URL:

install.avira-update.com/download/vpn-win/package/VpnInstaller.exe

Full analysis: https://app.any.run/tasks/81563d66-34d6-47e0-be55-38e24858f85e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 29, 2024, 15:07:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

E0ABB956A7FD4EE1E4C2BEED3FD69A37

SHA1:

2EEE0BCBCC224BC4B001F322ED69B74636147E24

SHA256:

B21BDDE2154119E82FE39A2924EB71F72AFCE172B09F13A7393BDB5E7676E4B2

SSDEEP:

3:KWirRDExKL1wFREJOXLNn:KWiJRJOXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VpnInstaller.exe (PID: 1368)

    • Actions looks like stealing of personal data

      • Avira.VpnService.exe (PID: 2244)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • iexplore.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • VpnInstaller.exe (PID: 1368)

    • The process creates files with name similar to system file names

      • VpnInstaller.exe (PID: 1368)

    • Reads the Internet Settings

      • VpnInstaller.exe (PID: 1368)
      • Avira.WebAppHost.exe (PID: 568)

    • Starts application with an unusual extension

      • VpnInstaller.exe (PID: 1368)

    • Reads settings of System Certificates

      • VpnInstaller.exe (PID: 1368)

    • Checks Windows Trust Settings

      • VpnInstaller.exe (PID: 1368)

    • Creates a software uninstall entry

      • VpnInstaller.exe (PID: 1368)

    • The process verifies whether the antivirus software is installed

      • ns8419.tmp (PID: 1132)
      • ns910B.tmp (PID: 1792)
      • sc.exe (PID: 1788)
      • Avira.WebAppHost.exe (PID: 568)
      • Avira.NetworkBlocker.exe (PID: 2624)
      • Avira.VpnService.exe (PID: 2244)
      • VpnInstaller.exe (PID: 1368)

    • Process drops legitimate windows executable

      • VpnInstaller.exe (PID: 1368)

    • Drops a system driver (possible attempt to evade defenses)

      • VpnInstaller.exe (PID: 1368)

    • Executes as Windows Service

      • Avira.VpnService.exe (PID: 2244)

    • Creates or modifies Windows services

      • VpnInstaller.exe (PID: 1368)

    • Starts SC.EXE for service management

      • ns910B.tmp (PID: 1792)

    • Reads security settings of Internet Explorer

      • VpnInstaller.exe (PID: 1368)
      • Avira.VpnService.exe (PID: 2244)
      • Avira.WebAppHost.exe (PID: 568)

    • Reads the Windows owner or organization settings

      • Avira.VpnService.exe (PID: 2244)

    • Searches for installed software

      • Avira.VpnService.exe (PID: 2244)

    • Adds/modifies Windows certificates

      • Avira.VpnService.exe (PID: 2244)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3984)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3984)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 4040)
      • iexplore.exe (PID: 3984)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1872)
      • VpnInstaller.exe (PID: 1368)
      • Avira.VpnService.exe (PID: 2244)
      • Avira.WebAppHost.exe (PID: 568)
      • Avira.NetworkBlocker.exe (PID: 2624)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1872)
      • VpnInstaller.exe (PID: 1368)
      • ns8419.tmp (PID: 1132)
      • ns910B.tmp (PID: 1792)
      • Avira.WebAppHost.exe (PID: 568)
      • Avira.NetworkBlocker.exe (PID: 2624)
      • Avira.VpnService.exe (PID: 2244)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1872)
      • Avira.WebAppHost.exe (PID: 568)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 4040)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3984)

    • Creates files or folders in the user directory

      • VpnInstaller.exe (PID: 1368)

    • Checks proxy server information

      • VpnInstaller.exe (PID: 1368)

    • Reads Environment values

      • VpnInstaller.exe (PID: 1368)
      • Avira.VpnService.exe (PID: 2244)

    • Reads the machine GUID from the registry

      • VpnInstaller.exe (PID: 1368)
      • Avira.VpnService.exe (PID: 2244)
      • Avira.WebAppHost.exe (PID: 568)

    • Reads the software policy settings

      • VpnInstaller.exe (PID: 1368)
      • Avira.VpnService.exe (PID: 2244)

    • Creates files in the program directory

      • VpnInstaller.exe (PID: 1368)
      • Avira.VpnService.exe (PID: 2244)

    • Reads CPU info

      • Avira.VpnService.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
11
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs vpninstaller.exe no specs vpninstaller.exe ns8419.tmp no specs ns910b.tmp no specs sc.exe no specs avira.vpnservice.exe avira.webapphost.exe no specs avira.networkblocker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Program Files\Avira\VPN\Avira.WebAppHost.exe" /migrateSettingsC:\Program Files\Avira\VPN\Avira.WebAppHost.exe—explorer.exe
User:
admin
Company:
Avira Operations GmbH & Co. KG
Integrity Level:
MEDIUM
Description:
Avira Phantom VPN
Exit code:
0
Version:
2.44.1.19926
Modules
Images
c:\program files\avira\vpn\avira.webapphost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1132"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\ns8419.tmp" "C:\Program Files\Avira\VPN\OpenVpn\TAP\i386\tapinstall.exe" tap_remove "tap0901"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\ns8419.tmp—VpnInstaller.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225501
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\nsistemp\nso8129.tmp\ns8419.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1368"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\VpnInstaller.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\VpnInstaller.exe
iexplore.exe
User:
admin
Company:
Avira Operations GmbH & Co. KG
Integrity Level:
HIGH
Description:
Avira Phantom VPN Installer
Exit code:
0
Version:
2.44.1.19908
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\vpninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1432"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\VpnInstaller.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\VpnInstaller.exe—iexplore.exe
User:
admin
Company:
Avira Operations GmbH & Co. KG
Integrity Level:
MEDIUM
Description:
Avira Phantom VPN Installer
Exit code:
3221226540
Version:
2.44.1.19908
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\vpninstaller.exe
c:\windows\system32\ntdll.dll
1788"C:\Windows\system32\sc.exe" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000C:\Windows\System32\sc.exe—ns910B.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1792"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\ns910B.tmp" "C:\Windows\system32\sc.exe" failure AviraPhantomVPN reset= 86400 actions= restart/5000/restart/10000//1000C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\ns910B.tmp—VpnInstaller.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\nsistemp\nso8129.tmp\ns910b.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1872"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2244"C:\Program Files\Avira\VPN\Avira.VpnService.exe"C:\Program Files\Avira\VPN\Avira.VpnService.exe
services.exe
User:
SYSTEM
Company:
Avira Operations GmbH & Co. KG
Integrity Level:
SYSTEM
Description:
VpnService
Version:
2.44.1.19908
Modules
Images
c:\program files\avira\vpn\avira.vpnservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2624"C:\Program Files\Avira\VPN\Avira.NetworkBlocker.exe" deleteC:\Program Files\Avira\VPN\Avira.NetworkBlocker.exe—Avira.VpnService.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\avira\vpn\avira.networkblocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\iphlpapi.dll
3984"C:\Program Files\Internet Explorer\iexplore.exe" "install.avira-update.com/download/vpn-win/package/VpnInstaller.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
26 398
Read events
26 154
Write events
194
Delete events
50

Modification events

(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
149843536
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31103559
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
450319786
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31103559
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
65
Suspicious files
33
Text files
367
Unknown types
10

Dropped files

PID
Process
Filename
Type
4040iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\VpnInstaller[1].exeexecutable
MD5:CF1EB662F5DDF13114CA647D6D05CCFB
SHA256:5B925AA9F2753E724F5441FD65A1960BFC7FC6649755629165C64AC3E14644CA
3984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\VpnInstaller.exe.mkxrjhq.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{468804A9-063A-11EF-9E36-12A9866C77DE}.datbinary
MD5:AF5432803584C7080CB3A384A21B2D55
SHA256:901E65533FC86FF1582DF6226D05EDDD3AADF0BCDCC4FFDC43DAFAB73EA11777
4040iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\VpnInstaller.exe.mkxrjhq.partialexecutable
MD5:9B41201BB6D9B439103B7A2FB1D41038
SHA256:F6D4A140924AF35DFBC63729736310737C6356052094B19FDDCB6E88D7E210ED
1368VpnInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\nsisXML.dllexecutable
MD5:9F3D5344E7EDE1F41F99D8FC37FD01AD
SHA256:77AA1A74A556F00F16BAF9B94637FA997BD4085695BA81BF496223644E43E815
1368VpnInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\ns8419.tmpexecutable
MD5:293165DB1E46070410B4209519E67494
SHA256:49B7477DB8DD22F8CF2D41EE2D79CE57797F02E8C7B9E799951A6C710384349A
1368VpnInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\064D75DF60A1456F63CEF9F347BAA00B_56E55841A2CD721637450FF62327CD0Fbinary
MD5:593918EFD3BC73CFF5C8B9373485F5DE
SHA256:FA935FCEC87A808FB9A41C5F63C2C5C24E8F132A71A4DEAA889E3115CC17CD8A
1368VpnInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\FindProcDLL.dllexecutable
MD5:75E7351A0F836B8659E6F315683C29F7
SHA256:7FFC549E7F679A08C77FA230654B77CDFFB3444296BB7C6B8B5769DB374B61EE
1368VpnInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nst8149.tmpbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1368VpnInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\nsistemp\nso8129.tmp\nsExec.dllexecutable
MD5:293165DB1E46070410B4209519E67494
SHA256:49B7477DB8DD22F8CF2D41EE2D79CE57797F02E8C7B9E799951A6C710384349A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
11
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4040
iexplore.exe
GET
200
23.199.214.7:80
http://install.avira-update.com/download/vpn-win/package/VpnInstaller.exe
unknown
—
—
unknown
1368
VpnInstaller.exe
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b59702af0c46080c
unknown
—
—
unknown
1368
VpnInstaller.exe
GET
200
192.229.221.95:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS6FKmrgWTGr7Q8nSk4Oub50ler6QQUlE%2FUXYvkpOKmgP792PkA76O%2BAlcCEAgCQr2BWQcpQeKtOv5EuBE%3D
unknown
—
—
unknown
1368
VpnInstaller.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA0HeCoTP8b5pXKW4TH%2F0Xk%3D
unknown
—
—
unknown
3984
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4040
iexplore.exe
23.199.214.7:80
install.avira-update.com
AKAMAI-AS
DE
unknown
1368
VpnInstaller.exe
35.190.25.25:443
api.mixpanel.com
GOOGLE
US
whitelisted
1368
VpnInstaller.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1368
VpnInstaller.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2244
Avira.VpnService.exe
18.194.64.246:443
api.phantom.avira-vpn.com
AMAZON-02
DE
unknown
2244
Avira.VpnService.exe
3.122.47.82:443
api.phantom.avira-vpn.com
AMAZON-02
DE
unknown
2244
Avira.VpnService.exe
35.190.25.25:443
api.mixpanel.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
install.avira-update.com
  • 23.199.214.7
unknown
api.mixpanel.com
  • 35.190.25.25
  • 130.211.34.183
  • 35.186.241.51
  • 107.178.240.159
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
status.geotrust.com
  • 192.229.221.95
whitelisted
api.phantom.avira-vpn.com
  • 3.122.47.82
  • 18.195.197.190
  • 18.194.64.246
  • 3.127.4.4
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
dispatch.avira-update.com
  • 3.120.202.195
  • 3.66.138.47
unknown

Threats

PID
Process
Class
Message
4040
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
install.avira-update.com/download/vpn-win/package/VpnInstaller.exe