Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Siggen9.42911

Added to the Dr.Web virus database: 2020-04-28

Virus description added:

Technical Information

To ensure autorun and distribution
Creates the following services
  • [<HKLM>\System\CurrentControlSet\Services\AviraPhantomVPN] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\AviraPhantomVPN] 'ImagePath' = '%ProgramFiles(x86)%\Avira\VPN\Avira.VpnService.exe'
  • [<HKLM>\SYSTEM\CurrentControlSet\Services\AviraPhantomVPN] 'ImagePath' = '"%ProgramFiles(x86)%\Avira\VPN\Avira.VpnService.exe"'
Malicious functions
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /F /IM Avira.VpnService.exe
Modifies file system
Creates the following files
  • %TEMP%\7zipsfx.000\avira.phantom.vpn.v2.32.2.34115.exe
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\uz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\va.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\vc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ve.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\vg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\vi.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\vu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\zw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\wf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ws.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ye.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\yt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\za.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\zm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\uy.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\vn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\us.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\to.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\th.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tj.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\uk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tv.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ua.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ug.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\um.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\map.svg
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\vpn.svg
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\de.svg
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\keychain.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\location.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\login.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\notifications.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\privacy.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\forced_login.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\header.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\progress_diagnostic_data.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\rate.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\regions.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\regions_lock.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\register.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\sent_diagnostic_data.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\pulsar.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\purchase.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\features.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\email_confirmation.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\display_settings.html
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\pulsar_icon.svg
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\ro.svg
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\uk.svg
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\us.svg
  • %ProgramFiles(x86)%\avira\vpn\app\js\vpn-1.0.0.js
  • %ProgramFiles(x86)%\avira\vpn\app\js\vpn-1.0.0.js.map
  • %ProgramFiles(x86)%\avira\vpn\app\images\svg\nl.svg
  • %ProgramFiles(x86)%\avira\vpn\app\js\vpn-1.0.0.min.js
  • %ProgramFiles(x86)%\avira\vpn\app\js\vpn-vendor-1.0.0.js
  • %ProgramFiles(x86)%\avira\vpn\app\js\vpn-vendor-1.0.0.min.js
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\collect_diagnostic_data.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\confirm_sent_data.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\data_usage_popup.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\diagnostics.html
  • %ProgramFiles(x86)%\avira\vpn\app\js\vpn-1.0.0.min.js.map
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tg.png
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\settings.html
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\tc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ng.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ni.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\no.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\np.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ph.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\om.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pa.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pe.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ne.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ml.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mo.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mp.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mq.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ms.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mv.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mx.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\my.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\na.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sj.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sh.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\si.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\so.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\st.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sv.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sx.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sy.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ss.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\se.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sd.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ps.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\py.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\qa.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\pn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\re.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\rs.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ru.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\rw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sa.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sb.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\sc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ro.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\td.png
  • %PROGRAMDATA%\avira\vpn\vpnsharedsettings.backup
  • %WINDIR%\temp\cab5ee1.tmp
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\subscription_terms.html
  • %WINDIR%\temp\cabe357.tmp
  • %WINDIR%\temp\tare358.tmp
  • %WINDIR%\temp\cabe57c.tmp
  • %WINDIR%\temp\tare57d.tmp
  • %WINDIR%\temp\cabe5dc.tmp
  • %WINDIR%\temp\tare5dd.tmp
  • %WINDIR%\temp\cabf772.tmp
  • %WINDIR%\temp\tarfc2.tmp
  • %WINDIR%\temp\tarf773.tmp
  • %WINDIR%\temp\cabfa04.tmp
  • %WINDIR%\temp\tarfa05.tmp
  • %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
  • %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
  • %WINDIR%\temp\cabfc1.tmp
  • %WINDIR%\temp\tarcbc7.tmp
  • unc\ghfauclmz*\mailslot\net\netlogon
  • %WINDIR%\temp\cabcbc6.tmp
  • C:\users\public\desktop\avira phantom vpn.lnk
  • %PROGRAMDATA%\avira\vpn\vpnprivatesettings.config
  • %PROGRAMDATA%\avira\vpn\vpnprivatesettings.backup
  • %TEMP%\nsueb14.tmp\nsprocess.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.trialreset.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\avira\avira phantom vpn trial reset.lnk
  • C:\users\public\desktop\avira phantom vpn trial reset.lnk
  • %TEMP%\nsueb14.tmp\newtextreplace.dll
  • %WINDIR%\temp\cabcba5.tmp
  • %WINDIR%\temp\cabcb31.tmp
  • %WINDIR%\temp\tarcb32.tmp
  • %WINDIR%\temp\cabcb53.tmp
  • %WINDIR%\temp\tarcb54.tmp
  • %WINDIR%\temp\cabcb74.tmp
  • %WINDIR%\temp\tarcb75.tmp
  • %WINDIR%\temp\tarcba6.tmp
  • %WINDIR%\temp\cab1706.tmp
  • %WINDIR%\temp\tar1707.tmp
  • %WINDIR%\temp\cab1785.tmp
  • %WINDIR%\temp\tar396a.tmp
  • %WINDIR%\temp\cab3aa4.tmp
  • %WINDIR%\temp\tar3aa5.tmp
  • %WINDIR%\temp\cab4256.tmp
  • %WINDIR%\temp\tar4257.tmp
  • %WINDIR%\temp\tar392a.tmp
  • %WINDIR%\temp\cab3969.tmp
  • %WINDIR%\temp\cab440e.tmp
  • %WINDIR%\temp\tar4edf.tmp
  • %WINDIR%\temp\cab5d18.tmp
  • %WINDIR%\temp\tar5d19.tmp
  • %WINDIR%\temp\cab5ea1.tmp
  • %WINDIR%\temp\tar5ea2.tmp
  • %WINDIR%\temp\tar440f.tmp
  • %WINDIR%\temp\cab4ede.tmp
  • %WINDIR%\temp\cab3929.tmp
  • %WINDIR%\temp\tar2e1c.tmp
  • %WINDIR%\temp\cab2e1b.tmp
  • %WINDIR%\temp\cab2300.tmp
  • %WINDIR%\temp\tar2301.tmp
  • %WINDIR%\temp\cab2341.tmp
  • %WINDIR%\temp\tar2342.tmp
  • %WINDIR%\temp\cab2527.tmp
  • %WINDIR%\temp\tar2528.tmp
  • %WINDIR%\temp\tar1786.tmp
  • %WINDIR%\temp\cab2558.tmp
  • %WINDIR%\temp\cab2cdc.tmp
  • %WINDIR%\temp\tar2cdd.tmp
  • %WINDIR%\temp\cab2d0d.tmp
  • %WINDIR%\temp\tar2d0e.tmp
  • %WINDIR%\temp\cab2dea.tmp
  • %WINDIR%\temp\tar2deb.tmp
  • %WINDIR%\temp\tar2559.tmp
  • %PROGRAMDATA%\avira\vpn\vpndbg.log
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mk.png
  • %TEMP%\nsy3453.tmp
  • %PROGRAMDATA%\avira\vpn\vpnsharedsettings.config
  • %ProgramFiles(x86)%\avira\vpn\templates\template2.html
  • %ProgramFiles(x86)%\avira\vpn\templates\templateeducationmessage.html
  • %ProgramFiles(x86)%\avira\vpn\templates\templatevpn2.html
  • %ProgramFiles(x86)%\avira\vpn\templates\templatevpn3.html
  • %ProgramFiles(x86)%\avira\vpn\templates\templatevpnmessagwithcaption.html
  • %ProgramFiles(x86)%\avira\vpn\templates\templatevpnmessage.html
  • %ProgramFiles(x86)%\avira\vpn\templates\avira-icons.woff
  • %ProgramFiles(x86)%\avira\vpn\templates\images\ftu-gfx-screen-1.png
  • %ProgramFiles(x86)%\avira\vpn\templates\educationmessage.css
  • %ProgramFiles(x86)%\avira\vpn\templates\ftu.css
  • %ProgramFiles(x86)%\avira\vpn\templates\ftu.html
  • %ProgramFiles(x86)%\avira\vpn\templates\ftu.js
  • %ProgramFiles(x86)%\avira\vpn\templates\notifier.css
  • %ProgramFiles(x86)%\avira\vpn\templates\notifieravira.css
  • %ProgramFiles(x86)%\avira\vpn\templates\template1.html
  • %ProgramFiles(x86)%\avira\vpn\templates\templatewarningnohint.html
  • %ProgramFiles(x86)%\avira\vpn\templates\template0.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\wifi.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\switch.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\theme_selection.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\traffic.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\trial.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\waiting_window.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\whitelabel_loc.html
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\rate.html
  • %ProgramFiles(x86)%\avira\vpn\templates\kievit-light.woff
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\images\png\star.png
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\images\png\star@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\images\png\star@3x.png
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\images\png\stargrey.png
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\images\png\stargrey@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\widgets\rate-5stars\images\png\stargrey@3x.png
  • %ProgramFiles(x86)%\avira\vpn\templates\kievitcomppro-light.woff
  • %ProgramFiles(x86)%\avira\vpn\templates\images\ftu-gfx-screen-2.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\ftu-gfx-screen-3.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\ftu-vpn-logo.png
  • %ProgramFiles(x86)%\avira\vpn\ja-jp\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\nl-nl\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\pt-br\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\pt-br\fsharp.core.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\ru-ru\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\fr-fr\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\it-it\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\tr-tr\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\uninstaller.exe
  • %WINDIR%\inf\oem0.pnf
  • %WINDIR%\inf\oem1.pnf
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\avira\avira phantom vpn.lnk
  • %TEMP%\nsm9b7.tmp\registry.dll
  • %ProgramFiles(x86)%\avira\vpn\zh-cn\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\zh-tw\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\es-es\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\en-us\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\de-de\avira.vpnservice.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\templates\images\vpn.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\alert-orange.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\alert-red.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\alert.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\checkmark.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\feedback.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\ipm-header.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\header_edu-transparent.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\info.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\lock.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\logo.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\onlineprivacy.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\traveler.png
  • %ProgramFiles(x86)%\avira\vpn\templates\images\vpn-gray.svg
  • %ProgramFiles(x86)%\avira\vpn\templates\images\horzline.png
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\start_diagnostic_data.html
  • %ProgramFiles(x86)%\avira\vpn\app\views\directives\status.html
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mh.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\mac_grey.png
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitwebpro-medi.woff
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\avira-icons-regular-webfont.eot
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\avira-icons-regular-webfont.ttf
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\avira-icons-regular-webfont.woff
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\ionicons.eot
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\ionicons.svg
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\ionicons.woff
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-grey.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\loading.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-active-pro.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-active.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-green-pro.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-green.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-grey-pro.gif
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitwebpro-medi.eot
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\ionicons.ttf
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitwebpro-book.woff
  • %ProgramFiles(x86)%\avira\vpn\app\css\vpn-1.0.0.min.css
  • %ProgramFiles(x86)%\avira\vpn\jwt.dll
  • %ProgramFiles(x86)%\avira\vpn\crypto.dll
  • %ProgramFiles(x86)%\avira\vpn\third-party attributions.txt
  • %ProgramFiles(x86)%\avira\vpn\app\index.html
  • %ProgramFiles(x86)%\avira\vpn\app\package.json
  • %ProgramFiles(x86)%\avira\vpn\app\css\vpn-1.0.0.css
  • %ProgramFiles(x86)%\avira\vpn\app\css\vpn-1.0.0.min.css.map
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitwebpro-bold.woff
  • %ProgramFiles(x86)%\avira\vpn\app\css\vpn-vendor-1.0.0.css
  • %ProgramFiles(x86)%\avira\vpn\app\css\vpn-vendor-1.0.0.min.css
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitcomppro.woff
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitweb-light.eot
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitweb-light.woff
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitwebpro-bold.eot
  • %ProgramFiles(x86)%\avira\vpn\app\fonts\kievitwebpro-book.eot
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-progress-pro.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\gif\pulsar-progress.gif
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\logo_pro.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\ref-copy.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\ref-tick.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\theme-dark-thumbnail.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\theme-light-thumbnail.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\three-blue-stars.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\pulsar_watermark_active.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\pulsar_watermark_pro.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\wifi-connected-dark.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\wifi-disconnected-light.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\all_devices_black.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\all_devices_black@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\all_devices_grey.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\all_devices_grey@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\wifi-connected-light.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\wifi-disconnected-dark.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\pulsar_watermark.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\pulsargreen.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\pulsar.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\map_pro.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\nearest.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\star.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\star@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\star@3x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\vpn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\map.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\angle-down-dark.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\logo.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\logo_green.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\neagentdialog.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\neagentdialog@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\neagentdialogmagnifier.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\neagentdialogmagnifier@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\angle-down-light.png
  • %ProgramFiles(x86)%\avira\vpn\system.runtime.interopservices.runtimeinformation.dll
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\mac_black.png
  • %ProgramFiles(x86)%\avira\vpn\pclstorage.abstractions.dll
  • %ProgramFiles(x86)%\avira\vpn\pclappconfig.filesystemstream.abstractions.dll
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\amd64\phantomtap.cat
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\amd64\phantomtap.sys
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\amd64\tapinstall.exe
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\i386\oemvista.inf
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\i386\phantomtap.cat
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\i386\phantomtap.sys
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\oemvista.inf
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\i386\tapinstall.exe
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\phantomtap.cat
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\phantomtap.sys
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\tapinstall.exe
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\i386\oemvista.inf
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\i386\phantomtap.cat
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\i386\phantomtap.sys
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\amd64\oemvista.inf
  • %ProgramFiles(x86)%\avira\vpn\openvpn\tap\win10\i386\tapinstall.exe
  • %ProgramFiles(x86)%\avira\vpn\openvpn\phantomvpn.exe
  • %TEMP%\nsm9b7.tmp\inetc.dll
  • %TEMP%\nsfeb04.tmp
  • %TEMP%\nsueb14.tmp\nsexec.dll
  • %TEMP%\nsueb14.tmp\vpninstaller.exe
  • %TEMP%\nsm9b7.tmp\nsprocess.dll
  • %TEMP%\nsm9b7.tmp\system.dll
  • %TEMP%\nsm9b7.tmp\base64.dll
  • %TEMP%\nsra25.tmp
  • %ProgramFiles(x86)%\avira\vpn\openvpn\libssl-1_1.dll
  • %TEMP%\nsm9b7.tmp\nsexec.dll
  • %TEMP%\nsm9b7.tmp\findprocdll.dll
  • %TEMP%\nsm9b7.tmp\nsisxml.dll
  • %ProgramFiles(x86)%\avira\vpn\openvpn\vpnclient.ovpn
  • %ProgramFiles(x86)%\avira\vpn\openvpn\libcrypto-1_1.dll
  • %ProgramFiles(x86)%\avira\vpn\openvpn\libpkcs11-helper-1.dll
  • %ProgramFiles(x86)%\avira\vpn\openvpn\lzo2.dll
  • %ProgramFiles(x86)%\avira\vpn\openvpn\doc\license.txt
  • %ProgramFiles(x86)%\avira\vpn\defaults\productsettings.json
  • %ProgramFiles(x86)%\avira\vpn\certificates\avira.cer
  • %ProgramFiles(x86)%\avira\vpn\serilog.enrichers.process.dll
  • %ProgramFiles(x86)%\avira\vpn\serilog.enrichers.thread.dll
  • %ProgramFiles(x86)%\avira\vpn\sharpravenportable.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.webapphost.exe.config
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifier.exe.config
  • %ProgramFiles(x86)%\avira\vpn\serilog.dll
  • %ProgramFiles(x86)%\avira\vpn\serilog.sinks.file.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.core.dll.config
  • %ProgramFiles(x86)%\avira\vpn\vpn.shared.win.dll
  • %ProgramFiles(x86)%\avira\vpn\messaging.dll
  • %ProgramFiles(x86)%\avira\vpn\vpn.shared.core.dll
  • %ProgramFiles(x86)%\avira\vpn\pclappconfig.dll
  • %ProgramFiles(x86)%\avira\vpn\pclappconfig.filesystemstream.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.networkblocker.exe
  • %ProgramFiles(x86)%\avira\vpn\vpn.core.dll
  • %ProgramFiles(x86)%\avira\vpn\fsharp.core.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.diag.exe
  • %ProgramFiles(x86)%\avira\vpn\newtonsoft.json.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpnservice.exe.config
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.core.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.oeconnector.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.common.core.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.acp.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.acp.common.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpnservice.exe
  • %ProgramFiles(x86)%\avira\vpn\avira.acp.resources.dll
  • %ProgramFiles(x86)%\avira\vpn\servicestack.text.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.acp.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.messaging.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.webapphost.exe
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifier.exe
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifierclient.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.common.acp.appclient.dll
  • %ProgramFiles(x86)%\avira\vpn\pclstorage.dll
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\et.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\mac_grey@2x.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gs.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gy.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\hk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\hn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\im.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\hr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ht.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\hu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\id.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ie.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\il.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\hm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gq.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gd.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\fk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\fm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\fo.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\fr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ga.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gb.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ge.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gh.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gi.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\gp.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\in.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\io.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\iq.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\li.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ls.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\la.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lb.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ly.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ma.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\md.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\me.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\lv.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ky.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\is.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\it.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\je.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\jm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\jo.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\jp.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ir.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ke.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kh.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ki.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\km.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kp.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\kg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\fj.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\mg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\fi.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\es.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ba.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bb.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bd.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\be.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bi.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\br.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bj.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bo.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bq.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\az.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bh.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ax.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\al.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\nearest.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ad.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ae.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\af.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ag.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ai.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\am.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\au.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\an.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ao.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\aq.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ar.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\as.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\at.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\aw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bs.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bt.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bv.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cy.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\de.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\dj.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\dk.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cx.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\dm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ec.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ee.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\eg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\eh.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\er.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\do.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\dz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cv.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cu.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cr.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\by.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bz.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ca.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cc.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cd.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cf.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\bw.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cg.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ci.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ck.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cl.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cm.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\cn.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\co.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\regions\ch.png
  • %ProgramFiles(x86)%\avira\vpn\app\images\png\purchase\mac_black@2x.png
  • %WINDIR%\temp\tar5ee2.tmp
Deletes the following files
  • %TEMP%\nsra25.tmp
  • %WINDIR%\temp\tar2d0e.tmp
  • %WINDIR%\temp\cab2d0d.tmp
  • %WINDIR%\temp\tar2cdd.tmp
  • %WINDIR%\temp\cab2cdc.tmp
  • %WINDIR%\temp\tar2559.tmp
  • %WINDIR%\temp\cab2558.tmp
  • %WINDIR%\temp\tar2528.tmp
  • %WINDIR%\temp\cab2dea.tmp
  • %WINDIR%\temp\cab2527.tmp
  • %WINDIR%\temp\cab2341.tmp
  • %WINDIR%\temp\tar2301.tmp
  • %WINDIR%\temp\cab2300.tmp
  • %WINDIR%\temp\tar1786.tmp
  • %WINDIR%\temp\cab1785.tmp
  • %WINDIR%\temp\tar1707.tmp
  • %WINDIR%\temp\cab1706.tmp
  • %WINDIR%\temp\tar2342.tmp
  • %WINDIR%\temp\tar4257.tmp
  • %WINDIR%\temp\cab5ee1.tmp
  • %WINDIR%\temp\tar2e1c.tmp
  • %WINDIR%\temp\tar5ea2.tmp
  • %WINDIR%\temp\cab5ea1.tmp
  • %WINDIR%\temp\tar5d19.tmp
  • %WINDIR%\temp\cab5d18.tmp
  • %WINDIR%\temp\tar4edf.tmp
  • %WINDIR%\temp\cab4ede.tmp
  • %WINDIR%\temp\tar440f.tmp
  • %WINDIR%\temp\tarfc2.tmp
  • %WINDIR%\temp\cab440e.tmp
  • %WINDIR%\temp\cab4256.tmp
  • %WINDIR%\temp\tar3aa5.tmp
  • %WINDIR%\temp\cab3aa4.tmp
  • %WINDIR%\temp\tar396a.tmp
  • %WINDIR%\temp\cab3969.tmp
  • %WINDIR%\temp\tar392a.tmp
  • %WINDIR%\temp\cab3929.tmp
  • %WINDIR%\temp\tar2deb.tmp
  • %WINDIR%\temp\cab2e1b.tmp
  • %WINDIR%\temp\cabfc1.tmp
  • %WINDIR%\temp\cabcb31.tmp
  • %TEMP%\nsueb14.tmp\nsprocess.dll
  • %TEMP%\nsueb14.tmp\nsexec.dll
  • %TEMP%\nsueb14.tmp\newtextreplace.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpnservice.bak
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifier.bak
  • %ProgramFiles(x86)%\avira\vpn\vpn.core.bak
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.core.bak
  • %TEMP%\nsueb14.tmp\vpninstaller.exe
  • %TEMP%\nsm9b7.tmp\system.dll
  • %TEMP%\nsm9b7.tmp\nsprocess.dll
  • %TEMP%\nsm9b7.tmp\nsisxml.dll
  • %TEMP%\nsm9b7.tmp\nsexec.dll
  • %TEMP%\nsm9b7.tmp\inetc.dll
  • %TEMP%\nsm9b7.tmp\findprocdll.dll
  • %TEMP%\nsm9b7.tmp\base64.dll
  • %TEMP%\nsy3453.tmp
  • %TEMP%\nsm9b7.tmp\registry.dll
  • %WINDIR%\temp\tarcbc7.tmp
  • %WINDIR%\temp\cabfa04.tmp
  • %WINDIR%\temp\tarcb32.tmp
  • %WINDIR%\temp\tarf773.tmp
  • %WINDIR%\temp\cabf772.tmp
  • %WINDIR%\temp\tare5dd.tmp
  • %WINDIR%\temp\cabe5dc.tmp
  • %WINDIR%\temp\tare57d.tmp
  • %WINDIR%\temp\cabe57c.tmp
  • %WINDIR%\temp\tare358.tmp
  • %WINDIR%\temp\tarfa05.tmp
  • %WINDIR%\temp\cabe357.tmp
  • %WINDIR%\temp\cabcbc6.tmp
  • %WINDIR%\temp\tarcba6.tmp
  • %WINDIR%\temp\cabcba5.tmp
  • %WINDIR%\temp\tarcb75.tmp
  • %WINDIR%\temp\cabcb74.tmp
  • %WINDIR%\temp\tarcb54.tmp
  • %WINDIR%\temp\cabcb53.tmp
  • %TEMP%\7zipsfx.000\avira.phantom.vpn.v2.32.2.34115.exe
  • %WINDIR%\temp\tar5ee2.tmp
Moves the following files
  • from %ProgramFiles(x86)%\avira\vpn\avira.vpn.core.dll to %ProgramFiles(x86)%\avira\vpn\avira.vpn.core.bak
  • from %ProgramFiles(x86)%\avira\vpn\vpn.core.dll to %ProgramFiles(x86)%\avira\vpn\vpn.core.bak
  • from %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifier.exe to %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifier.bak
  • from %ProgramFiles(x86)%\avira\vpn\avira.vpnservice.exe to %ProgramFiles(x86)%\avira\vpn\avira.vpnservice.bak
Substitutes the following files
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.core.dll
  • %ProgramFiles(x86)%\avira\vpn\avira.vpn.notifier.exe
  • %ProgramFiles(x86)%\avira\vpn\avira.vpnservice.exe
  • %ProgramFiles(x86)%\avira\vpn\vpn.core.dll
Network activity
TCP
HTTP GET requests
  • http://ap#.##xpanel.com/track/?ip################################################################################################################################################################...
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
  • http://www.ms###csi.com/ncsi.txt
  • 'ap#.####tom.avira-vpn.com':443
  • 'di######.avira-update.com':443
  • 'se####.avira.net':443
  • 'ir##########alt-antenna-219709.appspot.com':443
  • 'ap#.##xpanel.com':443
  • UDP
    • DNS ASK ap#.##xpanel.com
    • DNS ASK ap#.####tom.avira-vpn.com
    • DNS ASK di######.avira-update.com
    • DNS ASK se####.avira.net
    • DNS ASK ir##########alt-antenna-219709.appspot.com
    Miscellaneous
    Searches for the following windows
    • ClassName: '' WindowName: ''
    Creates and executes the following
    • '%TEMP%\7zipsfx.000\avira.phantom.vpn.v2.32.2.34115.exe' /S
    • '%ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\tapinstall.exe' status phantomtap
    • '%ProgramFiles(x86)%\avira\vpn\avira.networkblocker.exe' delete
    • '%ProgramFiles(x86)%\avira\vpn\avira.webapphost.exe' /migrateSettings
    • '%ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\tapinstall.exe' find phantomtap
    • '%ProgramFiles(x86)%\avira\vpn\avira.vpnservice.exe'
    • '%ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\tapinstall.exe' install "%ProgramFiles(x86)%\Avira\VPN\OpenVpn\TAP\win7\amd64\OemVista.inf" phantomtap
    • '%ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\tapinstall.exe' tap_remove "phantomtap"
    • '%TEMP%\nsueb14.tmp\vpninstaller.exe' /S
    • '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="all" remoteip=95.141.193.133' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000' (with hidden window)
    • '%ProgramFiles(x86)%\avira\vpn\openvpn\tap\win7\amd64\tapinstall.exe' tap_remove "phantomtap"' (with hidden window)
    • '%WINDIR%\syswow64\taskkill.exe' /F /IM Avira.VpnService.exe' (with hidden window)
    • '%ProgramFiles(x86)%\avira\vpn\avira.webapphost.exe' /migrateSettings' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' config AviraPhantomVPN start=auto' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' start AviraPhantomVPN' (with hidden window)
    • '%WINDIR%\syswow64\route.exe' delete 95.141.193.133' (with hidden window)
    • '%WINDIR%\syswow64\sc.exe' config AviraPhantomVPN start=disabled' (with hidden window)
    Executes the following
    • '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="all" remoteip=95.141.193.133
    • '%WINDIR%\syswow64\route.exe' delete 95.141.193.133
    • '%WINDIR%\syswow64\sc.exe' failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000
    • '%WINDIR%\syswow64\sc.exe' config AviraPhantomVPN start=disabled
    • '%WINDIR%\syswow64\sc.exe' config AviraPhantomVPN start=auto
    • '%WINDIR%\syswow64\sc.exe' start AviraPhantomVPN

    Curing recommendations

    1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
    2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
    Free trial

    One month (no registration) or three months (registration and renewal discount)

    Download Dr.Web

    Download by serial number

    Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

    Free trial

    One month (no registration) or three months (registration and renewal discount)

    Download Dr.Web

    Download by serial number

    After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

    Free trial

    One month (no registration) or three months (registration and renewal discount)

    Download Dr.Web

    Download by serial number

    1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
    2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
      • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
      • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
      • Switch off your device and turn it on as normal.

    Find out more about Dr.Web for Android

    The Russian developer of Dr.Web anti-viruses
    Doctor Web has been developing anti-virus software since 1992
    Dr.Web is trusted by users around the world in 200+ countries
    The company has delivered an anti-virus as a service since 2007
    24/7 tech support

    Dr.Web © Doctor Web
    2003 — 2020

    Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

    2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124