Overview
overview
8Static
static
5VpnInstaller.exe
windows10-2004-x64
8VpnInstaller.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...64.dll
windows10-2004-x64
3$PLUGINSDI...64.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ML.dll
windows10-2004-x64
3$PLUGINSDI...ML.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3App/fonts/...ns.svg
windows10-2004-x64
3App/fonts/...ns.svg
windows11-ltsc_2024-x64
4App/index.html
windows10-2004-x64
3App/index.html
windows11-ltsc_2024-x64
4App/js/vpn-1.0.0.js
windows10-2004-x64
3App/js/vpn-1.0.0.js
windows11-ltsc_2024-x64
3App/js/vpn...min.js
windows10-2004-x64
3App/js/vpn...min.js
windows11-ltsc_2024-x64
3App/js/vpn...0.0.js
windows10-2004-x64
3App/js/vpn...0.0.js
windows11-ltsc_2024-x64
8App/js/vpn...min.js
windows10-2004-x64
3App/js/vpn...min.js
windows11-ltsc_2024-x64
3App/views/...a.html
windows10-2004-x64
3App/views/...a.html
windows11-ltsc_2024-x64
4Analysis
- max time kernel
148s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 12:20
Behavioral task
behavioral1
Sample
VpnInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
VpnInstaller.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/INetC.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/base64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/base64.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/registry.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
App/fonts/ionicons.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
App/fonts/ionicons.svg
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral21
Sample
App/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral22
Sample
App/index.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral23
Sample
App/js/vpn-1.0.0.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
App/js/vpn-1.0.0.js
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
App/js/vpn-1.0.0.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
App/js/vpn-1.0.0.min.js
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
App/js/vpn-vendor-1.0.0.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
App/js/vpn-vendor-1.0.0.js
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral29
Sample
App/js/vpn-vendor-1.0.0.min.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
App/js/vpn-vendor-1.0.0.min.js
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
App/views/directives/collect_diagnostic_data.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral32
Sample
App/views/directives/collect_diagnostic_data.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target VpnInstaller.exe
- Size 7.4MB
- Sample260708-ph9sfafw2w
- SHA256 84e7c2d32cbb0b1546c14fe3f7fbceb36ca143dbae8f19fb03f91f7a4a42d8ba
- MD5 d9918b5ed9fb58631f174e56e07a079c
- SHA1 e3b177da01ef18d658c03f426702f2d369728d19
- SHA512 edf1cb7a3bcef229db7e65821f76a8d70df5e2252fd675e53641d76c247fe5de96b67c799f9f2813cfdced8f832267b16bdee231ace833bfc864909fd6e7d7e7
- SSDEEP 98304:40Z7v4NSszc2mO23g+KaKkqZ3KEmE9ZYsCFk1WVbS/D3K6Yb6vEHvmPcF3kZe3qN:z7vOlI2r+pgKU9CiWpS7GeMPdt8ea9z
- TLSH T18A7633CF02D05D5BC66B0A73121B0165ECE31F454B3794CE8BADF4EF2A633512699A8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AviraPhantomVPN\ImagePath = "\"C:\\Program Files (x86)\\Avira\\VPN\\Avira.VpnService.exe\"" VpnInstaller.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Security\Benchmark Avira.VpnService.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Security VpnInstaller.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: explorer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\bw.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gf.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mc.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\pf.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\sr.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Templates\images\alert-orange.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gq.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\kh.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ki.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\vn.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\views\directives\regions.html VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\bg.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\fo.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\np.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\theme-dark-thumbnail.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\theme-light-thumbnail.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\bm.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ec.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\lv.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ss.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\js\vpn-1.0.0.js.map VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\views\directives\sent_diagnostic_data.html VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Serilog.dll VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\fonts\ionicons.svg VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\views\directives\keychain.html VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\il.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Avira.VPN.Notifier.exe.config VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\nz.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ph.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\zm.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\tr-TR\Avira.VpnService.resources.dll VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\OpenVpn\VpnClient.ovpn VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ky.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mw.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ba.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\hn.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mf.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\pn.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\wf.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\[email protected] VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\cf.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\kw.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mr.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\bn.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\eg.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\mx.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Templates\images\FTU-gfx-screen-1.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ck.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\gn.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\tj.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\uy.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\OpenVpn\phantomvpn.exe VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\kg.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\ng.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\sn.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Templates\Template0.html VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\i386\tapinstall.exe VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\pa.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Templates\images\info.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\ru-RU\Avira.VpnService.resources.dll VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win7\i386\phantomtap.sys VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\fonts\KievitWebPro-Bold.eot VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\App\images\png\regions\er.png VpnInstaller.exe File created C:\Program Files (x86)\Avira\VPN\Templates\images\feedback.png VpnInstaller.exe - Executes dropped EXE 3 IoCs
pid Process 4820 Avira.VpnService.exe 1288 Avira.WebAppHost.exe 4188 Avira.NetworkBlocker.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1548 sc.exe - Loads dropped DLL 12 IoCs
pid Process 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VpnInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avira.NetworkBlocker.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Avira.VpnService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Avira.VpnService.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Avira.VpnService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" Avira.VpnService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Avira.VpnService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Avira.VpnService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" Avira.VpnService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" Avira.VpnService.exe - Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{E2B0A64D-0649-4860-8BD8-3FFADA76D1AF} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79} Avira.VpnService.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\machine = "453ea30d5f6846fea85fa2a8601f01c344118ea8" Avira.VpnService.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{E6555451-C942-4F7D-A808-9A90D313DF86} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\telemetry = "b3929006463346fc9f6291e722f4cdc3e0acdbd5" Avira.VpnService.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}\vpnclient = "c3cbc57b92104c00a72a774aa7e45acd21a92ace" Avira.VpnService.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 3400 VpnInstaller.exe 4820 Avira.VpnService.exe 1288 Avira.WebAppHost.exe 4820 Avira.VpnService.exe 2544 explorer.exe 2544 explorer.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4820 Avira.VpnService.exe Token: SeDebugPrivilege 1288 Avira.WebAppHost.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe Token: SeShutdownPrivilege 2544 explorer.exe Token: SeCreatePagefilePrivilege 2544 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1600 sihost.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe 2544 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3688 StartMenuExperienceHost.exe 1780 SearchHost.exe 2544 explorer.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3400 wrote to memory of 1548 3400 VpnInstaller.exe 88 PID 4820 wrote to memory of 4188 4820 Avira.VpnService.exe 92 PID 1600 wrote to memory of 2544 1600 sihost.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VpnInstaller.exe"C:\Users\Admin\AppData\Local\Temp\VpnInstaller.exe"1⤵
- Sets service image path in registry
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//10002⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1548
-
-
C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"1⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe"C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe" delete2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4188
-
-
C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe"C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe" /migrateSettings1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1780
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3688
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Avira\VPN\App\images\png\regions\no.png
- Size 743B
- SHA256 3cf52e677d7f7be201cbf6e3ec56ed1f48b95c47e5969ef2c2510e270133c4f0
- MD5 d3b58f803a9a01a59210dd673998a229
- SHA1 6caddb6c8e749e9c5b786a3984bb7bdbba2bafc5
- SHA512 88aade4affd629926e473df3d26ecca5ba49c4b77da9343e58729cf3a2b1cd0b9d27d9e019018455bffd18b7a7570a5c14d918eff46deecc5821903f76094988
- TLSH T15501B5C7A78024A68B3ECA3B40066A23976B28186E26100C5128A9BD02C21ED3D50BFC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Common.dll
- Size 17KB
- SHA256 b738ee32b11a58b74686ccd551d0d33b58c3b335d9ba8998ba291c805340c455
- MD5 c24b22b9cf851bcafac9f095dc845f7e
- SHA1 8eab085e3dfe6b6799c66f576697fe7a17c9afbf
- SHA512 dbefb4c2183068c8d61c29b5594cd676ac8e14176b961ad326190afe3f3710a6564c67507af7f32c31e46f279ffc97a3640f8648fb02eb0a846f5e28548349c0
- SSDEEP 384:GFIAHpwK37Ts5x6xldei2WSx7bLkPZLqi:GFjRgJAmbLUd
- TLSH T1A0727D873F346523EE8B4E38F0C69BA31C71B2B1AF62458754318649EC177E22B2556F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Resources.dll
- Size 54KB
- SHA256 839942ba4c0e36ad27355f65acf6520bbd6fa0967bfd3d9d6ddec520ca4fc3c9
- MD5 318f261f2875d1b6ad27afd9aebce1da
- SHA1 6230901e4b145e7ea66160e9726951931a00b7de
- SHA512 379c89f2d165a1551c459984f3aeec556499c2cc7346f4a346d5b651f5a729c44b0f84c68b48f120f8c5ddaba0bfa2895421acb7261f266dd5743ce8fa6a6c80
- SSDEEP 768:X+8ePSjZKaZXrcIA0wPmC2Nx4aeKDFTaYix0PZAMxkEw:X+8TBJrcIA9atDFTa7xsBx8
- TLSH T1B843D822C778C76DD71E0A32B4E04A3A45B1D24F3161DAE5CB60F45B3F627817E1A8B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.dll
- Size 154KB
- SHA256 19f6be72656bc0df0ab8849ed1e87f92af256228a569fcc330c7d836527176c2
- MD5 dac7dfa8663bcc02569c8add3e8b95b4
- SHA1 2780e12bc08348f1a9fdfebec1022e8250ad52c3
- SHA512 d2a80dd7eefab588a2ce8bd894fb9e7dade29ae6993b78cce3a82f5dc3e0fbe74f862c90db69819cfc3e0e26a05be995a8b765c5ddc28be2a34ea4c9f7f52b33
- SSDEEP 3072:qEVpdvBxV2NuMJ9eiqO4I/rwHviUoR+Tc37cNtfX6KmhbZJVeGeq1Vlf:TLvzE9WTSVlf
- TLSH T17BF36D13175C8B26DBFF097AF161012287F1E117B162E79A8D80B8ED1DABB41D9207B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Acp.AppClient.dll
- Size 46KB
- SHA256 fd96ed729b1049db0d5a9d7ca137716d713836f71574537be7367475748a51da
- MD5 3f48f382283577104d5b2166040ccc7a
- SHA1 4a46f359547ca530c9d6cf6dc1ded4e506b02b6f
- SHA512 563292e49838d937aff2fda5753a18c955ebf4748cb04a6a7f53571b56dbf15df119683d6f797debf16f930bbcbf61a6d68506e27b4507c83d1a9b779ebb6d93
- SSDEEP 768:adoqab4+w581Qs8XeC9bP/dwL+lX03IzxbLw:994+w58rieebNw6lX03gxI
- TLSH T178237E073B488F23CF9F0F3DB4A155530BB2E3566913E79698CCE5C5A9677901A203AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Core.dll
- Size 70KB
- SHA256 1264c01dfd15b56dc8a329c0e39c7f471d97f7319ad16febd264ad804dc6faba
- MD5 7aee6e23fabf1da0e8f0f1bca8e92ec4
- SHA1 c58a3dd0d6a214952ad687024c2ca58bd63a919c
- SHA512 652522de8959c017b9d586b1509a7090423db45017992b8b4cf6d83af3b3dfbdb93ea1618de8fec056a1f8a43184d59d8f47a8b4166408ff7a5508209cb9f64f
- SSDEEP 1536:oSEJXarOmeCVwzM8cGqnCXgU3n3WVH6mMP:oSE5T8VwzM5GO8gU33WFaP
- TLSH T1A9636C037B449527DFCE8BB9A0A347964B729147AAD3EF4A5DC892E95CF33C006142E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.Messaging.dll
- Size 48KB
- SHA256 03d3cc4eb85ae4b8a4c670773ed2d35118a9dd5a76d5fe1f0ca28f711b199726
- MD5 910b5f49a4ebde400270be309ea1a756
- SHA1 ea415e435de8e2a278765d68c4203597192a6aa9
- SHA512 c282ee0a0f4a98c92f3c254029d15dcd659827c59fbad517700f762a05ec4808f2a0018f298819d7e018f4c605ce254f5516073a77ec81dc15021e4ba1114d08
- SSDEEP 768:Mok8aLIW0dxlPVXr76bvm2Cg94DlS4xpK6mbdCbL/H:MltsHDng9CS4j4bdCnH
- TLSH T1E7235B0267648B73DBEE0978B8A112110FF1E1566912E3895DCCA4E69E537A60F903FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
- Size 231KB
- SHA256 088e2217d57de9333e58396e754b07f8cb2540bcc9600ef6b22ae00b4097e24f
- MD5 e00b93cfa0566ba39599ae20918da9f5
- SHA1 ddcd846b0ef803732c20bebb8870287bd0994483
- SHA512 35012250a5177a0ce004e1d6613dbfd1c518437c9ec0552f3f6955f8d5a06211b14dbc2edf7857155406cccfba0ca176ebd3c7d1033174f3a476e53d44921fd8
- SSDEEP 3072:NvAwWTowg2EfMX5R2c+hvekD2/S/zJZ2nBulgc8lvjiVsDKZTRqZ68IpY:NvAwWTYjfu2Mg2GzJ4Bjc8dM8IpY
- TLSH T1FC347C11B9D1C073DA63093588F4DB795E3EFC610FA1A9C7A3940FBA8E606C19B3571A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Acp.dll
- Size 33KB
- SHA256 432ff81dde4ff2fc987037c592a859389cfd8b9ee20b3e75a33802ac739268bf
- MD5 28496192fc2b78808d9defa79741be91
- SHA1 1742574e10f632773501807492a836b0738f01cb
- SHA512 06538506a9381349243060d9ad70270d57a6d1c0817f8863f52af40c98218198dbe5f78de3c3ea38567f855b86a3efed9b63c62043264c64e802cf68cdcbd3fd
- SSDEEP 384:nStn6MsNeqrEK6FR9X0I7Xl97p7ty3xPRVEEtUahnYmH1/+bpwK37TXiGOwMwx7o:nGllXK6T9kI59VtiGoV+V+HsbLg
- TLSH T18BF26C461B38D73EDFAA0E7DF3A056930676A2A63923E599CE54B04A6D33740320467F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Core.dll
- Size 155KB
- SHA256 b1a8a190919a001d548dafa34d7da5495e9ff8297af3071873738ac12d92b5c9
- MD5 97beaa68cf425a7df35f4f9d6645c049
- SHA1 6be5ae98540699d959e9960d199e6ce90519ba2f
- SHA512 7a29a947bd8cc574c86ceddedc237199b51b4864c4976a68944aef5b82bc8ac4309216183da0a323f99ce48ee5cc8f154b3fe98c60e4618a26852d6afe18ec43
- SSDEEP 3072:a9yza0F3YjTBmJmcQ9WjPprzWHGkFnWWJnrJnWsqGuqYHblGaHL+FQ8YeI:a9yza0F3YaNQ9eprnkFnWWJnrJnWszBM
- TLSH T14DF35C2437E8451AE3FF6F7CA8F011128FBAF587A513E75E168446DE09637809A502FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.NotifierClient.dll
- Size 29KB
- SHA256 679a92f0c5538ce28bbeae79d2cd48e7370db511d789de632667fb10b29e7202
- MD5 4a4ce2ff90668fa41267041922d0cc65
- SHA1 13647790395bbcda35e566c402deda9653a4c50d
- SHA512 3e493a78a5eb735b7f1f8fbb55831b0338d1f64bd5f13159b2b0624229ea2fc1f9be04fa93143195475ca24eefe7a00d6bb89832aa95bde1631fa02becf102b2
- SSDEEP 384:cVZ3lLNEykH3+t9qiBABK+4VeXjzmpvkH25E5pwK37TWsDZGMwx7bLhqFjok:cVVlLNEykX+tgOABAeuo2mfFebLpk
- TLSH T1B4D26C033B3C9756CFA70A3CB1E253A20A727159B933D98A9B60A14F2D1B74117057BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.OeConnector.dll
- Size 42KB
- SHA256 0f9b698d943cc1a52a7e487264593f12cefa91ef8f99946669f1c01524be07dd
- MD5 5c5b7ab1a81cc258e2cb8683a1c66e09
- SHA1 4e63245d9311b49334c6a265abf9aef46f5172f9
- SHA512 a2d078e3aba513e8381e63413065db83bc05961c9350e85b1892ee8b5dc1d2b50e109e44f3f8fd745827d378190406fa7981cbc2c14a2d37e4eae84136516139
- SSDEEP 768:1nSQyogWaeeA06d26MCcstdOteXKe9qbLZ:1nS6gWayTd2ucst0teae9qR
- TLSH T19A135C0637B84513EAFF1E7DB8B046120F71BA53FD15E6C9A88898DE48A339149153BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
- Size 395KB
- SHA256 e34165f525d8eeb225929dfd1eaf71f8a956951a7a6642fcde9499c0c7128c5e
- MD5 55879a2fc97fb2c506351629d6ee6770
- SHA1 25c53d0462b55c86e1efc446a6ae891e79166894
- SHA512 ce3a2a0490d9d522e9d86b1a3c0b1d8d35accdfa393d5c8e5e27011f2a875aaa5d5173026859b8b2f418c1c8e47a8828d3b831fae2687774fbc51df2ffdd62d2
- SSDEEP 6144:SKRtRYZBEwSVJXmsH4d6KiXbOpnddZ8Knu6jKgRFgB8:S8t2yvcFNKMFgB8
- TLSH T15B84174263E5891AE6FF4B3CAC3642108E77FD03DC2AE68D5B81389E09B2740991577F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe.config
- Size 7KB
- SHA256 26609d9d2352ce7569cb7771270e0f926eefaa86d7e92650f753a706db512ebb
- MD5 ec3114cb3aee3661babc8b297546df63
- SHA1 287fbdfa164b5aaff317138eb2b1ae0d3f431428
- SHA512 0efd43fe15f6594d2c715b1280f02fb99354dc8be8abebf728cbdb234135e98c5917e54061bfeda84619ef9aa1e8248f4a8fd2db51d037ef10feb06ca0cd63de
- SSDEEP 96:2eDibrDiImWH2kZAuuaxzzr1AsfrQw3ZzYIiAsN/s3xfs3sbtAscdVT7cZMPS7+K:2eObrOKQXu/HZ/HH1rLG+N
- TLSH T1EBE12A0C72CCBF6D06426637EA3122D1947FEE231579A0F468FE717365508DA06B2BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
- Size 824KB
- SHA256 60bdf774e24867deeeff39e7779598124be7d3f603088109a8efbbc0386cc33f
- MD5 145ec46eebfd73be9f7b355bd4a44f3f
- SHA1 28dd34f297e89000403d5e410f937e0e9c83b2a9
- SHA512 a18f38164bad617ff6d939256526cfeb722d02a470b7bc69c363b013051118accb909e6d8c222a22dbe05422599e4feb8714e8f59d652e61ef4fb8d79f95eff8
- SSDEEP 3072:L8Bp5sKpqFZOUZIeX/j9FCd4XgKSv9gd49gKBv9TJcp3b9:IfCKp+Zjj8WgNFeQgWF+pr9
- TLSH T16F055C019B63D407C88C09FCF85251FEAB969CCAF91F668352C03FA535BB2E530955EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe.config
- Size 2KB
- SHA256 d2d75be243f2985bce5cda333b827429509330fe5a3b4d3e2812c42394f870c0
- MD5 3719d4b02d74f27c3445dd0f4e34dd1c
- SHA1 7d3e2236ad467432a44f0fe7be97bf5380eb3f57
- SHA512 8cd6317e979b9d26f8840fefc7af7a2ea28979da62ad36801271c9a241004d71f7d136fd86f7880d4eae4295ea6bf3e3a2174d3fee8fa98edf69736ba84364a1
- TLSH T10951EE14729C7FAE0B421A73AD3656C1867FCF762878116CA0BE727BA6114CB13523B5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Avira\VPN\Defaults\ProductSettings.json
- Size 1KB
- SHA256 7e84e38c4b147fa13e871249a9986c4621176ed0afc88c999901e354f603d096
- MD5 f9eb282786f0c1d27f9f6ae8b448d4d1
- SHA1 df4f115df8a7dc8ffc2d7dbdd9953170cb0f8b32
- SHA512 db8a15d8b7b830dd63819eea73aa160accee27dca61a4b9b76d30f9b4161d28307c47d1f412faad9f92d2b77c17832226c16e8db0bb1d413444de1e918692753
- TLSH T1BF21EFDFF1504E779379C2EB497182A2F902B3AF601514CFB470185D5F70C1631D616A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Avira\VPN\Messaging.dll
- Size 38KB
- SHA256 a820f125edf604369571a9bda86806bc3651888c1b6c1748474f367454fe220c
- MD5 9747ab90832966c4951017c2bef75330
- SHA1 43e0839fd7c9ebe29cb8e6dea8881517d1738264
- SHA512 866a62fae7661af923d3277cbf82ef4f95bf4bc6bb07b64bf684cf54f8bf8f780f2ec1f12d27751927526845c4fc920aee2ffbdbfac884430212b5ad60cf519f
- SSDEEP 768:pijhpNDxbofroiWtbHrskOj0GYBr9DvBQbL6Ne:pGhpNFbofkLHrskOjf6r5vBQCNe
- TLSH T18E037D052B7496B3CFAD4975B0E0600647F2E2527C23EB854DD890EA6E937E15A122FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Newtonsoft.Json.dll
- Size 701KB
- SHA256 6e969da87b52b6a71dc5704767bbe66eef27d0bf351cd9bef563a1dea446021d
- MD5 1f9058b23d18bf4e1c7fda5d09f25588
- SHA1 bffd8e2e138d112428f01d65448ec595c85c2653
- SHA512 6dce7a454e997a308fcb3b3a71d341a0bcf3cc69e5231c9f9ad069af61cdce31e1c1343efc47f02ce94341a3e334cbbd95b840a7a54edd24ccbf09976a541f67
- SSDEEP 12288:XBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUkRl:XBjk38WuBcAbwoA/BkjSHXP36RMGNRl
- TLSH T1B0E4394123F98F2BE1AF6B75B4704E1543F9F817A6B5E78F9A04D9A91C43B418E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Serilog.Sinks.File.dll
- Size 37KB
- SHA256 b5094f4381ec74a17a38c94027709201eb36d5b710003a1a87c85d59035f26c3
- MD5 cfc8947ab9b7a4625229ae42c144e645
- SHA1 173aa1ffeb6e0b8ff13b387659346659d71f4719
- SHA512 a5e563669447b3f7237fdc03cfa65b758d6449b7c00493b6e0b9d950b23fdeb1cecc3fd69750a563acccf301002fa514ee2a5b2257e11a329a499217f1fd16cf
- SSDEEP 768:i2IVwX/kpnTXMcTWpHdD2JRrcfwcyz03EvbLTu:qwXcpnTXMwWmJRXVz0kbu
- TLSH T133035A867BE8521BDAEE4FB8F9F122560B71FA71FC22EA8D009C454D5C16B500E1176F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\Serilog.dll
- Size 153KB
- SHA256 cf9f921dd5d13a6704750478a1ce3eee47be40f54d86eb3ede40633e670c881e
- MD5 e9c21ab8d2f062ec8146a0527dd5d754
- SHA1 c01a5a1d844bd439e35dea6c6c85cd0689ea18b3
- SHA512 9c599d09f0986a2f527b61148eb4fef35aabc7d92e936a7f59a1dc342ec24020174ea406167cd9bb6918efc5d75fe9a47b05f64a63386d17aec968f76d152e46
- SSDEEP 3072:vjZjs+3+wx+85/kuWL/h9AQkNvMuaO2CWzE:vjxs+3Q8SZLJWAbzE
- TLSH T1C1E34A5B73EC4B25D6FE6A34F4A850214F72F4DB782BE35FA945D6E61812B10AB00336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\ServiceStack.Text.dll
- Size 199KB
- SHA256 ec76697312e7a02eb9c150b3c6fe55eb9a9fc740bf09229c16d226849622c3da
- MD5 2da4a49365dcc08862c141889494939c
- SHA1 96826379d3bcf1072f5595eb37de574eeaf5a315
- SHA512 092db363b171cf44d8638b2b0b3698679120f8cd2aa42b44a48d82ef60e14a4a90950f2889945231a2c3a2368c17928f0f54af8e0c851d79b0135d1ac86dfa9e
- SSDEEP 3072:dzL1AtpXQLhGJheRCP5OyG/uR+Py/v79Lx+lHdFA8wxlPUUKmHcqzCvmQpM:dzMpXQ9XRCP5bGpPyr3+l9FA9jH4M
- TLSH T1AB147C8833684A11C7EE4AB47860AD558A72F507D4D2FFA37DD494FB8E1738A27843E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\SharpRaven.dll
- Size 103KB
- SHA256 d1511f52dfd181f37cf886e1edbb24545161dccc0d70aab0c733d7d876cf47d4
- MD5 8d7420857a5f950a8d180b438121a6a9
- SHA1 7c380e7ae43540149c53203acfc493f3c74eeb2a
- SHA512 3264db43def082b2fc9bf89e8dbc13c0e86edbff7312adbaf1b28bafeca6cb6edf05f30b1228a633c3ddb1a5062b29c2328dceaa25e96aac137b45404dce34b0
- SSDEEP 1536:I8uCSVATi04rrWaLSyUlnx8FxaCXNpS71eP4uE3ZheKB2K:kCfTiRSyUl+eCXNM7HL3Zh3BN
- TLSH T116A3192517A85768CE5D4734E07C239AD7B1624F6E31E69A8B18A5CE2F037C34B112FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\System.Diagnostics.DiagnosticSource.dll
- Size 172KB
- SHA256 32ae5b9e60b30256c4414bebb03d59c2767dca6116c27f5afe4262e0a5a49877
- MD5 55c49c0896dbacb6cd152701f3a16137
- SHA1 a9271391d5130342b6ef0c7e70c437c4a391a18e
- SHA512 e36b0bc71541b32200d8b45e5d00fb66ff6166ce8c796f37450634bde03166258479789b4dae30376a78f34b299454d6ba32e75a769560b06793c9c4415d1ddb
- SSDEEP 3072:nNcLPcNABKuTwIxpRoZgM4U2Ny1jb54rbHXrwZ24wvx:N1NAB9qZgM4U4qnQwUvx
- TLSH T113047C0433E84BABCEEF1B79F574C8524772E917B112E7AD6D04B8ED6823B914E01267
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\VPN.Core.dll
- Size 189KB
- SHA256 654027c2ce1da6f8258a2298974cec9210d54782294d23005eb5ba52eecace84
- MD5 575c561f51af8cf5455d03eb3d3612bc
- SHA1 b912bf4406c8528817f14e27d3a2b5e59430fa0c
- SHA512 c633996d2013973cdfb317d4d7f0249ccbf3a92e6085d1db5f8dbd8e656c35b74034de9b766857d6e2da323265529197e39655763fb118f8e7eb7fdada6e47e0
- SSDEEP 3072:zXY30Om7Bcnj0JNtD7bGW3ik+DMHLzP2Icojic6myAUgPCO:UkR7Bcj0RGkF+DMrzPpPT
- TLSH T17514395023F49E12F7BF4B7DF8704215CB76BA87AC2AE38D4D48A4ED285A381D541B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Avira\VPN\en-US\Avira.VpnService.resources.dll
- Size 23KB
- SHA256 cf05125aea4e5ec3d7acdf7ef2176d1e28e226004d0346c04bcddf6010b681aa
- MD5 a5b52ec03a966abdddfcf14ef01f12f7
- SHA1 c6bea4dc0f8065bb7012463086225108b8bd0637
- SHA512 4df9fb5bea2dd9be99b49f7301a4875d48de3e3badfb433b05ae79ca48f60adbccd1057e9462e9ad12041ecff1111a8adc8329bba3001bd1fedb8f41c13c5a8c
- SSDEEP 384:rXrgiWpij699pO95w9MLSdRb12pwK37Te0Mwx7bLtHlmfn:rbgiWpi3ORbU5bL1lK
- TLSH T12BB23A076BF02906FAF34F35B9F9E6129C33B9955E20C49D1021024D4EA6B829BB537F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
- Size 429B
- SHA256 35a033f7077db801021a2a210597023965ecfeff5927c5384200c49bbff09e59
- MD5 0473d1e10c4aa217a584dad7275e2c53
- SHA1 3f20878f0e321b182ca9850a5b0ea221a4045ebe
- SHA512 60ed95f613759a9a9d750c50b7a0dda25b14fc9b839c277f820d05b73fcf1309a7469baca69970043fb3cadb9a9437ef8b3b77c309dab9aa8f811428dc2d8821
- TLSH T10CE0E521E6B0745BFB72201FBD346F18007BF91B21C00E20BD7145D32F115E4224B0D2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
- Size 429B
- SHA256 42db8dd84e053364329fa787db54b13dbea3afee6dafa7fd3c77581d925e08a0
- MD5 94ce2318e77c316571aa0383a2277c22
- SHA1 f50c868bcc679bd3cebf054b39993ebd499f2410
- SHA512 9247c306d7e1b0ef7ce72b349ee02e885696f32b02b70f0effdde38d58737a8930639b381c535282048e1fd72e8439e424dcefaca973d9de1ee864f3d50dfd48
- TLSH T1ECE0E521A671685BE7B2206FED386F18107BF95721C00A70BD7246932B11494228B1E2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
- Size 534B
- SHA256 6e552bf3719e0aafe21fa20d40e41025b7eaf2613d0948b0f0a756f88a8b522c
- MD5 0891445de28ae958b990e1d9049a2e60
- SHA1 d8df8f7413a8f68551e77904d685d92a170d72fe
- SHA512 dd2fb1c54b8f68861b82956272604318c9fd76a3ed5e4fbbed80add9ee0d468213c2a4dae6c39c69644426143e6086151e1a2c428c081af128c982ce41e0f966
- TLSH T1DCF0E922E6B0B89BFB72611FBD246F59047BF95E21C80F20B9B142C72F050D4264B0D2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
- Size 5KB
- SHA256 a6525a193ec82fd78ac71e58b3d7ebba95234c6d02bfa98ece33ff0fb034651c
- MD5 53219f9ce80c8412757c214bf3efce27
- SHA1 0d66b9a338dfd8bfc74340c7364b26762cb77176
- SHA512 cc33ff804bc310eaeea10c87a8996c040f4fa858b96ecb84b60f4e6de83d04905d1e0a2c6195f4ac1586a1793d00670f9e21569917c481517504f782d713ed58
- SSDEEP 48:38jG5hBkabut1AJFuBCy5x5xQ+ugQyAmxiUDMUK9iTeJSClz:n5hBkDGXV9iTeJSClz
- TLSH T1A1C15A9B9480AABEC7E057F31542569CB00E1C4DD4CC2C5D75F89FACBAF9233625923A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
- Size 6KB
- SHA256 5833a29771e048cfd010c4540ff966423fff1c385c85b86d95a63b98022848d5
- MD5 ccfc6db164fe957e23c7974489d90df3
- SHA1 0fad77772b9380e45a75d14266a4de24b7883bf4
- SHA512 2116c3f0b87d1b48853d7e186a5e062706da1763ed682f91af00abc660352ad708291965eefaf19199c2f67a9e9497ddcf99027aa2db7a0f3872c6cd62c697ed
- SSDEEP 48:38jGLF0Bkabut1AJFuBCy5x5xQ+ugQyAmxiUDMUK9iTeJSClQ00IX:nLF0BkDGXV9iTeJSClQ00Y
- TLSH T127C16B9B9480AEBEC7D057F61542569CB00E1C4DD4CC2C5D75F88FACBAF9233615922A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
- Size 6KB
- SHA256 33f4838bd76da2143c333cf892e7078ccde9db7dc3244e8a424e226cb1d37485
- MD5 64b2ed0b3d0f89c159663f0d51220496
- SHA1 588be14b8afa139632bf404a7ec44244f04b4c85
- SHA512 53577fa946e833526ed34467244573c199793f7a51b8a8d0660a04a408e85116a8dbd77e7bdc0d4ae8df27728a80574c4e9a74c701ee91be00637c5a72029982
- SSDEEP 48:38jGl8OkF0Bkabut1AJFuBCy5x5xQ+ugQyAmxiUDMUK9iTeJSClQ00IX:nl8PF0BkDGXV9iTeJSClQ00Y
- TLSH T1DED17B9B9480AEBEC7D057F215425A9CB00E1C4DD4CC2C5D75F88FACBAB9233615922A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
- Size 460B
- SHA256 e238e1f7188cfed003a056996bd2e87cd1b5a0e38347daa46bd102d53cd4923d
- MD5 154dc048680350ee9b55292014f29039
- SHA1 853f0f8ac89c01dc4bb8a474520414b628243bfb
- SHA512 42530df6215889b72d47563ec4efa8d8a4bf77ad906ce095176d2db9a1323dbbdb1f57f17e9cff31852d4f54beb2dba5fe9521470fc3c8ae0812fd3bedc3b0dd
- TLSH T159F02711D3E178ABDB32420FAD899F1012AFB45C65845A00E47101D72F010C92B53089
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
- Size 527B
- SHA256 0016010f0e7b197980f47c76f4845b06bce6157de9d24ef3ff5880d3df603ff6
- MD5 b1ab1554ead23063468e9589eb7fa98c
- SHA1 91e09a85ed8a7dfe2c01b06245609259fb30723e
- SHA512 898ef05810f85be3102d6baed53f1fa4be2f6c0bf12f5c7e28cf8cfb8e7d6970bc03d295b3d620554c4e08b9f9227b6966d42c29848fc7c0b8ba32482e8d1230
- TLSH T1EAF0B426D2E17CABEB32821FAD899F5016AFB45C65845A10E57105DB2F450CA2F97089
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
- Size 710B
- SHA256 4a2d87b341cc95cef93bd3cab15890e5568a01fbea3e2f69bd3a42d3ee565693
- MD5 34849eba7d5a69c9a5470cd7f5692222
- SHA1 3a20db204dbc7e7e2a97324e8eaa1d54a2b9cbbd
- SHA512 675d94d5e2acde52500ebafa206f746dd4c6ee39520f790c1aa8f105f6bd5d13a864e0ad9679f8ba8abf98843f8a25fbdb88ef07804546d6b3c218ad941c1a63
- TLSH T1F701F72AD6E17CABEF32511FAC489F5019AFF45C65840A11E97501C72F450DA6E570C5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
- Size 233B
- SHA256 f05b4910408bcbc9f27160b136c3311158941d20b0289c373dc5872c66e9c92a
- MD5 138ef57caaef488d83ff206092044467
- SHA1 ca235dc81f187676e49944991efeccdba53d8a15
- SHA512 ca174deceb0b0ddc20ddfdf63e94c6c64ddee6b3f39b7698e65bfda9a935f3c43a0ece255f49ccf874d255380f437ab33501f4fae3e94a703e7a52633bc33294
- TLSH T1E3D0A700A305FC679B62C74F9EC4EA20239B3C4464C4A952606304DB1F000C657E199D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\VpnSharedSettings.config
- Size 384B
- SHA256 883d7595301b090803c759afd6a0055be9cf4ff1b013c592fa2e1bde72bb5809
- MD5 0fa7ae50957400597204d16e85f1d4e3
- SHA1 66f0d03cc4d7761267d5608ee8526a0454f78b7a
- SHA512 55c0145608b007d97377d22e40b003aa61b4a7240a5f3a5087d1aaeb67f0d6d4a33ef173b8bd80bd0a0f93e87705843dfdd3c4bf9ab16b7104c4886c2024c307
- TLSH T10EE06811A391BCBBDF32521FADD8EF2023AEB84C30C41A01E47201D72F000CA2BA2489
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Avira\VPN\vpndbg.log
- Size 4KB
- SHA256 e753ed017e61c270d286476a10ed930d7c4c132fe1e193ab18cba657f418f04e
- MD5 14d8852bc02a5ea8e3db8e7a6869d6b0
- SHA1 0cb4954ab5040066af99263eb957dccbf03673bb
- SHA512 b0667b5a8f07cb5d2a3984119f9dbc630e7d29d22dd576a2b2e6eadf9bfbffbf597836e6a6c2905bcb346c103db5257ec45d770d1ecdd06f1acdc80c6e8c74a6
- SSDEEP 96:KROnDeLk2vlASegmN1/D+M/MxWxzaWHJ5GG/w2VjsyVbsSpIce0fFWvb4YqWF9jY:COeLk2vlADgmT/P/M4xzxp5GG/wCjs+H
- TLSH T17E91DD853AB538E20E3743277D423914E5EEE456F45C28A8BFF61206079BF9FE52C244
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\FindProcDLL.dll
- Size 3KB
- SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
- MD5 75e7351a0f836b8659e6f315683c29f7
- SHA1 66b733d1c978d68cadc245e7efbfcae32807429d
- SHA512 f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4
- TLSH T17C71C56663A09FFED1A41330309E38176DDA703123BB66DACE3B761ABBE0081C835711
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\INetC.dll
- Size 21KB
- SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
- MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
- SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
- SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
- SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
- TLSH T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\System.dll
- Size 12KB
- SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
- MD5 81e268e27dbbcadbf116b5a9402195ab
- SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
- SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
- TLSH T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\base64.dll
- Size 40KB
- SHA256 7e10ef2723a50b7346449f8bb39efab8a99e2815d33d311ecb8112734f91519d
- MD5 ac6fb776262b63562c00374392fe1c55
- SHA1 045dcad3edcd1c6865f5dea95ace35f4d9964b78
- SHA512 2c511c5f2bb265fd247e43c47046a3cddad2b72a0fd3b35fcb70ab53d7fbc070d36eadd93c279680306d30d6ef5730fcbfed01195a85761ae571e2d324416ed5
- SSDEEP 768:h0lTvjkgjp5vVBFTKnebbo1QiB9PfdkMClc8o4CJh1o:evAgbJTKnMo/dXY3ohp
- TLSH T130036D22349181F3E1AB82761595CB1F9F7EEB1403D218C38FF4694A6F256E1A53F24B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\nsExec.dll
- Size 6KB
- SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
- MD5 13bd8e89dc79004d85ab02626e08c3c5
- SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
- SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
- SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
- TLSH T1F7D1F83A2AD12DF3D04889702827793ACBB9C8360F500650DF671EE225E1DE7DB2038B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\nsProcess.dll
- Size 70KB
- SHA256 8f80ef429ce7c8a1ac7958ab36ec177f732dc924d14b21230da045e5ed1b255a
- MD5 9c452d3cb1f2b06c16467849755cd724
- SHA1 35f2e9754e9dc226baa8b0cbf21db2b523248a73
- SHA512 438e406a18db363008776172e20f6422db71c5b1eaeb63f0a8100f05c5365f52ee177851c7710985b529e1b5fb2be2ac8142cc6e0ca08628054b6eabe063fea2
- SSDEEP 1536:8Z6GdfXw+kpgUfswHfQeMVYOsW+ocd3q8DsRUClo:8ZgGURzMVY73q8DUi
- TLSH T1EF635C10B2D0C8B1E1BE1E391434D6616A7E3D214FE48DAB3B99012E5F741D2AB36E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\nsisXML.dll
- Size 12KB
- SHA256 77aa1a74a556f00f16baf9b94637fa997bd4085695ba81bf496223644e43e815
- MD5 9f3d5344e7ede1f41f99d8fc37fd01ad
- SHA1 d0322ce3ba30a924daa1c9e322846a3d8ccda878
- SHA512 2849b261b77fa2abf0d0efc7604ccce7f502d20a556eea9877cfe1cbc6d515d8fe41986943081629243b81987cddd54613ee01fc7859ae16eab57f6ca2cd4bfc
- SSDEEP 192:EWauH4FuPphUmX1VGsGN2kmQNJnm1ilWnE:EWasoMphljGs4NJoil2
- TLSH T1D242C8033EEAD8B7C94A0278AF977389D6B4630524810D06A3564F0B6F3199EFD7D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsistemp\nst70E2.tmp\registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- TLSH T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
- MD5 SHA1 SHA512 SSDEEP TLSH