Overview

overview

8

Static

static

3

Avira Phan...83.exe

windows10-2004-x64

8

Avira Phan...83.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 16:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Avira Phantom VPN Pro 2.47.1.24783.exe
  • Size 6.7MB
  • Sample260709-trqs5sdt3l
  • SHA256 a61a205de8f519a512de3469781ffe74deb74f856bc08e76cffa115d92f00c34
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 52 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Avira Phantom VPN Pro 2.47.1.24783.exe
    "C:\Users\Admin\AppData\Local\Temp\Avira Phantom VPN Pro 2.47.1.24783.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Users\Admin\AppData\Local\Temp\is-TDDAI.tmp\Avira Phantom VPN Pro 2.47.1.24783.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TDDAI.tmp\Avira Phantom VPN Pro 2.47.1.24783.tmp" /SL5="$40104,6529054,248832,C:\Users\Admin\AppData\Local\Temp\Avira Phantom VPN Pro 2.47.1.24783.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im Avira.WebAppHost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1128
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im Avira.VPN.Notifier.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4888
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im Avira.NetworkBlocker.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6104
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" stop AviraPhantomVPN
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1948
      • C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\tapinstall.exe
        "C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\tapinstall.exe" install "C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\OemVista.inf" "phantomtap"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:4612
      • C:\Windows\SysWOW64\sc.exe
        "sc" create "AviraPhantomVPN" displayname= "Avira Phantom VPN" start= auto binPath= "C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3116
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" start "AviraPhantomVPN"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4332
      • C:\Windows\SysWOW64\sc.exe
        "sc" description "AviraPhantomVPN" "AviraPhantomVPN"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1752
      • C:\Windows\SysWOW64\sc.exe
        "sc" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4280
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=in action=allow program="C:\Program Files (x86)\Avira\VPN\OpenVpn\phantomvpn.exe" enable=yes profile=any name="Avira Phantom VPN"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1088
      • C:\Windows\SysWOW64\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule dir=out action=allow program="C:\Program Files (x86)\Avira\VPN\OpenVpn\phantomvpn.exe" enable=yes profile=any name="Avira Phantom VPN"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1844
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C TIMEOUT 10
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Windows\SysWOW64\timeout.exe
          TIMEOUT 10
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:5828
      • C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
        "C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe" /migrateSettings
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4176
      • C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
        "C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe"
        3⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5948
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f12a7e54-b97d-9144-9aae-333cb6c80b22}\oemvista.inf" "9" "457afe35b" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\avira\vpn\openvpn\tap\win10\amd64"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2480
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_812e4bc89260cd62\oemvista.inf" "oem1.inf:3beb73aff103cc24:phantomtap.ndi:9.27.0.0:phantomtap," "457afe35b" "0000000000000194" "496b"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4888
  • C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
    "C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe"
    1⤵
    • Executes dropped EXE
    • Checks for any installed AV software in registry
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
      "C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe" delete
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4720
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2872

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          System Services

          2
          T1569

          Service Execution

          2
          T1569.002

          Persistence

          Create or Modify System Process

          3
          T1543

          Windows Service

          3
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Create or Modify System Process

          3
          T1543

          Windows Service

          3
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          2
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          3
          T1012

          Software Discovery

          1
          T1518

          Security Software Discovery

          1
          T1518.001

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          vpn-1.0.0.min.css
          • Path C:\Program Files (x86)\Avira\VPN\App\css\vpn-1.0.0.min.css
          • Size 62KB
          • SHA256 f80497aa10258094bc4a22b60fa2536466a0e6635d2b6c700847d292af9cbe3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vpn-vendor-1.0.0.min.css
          • Path C:\Program Files (x86)\Avira\VPN\App\css\vpn-vendor-1.0.0.min.css
          • Size 50KB
          • SHA256 7146bb2cd47b3bf090b202cd88c53467318f534c5f4e079c1ac3bf7be56f485f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          KievitWeb-Light.woff
          • Path C:\Program Files (x86)\Avira\VPN\App\fonts\KievitWeb-Light.woff
          • Size 54KB
          • SHA256 a791aba3842d3766494ad0aa2a1b9cdbd2bb8aa8b2235aedea82e993c851a1ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          loading.gif
          • Path C:\Program Files (x86)\Avira\VPN\App\images\gif\loading.gif
          • Size 8KB
          • SHA256 c9c616de646e94b9adea60ef1e8ffe5246f82b82baa1e039b1b6007067791773
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-SQPF4.tmp
          • Path C:\Program Files (x86)\Avira\VPN\App\images\png\regions\is-SQPF4.tmp
          • Size 743B
          • SHA256 3cf52e677d7f7be201cbf6e3ec56ed1f48b95c47e5969ef2c2510e270133c4f0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          index.html
          • Path C:\Program Files (x86)\Avira\VPN\App\index.html
          • Size 5KB
          • SHA256 954e696f9ef29f1756d187852965d8736460887481aed0cd7134d997d1e32c85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vpn-1.0.0.min.js
          • Path C:\Program Files (x86)\Avira\VPN\App\js\vpn-1.0.0.min.js
          • Size 317KB
          • SHA256 ccfd8f13339211df2a8e428877f8bb202697f9e4b86d6770bc62a08dd9964148
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vpn-vendor-1.0.0.min.js
          • Path C:\Program Files (x86)\Avira\VPN\App\js\vpn-vendor-1.0.0.min.js
          • Size 317KB
          • SHA256 696393aa261c0980dac558ce58fc30e9806d8b64f65c28c572b282ebf2a04f56
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          features.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\features.html
          • Size 13KB
          • SHA256 a8fc41ac51d9a38a24efab64b2cda207de49e1e68121d388fc37ce913f0d5d2b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          forced_login.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\forced_login.html
          • Size 3KB
          • SHA256 6787f4011beae68593821f1abc44f429c27c13bca1feb9ab7563b910a209862e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          header.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\header.html
          • Size 1KB
          • SHA256 7126677d091922845bfdc3978536a9a2edfb786483527859e5f67a4417e3cd42
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          location.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\location.html
          • Size 400B
          • SHA256 8e61b3ca9e7080a6d666ec29355cf90349404152c983c3964bc0c3f8e5bb59ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pulsar.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\pulsar.html
          • Size 1KB
          • SHA256 6da46f16daaf56b35db00c2e5bac111d610aadd689f3d95342ec67bab9eb21b7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          regions.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\regions.html
          • Size 2KB
          • SHA256 03dbe6cba5a6e6aa2c1e57e6d8e1778167912d278cad0e4f6d6f770689783ff3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\settings.html
          • Size 1KB
          • SHA256 617c5e3341444cd6c7bfff4e38588d7cc88a419025225c1c22f17569f687d108
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          status.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\status.html
          • Size 851B
          • SHA256 80fb38576f71698ad28eddf09cb9d9f63ccbe6f010d6b16f64a28aa221311a2f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          theme_selection.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\theme_selection.html
          • Size 4KB
          • SHA256 ff5442256e604abf882aa1dfb45fccc7dadc1c701ec2ca90b41e00d1030ec764
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          traffic.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\traffic.html
          • Size 222B
          • SHA256 428c15b0883bfa4d9089025b7bd0fd3c65307e7c6f618afe6fc400a394dd5b9c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wifi.html
          • Path C:\Program Files (x86)\Avira\VPN\App\views\directives\wifi.html
          • Size 2KB
          • SHA256 ad9cd853857565b9e3503f86cb473a0d4565c5ba32b5171cbfe181303ea32fd0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Avira.Acp.Common.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Common.dll
          • Size 17KB
          • SHA256 b738ee32b11a58b74686ccd551d0d33b58c3b335d9ba8998ba291c805340c455
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Acp.Resources.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.Resources.dll
          • Size 54KB
          • SHA256 839942ba4c0e36ad27355f65acf6520bbd6fa0967bfd3d9d6ddec520ca4fc3c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Acp.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.Acp.dll
          • Size 154KB
          • SHA256 19f6be72656bc0df0ab8849ed1e87f92af256228a569fcc330c7d836527176c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Common.Acp.AppClient.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Acp.AppClient.dll
          • Size 46KB
          • SHA256 fd96ed729b1049db0d5a9d7ca137716d713836f71574537be7367475748a51da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Common.Core.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.Common.Core.dll
          • Size 70KB
          • SHA256 1264c01dfd15b56dc8a329c0e39c7f471d97f7319ad16febd264ad804dc6faba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.Messaging.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.Messaging.dll
          • Size 48KB
          • SHA256 03d3cc4eb85ae4b8a4c670773ed2d35118a9dd5a76d5fe1f0ca28f711b199726
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.NetworkBlocker.exe
          • Path C:\Program Files (x86)\Avira\VPN\Avira.NetworkBlocker.exe
          • Size 231KB
          • SHA256 088e2217d57de9333e58396e754b07f8cb2540bcc9600ef6b22ae00b4097e24f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VPN.Acp.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Acp.dll
          • Size 33KB
          • SHA256 432ff81dde4ff2fc987037c592a859389cfd8b9ee20b3e75a33802ac739268bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VPN.Core.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.Core.dll
          • Size 143KB
          • SHA256 b2f065bf8e5193111e2c5f8c02838059a690508269471fc4d3d9c415f86def4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VPN.NotifierClient.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.NotifierClient.dll
          • Size 29KB
          • SHA256 679a92f0c5538ce28bbeae79d2cd48e7370db511d789de632667fb10b29e7202
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VPN.OeConnector.dll
          • Path C:\Program Files (x86)\Avira\VPN\Avira.VPN.OeConnector.dll
          • Size 42KB
          • SHA256 0f9b698d943cc1a52a7e487264593f12cefa91ef8f99946669f1c01524be07dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VpnService.exe
          • Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
          • Size 381KB
          • SHA256 0a7a4a984db41272350354faae65f652e50b974265c69eca7b48054b4954c3bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VpnService.exe.config
          • Path C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe.config
          • Size 8KB
          • SHA256 05210b2ddc6846c10a95b1f0874240930771c0f4383b60478fbf9585b3a67c61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.WebAppHost.exe
          • Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
          • Size 824KB
          • SHA256 60bdf774e24867deeeff39e7779598124be7d3f603088109a8efbbc0386cc33f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.WebAppHost.exe.config
          • Path C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe.config
          • Size 3KB
          • SHA256 a2b68cd7ad5e1158d182d59131488a0aa84c106f142ab62451bc284c72218216
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ProductSettings.json
          • Path C:\Program Files (x86)\Avira\VPN\Defaults\ProductSettings.json
          • Size 1KB
          • SHA256 7e84e38c4b147fa13e871249a9986c4621176ed0afc88c999901e354f603d096
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Messaging.dll
          • Path C:\Program Files (x86)\Avira\VPN\Messaging.dll
          • Size 38KB
          • SHA256 a820f125edf604369571a9bda86806bc3651888c1b6c1748474f367454fe220c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\Avira\VPN\Newtonsoft.Json.dll
          • Size 701KB
          • SHA256 6e969da87b52b6a71dc5704767bbe66eef27d0bf351cd9bef563a1dea446021d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OemVista.inf
          • Path C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\OemVista.inf
          • Size 7KB
          • SHA256 0f3dd51021075ffc5ee843bbe3f4f1b4d30ef0ae94b5cbbd7018a4ecc7fa37d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tapinstall.exe
          • Path C:\Program Files (x86)\Avira\VPN\OpenVpn\TAP\win10\amd64\tapinstall.exe
          • Size 595KB
          • SHA256 2286ab1901a7369eeb63898c84c8359bf4c316aa5147c6a78e1eb9ad94e57c52
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Serilog.Sinks.File.dll
          • Path C:\Program Files (x86)\Avira\VPN\Serilog.Sinks.File.dll
          • Size 37KB
          • SHA256 b5094f4381ec74a17a38c94027709201eb36d5b710003a1a87c85d59035f26c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Serilog.dll
          • Path C:\Program Files (x86)\Avira\VPN\Serilog.dll
          • Size 153KB
          • SHA256 cf9f921dd5d13a6704750478a1ce3eee47be40f54d86eb3ede40633e670c881e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServiceStack.Text.dll
          • Path C:\Program Files (x86)\Avira\VPN\ServiceStack.Text.dll
          • Size 199KB
          • SHA256 ec76697312e7a02eb9c150b3c6fe55eb9a9fc740bf09229c16d226849622c3da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SharpRaven.dll
          • Path C:\Program Files (x86)\Avira\VPN\SharpRaven.dll
          • Size 103KB
          • SHA256 d1511f52dfd181f37cf886e1edbb24545161dccc0d70aab0c733d7d876cf47d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.DiagnosticSource.dll
          • Path C:\Program Files (x86)\Avira\VPN\System.Diagnostics.DiagnosticSource.dll
          • Size 172KB
          • SHA256 32ae5b9e60b30256c4414bebb03d59c2767dca6116c27f5afe4262e0a5a49877
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VPN.Core.dll
          • Path C:\Program Files (x86)\Avira\VPN\VPN.Core.dll
          • Size 179KB
          • SHA256 8a79a68aea656ec11496df4c491180129319ddd5cd050d62e6f54d992ab30296
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira.VpnService.resources.dll
          • Path C:\Program Files (x86)\Avira\VPN\en-US\Avira.VpnService.resources.dll
          • Size 23KB
          • SHA256 cf05125aea4e5ec3d7acdf7ef2176d1e28e226004d0346c04bcddf6010b681aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VpnPrivateSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
          • Size 5KB
          • SHA256 95fb94d1340145ac9ba8cb6ffd102ee80343c858ea021b19e881516e033400b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VpnPrivateSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.backup
          • Size 6KB
          • SHA256 8cd642c39ec85d454ff8a598279fff07e10c7b59fa5802118146ef6bb261850b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VpnPrivateSettings.config
          • Path C:\ProgramData\Avira\VPN\VpnPrivateSettings.config
          • Size 6KB
          • SHA256 2fde44bd25894e3a626297de734fe83736bd4d970a86895c59a330a19dcb3d5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 25f308280fdf50857eb386a2d18e824aeea7a521c04dfe444df6ebb277ddac82
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 1ed45170fc59a605c8ef319779aa3ecf08b454bf2deb791e5c41e414707701db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 fbc9dec48f491bab158942d45d31ba3e94644cf80656ebef8e84d3bb8a537267
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 0f0861dee64f3536df1b0d9450516f9471ae381bcb901f28a41d6afb30376a30
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 7a07df98b4dd57477516c9bc98a7aa0a72a379d849b404cab1871a6399aab491
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 d53cdc2b5bfa2398700a68f54055be3b1772dc85f448ed09ddab5ae9482196c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 f470b5ea5199fd57bc30f4827b767ec21f6ce4f93ecb65fdf665c375e1c3863f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 6c48a68a06d4fbe375cfb63f3d17be812829938a7ce1aa8eca9d9c334ae68fd0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 46866344683462faaaa3d7d8bc1f10f3b3d399d65bdfd551f773c54b29135109
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 6f00bd821d9128c4fd5232ca253ae8442b3be630270b445850050600c9fcceaa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 f675d93454aa04f728e6a541b66d5a0174ceb13fbbe5f7ddbb3b7f66f9f40bff
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.backup
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.backup
          • Size 1KB
          • SHA256 91643bede5578e1660e1ff87f692ccefd03a28a012794d40dd7d55e4482219b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VpnSharedSettings.config
          • Path C:\ProgramData\Avira\VPN\VpnSharedSettings.config
          • Size 1KB
          • SHA256 abd246496373cd49bfcd63bc2d740874dde83c11598137526e9ff75056cfb58f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vpndbg.log
          • Path C:\ProgramData\Avira\VPN\vpndbg.log
          • Size 4KB
          • SHA256 d90fa63681ab578da389c5fbf288061e3f5abfed83c5a81ae0073402a40672ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vpndbg.log
          • Path C:\ProgramData\Avira\VPN\vpndbg.log
          • Size 4KB
          • SHA256 8c3ef55c84fbe2be959027cab2be09d5fb4ba02df005fec9da421356676171a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Avira Phantom VPN Pro 2.47.1.24783.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-TDDAI.tmp\Avira Phantom VPN Pro 2.47.1.24783.tmp
          • Size 1.5MB
          • SHA256 02febfffcac96296e9cbad84cccf0153a11c051e0f2421e86360eccfc21f7f4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oemvista.inf_amd64_812e4bc89260cd62.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_812e4bc89260cd62.ini
          • Size 424B
          • SHA256 9a4a97044a97ab21a4d09a5d4eba3479ab67cf6ccb2cd1899c8890ccc05269b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PHANTO~1.SYS
          • Path \??\c:\PROGRA~2\avira\vpn\openvpn\tap\win10\amd64\PHANTO~1.SYS
          • Size 52KB
          • SHA256 8e56bc542e4c317b27e3f4e813a71e452885046cac773b347a4beff59e987462
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          phantomtap.cat
          • Path \??\c:\program files (x86)\avira\vpn\openvpn\tap\win10\amd64\phantomtap.cat
          • Size 11KB
          • SHA256 2fbbcd28f64dbae9362e76ca409e0f750ae2bb12d941a19917bf46bba43a37b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1976-19-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/1976-1069-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/1976-6-0x00000000024C0000-0x00000000024C1000-memory.dmp
          Download

          memory/1976-1046-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/1976-15-0x00000000024C0000-0x00000000024C1000-memory.dmp
          Download

          memory/1976-14-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/1976-17-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/1976-752-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/1976-1084-0x0000000000400000-0x0000000000593000-memory.dmp
          Download

          memory/2656-990-0x0000013E2CF90000-0x0000013E2CFAC000-memory.dmp
          Download

          memory/2656-995-0x0000013E2CF70000-0x0000013E2CF78000-memory.dmp
          Download

          memory/2656-1016-0x0000013E2D0E0000-0x0000013E2D0EE000-memory.dmp
          Download

          memory/2656-994-0x0000013E458C0000-0x0000013E458EE000-memory.dmp
          Download

          memory/2656-975-0x0000013E2CF40000-0x0000013E2CF62000-memory.dmp
          Download

          memory/2656-979-0x0000013E2CF10000-0x0000013E2CF24000-memory.dmp
          Download

          memory/2656-1001-0x0000013E2D090000-0x0000013E2D09E000-memory.dmp
          Download

          memory/2656-973-0x0000013E2CFD0000-0x0000013E2D082000-memory.dmp
          Download

          memory/2656-969-0x0000013E2CEB0000-0x0000013E2CEE4000-memory.dmp
          Download

          memory/2656-971-0x0000013E2CE70000-0x0000013E2CE9A000-memory.dmp
          Download

          memory/2656-967-0x0000013E2C8A0000-0x0000013E2C8CA000-memory.dmp
          Download

          memory/2656-1014-0x0000013E45C20000-0x0000013E45C32000-memory.dmp
          Download

          memory/2656-1012-0x0000013E45970000-0x0000013E4599A000-memory.dmp
          Download

          memory/2656-1003-0x0000013E2D0A0000-0x0000013E2D0AA000-memory.dmp
          Download

          memory/2656-965-0x0000013E2C3B0000-0x0000013E2C414000-memory.dmp
          Download

          memory/2656-1010-0x0000013E2D0D0000-0x0000013E2D0DC000-memory.dmp
          Download

          memory/2656-1041-0x0000013E46080000-0x0000013E460CA000-memory.dmp
          Download

          memory/2656-1008-0x0000013E2D0B0000-0x0000013E2D0BE000-memory.dmp
          Download

          memory/2656-1020-0x0000013E45940000-0x0000013E45948000-memory.dmp
          Download

          memory/2656-1018-0x0000013E45C80000-0x0000013E45CB4000-memory.dmp
          Download

          memory/2656-1021-0x0000013E45D70000-0x0000013E45E1A000-memory.dmp
          Download

          memory/2656-992-0x0000013E2CEF0000-0x0000013E2CF00000-memory.dmp
          Download

          memory/2656-1023-0x0000013E45950000-0x0000013E4595A000-memory.dmp
          Download

          memory/2656-977-0x0000013E2C890000-0x0000013E2C89C000-memory.dmp
          Download

          memory/4088-13-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4088-0-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4088-1086-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4176-1052-0x0000019F19730000-0x0000019F197FE000-memory.dmp
          Download

          memory/5948-1120-0x0000029D8A680000-0x0000029D8A780000-memory.dmp
          Download

          memory/5948-1112-0x0000029D86D10000-0x0000029D86E10000-memory.dmp
          Download

          memory/5948-1110-0x0000029D86A70000-0x0000029D86B70000-memory.dmp
          Download

          memory/5948-1118-0x0000029D8A180000-0x0000029D8A280000-memory.dmp
          Download

          memory/5948-1111-0x0000029D87220000-0x0000029D87320000-memory.dmp
          Download

          memory/5948-1121-0x0000029D8ABC0000-0x0000029D8ACC0000-memory.dmp
          Download

          memory/5948-1123-0x0000029D8ABC0000-0x0000029D8ACC0000-memory.dmp
          Download

          memory/5948-1122-0x0000029D8ABC0000-0x0000029D8ACC0000-memory.dmp
          Download

          memory/5948-1124-0x0000029D8A180000-0x0000029D8A280000-memory.dmp
          Download

          memory/5948-1097-0x000002A5EBBC0000-0x000002A5EC366000-memory.dmp
          Download

          memory/5948-1114-0x0000029D86D10000-0x0000029D86E10000-memory.dmp
          Download

          memory/5948-1115-0x0000029D86D10000-0x0000029D86E10000-memory.dmp
          Download