12fca617cc83f3bb16c69e29cb09a
SHA512 8090040cd386a1846b7abf5df9c13a8dbfac87e2438e7f37727d6d170a9972a91ff7e90a9eae34e9491bdd3aed497eee13ef0ef41fa70bb3b6316eb55fedbaa0
SSDEEP 1536:+SEJXarOmeCVwzM8cGqnCXgU3n3WjHaSVi:+SE5T8VwzM5GO8gU33WjNVi
TLSH
T12A636C0337449527DF8E8BB9B0A347964B72914BA6D3EF4A5DC892E95CF33C00A152E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.Messaging.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.Messaging.dll
Size 48KB
SHA256 18a1c592f221731a710d8a9ef97d811a78411897b14c219206cebb0f78b550f7
MD5 7e0a01c3967aa8c2259fed901b86678a
SHA1 c95a0168bb3ac9fba4a60d50ada9e44aba8db6cd
SHA512 ff85f6c13c8787223daffc6591202930843ebe0627c8ecbf42590a9545655b046fe9915173cd5077cfb4db35196091c920ac21856a14fa5b8cc51a9798796c77
SSDEEP 768:pok8aLIW0dxlPVXr76bvm2Cg94DlS4xpK6m9qAmbLRW:pltsHDng9CS4j49qV5W
TLSH
T1F1235B0627648B73CBEE0978B8A112110FF1E1566812F3895DCCA4E69E537A61F913FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.NetworkBlocker.exe

Path C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
Size 231KB
SHA256 c69d3dee3e0c26dcaeb59ba40f7d8bbdbbfdb1444307d59add27de20f976240b
MD5 1ab0ca2a5c0cae27c76e73e3f7d9d81d
SHA1 55b15be11770965f795dc1079b587fac1437c5e3
SHA512 05010db1ecff9d418d09e64ca020db7d1872ed4a9eb41832e8edc30ddf531b8fa9035b8d92d251d5f095688db65811cc336f43d0e76e3192269409d5da618804
SSDEEP 3072:7vAwWTowg2EfMX5R2c+hvekD2/S/zJZ2nBulgc8lvjiVsDKZTTqZ68PpV3:7vAwWTYjfu2Mg2GzJ4Bjc83M8PpV3
TLSH
T1CB347C11B9D1C073DA63093598F4DB795E3EFC610FA1A9C7A3940FBA8E206C19B3561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VPN.Acp.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Acp.dll
Size 33KB
SHA256 73d94e738bd4f5b726cda5797a597a17d5533c773a513b6c219f95585ce78c2f
MD5 5cae508a3bd51d93818bb94311c1ad0a
SHA1 99469d03a0ee7bba4c023111a8f27121f499c764
SHA512 7baed3b97fbbfb1c5f1223a4e2671e1fb49fff367836f72c356d0357fae48ed085e96a05ca6822ac8957b1a387b9b5dbbc7d1c44582cc1478c12af2feaf4a8d3
SSDEEP 384:8Stn6MsNeqrEK6FR9X0I7XlWwVp7ty3xPRVEEtyahnYmHWqOpwK37T66yldei2WW:8GllXK6T9kI5bztiIodirAmbLzm0
TLSH
T1A0F26B4A2B3CD73EDFAA0A7DF3A052A30672A1A63933E594CE54B18A5D33741360457F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VPN.Core.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Core.dll
Size 155KB
SHA256 6e14e9ee345b6eccee23ff7978f07cfaeb741f7ac2804d959023425900edb237
MD5 f673b6579e903c75ee5c4fbd456bfb97
SHA1 52d3ad637d32a6225cb607215e0a9e4138a29ebe
SHA512 7ac9637d0d3463ace82d416f4a182ba9fe58ab87c8a6923ab7817eb15f01ac25bbce6086de793dedf51d73df5cd4ce842cae4d3468d6d38be5ad73ac50506e99
SSDEEP 3072:D9yza0F3YjTBmJmcQ9WjPprzWHGkFnWWJnrJnWssGuqYHblGTHL+FQTB5Vu:D9yza0F3YaNQ9eprnkFnWWJnrJnWsp6T
TLSH
T17DF35C2437E8451AE3FF6F7CA8F012128FBAF547A513E78E168446DD19637809A502FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VPN.NotifierClient.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.NotifierClient.dll
Size 29KB
SHA256 70c45706580a79e9789a7030e7a971995bba18930aaf34838f16f72cb66ecbed
MD5 228b9fe74325e58c34710366e475fada
SHA1 6f3fb245be9ab17095bb0010b2b0aa1939226caa
SHA512 1af892623eb7daeaa28b368e6cbd8e413643a4743492de1e9a634ae997303ff3388a28698b68ca31200b027007d174b86504264c423f7ed62254300700fe30c3
SSDEEP 768:YVVlLNEykX+tg5ABAeYoKUGF511AmbLEs:+lLRkX1o7QVVcs
TLSH
T18DD27D133B3C9717CF970A38B0E257A20A7271597933D5868B60A54F2E5BB9107057BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VPN.OeConnector.dll

Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.OeConnector.dll
Size 42KB
SHA256 f6ee56ba04ca40f4b09cc7711ae7919fa7fc64c1791d31a393324c91e62114b7
MD5 5b65e52f74294f1e779519af0157e88f
SHA1 fa012e25c163c0b0983f31bded475122834cb6b9
SHA512 a01a60227bbe84831bf91210b059729bbde051bb45807568bb21ccb62414e3011a51b646402d52121c601463407ece96114fbc24989dd9ddf5119a3958615d36
SSDEEP 768:RnSQyogWae/A06d26MCcstbOteXJNc5+AmbLv:RnS6gWaZTd2ucstateZNc5+V3
TLSH
T130134C0A37BC4513EABF1E7DB8B046120F71BA53FD15E6C9688898DD48A33914A113BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VpnService.exe

Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
Size 394KB
SHA256 f2162507b812680c842d4f14fd35ebc89cb509450e2d431a049bc9a7b7719c1e
MD5 1415cacd7cccfda2893bcd33a568b30c
SHA1 baffb88f693f358438d46287e7eda0291093e7d9
SHA512 375c142ff32d37395fdfaa82a8686967c645371f09e1a845c8c14209abec84be87dace143cf3a762f7fe382b6e31dc2eb0d217f036d03587313a7c67dafb8ae3
SSDEEP 6144:AKRtRYZBEwSVJXmsH4d6K8XbOpnddZ8mnu6iKgRFtMVK:A8t2y9cNAKMFtMVK
TLSH
T19684174263E5891AE6FF4B3CAC2642108E77FD03DC2AE6CD5B81399E09B2740991577F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VpnService.exe.config

Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe.config
Size 7KB
SHA256 26609d9d2352ce7569cb7771270e0f926eefaa86d7e92650f753a706db512ebb
MD5 ec3114cb3aee3661babc8b297546df63
SHA1 287fbdfa164b5aaff317138eb2b1ae0d3f431428
SHA512 0efd43fe15f6594d2c715b1280f02fb99354dc8be8abebf728cbdb234135e98c5917e54061bfeda84619ef9aa1e8248f4a8fd2db51d037ef10feb06ca0cd63de
SSDEEP 96:2eDibrDiImWH2kZAuuaxzzr1AsfrQw3ZzYIiAsN/s3xfs3sbtAscdVT7cZMPS7+K:2eObrOKQXu/HZ/HH1rLG+N
TLSH
T1EBE12A0C72CCBF6D06426637EA3122D1947FEE231579A0F468FE717365508DA06B2BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.WebAppHost.exe

Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
Size 824KB
SHA256 1139a8c5b872b774f23fc6b0f9c6a366f41f3fbe1e95703cb6c65cd03c37005e
MD5 44ce5d73b58310aec535b79ff39e1174
SHA1 c3e7659e4e23ab34e341e68460c607ae479d95f5
SHA512 0cf605ffbf67c593be3ae4458250b04296103037696a6dcef1c9fd43aa7543524c7a337e06703577d8c0c96c36d9bac3014c216067f72df8b8aa0b7445de5f6a
SSDEEP 3072:huBm5sKpqFZOUZIeX/j9FCd4XgKSv9td49gKBv97jEiuV3:8QCKp+Zjj8WgNFjQgWF8iuV3
TLSH
T1D7055C019B63D407C88C09FCF85251FEAB969CCAF91F668352C03FA535BB2E530955EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.WebAppHost.exe.config

Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe.config
Size 2KB
SHA256 d2d75be243f2985bce5cda333b827429509330fe5a3b4d3e2812c42394f870c0
MD5 3719d4b02d74f27c3445dd0f4e34dd1c
SHA1 7d3e2236ad467432a44f0fe7be97bf5380eb3f57
SHA512 8cd6317e979b9d26f8840fefc7af7a2ea28979da62ad36801271c9a241004d71f7d136fd86f7880d4eae4295ea6bf3e3a2174d3fee8fa98edf69736ba84364a1
TLSH
T10951EE14729C7FAE0B421A73AD3656C1867FCF762878116CA0BE727BA6114CB13523B5
MD5 SHA1 SHA512 TLSH

Submit Download

ProductSettings.json

Path C:\Program Files (x86)\Avira\VPN\Defaults\ProductSettings.json
Size 1KB
SHA256 7e84e38c4b147fa13e871249a9986c4621176ed0afc88c999901e354f603d096
MD5 f9eb282786f0c1d27f9f6ae8b448d4d1
SHA1 df4f115df8a7dc8ffc2d7dbdd9953170cb0f8b32
SHA512 db8a15d8b7b830dd63819eea73aa160accee27dca61a4b9b76d30f9b4161d28307c47d1f412faad9f92d2b77c17832226c16e8db0bb1d413444de1e918692753
TLSH
T1BF21EFDFF1504E779379C2EB497182A2F902B3AF601514CFB470185D5F70C1631D616A
MD5 SHA1 SHA512 TLSH

Submit Download

Messaging.dll

Path C:\Program Files (x86)\Avira\VPN\Messaging.dll
Size 38KB
SHA256 2dabccb49edd4ea3c6fd585088c4c51a0c0d3bb2fa69e9aef91c0eef486a5de5
MD5 7d702aaf87d858bdae0bf9f9d4200f3d
SHA1 b3ca2fabdcdd34e81ddfa5cca206dced9a04c05a
SHA512 90c7d284295401f7ee0054565bbd23eb1fe24d9000cfc4ceb8e0253962d475d14c0414eea8ce1c6992703083888175d03086ab5718b5e1909d574e4d4d18f600
SSDEEP 768:GijhpNDxbofroiWtbHrskOj0GYBrLDPOAmbLv:GGhpNFbofkLHrskOjf6rvPOV3
TLSH
T1CD037D052B7496B3CFAD4979B0E0600746F2E2527823FB854DD890E65E937E15B122FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Avira\VPN\Newtonsoft.Json.dll
Size 701KB
SHA256 cd59cc9622b588afb1e16ea9dd1e28d46a1e06b62f05e9aaace0fdc5c4268ab2
MD5 ce82bb579712330b665cc337f0921129
SHA1 2413bc25b00ba26be3efee8c2b0d9c693a3d1d41
SHA512 bf97c6c4c68e3da419f4b0ace3c6cf8691ab99924df6e3fcb56747b8279037046aecb2c964833473195f2675022d72b9bd88e4254203bb69421fcd4fd3c5b99d
SSDEEP 12288:yBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUs3VK:yBjk38WuBcAbwoA/BkjSHXP36RMGN3VK
TLSH
T140E4394123F98F2BE1AF6B75B4704E1543F9F817A6B5E78F9A04D9A91C43B418E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.File.dll

Path C:\Program Files (x86)\Avira\VPN\Serilog.Sinks.File.dll
Size 37KB
SHA256 dac5243b7ebf8e8a20e1a759523b9a2b1edc56ad80f4bfe4e1afc028cbfebae1
MD5 8300b0612ab2d5e0944b7443a889643f
SHA1 e7868e8e73b371a4266fb433b550037ea8e03b84
SHA512 5f2a02f8afb82c0de98299efa5dc7335c612c24d1f01394e09b4b564fee8783cb575969762ee8c9d7e9acc2e456f3364e351d7383d1ea93ea4bc87448f62e292
SSDEEP 768:l2IVwX/kpnTXMcTWpHdD2JRrcfwcyp0TE3AmbLU:fwXcpnTXMwWmJRXVp0gVs
TLSH
T14B033A867BEC5217DAEE4F78F9F122160B71FA72AC22EA8E049C154D5C16B900E1176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.dll

Path C:\Program Files (x86)\Avira\VPN\Serilog.dll
Size 153KB
SHA256 0a77ec95c2e5b43c2b5fc1f654475d1d0d227fd7b19fca324c42acce174f6bfd
MD5 249f6dbb2ceb18ca52a37f62a1dfbefa
SHA1 95ec623b87fb5d97c7db86554ca5c542da5cf7a5
SHA512 0eb5cf84b9ccadacfd440b353d23475b4430cac0df1cb71820825ffa90b8a6a384e89fa2a33d3f2609bfbc239dd21fc3057f491d0353284b95cc03cf9d661c85
SSDEEP 3072:7jZjs+3+wx+85/kuWL/h9AQkNvMuaO2Cf0VZ:7jxs+3Q8SZLJWA+0VZ
TLSH
T13AE34A5B73EC4B25D6FE6A34F4A850214F72F4DB382BE35FA945D6E61812B50AB00336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceStack.Text.dll

Path C:\Program Files (x86)\Avira\VPN\ServiceStack.Text.dll
Size 199KB
SHA256 678b767a6b621020b00b3920943105f2ae44b6f729e25c4539847021249797d0
MD5 58aa81190c215087f17d85cb6e55dd33
SHA1 d397668c054335bcd0d7df3e8e061194c844e715
SHA512 5541e7fde7138788d25f45001cc237bc9f62e4b15b49ac00ef7426aec1fe1a7de22470c5531abe87d9ee57dac4b34e4da1fdc188a56b0a27662a0f2c6e36ced7
SSDEEP 3072:yzL1AtpXQLhGJheRCP5OyG/uR+Py/v79Lx+lHdFA8wxlPUUKmHcqzCv0w7V1N:yzMpXQ9XRCP5bGpPyr3+l9FA9j5aV1N
TLSH
T1AB147C8833684A11C7EE46B47860AD558A72F507D4D2FFA37DD4A4FB8A1738A27843E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharpRaven.dll

Path C:\Program Files (x86)\Avira\VPN\SharpRaven.dll
Size 103KB
SHA256 74d9c20e3d52a7eab8c810dde770155b1b4a899c82d0f748ababdfb39c7d499e
MD5 f71a09dfb527f9c097e8231a9e1839c6
SHA1 a992f7843e73689b703f595a83df3bcd58672edb
SHA512 015264d9e312262ee7aaaab6610887d2c22c6b9321eccfd5390490e5d526f7b7f654ffdb586b56306a550cd87d1731c3429063432cc7eadafb3faedad9a82b7d
SSDEEP 1536:38uCSVATi04rrWaLSyUlnx8FxaCXNpS71eP4uEoZ5DVP:XCfTiRSyUl+eCXNM7HLoZ5DVP
TLSH
T147A3193517A89768CE5D4734E06C239AD7B1624F6D31E69A8B18A5CE2F037C34B112FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Program Files (x86)\Avira\VPN\System.Diagnostics.DiagnosticSource.dll
Size 172KB
SHA256 7d79a90e94abbdfa79c901faaabda24f33ffc21b259b2cfdfecb5195575fb79d
MD5 a0465e1aecc932bfcb4b5a62bcebae08
SHA1 a8ae65c31eb5ba52b80dc4f68779786ac4b2ea9a
SHA512 a8b3a0fe4dd1420e8aa544adb9f8b0e259a3cf7f7adf0b6c65525d244c637bc4bcd333a4ee30c7e21a50fb26bc91f3b4a0e94b30e1e1ea7023f8b2bf908b9dc1
SSDEEP 3072:nNcLPcNABKuTwIxpRoZgM4U2Ny1jb54rbHXrwZ2CwOVV:N1NAB9qZgM4U4qnQwiOVV
TLSH
T178047C0433E84BABCEEF1B79F574C8524771E917B112E7AD6D04B8ED6823B914E02267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VPN.Core.dll

Path C:\Program Files (x86)\Avira\VPN\VPN.Core.dll
Size 189KB
SHA256 cb71a544ad3f33c93daf0b90ff87d48fbd4713b00889d98be542202acd762f8a
MD5 d04b32bd07a4cc780651fa94e8b131a1
SHA1 6761871b6980f4f6325e72e0cb0ec4c813d093cd
SHA512 7abab1f9a95aa6295212e782d959a917d17a34885dc5e2cd00d99fbd3da49cb5fd66d08ef0789ce11fead4e7ec131deb02ec4d779ae9fa04e077025a63df2965
SSDEEP 3072:gXY30Om7Bcnj0JNtD7bGW3ik+DMHLzP2Icojic6myAUpfVl:3kR7Bcj0RGkF+DMrzPEfVl
TLSH
T10214396023F49E12F7BF4B7DF8704215CB76BA87AC2AE38D4D4864ED285A381D541B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avira.VpnService.resources.dll

Path C:\Program Files (x86)\Avira\VPN\en-US\Avira.VpnService.resources.dll
Size 23KB
SHA256 25f5cb88461617650c2c40201cb9066a0fda9935408697628b54ae2e1f03ae2c
MD5 98dfc9927e85fc2ac956cb64bb2a9841
SHA1 8d0fcbb2660ae84565503a9dc3f4f01ddfe3b387
SHA512 750bd2ab62ddb45ca9d4b0882b2e956c4f408cc390737bd1b94ee36701752bf454ed03078be2702604aa6632765cc88e5e820357a995c360d83685ab4813aceb
SSDEEP 384:KsXrgiWpij699pO95w9MLSdzTaWpwK37TlUASldei2WSx7bL3:3bgiWpi3OzTaqZPAmbL
TLSH
T19AB218076BF41916FAF30F35B8F9D6129C33B8865E30D49E1421021D4AA2B829BB537F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VpnPrivateSettings.backup

Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
Size 429B
SHA256 35a033f7077db801021a2a210597023965ecfeff5927c5384200c49bbff09e59
MD5 0473d1e10c4aa217a584dad7275e2c53
SHA1 3f20878f0e321b182ca9850a5b0ea221a4045ebe
SHA512 60ed95f613759a9a9d750c50b7a0dda25b14fc9b839c277f820d05b73fcf1309a7469baca69970043fb3cadb9a9437ef8b3b77c309dab9aa8f811428dc2d8821
TLSH
T10CE0E521E6B0745BFB72201FBD346F18007BF91B21C00E20BD7145D32F115E4224B0D2
MD5 SHA1 SHA512 TLSH

Submit Download

VpnPrivateSettings.backup

Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
Size 5KB
SHA256 d2062add4e668ba1f099bd3daee65d3ca2b67b5c5bb77b685ee5c26056ff5ef6
MD5 a4bc9939b1c6216ffe8121a9e8720427
SHA1 8719fe9cae5f2d30f2c7fb23487b1bf0ae901a02
SHA512 30db33031f56de411f30fc29c17b710b6fce776378bb94c4bf3e663e6d160fcff2707967c8f688b0e64263ef9f7d358170fed760855dd8a53120dc35e36869c4
SSDEEP 48:38jG5hBDv116FFBCS+xhxQ+obdx9KT4oKxiUDMLK9iTekgv99:n5hBZqJrb9iTe/z
TLSH
T1D9C1789B94809ABEC7E457F31542569CB00E1C4DD4CC2C5D75F89FACBAF8233615923A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VpnPrivateSettings.backup

Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
Size 5KB
SHA256 e8f60d72d2b748697eb97c0521723fdb2ed5296378849a8f13ce1443e596fd37
MD5 71892948eec8baeb312a3d5c969af478
SHA1 86a53b50d0259e9e0dfc86d5a0d8d35b9292b735
SHA512 26ff1b4e6c053db8f5c874ea079a2a42e972f5db4fadc085e77e84462824c43b0d98da181f6d399703b827ae3f693638072ea5fa7b32adb5ee88ee80cf01de47
SSDEEP 48:38jGf+0BDv116FFBCS+xhxQ+obdx9KT4oKxiUDMLK9iTekgv9C0l:nf+0BZqJrb9iTe/Q0l
TLSH
T113C18B9B9480AEBEC7E057F31542569CB01E2C0DD4CC2C5D75F89FACBAF9233615922A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VpnPrivateSettings.config

Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
Size 262B
SHA256 291ed56031d965d67d3d05fa08341680bd9b4c33fca31abce28a43caf10f8f4a
MD5 02a3c88e21bd2cdf774c3ea08758b7f1
SHA1 8c58e3b16425bf2103d42069e7800c888a194b91
SHA512 77317fe0a7350750c05149eec65a0842dafdd498d9e1390121c08ed50e9e1249c95f61aa712cd05937fd3fc4fd443e4fa2639030700f2c0fb039ab1efb15f9c6
TLSH
T1F7D09700A121942BFBB2202FBE34AF0C007EFA1711C00C307DB201930B099E8038F166
MD5 SHA1 SHA512 TLSH

Submit Download

VpnPrivateSettings.config

Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
Size 534B
SHA256 fb890f5119180325a177c05a83c560edc9d0f0bb47f1763051c36875f573e60f
MD5 7dd351d422e5f21c88baafdb57d3020a
SHA1 1c289d9ab031109f5990e04e36e0ce15ca2ab5a3
SHA512 be11eabeb7d9ac4e2668a66b2494d4cf2245426ceaed171aa2afdf988094985fb01ff026801520f6b9913b2e485126b8181a5e02589a18787c8b813522d1916b
TLSH
T1DCF0B422E6B0B8ABFB72211FBD38AF58007BF95B21C44E20B9B245C72F154D4264B0D2
MD5 SHA1 SHA512 TLSH

Submit Download

VpnPrivateSettings.config

Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
Size 66B
SHA256 cc05bd02cb929f5ef7a9362698d7794845899dd6510fd41eb5f0a95d708a68dc
MD5 44944cd590899045e3cdeb971fddd252
SHA1 33c584007e0df8fea3e677c6892d6b5549d1c94d
SHA512 f4f4feec8c79599f41ce83371dd861fea9dd05aaa5211f5be53e2d61df154b6965db17ee8df952a8d8c864fa67aba5b9d1ef0f94608e42a50c057cfd82ccf5ed
TLSH
T18DA002108A02946A47D8056A9B758658536579F224E018B448715EB84E550D707C4365
MD5 SHA1 SHA512 TLSH

Submit Download

VpnSharedSettings.backup

Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
Size 346B
SHA256 b1fffa75c975d475b35f4f292b9a0e88890e6d990b7ca3e63b7e4979c8e5c101
MD5 ac75c6264be9fcd91ed36448f5466ab9
SHA1 17d209275856bac3d806ecb48f3736b4344a66c8
SHA512 63a4c945b8b5ee5b25d9ce10162e0ce34aadc19b0aeda51eb204acc672a42cd049e6ccf7cc507083e82899b22e269a631ca0e80925bd79ca39032d445ad10334
TLSH
T13EE0DF21D2902CAFFB71021F9C0D4B46973AB20FAA800980443186AB2E006E0BB1B484
MD5 SHA1 SHA512 TLSH

Submit Download

VpnSharedSettings.backup

Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
Size 417B
SHA256 86a0fd28d8da2d9a27710d04e13d25407b5a61951b9c148b004d79f68c7e202d
MD5 75e500c88e1f310ea03474f313aa3dae
SHA1 7844b3fa03692cd32dd109eb29c5583382cd20a5
SHA512 9b2db3d8cc3d6032e041963c947fdaa10603c9a4c90c7a498f620755fc927f36a0237c5edf5ef7a9899beaa2bb6a72d20eb048963134f264883aecad2cc91d13
TLSH
T12DE02B21D2A03CBFFB71011FDC0D4F55533AB10FBA840A80593186D73E012D07B1B084
MD5 SHA1 SHA512 TLSH

Submit Download

VpnSharedSettings.backup

Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
Size 710B
SHA256 ed4dccac72e79b41efb8c50dae3534fb0976d48727779b19a4d8f717fd746f8e
MD5 c9a10ea5c799e1a37730abfbb0e2ea50
SHA1 a1e99761daceec330e53120e6a1b0f731b191405
SHA512 a3e6cacd1d092a55fc479a6affe08862b3d40533e047d526954421baf2dc3eb03cd359c928a4949bf9587b058b3ce79afad3a57398697a916bcc78fb0426b83b
TLSH
T19E01F22AD2E13CBBEB72412FEC4C8F954B3AB55F79840A44AA7446DB3E401D5AE0B085
MD5 SHA1 SHA512 TLSH

Submit Download

VpnSharedSettings.backup

Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
Size 233B
SHA256 cbf01a315acc02261f509941f896bc30d4e37ff6c894a3884e2d6420f98172e3
MD5 00c615e7da03af7799b9e36a2d018a80
SHA1 fcf196777a7a0c5d6ad37112de217182cc973a59
SHA512 73abeb6c927cdf304d788d4fafa6c7017094dc2434e47ce36dca01370dc844934154107bbf2175a87eea55017f74f81c0bdac2fe400c172f3813802c3bd41d01
TLSH
T1A7D0A72062046C3BFF61411F890C8616D736360BA9D108C50426C9EB2B002E1EB5B848
MD5 SHA1 SHA512 TLSH

Submit Download

VpnSharedSettings.config

Path C:\ProgramData\Avira\VPN\VpnSharedSettings.config
Size 270B
SHA256 56950acf510c4e80b5b3ff1e498e6cd4dbc005b61ced18f89feec1609615951e
MD5 b66f3edefe3c35f3e168a43e123f1f3c
SHA1 ce660daef46f15d4c63e2adea12117f1f5a38a9a
SHA512 d5188da1f7cdc55990e8e97dc3370e22edb6c4b5e3e24811a50724a3330a38e4b75b6d1edce154d613b1d0f8ae0c9dd442012801f21765976e6f04dd354ac7e8
TLSH
T178D02B2062402C3BFF71001F4D0C8646E736720B65C108C00431C6E72F046E0B71B448
MD5 SHA1 SHA512 TLSH

Submit Download

VpnSharedSettings.config

Path C:\ProgramData\Avira\VPN\VpnSharedSettings.config
Size 149B
SHA256 e36f4979e64b3e1e40047f18a367f108e8be510c9b97139db2b050236e04142c
MD5 3aac0846baf221b8efdd1632a53f5a3c
SHA1 8524917cd0d347a1f87d58a6f3628de6c08be0e3
SHA512 8ba00e2fb00d76879db179c711c8c0bd00ae57853d8cc2f7a93faee0c04bd86055334a35742589e8707da86c1cf2680095af1a1d699d9b0e18e9109ee9127afc
TLSH
T1CFC02B2062011C3BFFA1012FCA0CC619D736370B64D108D40432C9F71B002E1AB9A548
MD5 SHA1 SHA512 TLSH

Submit Download

vpndbg.log

Path C:\ProgramData\Avira\VPN\vpndbg.log
Size 1KB
SHA256 ea36b03b53f170103d5dc3c923bfaf51ce9fb3e478953b093fb57f0f6132c6c8
MD5 6d55b3e7b0fd7f4b41552be8b6342f7e
SHA1 a5208e17b5e38c8736aa07332fc9b670f5341845
SHA512 7da2d5354e697c8b5a7cb406a2cda635a293c8c19abba440fbd4d85f13f910bd3b419c6321ab1fbcab90b68bf4b0205f506f018e5234749bcff43436b9494d89
TLSH
T1C231680622A438B20A7B4737FC86BB00837DE8A2FB3C29197BF71D05F394D0E4969518
MD5 SHA1 SHA512 TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\FindProcDLL.dll
Size 3KB
SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
MD5 75e7351a0f836b8659e6f315683c29f7
SHA1 66b733d1c978d68cadc245e7efbfcae32807429d
SHA512 f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4
TLSH
T17C71C56663A09FFED1A41330309E38176DDA703123BB66DACE3B761ABBE0081C835711
MD5 SHA1 SHA512 TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\INetC.dll
Size 21KB
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
TLSH
T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base64.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\base64.dll
Size 40KB
SHA256 7e10ef2723a50b7346449f8bb39efab8a99e2815d33d311ecb8112734f91519d
MD5 ac6fb776262b63562c00374392fe1c55
SHA1 045dcad3edcd1c6865f5dea95ace35f4d9964b78
SHA512 2c511c5f2bb265fd247e43c47046a3cddad2b72a0fd3b35fcb70ab53d7fbc070d36eadd93c279680306d30d6ef5730fcbfed01195a85761ae571e2d324416ed5
SSDEEP 768:h0lTvjkgjp5vVBFTKnebbo1QiB9PfdkMClc8o4CJh1o:evAgbJTKnMo/dXY3ohp
TLSH
T130036D22349181F3E1AB82761595CB1F9F7EEB1403D218C38FF4694A6F256E1A53F24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\nsExec.dll
Size 6KB
SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
MD5 13bd8e89dc79004d85ab02626e08c3c5
SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
TLSH
T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\nsProcess.dll
Size 70KB
SHA256 8f80ef429ce7c8a1ac7958ab36ec177f732dc924d14b21230da045e5ed1b255a
MD5 9c452d3cb1f2b06c16467849755cd724
SHA1 35f2e9754e9dc226baa8b0cbf21db2b523248a73
SHA512 438e406a18db363008776172e20f6422db71c5b1eaeb63f0a8100f05c5365f52ee177851c7710985b529e1b5fb2be2ac8142cc6e0ca08628054b6eabe063fea2
SSDEEP 1536:8Z6GdfXw+kpgUfswHfQeMVYOsW+ocd3q8DsRUClo:8ZgGURzMVY73q8DUi
TLSH
T1EF635C10B2D0C8B1E1BE1E391434D6616A7E3D214FE48DAB3B99012E5F741D2AB36E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\nsisXML.dll
Size 12KB
SHA256 77aa1a74a556f00f16baf9b94637fa997bd4085695ba81bf496223644e43e815
MD5 9f3d5344e7ede1f41f99d8fc37fd01ad
SHA1 d0322ce3ba30a924daa1c9e322846a3d8ccda878
SHA512 2849b261b77fa2abf0d0efc7604ccce7f502d20a556eea9877cfe1cbc6d515d8fe41986943081629243b81987cddd54613ee01fc7859ae16eab57f6ca2cd4bfc
SSDEEP 192:EWauH4FuPphUmX1VGsGN2kmQNJnm1ilWnE:EWasoMphljGs4NJoil2
TLSH
T1D242C8033EEAD8B7C94A0278AF977389D6B4630524810D06A3564F0B6F3199EFD7D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nsc174D.tmp\registry.dll
Size 24KB
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
TLSH
T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3572-1127-0x000001BAD2A70000-0x000001BAD2AA1000-memory.dmp

Download

memory/3572-1128-0x000001BAD2B10000-0x000001BAD2B1C000-memory.dmp

Download

memory/3572-1091-0x000001BAD2600000-0x000001BAD26CE000-memory.dmp

Download

memory/4800-1017-0x0000000003E10000-0x0000000003E1B000-memory.dmp

Download

memory/4800-1072-0x00000000009C0000-0x0000000000A81000-memory.dmp

Download

memory/4800-23-0x00000000009C0000-0x0000000000A81000-memory.dmp

Download

memory/4800-948-0x0000000006310000-0x0000000006369000-memory.dmp

Download

memory/5500-1097-0x00000257801A0000-0x00000257801AE000-memory.dmp

Download

memory/5500-969-0x0000025780020000-0x000002578002C000-memory.dmp

Download

memory/5500-1112-0x00000257802D0000-0x00000257802DA000-memory.dmp

Download

memory/5500-1110-0x00000257804F0000-0x000002578059A000-memory.dmp

Download

memory/5500-1107-0x0000025780400000-0x0000025780434000-memory.dmp

Download

memory/5500-1045-0x0000025780180000-0x000002578019E000-memory.dmp

Download

memory/5500-1105-0x00000257802B0000-0x00000257802BE000-memory.dmp

Download

memory/5500-1044-0x0000025780320000-0x0000025780396000-memory.dmp

Download

memory/5500-991-0x00000257800A0000-0x00000257800A8000-memory.dmp

Download

memory/5500-1101-0x00000257802E0000-0x000002578030A000-memory.dmp

Download

memory/5500-990-0x0000025780270000-0x000002578029E000-memory.dmp

Download

memory/5500-1099-0x00000257802A0000-0x00000257802AC000-memory.dmp

Download

memory/5500-988-0x0000025780030000-0x0000025780040000-memory.dmp

Download

memory/5500-1088-0x0000025780120000-0x000002578012E000-memory.dmp

Download

memory/5500-1090-0x0000025780130000-0x000002578013A000-memory.dmp

Download

memory/5500-986-0x0000025780160000-0x000002578017C000-memory.dmp

Download

memory/5500-966-0x00000257800F0000-0x0000025780112000-memory.dmp

Download

memory/5500-967-0x00000257192F0000-0x0000025719300000-memory.dmp

Download

memory/5500-971-0x0000025780140000-0x0000025780154000-memory.dmp

Download

memory/5500-956-0x000002577FFA0000-0x0000025780004000-memory.dmp

Download

memory/5500-960-0x00000257800B0000-0x00000257800E2000-memory.dmp

Download

memory/5500-964-0x00000257801B0000-0x0000025780262000-memory.dmp

Download

memory/5500-962-0x0000025780070000-0x000002578009A000-memory.dmp

Download

memory/5500-958-0x0000025780040000-0x000002578006A000-memory.dmp

Download

memory/5500-1154-0x0000025719CD0000-0x000002571A1F8000-memory.dmp

Download

memory/5500-1109-0x00000257802C0000-0x00000257802C8000-memory.dmp

Download

memory/5500-1161-0x0000025780490000-0x00000257804DA000-memory.dmp

Download

memory/5500-1170-0x00000257003D0000-0x00000257003DC000-memory.dmp

Download

memory/5500-1171-0x00000257008F0000-0x0000025700902000-memory.dmp

Download

memory/5500-1172-0x00000257192F0000-0x0000025719300000-memory.dmp

Download

memory/5500-1103-0x00000257803A0000-0x00000257803B2000-memory.dmp

Download