Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    84s
  • max time network
    89s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2023, 19:28

General

  • Target

    Windscribe_2.5.18.exe

  • Size

    18.8MB

  • MD5

    5729d7f8fff698e46f35abc7d904ece9

  • SHA1

    7017eb70ff16eeaf91e9e9f7d60b938f83fb0169

  • SHA256

    a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475

  • SHA512

    e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7

  • SSDEEP

    393216:aaeuojgBv0B53Y6dwzrR0ncZutc6RDHqgu3LO4QK+N2ubT1EPIg9z5sc:aaHHBMB5I62inUbgua1jN201tksc

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
  • Drops file in Drivers directory 9 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 31 IoCs
  • Registers COM server for autorun 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windscribe_2.5.18.exe
    "C:\Users\Admin\AppData\Local\Temp\Windscribe_2.5.18.exe"
    1⤵
    • Sets service image path in registry
    • Loads dropped DLL
    • Registers COM server for autorun
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Windows\SYSTEM32\sc.exe
      "sc" create WindscribeService binPath= "C:\Program Files\Windscribe\WindscribeService.exe" start= auto
      2⤵
      • Launches sc.exe
      PID:5100
    • C:\Windows\SYSTEM32\sc.exe
      "sc" description WindscribeService "Manages the firewall and controls the VPN tunnel"
      2⤵
      • Launches sc.exe
      PID:3400
    • C:\Program Files\Windscribe\subinacl.exe
      "C:\Program Files\Windscribe\subinacl" /SERVICE WindscribeService /grant=S-1-5-11=STO
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3076
    • C:\Program Files\Windscribe\tap\tapinstall.exe
      "C:\Program Files\Windscribe\tap\tapinstall.exe" install OemVista.inf tapwindscribe0901
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Program Files\Windscribe\wintun\tapinstall.exe
      "C:\Program Files\Windscribe\wintun\tapinstall.exe" install windtun420.inf windtun420
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4896
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf
      2⤵
      • Drops file in Drivers directory
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3608
      • C:\Windows\system32\runonce.exe
        "C:\Windows\system32\runonce.exe" -r
        3⤵
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Windows\System32\grpconv.exe
          "C:\Windows\System32\grpconv.exe" -o
          4⤵
            PID:4824
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{62e2efd4-970a-ef4b-9880-f97241090b21}\oemvista.inf" "9" "40e41e9d3" "0000000000000148" "WinSta0\Default" "0000000000000140" "208" "c:\program files\windscribe\tap"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3216
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tapwindscribe0901.ndi:9.24.2.601:tapwindscribe0901," "40e41e9d3" "0000000000000178"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:612
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ef68a0a7-7c44-1d47-bbe9-74600d911bb0}\windtun420.inf" "9" "4fd9b412f" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "c:\program files\windscribe\wintun"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4584
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:f101f9793a5fdf02:Windtun420.Install:0.9.0.0:windtun420," "4fd9b412f" "000000000000014C"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3252
    • C:\Program Files\Windscribe\WindscribeLauncher.exe
      "C:\Program Files\Windscribe\WindscribeLauncher.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Program Files\Windscribe\Windscribe.exe
        "C:\Program Files\Windscribe\Windscribe.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe
          "C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe" --version
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4520
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/signup?cpid=app_windows
          3⤵
          • Adds Run key to start application
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7fff59ca46f8,0x7fff59ca4708,0x7fff59ca4718
            4⤵
              PID:4588
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
              4⤵
                PID:1280
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3200
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
                4⤵
                  PID:4108
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                  4⤵
                    PID:368
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                    4⤵
                      PID:4744
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5252 /prefetch:8
                      4⤵
                        PID:2104
                • C:\Program Files\Windscribe\WindscribeService.exe
                  "C:\Program Files\Windscribe\WindscribeService.exe"
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3720
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /t /im windscribeopenvpn_2_5_4.exe
                    2⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4884
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:4516

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\PROGRA~1\WINDSC~1\SPLITT~1\WindscribeSplitTunnel.sys

                    Filesize

                    34KB

                    MD5

                    1ba24e35575d93b69f8360cd746cda79

                    SHA1

                    18b0b826a0f58d4516a84c4e78a0acc38c1c268c

                    SHA256

                    24d6796707101b425226ad85f43a0fac921ba3f25c6129061781edd172bec095

                    SHA512

                    c85e17e3178fc98ee3a1f1c3e619910fd76a7081ed41c24c4622e01d09993cd8f68b7eea358c0141d01ec24e08cb8d923a7b5c7c6213b9eff3262c2534848410

                  • C:\Program Files\Windscribe\MSVCP140.dll

                    Filesize

                    553KB

                    MD5

                    6da7f4530edb350cf9d967d969ccecf8

                    SHA1

                    3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

                    SHA256

                    9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

                    SHA512

                    1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

                  • C:\Program Files\Windscribe\MSVCP140_1.dll

                    Filesize

                    23KB

                    MD5

                    0832532fab0d5c949aa0c65169aa9d61

                    SHA1

                    26f1bee679b7a6289b663c4fa4e65eba33a234e8

                    SHA256

                    8731a93e519c2595c9fd489e6d9ac07e964448c0da1c8ee9ee500a7989482617

                    SHA512

                    03147a59ee35fb3d2752d4c40741a39674ccd4474a575746bc574d2b2fae1fd04f5ab9c2e02b0dc6268fc6aee8fbb46dc4bf5ff23b5fcc4a0e9b847f57ca79d0

                  • C:\Program Files\Windscribe\Qt6Core.dll

                    Filesize

                    5.4MB

                    MD5

                    810662542c206d6fcb743b22be26a4a1

                    SHA1

                    d8465d53bf5e9d9be17130ee2879f8a6a4b5ab07

                    SHA256

                    4d04ca5c783b56977821387b25c6976843ac3dbe9da344d705e3019ad491517f

                    SHA512

                    d43d702dc8f7ed9fdadfb9e82c9aaa75f546f75a681bba8be45f35dbfae45da1d03c40b1bf11fb73e87030ec7c54fb81e06fe4126c5815bf14168fc14dfc7cd4

                  • C:\Program Files\Windscribe\Qt6Core.dll

                    Filesize

                    5.4MB

                    MD5

                    810662542c206d6fcb743b22be26a4a1

                    SHA1

                    d8465d53bf5e9d9be17130ee2879f8a6a4b5ab07

                    SHA256

                    4d04ca5c783b56977821387b25c6976843ac3dbe9da344d705e3019ad491517f

                    SHA512

                    d43d702dc8f7ed9fdadfb9e82c9aaa75f546f75a681bba8be45f35dbfae45da1d03c40b1bf11fb73e87030ec7c54fb81e06fe4126c5815bf14168fc14dfc7cd4

                  • C:\Program Files\Windscribe\Qt6Core5Compat.dll

                    Filesize

                    814KB

                    MD5

                    b08d2a888b1fef612c33039f454d668d

                    SHA1

                    cffb1b508600459c68d4f694ce51551bda315f53

                    SHA256

                    2858bfc330c64b653937d768d0b6e00e652b47cea1d7d42f3ff2db7f59cdfffb

                    SHA512

                    3efccb30455d8064d14ef98d8777be20ee796198db4d42f634439cc0b18123df166804c945a31f605f8e725a54d1b3b8c30d88890bf223b83e8b9b8eac750151

                  • C:\Program Files\Windscribe\Qt6Core5Compat.dll

                    Filesize

                    814KB

                    MD5

                    b08d2a888b1fef612c33039f454d668d

                    SHA1

                    cffb1b508600459c68d4f694ce51551bda315f53

                    SHA256

                    2858bfc330c64b653937d768d0b6e00e652b47cea1d7d42f3ff2db7f59cdfffb

                    SHA512

                    3efccb30455d8064d14ef98d8777be20ee796198db4d42f634439cc0b18123df166804c945a31f605f8e725a54d1b3b8c30d88890bf223b83e8b9b8eac750151

                  • C:\Program Files\Windscribe\Qt6Gui.dll

                    Filesize

                    7.2MB

                    MD5

                    3e474a9c2022407f68e53a8707c43a0f

                    SHA1

                    05cc00a87525001d1cc840a26f9ab7a8ffaeb4cb

                    SHA256

                    b293a4e5a73432b34b74f6047eb83a2301062aa5c37c1a7a8e8b266f4a9346ef

                    SHA512

                    6b595d4e0aec2e0b74ec4919d2b08ce8604e18927620ae1eb9f5d3cd3a9eb89f0b860cf53dc256455839ef438d7151931bd3b568b155fc10ec24a46e46016f13

                  • C:\Program Files\Windscribe\Qt6Gui.dll

                    Filesize

                    7.2MB

                    MD5

                    3e474a9c2022407f68e53a8707c43a0f

                    SHA1

                    05cc00a87525001d1cc840a26f9ab7a8ffaeb4cb

                    SHA256

                    b293a4e5a73432b34b74f6047eb83a2301062aa5c37c1a7a8e8b266f4a9346ef

                    SHA512

                    6b595d4e0aec2e0b74ec4919d2b08ce8604e18927620ae1eb9f5d3cd3a9eb89f0b860cf53dc256455839ef438d7151931bd3b568b155fc10ec24a46e46016f13

                  • C:\Program Files\Windscribe\Qt6Network.dll

                    Filesize

                    1.4MB

                    MD5

                    4b429615187bfcc469d4df92ebba1918

                    SHA1

                    d0c51a5e8e8a5b7dddc04abdb81a07823038783d

                    SHA256

                    76d4c36318f301783615ea238d58f7523dd811c299a75c66b18c52e311c55856

                    SHA512

                    1f9f6d9c7dcdff8dd189027bfd4f9df2a141a7c3f68737bceb57d68824e43c9272710ac9749f563ef4aa81fd54724f7c756249e6b0680aed3da7cdbba7067491

                  • C:\Program Files\Windscribe\Qt6Network.dll

                    Filesize

                    1.4MB

                    MD5

                    4b429615187bfcc469d4df92ebba1918

                    SHA1

                    d0c51a5e8e8a5b7dddc04abdb81a07823038783d

                    SHA256

                    76d4c36318f301783615ea238d58f7523dd811c299a75c66b18c52e311c55856

                    SHA512

                    1f9f6d9c7dcdff8dd189027bfd4f9df2a141a7c3f68737bceb57d68824e43c9272710ac9749f563ef4aa81fd54724f7c756249e6b0680aed3da7cdbba7067491

                  • C:\Program Files\Windscribe\Qt6Svg.dll

                    Filesize

                    352KB

                    MD5

                    53a7317fe3a2a3d65efa632613832647

                    SHA1

                    31d96658cc726f7c18c6bc16253b1c31181568ea

                    SHA256

                    040553e25037e715be71c6b7106e701406092d932aba29e8d00cfe22ebc3499e

                    SHA512

                    be3d902428700ecd4c15481b00787b36d246063ce265f66887f6d29935158b7c2f996a579af99db5d28be871be0bfd0b77c020c221e6e51ade7c85f9a70af329

                  • C:\Program Files\Windscribe\Qt6Svg.dll

                    Filesize

                    352KB

                    MD5

                    53a7317fe3a2a3d65efa632613832647

                    SHA1

                    31d96658cc726f7c18c6bc16253b1c31181568ea

                    SHA256

                    040553e25037e715be71c6b7106e701406092d932aba29e8d00cfe22ebc3499e

                    SHA512

                    be3d902428700ecd4c15481b00787b36d246063ce265f66887f6d29935158b7c2f996a579af99db5d28be871be0bfd0b77c020c221e6e51ade7c85f9a70af329

                  • C:\Program Files\Windscribe\Qt6Widgets.dll

                    Filesize

                    5.7MB

                    MD5

                    a4c2a7999942f52dd7f89c82c8bd82f3

                    SHA1

                    4a4dba97e84659a2a5feb5acbc294ca65283c768

                    SHA256

                    77206c28d16d2b8f8e4a436567fe6821f8d51f9dad33c9f62ba5fee41733d204

                    SHA512

                    622a673ce59915742bae8fa27215a809f63a7c844a98658cb0f65b42062fe738cb30a4c26cbc70c1125d2e28ed316439608c29ac7a4a02ae4e79e4494142a173

                  • C:\Program Files\Windscribe\Qt6Widgets.dll

                    Filesize

                    5.7MB

                    MD5

                    a4c2a7999942f52dd7f89c82c8bd82f3

                    SHA1

                    4a4dba97e84659a2a5feb5acbc294ca65283c768

                    SHA256

                    77206c28d16d2b8f8e4a436567fe6821f8d51f9dad33c9f62ba5fee41733d204

                    SHA512

                    622a673ce59915742bae8fa27215a809f63a7c844a98658cb0f65b42062fe738cb30a4c26cbc70c1125d2e28ed316439608c29ac7a4a02ae4e79e4494142a173

                  • C:\Program Files\Windscribe\VCRUNTIME140.dll

                    Filesize

                    95KB

                    MD5

                    f34eb034aa4a9735218686590cba2e8b

                    SHA1

                    2bc20acdcb201676b77a66fa7ec6b53fa2644713

                    SHA256

                    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                    SHA512

                    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                  • C:\Program Files\Windscribe\VCRUNTIME140_1.dll

                    Filesize

                    36KB

                    MD5

                    135359d350f72ad4bf716b764d39e749

                    SHA1

                    2e59d9bbcce356f0fece56c9c4917a5cacec63d7

                    SHA256

                    34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

                    SHA512

                    cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

                  • C:\Program Files\Windscribe\Windscribe.exe

                    Filesize

                    5.5MB

                    MD5

                    423476c801b7ee35e066e758276b904d

                    SHA1

                    a5bc2641a78e7991cce7f8c4ce94109930ad2268

                    SHA256

                    612ad77c2c26b8cfb51e3fe71730bc6797c381175ffa57439ef1d311bb82875d

                    SHA512

                    82dcb77d7109947a5b7132c2dc5c2bf260edc7f723e805a8e1bc02f196127886d04d7687019441cba47e08c3d9d680bd32270b3186178984a0d5c3c10b720944

                  • C:\Program Files\Windscribe\Windscribe.exe

                    Filesize

                    5.5MB

                    MD5

                    423476c801b7ee35e066e758276b904d

                    SHA1

                    a5bc2641a78e7991cce7f8c4ce94109930ad2268

                    SHA256

                    612ad77c2c26b8cfb51e3fe71730bc6797c381175ffa57439ef1d311bb82875d

                    SHA512

                    82dcb77d7109947a5b7132c2dc5c2bf260edc7f723e805a8e1bc02f196127886d04d7687019441cba47e08c3d9d680bd32270b3186178984a0d5c3c10b720944

                  • C:\Program Files\Windscribe\WindscribeLauncher.exe

                    Filesize

                    329KB

                    MD5

                    87055aecaf0fd21b32c276b9a296f133

                    SHA1

                    a1849caa6eeb2b83458881c336be84d2a5c346cb

                    SHA256

                    77cdad81d9e9c5b515230c8b1eebc2af2c09edfa6130768aec6df4b8d0e003b2

                    SHA512

                    f8fbd86670a2bd4db1b08eb7ecf35347f9e2fac886b7faab06e01eb4782b650adaa9ea506bb3d05611520efb14d15921f7dae2d7fe7f23f8633119faa197cc4b

                  • C:\Program Files\Windscribe\WindscribeLauncher.exe

                    Filesize

                    329KB

                    MD5

                    87055aecaf0fd21b32c276b9a296f133

                    SHA1

                    a1849caa6eeb2b83458881c336be84d2a5c346cb

                    SHA256

                    77cdad81d9e9c5b515230c8b1eebc2af2c09edfa6130768aec6df4b8d0e003b2

                    SHA512

                    f8fbd86670a2bd4db1b08eb7ecf35347f9e2fac886b7faab06e01eb4782b650adaa9ea506bb3d05611520efb14d15921f7dae2d7fe7f23f8633119faa197cc4b

                  • C:\Program Files\Windscribe\cares.dll

                    Filesize

                    213KB

                    MD5

                    cefca7a7494b32c43aa9f29d6d98837e

                    SHA1

                    1298b6298f912556a565bfd880e5dfc7e808e527

                    SHA256

                    0ca51b86740bfc116f43c8adffc0826a2311c80b889c35d8659fb2c512efd3a3

                    SHA512

                    c106ced195d5871d1eecfa30a5ad77ceae099a4f9b6fec0222332daeecebf1d5f25871ab4a687db9055cae410b34f86112820c28a4baf0405dfe85e8b1c0033a

                  • C:\Program Files\Windscribe\cares.dll

                    Filesize

                    213KB

                    MD5

                    cefca7a7494b32c43aa9f29d6d98837e

                    SHA1

                    1298b6298f912556a565bfd880e5dfc7e808e527

                    SHA256

                    0ca51b86740bfc116f43c8adffc0826a2311c80b889c35d8659fb2c512efd3a3

                    SHA512

                    c106ced195d5871d1eecfa30a5ad77ceae099a4f9b6fec0222332daeecebf1d5f25871ab4a687db9055cae410b34f86112820c28a4baf0405dfe85e8b1c0033a

                  • C:\Program Files\Windscribe\libcrypto-1_1-x64.dll

                    Filesize

                    2.7MB

                    MD5

                    36846b5d42bfb8ad2f11ed0fc5b50876

                    SHA1

                    fd73bbba4c8ee30d6ef6f3d5ce6f98135dbf5412

                    SHA256

                    ce896e9c01bc34843bac4aa5aa5badad82a240f393627958e1cc44ac0755316d

                    SHA512

                    cae0d84d9ba529027f9fcb13fd49f83f220c6cf73350d79bd7b8f4c1fe8f3485883124e840339031e7626086baf0b40054a3c457a7ea7dd1ff3abba194e18f7f

                  • C:\Program Files\Windscribe\libcrypto-1_1-x64.dll

                    Filesize

                    2.7MB

                    MD5

                    36846b5d42bfb8ad2f11ed0fc5b50876

                    SHA1

                    fd73bbba4c8ee30d6ef6f3d5ce6f98135dbf5412

                    SHA256

                    ce896e9c01bc34843bac4aa5aa5badad82a240f393627958e1cc44ac0755316d

                    SHA512

                    cae0d84d9ba529027f9fcb13fd49f83f220c6cf73350d79bd7b8f4c1fe8f3485883124e840339031e7626086baf0b40054a3c457a7ea7dd1ff3abba194e18f7f

                  • C:\Program Files\Windscribe\libcurl.dll

                    Filesize

                    484KB

                    MD5

                    86b0e373384f593fd83a312efba7ca8f

                    SHA1

                    36a352f0b0658d359af10396df4287360b629d72

                    SHA256

                    41be6574b16c357298c07c556af8992ecdf11d2fe3688cfbf5eb2d3c1e46ae4f

                    SHA512

                    eacf846381e8f117e1868fa4606adbc5a1203c1b3b9e059e056f04176677965f94409a3a755ab9948f6fa16c0b4dcaae03008468907a513f35732fbb61967a67

                  • C:\Program Files\Windscribe\libcurl.dll

                    Filesize

                    484KB

                    MD5

                    86b0e373384f593fd83a312efba7ca8f

                    SHA1

                    36a352f0b0658d359af10396df4287360b629d72

                    SHA256

                    41be6574b16c357298c07c556af8992ecdf11d2fe3688cfbf5eb2d3c1e46ae4f

                    SHA512

                    eacf846381e8f117e1868fa4606adbc5a1203c1b3b9e059e056f04176677965f94409a3a755ab9948f6fa16c0b4dcaae03008468907a513f35732fbb61967a67

                  • C:\Program Files\Windscribe\libssl-1_1-x64.dll

                    Filesize

                    679KB

                    MD5

                    864b237c026048ac618d4bb2eba28aaa

                    SHA1

                    4c145e752b38fbba9f375f1b44cd60b70369bda5

                    SHA256

                    8a9aa07e4ba061573e252e45732df02775c78506738bdccfd9f30e7ef9dc9655

                    SHA512

                    195c4e8cde3e5daea7700f784fcff67b66fd341474ab981362568a12691ca66542864e59a479c05f2fce83f8520081b78e287736babb72eced2d06ec5d0133a7

                  • C:\Program Files\Windscribe\libssl-1_1-x64.dll

                    Filesize

                    679KB

                    MD5

                    864b237c026048ac618d4bb2eba28aaa

                    SHA1

                    4c145e752b38fbba9f375f1b44cd60b70369bda5

                    SHA256

                    8a9aa07e4ba061573e252e45732df02775c78506738bdccfd9f30e7ef9dc9655

                    SHA512

                    195c4e8cde3e5daea7700f784fcff67b66fd341474ab981362568a12691ca66542864e59a479c05f2fce83f8520081b78e287736babb72eced2d06ec5d0133a7

                  • C:\Program Files\Windscribe\msvcp140.dll

                    Filesize

                    553KB

                    MD5

                    6da7f4530edb350cf9d967d969ccecf8

                    SHA1

                    3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

                    SHA256

                    9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

                    SHA512

                    1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

                  • C:\Program Files\Windscribe\msvcp140_1.dll

                    Filesize

                    23KB

                    MD5

                    0832532fab0d5c949aa0c65169aa9d61

                    SHA1

                    26f1bee679b7a6289b663c4fa4e65eba33a234e8

                    SHA256

                    8731a93e519c2595c9fd489e6d9ac07e964448c0da1c8ee9ee500a7989482617

                    SHA512

                    03147a59ee35fb3d2752d4c40741a39674ccd4474a575746bc574d2b2fae1fd04f5ab9c2e02b0dc6268fc6aee8fbb46dc4bf5ff23b5fcc4a0e9b847f57ca79d0

                  • C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf

                    Filesize

                    1KB

                    MD5

                    29eceac8c34357624a1517c7d7013ef9

                    SHA1

                    d07447b098c07f119be11de37ade8d95a9ad6bec

                    SHA256

                    b1f52a014cc72cdafc97f325f420c88e835c6a0f8eb8b8881bcad9e85aa9b648

                    SHA512

                    cba0a5bf1832fcc6268fa6d3d159980e8c27e6a4f6b3004678daad9ed6a8908528b0255e0096883fe845a3e909b794c2af5c78ac1cf84e020081f135988b5eb1

                  • C:\Program Files\Windscribe\subinacl.exe

                    Filesize

                    292KB

                    MD5

                    f933eb373fcd096535064d73e3ebedb1

                    SHA1

                    8e5242ffab6615c51ba3902dbb4427f774731eb6

                    SHA256

                    724ef5480cbc2133e2b19d1edd994499756bdb4c92842bc2ab0c9ee441cab492

                    SHA512

                    7963d2fe9cd325ad77213c452ca98412e311da67574fdfbe17fb26c65e4a5dfc8112ed8046e4c7812e1069a790e2e40ef2b5168f51b72e34482336d6b5b0267f

                  • C:\Program Files\Windscribe\subinacl.exe

                    Filesize

                    292KB

                    MD5

                    f933eb373fcd096535064d73e3ebedb1

                    SHA1

                    8e5242ffab6615c51ba3902dbb4427f774731eb6

                    SHA256

                    724ef5480cbc2133e2b19d1edd994499756bdb4c92842bc2ab0c9ee441cab492

                    SHA512

                    7963d2fe9cd325ad77213c452ca98412e311da67574fdfbe17fb26c65e4a5dfc8112ed8046e4c7812e1069a790e2e40ef2b5168f51b72e34482336d6b5b0267f

                  • C:\Program Files\Windscribe\tap\OemVista.inf

                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                  • C:\Program Files\Windscribe\tap\tapinstall.exe

                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                  • C:\Program Files\Windscribe\tap\tapinstall.exe

                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                  • C:\Program Files\Windscribe\vcruntime140.dll

                    Filesize

                    95KB

                    MD5

                    f34eb034aa4a9735218686590cba2e8b

                    SHA1

                    2bc20acdcb201676b77a66fa7ec6b53fa2644713

                    SHA256

                    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                    SHA512

                    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                  • C:\Program Files\Windscribe\vcruntime140.dll

                    Filesize

                    95KB

                    MD5

                    f34eb034aa4a9735218686590cba2e8b

                    SHA1

                    2bc20acdcb201676b77a66fa7ec6b53fa2644713

                    SHA256

                    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                    SHA512

                    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                  • C:\Program Files\Windscribe\vcruntime140_1.dll

                    Filesize

                    36KB

                    MD5

                    135359d350f72ad4bf716b764d39e749

                    SHA1

                    2e59d9bbcce356f0fece56c9c4917a5cacec63d7

                    SHA256

                    34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

                    SHA512

                    cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

                  • C:\Program Files\Windscribe\wintun\tapinstall.exe

                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                  • C:\Program Files\Windscribe\wintun\tapinstall.exe

                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                  • C:\Program Files\Windscribe\wintun\windtun420.inf

                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                  • C:\Program Files\Windscribe\ws_com.dll

                    Filesize

                    444KB

                    MD5

                    c3ba9a97f27c4b76149c4b10aea9a7a9

                    SHA1

                    2f43e443fdad83c39124c9ab161fe31fbc3347af

                    SHA256

                    cae0987b7a4906f80199b2768166c44877ef4f90280cea859dc4b41462b14b7a

                    SHA512

                    59a820a2bc8098c199b523d3fdd178669f9fd84c6a698a421e9e8246844d04e0694e3bea35b8352c611050210a675f4343580911a20c1047a00190e3f724763c

                  • C:\Program Files\Windscribe\ws_proxy_stub.dll

                    Filesize

                    101KB

                    MD5

                    09cc99317316ebbd5816286e23d3c096

                    SHA1

                    28c8ab9ee0bbe6f3be77dc47d91837d98f81a669

                    SHA256

                    38dc7470535b266471ae05c38f5b55fc0aaf5994bb1a01b1b8495d983111ec97

                    SHA512

                    70f6828b1f7f017641f275bef04a4d8dcc17651af37a343ea0761a3bcabe99e63b3d0ecff544516f27aa2c880faf79de9e22d906cd4318c4289c09719d4e2a65

                  • C:\Program Files\Windscribe\zlib1.dll

                    Filesize

                    93KB

                    MD5

                    28f031f0b70073e2ad4160749756d05e

                    SHA1

                    f603dea4bdffefc397d04aa5fb6dd0cb0db33a32

                    SHA256

                    3f15afc28c36ea185a0d6525bbd2ec6decdc9e14452c18a7366baa3fe3170f72

                    SHA512

                    225139d562dc052dbd641928f44ea9a3a71b8e06e3274d7f902631fd95bd79738ea74012839097d440dfbbcbdccf23e6d4f689bffc40fb9c0321e879e82bc226

                  • C:\Program Files\Windscribe\zlib1.dll

                    Filesize

                    93KB

                    MD5

                    28f031f0b70073e2ad4160749756d05e

                    SHA1

                    f603dea4bdffefc397d04aa5fb6dd0cb0db33a32

                    SHA256

                    3f15afc28c36ea185a0d6525bbd2ec6decdc9e14452c18a7366baa3fe3170f72

                    SHA512

                    225139d562dc052dbd641928f44ea9a3a71b8e06e3274d7f902631fd95bd79738ea74012839097d440dfbbcbdccf23e6d4f689bffc40fb9c0321e879e82bc226

                  • C:\Users\Admin\AppData\Local\Temp\{62E2E~1\tapwindscribe0901.cat

                    Filesize

                    10KB

                    MD5

                    18ef4501d1f4acb8de464796cb2780b5

                    SHA1

                    7e76c6703081ac711ac75c36616c4fc38fdee3e2

                    SHA256

                    7a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86

                    SHA512

                    bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff

                  • C:\Users\Admin\AppData\Local\Temp\{62E2E~1\tapwindscribe0901.sys

                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                  • C:\Users\Admin\AppData\Local\Temp\{62e2efd4-970a-ef4b-9880-f97241090b21}\oemvista.inf

                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                  • C:\Users\Admin\AppData\Local\Temp\{EF68A~1\windtun420.cat

                    Filesize

                    10KB

                    MD5

                    4d00baa194a2e39eaa0d9aa32bff8f04

                    SHA1

                    a7d501754bb5d570a95c46ff1df6ad3cbce867fb

                    SHA256

                    4e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b

                    SHA512

                    594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670

                  • C:\Users\Admin\AppData\Local\Temp\{EF68A~1\windtun420.sys

                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                  • C:\Users\Admin\AppData\Local\Temp\{ef68a0a7-7c44-1d47-bbe9-74600d911bb0}\windtun420.inf

                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                  • C:\Windows\INF\oem2.inf

                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                  • C:\Windows\INF\oem3.inf

                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                  • C:\Windows\System32\CatRoot2\dberr.txt

                    Filesize

                    148KB

                    MD5

                    533838b44d248ad0b46293b5580f5ec7

                    SHA1

                    b914ac64c8dc80404ee439bd7a850731c96658f9

                    SHA256

                    3c0a398ab8837af3c8bed05a896b512ed0b56e4a4f24affc1eda53f868257a80

                    SHA512

                    41ee7d065a82bb8c0b535314e7dba5496c6f246a8e03cbe4a021363fbd46f8a7a24296523bb4156064f281754b9a3b446aeb0c69b0bba03d9ef7f9fe5a9a6c09

                  • C:\Windows\System32\DriverStore\FileRepository\OEMVIS~1.INF\tapwindscribe0901.sys

                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                  • C:\Windows\System32\DriverStore\FileRepository\WINDTU~1.INF\windtun420.sys

                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                  • C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_2c4931cd70af38ac\oemvista.inf

                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                  • C:\Windows\System32\DriverStore\FileRepository\windtun420.inf_amd64_fef6efb45cfbe4be\windtun420.inf

                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                  • \??\c:\PROGRA~1\WINDSC~1\tap\TAPWIN~1.SYS

                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                  • \??\c:\PROGRA~1\WINDSC~1\wintun\WINDTU~1.SYS

                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                  • \??\c:\program files\windscribe\tap\tapwindscribe0901.cat

                    Filesize

                    10KB

                    MD5

                    18ef4501d1f4acb8de464796cb2780b5

                    SHA1

                    7e76c6703081ac711ac75c36616c4fc38fdee3e2

                    SHA256

                    7a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86

                    SHA512

                    bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff

                  • \??\c:\program files\windscribe\wintun\windtun420.cat

                    Filesize

                    10KB

                    MD5

                    4d00baa194a2e39eaa0d9aa32bff8f04

                    SHA1

                    a7d501754bb5d570a95c46ff1df6ad3cbce867fb

                    SHA256

                    4e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b

                    SHA512

                    594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670

                  • memory/804-210-0x00007FFF589B0000-0x00007FFF58F6F000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/804-209-0x00007FF7122B0000-0x00007FF71282F000-memory.dmp

                    Filesize

                    5.5MB

                  • memory/804-221-0x0000019D16E00000-0x0000019D17544000-memory.dmp

                    Filesize

                    7.3MB

                  • memory/804-212-0x0000019D16E00000-0x0000019D17544000-memory.dmp

                    Filesize

                    7.3MB