Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
89s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2023, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
Windscribe_2.5.18.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Windscribe_2.5.18.exe
Resource
win10v2004-20221111-en
General
-
Target
Windscribe_2.5.18.exe
-
Size
18.8MB
-
MD5
5729d7f8fff698e46f35abc7d904ece9
-
SHA1
7017eb70ff16eeaf91e9e9f7d60b938f83fb0169
-
SHA256
a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475
-
SHA512
e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7
-
SSDEEP
393216:aaeuojgBv0B53Y6dwzrR0ncZutc6RDHqgu3LO4QK+N2ubT1EPIg9z5sc:aaHHBMB5I62inUbgua1jN201tksc
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Drops file in Drivers directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETEF56.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\windtun420.sys DrvInst.exe File created C:\Windows\system32\DRIVERS\SETF66B.tmp rundll32.exe File opened for modification C:\Windows\system32\DRIVERS\WindscribeSplitTunnel.sys rundll32.exe File created C:\Windows\System32\drivers\SETEF56.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tapwindscribe0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETF4B5.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETF4B5.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\SETF66B.tmp rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WindscribeService\ImagePath = "\"C:\\Program Files\\Windscribe\\WindscribeService.exe\"" Windscribe_2.5.18.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation Windscribe.exe -
Executes dropped EXE 7 IoCs
pid Process 3076 subinacl.exe 2904 tapinstall.exe 4896 tapinstall.exe 1696 WindscribeLauncher.exe 804 Windscribe.exe 4520 windscribeopenvpn_2_5_4.exe 3720 WindscribeService.exe -
Loads dropped DLL 31 IoCs
pid Process 4224 Windscribe_2.5.18.exe 4224 Windscribe_2.5.18.exe 1696 WindscribeLauncher.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 4520 windscribeopenvpn_2_5_4.exe 4520 windscribeopenvpn_2_5_4.exe 4520 windscribeopenvpn_2_5_4.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe -
Registers COM server for autorun 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InProcServer32 Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InProcServer32\ = "C:\\Program Files\\Windscribe\\ws_proxy_stub.dll" Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InProcServer32\ThreadingModel = "Both" Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InprocServer32 Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalServer32 Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalServer32\ = "C:\\Program Files\\Windscribe\\ws_com_server.exe" Windscribe_2.5.18.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\SETEAF3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\tapwindscribe0901.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 WindscribeService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CA1C2707CF388B18A492F7B630F8727E WindscribeService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\SETEAF2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\SETF2F0.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\SETF2F0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 WindscribeService.exe File created C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\SETEAE2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_2c4931cd70af38ac\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\SETF2F1.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\SETF2F1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\windtun420.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\SETF2F2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\windtun420.inf_amd64_fef6efb45cfbe4be\windtun420.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\windtun420.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CA1C2707CF388B18A492F7B630F8727E WindscribeService.exe File created C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\SETEAF3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\oemvista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\SETEAF2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\tapwindscribe0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_2c4931cd70af38ac\tapwindscribe0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\windtun420.inf_amd64_fef6efb45cfbe4be\windtun420.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\windtun420.inf_amd64_fef6efb45cfbe4be\windtun420.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{63f23aca-471b-2e42-85a3-a0e5db701ed6}\SETEAE2.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\windtun420.inf_amd64_fef6efb45cfbe4be\windtun420.PNF tapinstall.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_2c4931cd70af38ac\oemvista.PNF tapinstall.exe File created C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\SETF2F2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5b9d4c3f-41d5-b842-bfa2-9d1734ae7a53}\windtun420.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_2c4931cd70af38ac\tapwindscribe0901.sys DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windscribe\api-ms-win-core-util-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\networkinformation\qnetworklistmanager.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\msvcp140_1.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\tls\qopensslbackend.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\log_installer.txt Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-convert-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-filesystem-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-utility-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\imageformats\qico.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\imageformats\qgif.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\styles\qwindowsvistastyle.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\subinacl.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-memory-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-synch-l1-2-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-locale-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-time-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\tap\tapinstall.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\vcruntime140.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\windscribeservice.log WindscribeService.exe File created C:\Program Files\Windscribe\vcruntime140_1.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\wireguard.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\ws_com.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\ws_proxy_stub.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-console-l1-2-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-processthreads-l1-1-1.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\concrt140.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\libcrypto-1_1-x64.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-namedpipe-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\Qt6Gui.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-profile-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-sysinfo-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\cares.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\tunnel.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\wintun\windtun420.cat Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\wintun\windtun420.inf Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-file-l2-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-localization-l1-2-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\windscribe-cli.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\wintun\windtun420.sys Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\WireguardService.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\zlib1.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\wintun\tapinstall.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\wstunnel.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-errorhandling-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-heap-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-string-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\libssl-1_1-x64.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\ChangeIcs.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\platforms\qwindows.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\ucrtbase.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\uninstall.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\open_source_licenses.txt Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-handle-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-string-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-crt-math-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\WindscribeService.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\ws_com_server.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-datetime-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-heap-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-synch-l1-1-0.dll Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\WindscribeInstallHelper.exe Windscribe_2.5.18.exe File created C:\Program Files\Windscribe\api-ms-win-core-timezone-l1-1-0.dll Windscribe_2.5.18.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5100 sc.exe 3400 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Kills process with taskkill 1 IoCs
pid Process 4884 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WindscribeService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe -
Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B} Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ProxyStubClsid32\ = "{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}" Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\NumMethods Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\ = "PSFactoryBuffer" Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B} Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InProcServer32\ = "C:\\Program Files\\Windscribe\\ws_proxy_stub.dll" Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InProcServer32\ThreadingModel = "Both" Windscribe_2.5.18.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Interface Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B} Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\NumMethods\ = "3" Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\ = "Windscribe CAuthHelper" Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalizedString = "@C:\\Program Files\\Windscribe\\ws_com.dll,-101" Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InprocServer32 Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalServer32 Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\Elevation Windscribe_2.5.18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\Elevation\Enabled = "1" Windscribe_2.5.18.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InProcServer32 Windscribe_2.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ProxyStubClsid32 Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ = "IAuthHelper" Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalServer32\ = "C:\\Program Files\\Windscribe\\ws_com_server.exe" Windscribe_2.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\Elevation\IconReference = "@C:\\Program Files\\Windscribe\\ws_com.dll,-102" Windscribe_2.5.18.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Windscribe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Windscribe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Windscribe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Windscribe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Windscribe.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 804 Windscribe.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 804 Windscribe.exe 804 Windscribe.exe 3200 msedge.exe 3200 msedge.exe 4444 msedge.exe 4444 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 804 Windscribe.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4444 msedge.exe 4444 msedge.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeSecurityPrivilege 3076 subinacl.exe Token: SeBackupPrivilege 3076 subinacl.exe Token: SeRestorePrivilege 3076 subinacl.exe Token: SeRestorePrivilege 3076 subinacl.exe Token: SeTakeOwnershipPrivilege 3076 subinacl.exe Token: SeChangeNotifyPrivilege 3076 subinacl.exe Token: SeDebugPrivilege 3076 subinacl.exe Token: SeAuditPrivilege 4260 svchost.exe Token: SeSecurityPrivilege 4260 svchost.exe Token: SeLoadDriverPrivilege 2904 tapinstall.exe Token: SeRestorePrivilege 612 DrvInst.exe Token: SeBackupPrivilege 612 DrvInst.exe Token: SeLoadDriverPrivilege 612 DrvInst.exe Token: SeLoadDriverPrivilege 612 DrvInst.exe Token: SeLoadDriverPrivilege 612 DrvInst.exe Token: SeLoadDriverPrivilege 4896 tapinstall.exe Token: SeRestorePrivilege 3252 DrvInst.exe Token: SeBackupPrivilege 3252 DrvInst.exe Token: SeLoadDriverPrivilege 3252 DrvInst.exe Token: SeLoadDriverPrivilege 3252 DrvInst.exe Token: SeLoadDriverPrivilege 3252 DrvInst.exe Token: SeDebugPrivilege 4884 taskkill.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 4444 msedge.exe 804 Windscribe.exe 4444 msedge.exe 4444 msedge.exe 804 Windscribe.exe 4444 msedge.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe 804 Windscribe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4224 wrote to memory of 5100 4224 Windscribe_2.5.18.exe 90 PID 4224 wrote to memory of 5100 4224 Windscribe_2.5.18.exe 90 PID 4224 wrote to memory of 3400 4224 Windscribe_2.5.18.exe 92 PID 4224 wrote to memory of 3400 4224 Windscribe_2.5.18.exe 92 PID 4224 wrote to memory of 3076 4224 Windscribe_2.5.18.exe 94 PID 4224 wrote to memory of 3076 4224 Windscribe_2.5.18.exe 94 PID 4224 wrote to memory of 3076 4224 Windscribe_2.5.18.exe 94 PID 4224 wrote to memory of 2904 4224 Windscribe_2.5.18.exe 96 PID 4224 wrote to memory of 2904 4224 Windscribe_2.5.18.exe 96 PID 4260 wrote to memory of 3216 4260 svchost.exe 99 PID 4260 wrote to memory of 3216 4260 svchost.exe 99 PID 4260 wrote to memory of 612 4260 svchost.exe 100 PID 4260 wrote to memory of 612 4260 svchost.exe 100 PID 4224 wrote to memory of 4896 4224 Windscribe_2.5.18.exe 103 PID 4224 wrote to memory of 4896 4224 Windscribe_2.5.18.exe 103 PID 4260 wrote to memory of 4584 4260 svchost.exe 105 PID 4260 wrote to memory of 4584 4260 svchost.exe 105 PID 4260 wrote to memory of 3252 4260 svchost.exe 106 PID 4260 wrote to memory of 3252 4260 svchost.exe 106 PID 4224 wrote to memory of 3608 4224 Windscribe_2.5.18.exe 107 PID 4224 wrote to memory of 3608 4224 Windscribe_2.5.18.exe 107 PID 3608 wrote to memory of 3132 3608 rundll32.exe 108 PID 3608 wrote to memory of 3132 3608 rundll32.exe 108 PID 3132 wrote to memory of 4824 3132 runonce.exe 109 PID 3132 wrote to memory of 4824 3132 runonce.exe 109 PID 1696 wrote to memory of 804 1696 WindscribeLauncher.exe 113 PID 1696 wrote to memory of 804 1696 WindscribeLauncher.exe 113 PID 804 wrote to memory of 4520 804 Windscribe.exe 115 PID 804 wrote to memory of 4520 804 Windscribe.exe 115 PID 3720 wrote to memory of 4884 3720 WindscribeService.exe 120 PID 3720 wrote to memory of 4884 3720 WindscribeService.exe 120 PID 804 wrote to memory of 4444 804 Windscribe.exe 122 PID 804 wrote to memory of 4444 804 Windscribe.exe 122 PID 4444 wrote to memory of 4588 4444 msedge.exe 123 PID 4444 wrote to memory of 4588 4444 msedge.exe 123 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124 PID 4444 wrote to memory of 1280 4444 msedge.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windscribe_2.5.18.exe"C:\Users\Admin\AppData\Local\Temp\Windscribe_2.5.18.exe"1⤵
- Sets service image path in registry
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SYSTEM32\sc.exe"sc" create WindscribeService binPath= "C:\Program Files\Windscribe\WindscribeService.exe" start= auto2⤵
- Launches sc.exe
PID:5100
-
-
C:\Windows\SYSTEM32\sc.exe"sc" description WindscribeService "Manages the firewall and controls the VPN tunnel"2⤵
- Launches sc.exe
PID:3400
-
-
C:\Program Files\Windscribe\subinacl.exe"C:\Program Files\Windscribe\subinacl" /SERVICE WindscribeService /grant=S-1-5-11=STO2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Program Files\Windscribe\tap\tapinstall.exe"C:\Program Files\Windscribe\tap\tapinstall.exe" install OemVista.inf tapwindscribe09012⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Program Files\Windscribe\wintun\tapinstall.exe"C:\Program Files\Windscribe\wintun\tapinstall.exe" install windtun420.inf windtun4202⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:4824
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{62e2efd4-970a-ef4b-9880-f97241090b21}\oemvista.inf" "9" "40e41e9d3" "0000000000000148" "WinSta0\Default" "0000000000000140" "208" "c:\program files\windscribe\tap"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3216
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tapwindscribe0901.ndi:9.24.2.601:tapwindscribe0901," "40e41e9d3" "0000000000000178"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ef68a0a7-7c44-1d47-bbe9-74600d911bb0}\windtun420.inf" "9" "4fd9b412f" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "c:\program files\windscribe\wintun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4584
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:f101f9793a5fdf02:Windtun420.Install:0.9.0.0:windtun420," "4fd9b412f" "000000000000014C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Program Files\Windscribe\WindscribeLauncher.exe"C:\Program Files\Windscribe\WindscribeLauncher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files\Windscribe\Windscribe.exe"C:\Program Files\Windscribe\Windscribe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe"C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/signup?cpid=app_windows3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7fff59ca46f8,0x7fff59ca4708,0x7fff59ca47184⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:24⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:84⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:14⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:14⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,16516274252629344510,12665950056980366451,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5252 /prefetch:84⤵PID:2104
-
-
-
-
C:\Program Files\Windscribe\WindscribeService.exe"C:\Program Files\Windscribe\WindscribeService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\taskkill.exetaskkill /f /t /im windscribeopenvpn_2_5_4.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD51ba24e35575d93b69f8360cd746cda79
SHA118b0b826a0f58d4516a84c4e78a0acc38c1c268c
SHA25624d6796707101b425226ad85f43a0fac921ba3f25c6129061781edd172bec095
SHA512c85e17e3178fc98ee3a1f1c3e619910fd76a7081ed41c24c4622e01d09993cd8f68b7eea358c0141d01ec24e08cb8d923a7b5c7c6213b9eff3262c2534848410
-
Filesize
553KB
MD56da7f4530edb350cf9d967d969ccecf8
SHA13e2681ea91f60a7a9ef2407399d13c1ca6aa71e9
SHA2569fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
SHA5121f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab
-
Filesize
23KB
MD50832532fab0d5c949aa0c65169aa9d61
SHA126f1bee679b7a6289b663c4fa4e65eba33a234e8
SHA2568731a93e519c2595c9fd489e6d9ac07e964448c0da1c8ee9ee500a7989482617
SHA51203147a59ee35fb3d2752d4c40741a39674ccd4474a575746bc574d2b2fae1fd04f5ab9c2e02b0dc6268fc6aee8fbb46dc4bf5ff23b5fcc4a0e9b847f57ca79d0
-
Filesize
5.4MB
MD5810662542c206d6fcb743b22be26a4a1
SHA1d8465d53bf5e9d9be17130ee2879f8a6a4b5ab07
SHA2564d04ca5c783b56977821387b25c6976843ac3dbe9da344d705e3019ad491517f
SHA512d43d702dc8f7ed9fdadfb9e82c9aaa75f546f75a681bba8be45f35dbfae45da1d03c40b1bf11fb73e87030ec7c54fb81e06fe4126c5815bf14168fc14dfc7cd4
-
Filesize
5.4MB
MD5810662542c206d6fcb743b22be26a4a1
SHA1d8465d53bf5e9d9be17130ee2879f8a6a4b5ab07
SHA2564d04ca5c783b56977821387b25c6976843ac3dbe9da344d705e3019ad491517f
SHA512d43d702dc8f7ed9fdadfb9e82c9aaa75f546f75a681bba8be45f35dbfae45da1d03c40b1bf11fb73e87030ec7c54fb81e06fe4126c5815bf14168fc14dfc7cd4
-
Filesize
814KB
MD5b08d2a888b1fef612c33039f454d668d
SHA1cffb1b508600459c68d4f694ce51551bda315f53
SHA2562858bfc330c64b653937d768d0b6e00e652b47cea1d7d42f3ff2db7f59cdfffb
SHA5123efccb30455d8064d14ef98d8777be20ee796198db4d42f634439cc0b18123df166804c945a31f605f8e725a54d1b3b8c30d88890bf223b83e8b9b8eac750151
-
Filesize
814KB
MD5b08d2a888b1fef612c33039f454d668d
SHA1cffb1b508600459c68d4f694ce51551bda315f53
SHA2562858bfc330c64b653937d768d0b6e00e652b47cea1d7d42f3ff2db7f59cdfffb
SHA5123efccb30455d8064d14ef98d8777be20ee796198db4d42f634439cc0b18123df166804c945a31f605f8e725a54d1b3b8c30d88890bf223b83e8b9b8eac750151
-
Filesize
7.2MB
MD53e474a9c2022407f68e53a8707c43a0f
SHA105cc00a87525001d1cc840a26f9ab7a8ffaeb4cb
SHA256b293a4e5a73432b34b74f6047eb83a2301062aa5c37c1a7a8e8b266f4a9346ef
SHA5126b595d4e0aec2e0b74ec4919d2b08ce8604e18927620ae1eb9f5d3cd3a9eb89f0b860cf53dc256455839ef438d7151931bd3b568b155fc10ec24a46e46016f13
-
Filesize
7.2MB
MD53e474a9c2022407f68e53a8707c43a0f
SHA105cc00a87525001d1cc840a26f9ab7a8ffaeb4cb
SHA256b293a4e5a73432b34b74f6047eb83a2301062aa5c37c1a7a8e8b266f4a9346ef
SHA5126b595d4e0aec2e0b74ec4919d2b08ce8604e18927620ae1eb9f5d3cd3a9eb89f0b860cf53dc256455839ef438d7151931bd3b568b155fc10ec24a46e46016f13
-
Filesize
1.4MB
MD54b429615187bfcc469d4df92ebba1918
SHA1d0c51a5e8e8a5b7dddc04abdb81a07823038783d
SHA25676d4c36318f301783615ea238d58f7523dd811c299a75c66b18c52e311c55856
SHA5121f9f6d9c7dcdff8dd189027bfd4f9df2a141a7c3f68737bceb57d68824e43c9272710ac9749f563ef4aa81fd54724f7c756249e6b0680aed3da7cdbba7067491
-
Filesize
1.4MB
MD54b429615187bfcc469d4df92ebba1918
SHA1d0c51a5e8e8a5b7dddc04abdb81a07823038783d
SHA25676d4c36318f301783615ea238d58f7523dd811c299a75c66b18c52e311c55856
SHA5121f9f6d9c7dcdff8dd189027bfd4f9df2a141a7c3f68737bceb57d68824e43c9272710ac9749f563ef4aa81fd54724f7c756249e6b0680aed3da7cdbba7067491
-
Filesize
352KB
MD553a7317fe3a2a3d65efa632613832647
SHA131d96658cc726f7c18c6bc16253b1c31181568ea
SHA256040553e25037e715be71c6b7106e701406092d932aba29e8d00cfe22ebc3499e
SHA512be3d902428700ecd4c15481b00787b36d246063ce265f66887f6d29935158b7c2f996a579af99db5d28be871be0bfd0b77c020c221e6e51ade7c85f9a70af329
-
Filesize
352KB
MD553a7317fe3a2a3d65efa632613832647
SHA131d96658cc726f7c18c6bc16253b1c31181568ea
SHA256040553e25037e715be71c6b7106e701406092d932aba29e8d00cfe22ebc3499e
SHA512be3d902428700ecd4c15481b00787b36d246063ce265f66887f6d29935158b7c2f996a579af99db5d28be871be0bfd0b77c020c221e6e51ade7c85f9a70af329
-
Filesize
5.7MB
MD5a4c2a7999942f52dd7f89c82c8bd82f3
SHA14a4dba97e84659a2a5feb5acbc294ca65283c768
SHA25677206c28d16d2b8f8e4a436567fe6821f8d51f9dad33c9f62ba5fee41733d204
SHA512622a673ce59915742bae8fa27215a809f63a7c844a98658cb0f65b42062fe738cb30a4c26cbc70c1125d2e28ed316439608c29ac7a4a02ae4e79e4494142a173
-
Filesize
5.7MB
MD5a4c2a7999942f52dd7f89c82c8bd82f3
SHA14a4dba97e84659a2a5feb5acbc294ca65283c768
SHA25677206c28d16d2b8f8e4a436567fe6821f8d51f9dad33c9f62ba5fee41733d204
SHA512622a673ce59915742bae8fa27215a809f63a7c844a98658cb0f65b42062fe738cb30a4c26cbc70c1125d2e28ed316439608c29ac7a4a02ae4e79e4494142a173
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
36KB
MD5135359d350f72ad4bf716b764d39e749
SHA12e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA25634048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
-
Filesize
5.5MB
MD5423476c801b7ee35e066e758276b904d
SHA1a5bc2641a78e7991cce7f8c4ce94109930ad2268
SHA256612ad77c2c26b8cfb51e3fe71730bc6797c381175ffa57439ef1d311bb82875d
SHA51282dcb77d7109947a5b7132c2dc5c2bf260edc7f723e805a8e1bc02f196127886d04d7687019441cba47e08c3d9d680bd32270b3186178984a0d5c3c10b720944
-
Filesize
5.5MB
MD5423476c801b7ee35e066e758276b904d
SHA1a5bc2641a78e7991cce7f8c4ce94109930ad2268
SHA256612ad77c2c26b8cfb51e3fe71730bc6797c381175ffa57439ef1d311bb82875d
SHA51282dcb77d7109947a5b7132c2dc5c2bf260edc7f723e805a8e1bc02f196127886d04d7687019441cba47e08c3d9d680bd32270b3186178984a0d5c3c10b720944
-
Filesize
329KB
MD587055aecaf0fd21b32c276b9a296f133
SHA1a1849caa6eeb2b83458881c336be84d2a5c346cb
SHA25677cdad81d9e9c5b515230c8b1eebc2af2c09edfa6130768aec6df4b8d0e003b2
SHA512f8fbd86670a2bd4db1b08eb7ecf35347f9e2fac886b7faab06e01eb4782b650adaa9ea506bb3d05611520efb14d15921f7dae2d7fe7f23f8633119faa197cc4b
-
Filesize
329KB
MD587055aecaf0fd21b32c276b9a296f133
SHA1a1849caa6eeb2b83458881c336be84d2a5c346cb
SHA25677cdad81d9e9c5b515230c8b1eebc2af2c09edfa6130768aec6df4b8d0e003b2
SHA512f8fbd86670a2bd4db1b08eb7ecf35347f9e2fac886b7faab06e01eb4782b650adaa9ea506bb3d05611520efb14d15921f7dae2d7fe7f23f8633119faa197cc4b
-
Filesize
213KB
MD5cefca7a7494b32c43aa9f29d6d98837e
SHA11298b6298f912556a565bfd880e5dfc7e808e527
SHA2560ca51b86740bfc116f43c8adffc0826a2311c80b889c35d8659fb2c512efd3a3
SHA512c106ced195d5871d1eecfa30a5ad77ceae099a4f9b6fec0222332daeecebf1d5f25871ab4a687db9055cae410b34f86112820c28a4baf0405dfe85e8b1c0033a
-
Filesize
213KB
MD5cefca7a7494b32c43aa9f29d6d98837e
SHA11298b6298f912556a565bfd880e5dfc7e808e527
SHA2560ca51b86740bfc116f43c8adffc0826a2311c80b889c35d8659fb2c512efd3a3
SHA512c106ced195d5871d1eecfa30a5ad77ceae099a4f9b6fec0222332daeecebf1d5f25871ab4a687db9055cae410b34f86112820c28a4baf0405dfe85e8b1c0033a
-
Filesize
2.7MB
MD536846b5d42bfb8ad2f11ed0fc5b50876
SHA1fd73bbba4c8ee30d6ef6f3d5ce6f98135dbf5412
SHA256ce896e9c01bc34843bac4aa5aa5badad82a240f393627958e1cc44ac0755316d
SHA512cae0d84d9ba529027f9fcb13fd49f83f220c6cf73350d79bd7b8f4c1fe8f3485883124e840339031e7626086baf0b40054a3c457a7ea7dd1ff3abba194e18f7f
-
Filesize
2.7MB
MD536846b5d42bfb8ad2f11ed0fc5b50876
SHA1fd73bbba4c8ee30d6ef6f3d5ce6f98135dbf5412
SHA256ce896e9c01bc34843bac4aa5aa5badad82a240f393627958e1cc44ac0755316d
SHA512cae0d84d9ba529027f9fcb13fd49f83f220c6cf73350d79bd7b8f4c1fe8f3485883124e840339031e7626086baf0b40054a3c457a7ea7dd1ff3abba194e18f7f
-
Filesize
484KB
MD586b0e373384f593fd83a312efba7ca8f
SHA136a352f0b0658d359af10396df4287360b629d72
SHA25641be6574b16c357298c07c556af8992ecdf11d2fe3688cfbf5eb2d3c1e46ae4f
SHA512eacf846381e8f117e1868fa4606adbc5a1203c1b3b9e059e056f04176677965f94409a3a755ab9948f6fa16c0b4dcaae03008468907a513f35732fbb61967a67
-
Filesize
484KB
MD586b0e373384f593fd83a312efba7ca8f
SHA136a352f0b0658d359af10396df4287360b629d72
SHA25641be6574b16c357298c07c556af8992ecdf11d2fe3688cfbf5eb2d3c1e46ae4f
SHA512eacf846381e8f117e1868fa4606adbc5a1203c1b3b9e059e056f04176677965f94409a3a755ab9948f6fa16c0b4dcaae03008468907a513f35732fbb61967a67
-
Filesize
679KB
MD5864b237c026048ac618d4bb2eba28aaa
SHA14c145e752b38fbba9f375f1b44cd60b70369bda5
SHA2568a9aa07e4ba061573e252e45732df02775c78506738bdccfd9f30e7ef9dc9655
SHA512195c4e8cde3e5daea7700f784fcff67b66fd341474ab981362568a12691ca66542864e59a479c05f2fce83f8520081b78e287736babb72eced2d06ec5d0133a7
-
Filesize
679KB
MD5864b237c026048ac618d4bb2eba28aaa
SHA14c145e752b38fbba9f375f1b44cd60b70369bda5
SHA2568a9aa07e4ba061573e252e45732df02775c78506738bdccfd9f30e7ef9dc9655
SHA512195c4e8cde3e5daea7700f784fcff67b66fd341474ab981362568a12691ca66542864e59a479c05f2fce83f8520081b78e287736babb72eced2d06ec5d0133a7
-
Filesize
553KB
MD56da7f4530edb350cf9d967d969ccecf8
SHA13e2681ea91f60a7a9ef2407399d13c1ca6aa71e9
SHA2569fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
SHA5121f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab
-
Filesize
23KB
MD50832532fab0d5c949aa0c65169aa9d61
SHA126f1bee679b7a6289b663c4fa4e65eba33a234e8
SHA2568731a93e519c2595c9fd489e6d9ac07e964448c0da1c8ee9ee500a7989482617
SHA51203147a59ee35fb3d2752d4c40741a39674ccd4474a575746bc574d2b2fae1fd04f5ab9c2e02b0dc6268fc6aee8fbb46dc4bf5ff23b5fcc4a0e9b847f57ca79d0
-
Filesize
1KB
MD529eceac8c34357624a1517c7d7013ef9
SHA1d07447b098c07f119be11de37ade8d95a9ad6bec
SHA256b1f52a014cc72cdafc97f325f420c88e835c6a0f8eb8b8881bcad9e85aa9b648
SHA512cba0a5bf1832fcc6268fa6d3d159980e8c27e6a4f6b3004678daad9ed6a8908528b0255e0096883fe845a3e909b794c2af5c78ac1cf84e020081f135988b5eb1
-
Filesize
292KB
MD5f933eb373fcd096535064d73e3ebedb1
SHA18e5242ffab6615c51ba3902dbb4427f774731eb6
SHA256724ef5480cbc2133e2b19d1edd994499756bdb4c92842bc2ab0c9ee441cab492
SHA5127963d2fe9cd325ad77213c452ca98412e311da67574fdfbe17fb26c65e4a5dfc8112ed8046e4c7812e1069a790e2e40ef2b5168f51b72e34482336d6b5b0267f
-
Filesize
292KB
MD5f933eb373fcd096535064d73e3ebedb1
SHA18e5242ffab6615c51ba3902dbb4427f774731eb6
SHA256724ef5480cbc2133e2b19d1edd994499756bdb4c92842bc2ab0c9ee441cab492
SHA5127963d2fe9cd325ad77213c452ca98412e311da67574fdfbe17fb26c65e4a5dfc8112ed8046e4c7812e1069a790e2e40ef2b5168f51b72e34482336d6b5b0267f
-
Filesize
7KB
MD551b1f2168f66b3efb3ab6ef3d3e39e2e
SHA128950c1715fb88f9bba794c99eceea2af45c620b
SHA256edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0
SHA512bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c
-
Filesize
97KB
MD5fbddee14978c60a90eccb2b9304304f1
SHA19f726861b81c570860c2922b128bbbe2004e6295
SHA256cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0
SHA512bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2
-
Filesize
97KB
MD5fbddee14978c60a90eccb2b9304304f1
SHA19f726861b81c570860c2922b128bbbe2004e6295
SHA256cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0
SHA512bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
36KB
MD5135359d350f72ad4bf716b764d39e749
SHA12e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA25634048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
-
Filesize
97KB
MD5fbddee14978c60a90eccb2b9304304f1
SHA19f726861b81c570860c2922b128bbbe2004e6295
SHA256cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0
SHA512bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2
-
Filesize
97KB
MD5fbddee14978c60a90eccb2b9304304f1
SHA19f726861b81c570860c2922b128bbbe2004e6295
SHA256cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0
SHA512bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2
-
Filesize
1KB
MD585db3aa1f72f02c9a731a83d7c8a479c
SHA11d133344ff4dd14e16bc130b00d3f44520178e0c
SHA25614626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118
SHA51211e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822
-
Filesize
444KB
MD5c3ba9a97f27c4b76149c4b10aea9a7a9
SHA12f43e443fdad83c39124c9ab161fe31fbc3347af
SHA256cae0987b7a4906f80199b2768166c44877ef4f90280cea859dc4b41462b14b7a
SHA51259a820a2bc8098c199b523d3fdd178669f9fd84c6a698a421e9e8246844d04e0694e3bea35b8352c611050210a675f4343580911a20c1047a00190e3f724763c
-
Filesize
101KB
MD509cc99317316ebbd5816286e23d3c096
SHA128c8ab9ee0bbe6f3be77dc47d91837d98f81a669
SHA25638dc7470535b266471ae05c38f5b55fc0aaf5994bb1a01b1b8495d983111ec97
SHA51270f6828b1f7f017641f275bef04a4d8dcc17651af37a343ea0761a3bcabe99e63b3d0ecff544516f27aa2c880faf79de9e22d906cd4318c4289c09719d4e2a65
-
Filesize
93KB
MD528f031f0b70073e2ad4160749756d05e
SHA1f603dea4bdffefc397d04aa5fb6dd0cb0db33a32
SHA2563f15afc28c36ea185a0d6525bbd2ec6decdc9e14452c18a7366baa3fe3170f72
SHA512225139d562dc052dbd641928f44ea9a3a71b8e06e3274d7f902631fd95bd79738ea74012839097d440dfbbcbdccf23e6d4f689bffc40fb9c0321e879e82bc226
-
Filesize
93KB
MD528f031f0b70073e2ad4160749756d05e
SHA1f603dea4bdffefc397d04aa5fb6dd0cb0db33a32
SHA2563f15afc28c36ea185a0d6525bbd2ec6decdc9e14452c18a7366baa3fe3170f72
SHA512225139d562dc052dbd641928f44ea9a3a71b8e06e3274d7f902631fd95bd79738ea74012839097d440dfbbcbdccf23e6d4f689bffc40fb9c0321e879e82bc226
-
Filesize
10KB
MD518ef4501d1f4acb8de464796cb2780b5
SHA17e76c6703081ac711ac75c36616c4fc38fdee3e2
SHA2567a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86
SHA512bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff
-
Filesize
56KB
MD5a06a6cca3c5685775a54b1af6c0dc5f6
SHA15b7a5bf57610f7e06b30793c4196242cc238bb54
SHA25617c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012
SHA5127179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184
-
Filesize
7KB
MD551b1f2168f66b3efb3ab6ef3d3e39e2e
SHA128950c1715fb88f9bba794c99eceea2af45c620b
SHA256edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0
SHA512bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c
-
Filesize
10KB
MD54d00baa194a2e39eaa0d9aa32bff8f04
SHA1a7d501754bb5d570a95c46ff1df6ad3cbce867fb
SHA2564e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b
SHA512594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670
-
Filesize
46KB
MD5204f64debf2647874545421e6feaed2b
SHA1fc3b676f92d9579d90f4c7bee33eaeb395f9b27f
SHA256e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92
SHA5125b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195
-
Filesize
1KB
MD585db3aa1f72f02c9a731a83d7c8a479c
SHA11d133344ff4dd14e16bc130b00d3f44520178e0c
SHA25614626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118
SHA51211e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822
-
Filesize
7KB
MD551b1f2168f66b3efb3ab6ef3d3e39e2e
SHA128950c1715fb88f9bba794c99eceea2af45c620b
SHA256edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0
SHA512bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c
-
Filesize
1KB
MD585db3aa1f72f02c9a731a83d7c8a479c
SHA11d133344ff4dd14e16bc130b00d3f44520178e0c
SHA25614626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118
SHA51211e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822
-
Filesize
148KB
MD5533838b44d248ad0b46293b5580f5ec7
SHA1b914ac64c8dc80404ee439bd7a850731c96658f9
SHA2563c0a398ab8837af3c8bed05a896b512ed0b56e4a4f24affc1eda53f868257a80
SHA51241ee7d065a82bb8c0b535314e7dba5496c6f246a8e03cbe4a021363fbd46f8a7a24296523bb4156064f281754b9a3b446aeb0c69b0bba03d9ef7f9fe5a9a6c09
-
Filesize
56KB
MD5a06a6cca3c5685775a54b1af6c0dc5f6
SHA15b7a5bf57610f7e06b30793c4196242cc238bb54
SHA25617c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012
SHA5127179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184
-
Filesize
46KB
MD5204f64debf2647874545421e6feaed2b
SHA1fc3b676f92d9579d90f4c7bee33eaeb395f9b27f
SHA256e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92
SHA5125b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195
-
Filesize
7KB
MD551b1f2168f66b3efb3ab6ef3d3e39e2e
SHA128950c1715fb88f9bba794c99eceea2af45c620b
SHA256edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0
SHA512bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c
-
Filesize
1KB
MD585db3aa1f72f02c9a731a83d7c8a479c
SHA11d133344ff4dd14e16bc130b00d3f44520178e0c
SHA25614626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118
SHA51211e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822
-
Filesize
56KB
MD5a06a6cca3c5685775a54b1af6c0dc5f6
SHA15b7a5bf57610f7e06b30793c4196242cc238bb54
SHA25617c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012
SHA5127179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184
-
Filesize
46KB
MD5204f64debf2647874545421e6feaed2b
SHA1fc3b676f92d9579d90f4c7bee33eaeb395f9b27f
SHA256e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92
SHA5125b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195
-
Filesize
10KB
MD518ef4501d1f4acb8de464796cb2780b5
SHA17e76c6703081ac711ac75c36616c4fc38fdee3e2
SHA2567a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86
SHA512bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff
-
Filesize
10KB
MD54d00baa194a2e39eaa0d9aa32bff8f04
SHA1a7d501754bb5d570a95c46ff1df6ad3cbce867fb
SHA2564e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b
SHA512594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670