Overview

overview

10

Static

static

3

Windscribe_2.5.18.exe

windows7-x64

10

Windscribe_2.5.18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2023, 18:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windscribe_2.5.18.exe

  • Size

    20.5MB

  • MD5

    8b45ea7fa70ea3e60c1642001ab66bb1

  • SHA1

    69ab31a64f4d1c7ab2d5bf08b6ff05fe29efcfe1

  • SHA256

    34b8535955457b70007bc360d6f60a59dc70bd0aa8030ccaff77a07bd38ca320

  • SHA512

    9175435ca08cfbd498c5ab2dc63a29ebea508178397db2413d830a997673a2d60b4ca2178972c75dc57a33e9122e7d51aee2169dcc2dce8b445dcf33646a9b8e

  • SSDEEP

    393216:uVgDgNg+Vim3Tp8YTLz4Iom3CgnuhGQ5DtOCmJ6z5OqHCQZFsAIWKCYoyLV0:uV2WIiGYTX4VPhZs7JSFlIW9V

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Creates new service(s) 1 TTPs
    persistence
  • Drops file in Drivers directory 9 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 30 IoCs
  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windscribe_2.5.18.exe
    "C:\Users\Admin\AppData\Local\Temp\Windscribe_2.5.18.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Temp\tmTZAu0ww6EK.vbe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Temp\2b3nvEZbyOKVLO0rFX9CQNCe.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Temp\Runtime Broker.exe
            "C:\Temp\Runtime Broker.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4920
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18_licensekey.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18_licensekey.exe"
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\SYSTEM32\sc.exe
        "sc" create WindscribeService binPath= "C:\Program Files\Windscribe\WindscribeService.exe" start= auto
        3⤵
        • Launches sc.exe
        PID:5104
      • C:\Windows\SYSTEM32\sc.exe
        "sc" description WindscribeService "Manages the firewall and controls the VPN tunnel"
        3⤵
        • Launches sc.exe
        PID:2276
      • C:\Program Files\Windscribe\subinacl.exe
        "C:\Program Files\Windscribe\subinacl" /SERVICE WindscribeService /grant=S-1-5-11=STO
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3372
      • C:\Program Files\Windscribe\tap\tapinstall.exe
        "C:\Program Files\Windscribe\tap\tapinstall.exe" install OemVista.inf tapwindscribe0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4908
      • C:\Program Files\Windscribe\wintun\tapinstall.exe
        "C:\Program Files\Windscribe\wintun\tapinstall.exe" install windtun420.inf windtun420
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:752
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf
        3⤵
        • Drops file in Drivers directory
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\system32\runonce.exe
          "C:\Windows\system32\runonce.exe" -r
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\System32\grpconv.exe
            "C:\Windows\System32\grpconv.exe" -o
            5⤵
              PID:884
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{18432bbe-e558-8142-b299-937b60cc2d9d}\oemvista.inf" "9" "40e41e9d3" "000000000000014C" "WinSta0\Default" "0000000000000158" "208" "c:\program files\windscribe\tap"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:1504
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tapwindscribe0901.ndi:9.24.2.601:tapwindscribe0901," "40e41e9d3" "000000000000014C"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:3904
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{405b23cd-fe78-3045-ab2f-6c19c7b8fc15}\windtun420.inf" "9" "4fd9b412f" "0000000000000170" "WinSta0\Default" "0000000000000138" "208" "c:\program files\windscribe\wintun"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:4556
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:f101f9793a5fdf02:Windtun420.Install:0.9.0.0:windtun420," "4fd9b412f" "0000000000000178"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1576
    • C:\Program Files\Windscribe\WindscribeLauncher.exe
      "C:\Program Files\Windscribe\WindscribeLauncher.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Program Files\Windscribe\Windscribe.exe
        "C:\Program Files\Windscribe\Windscribe.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe
          "C:\Program Files\Windscribe\windscribeopenvpn_2_5_4.exe" --version
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5032
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/installed/desktop?jdz6q20s
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaaa4746f8,0x7ffaaa474708,0x7ffaaa474718
            4⤵
              PID:5044
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8950744402499926315,16817837955825138860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
              4⤵
                PID:3516
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8950744402499926315,16817837955825138860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2552
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8950744402499926315,16817837955825138860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
                4⤵
                  PID:4116
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8950744402499926315,16817837955825138860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                  4⤵
                    PID:3720
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8950744402499926315,16817837955825138860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                    4⤵
                      PID:4792
              • C:\Program Files\Windscribe\WindscribeService.exe
                "C:\Program Files\Windscribe\WindscribeService.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5112
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /t /im windscribeopenvpn_2_5_4.exe
                  2⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3252
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3648
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:2228

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\PROGRA~1\WINDSC~1\SPLITT~1\WindscribeSplitTunnel.sys
                    Filesize

                    34KB

                    MD5

                    1ba24e35575d93b69f8360cd746cda79

                    SHA1

                    18b0b826a0f58d4516a84c4e78a0acc38c1c268c

                    SHA256

                    24d6796707101b425226ad85f43a0fac921ba3f25c6129061781edd172bec095

                    SHA512

                    c85e17e3178fc98ee3a1f1c3e619910fd76a7081ed41c24c4622e01d09993cd8f68b7eea358c0141d01ec24e08cb8d923a7b5c7c6213b9eff3262c2534848410

                    Download Submit

                  • C:\Program Files\Windscribe\MSVCP140.dll
                    Filesize

                    553KB

                    MD5

                    6da7f4530edb350cf9d967d969ccecf8

                    SHA1

                    3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

                    SHA256

                    9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

                    SHA512

                    1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Core.dll
                    Filesize

                    5.4MB

                    MD5

                    810662542c206d6fcb743b22be26a4a1

                    SHA1

                    d8465d53bf5e9d9be17130ee2879f8a6a4b5ab07

                    SHA256

                    4d04ca5c783b56977821387b25c6976843ac3dbe9da344d705e3019ad491517f

                    SHA512

                    d43d702dc8f7ed9fdadfb9e82c9aaa75f546f75a681bba8be45f35dbfae45da1d03c40b1bf11fb73e87030ec7c54fb81e06fe4126c5815bf14168fc14dfc7cd4

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Core.dll
                    Filesize

                    5.4MB

                    MD5

                    810662542c206d6fcb743b22be26a4a1

                    SHA1

                    d8465d53bf5e9d9be17130ee2879f8a6a4b5ab07

                    SHA256

                    4d04ca5c783b56977821387b25c6976843ac3dbe9da344d705e3019ad491517f

                    SHA512

                    d43d702dc8f7ed9fdadfb9e82c9aaa75f546f75a681bba8be45f35dbfae45da1d03c40b1bf11fb73e87030ec7c54fb81e06fe4126c5815bf14168fc14dfc7cd4

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Core5Compat.dll
                    Filesize

                    814KB

                    MD5

                    b08d2a888b1fef612c33039f454d668d

                    SHA1

                    cffb1b508600459c68d4f694ce51551bda315f53

                    SHA256

                    2858bfc330c64b653937d768d0b6e00e652b47cea1d7d42f3ff2db7f59cdfffb

                    SHA512

                    3efccb30455d8064d14ef98d8777be20ee796198db4d42f634439cc0b18123df166804c945a31f605f8e725a54d1b3b8c30d88890bf223b83e8b9b8eac750151

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Core5Compat.dll
                    Filesize

                    814KB

                    MD5

                    b08d2a888b1fef612c33039f454d668d

                    SHA1

                    cffb1b508600459c68d4f694ce51551bda315f53

                    SHA256

                    2858bfc330c64b653937d768d0b6e00e652b47cea1d7d42f3ff2db7f59cdfffb

                    SHA512

                    3efccb30455d8064d14ef98d8777be20ee796198db4d42f634439cc0b18123df166804c945a31f605f8e725a54d1b3b8c30d88890bf223b83e8b9b8eac750151

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Gui.dll
                    Filesize

                    7.2MB

                    MD5

                    3e474a9c2022407f68e53a8707c43a0f

                    SHA1

                    05cc00a87525001d1cc840a26f9ab7a8ffaeb4cb

                    SHA256

                    b293a4e5a73432b34b74f6047eb83a2301062aa5c37c1a7a8e8b266f4a9346ef

                    SHA512

                    6b595d4e0aec2e0b74ec4919d2b08ce8604e18927620ae1eb9f5d3cd3a9eb89f0b860cf53dc256455839ef438d7151931bd3b568b155fc10ec24a46e46016f13

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Gui.dll
                    Filesize

                    7.2MB

                    MD5

                    3e474a9c2022407f68e53a8707c43a0f

                    SHA1

                    05cc00a87525001d1cc840a26f9ab7a8ffaeb4cb

                    SHA256

                    b293a4e5a73432b34b74f6047eb83a2301062aa5c37c1a7a8e8b266f4a9346ef

                    SHA512

                    6b595d4e0aec2e0b74ec4919d2b08ce8604e18927620ae1eb9f5d3cd3a9eb89f0b860cf53dc256455839ef438d7151931bd3b568b155fc10ec24a46e46016f13

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Network.dll
                    Filesize

                    1.4MB

                    MD5

                    4b429615187bfcc469d4df92ebba1918

                    SHA1

                    d0c51a5e8e8a5b7dddc04abdb81a07823038783d

                    SHA256

                    76d4c36318f301783615ea238d58f7523dd811c299a75c66b18c52e311c55856

                    SHA512

                    1f9f6d9c7dcdff8dd189027bfd4f9df2a141a7c3f68737bceb57d68824e43c9272710ac9749f563ef4aa81fd54724f7c756249e6b0680aed3da7cdbba7067491

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Network.dll
                    Filesize

                    1.4MB

                    MD5

                    4b429615187bfcc469d4df92ebba1918

                    SHA1

                    d0c51a5e8e8a5b7dddc04abdb81a07823038783d

                    SHA256

                    76d4c36318f301783615ea238d58f7523dd811c299a75c66b18c52e311c55856

                    SHA512

                    1f9f6d9c7dcdff8dd189027bfd4f9df2a141a7c3f68737bceb57d68824e43c9272710ac9749f563ef4aa81fd54724f7c756249e6b0680aed3da7cdbba7067491

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Svg.dll
                    Filesize

                    352KB

                    MD5

                    53a7317fe3a2a3d65efa632613832647

                    SHA1

                    31d96658cc726f7c18c6bc16253b1c31181568ea

                    SHA256

                    040553e25037e715be71c6b7106e701406092d932aba29e8d00cfe22ebc3499e

                    SHA512

                    be3d902428700ecd4c15481b00787b36d246063ce265f66887f6d29935158b7c2f996a579af99db5d28be871be0bfd0b77c020c221e6e51ade7c85f9a70af329

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Svg.dll
                    Filesize

                    352KB

                    MD5

                    53a7317fe3a2a3d65efa632613832647

                    SHA1

                    31d96658cc726f7c18c6bc16253b1c31181568ea

                    SHA256

                    040553e25037e715be71c6b7106e701406092d932aba29e8d00cfe22ebc3499e

                    SHA512

                    be3d902428700ecd4c15481b00787b36d246063ce265f66887f6d29935158b7c2f996a579af99db5d28be871be0bfd0b77c020c221e6e51ade7c85f9a70af329

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Widgets.dll
                    Filesize

                    5.7MB

                    MD5

                    a4c2a7999942f52dd7f89c82c8bd82f3

                    SHA1

                    4a4dba97e84659a2a5feb5acbc294ca65283c768

                    SHA256

                    77206c28d16d2b8f8e4a436567fe6821f8d51f9dad33c9f62ba5fee41733d204

                    SHA512

                    622a673ce59915742bae8fa27215a809f63a7c844a98658cb0f65b42062fe738cb30a4c26cbc70c1125d2e28ed316439608c29ac7a4a02ae4e79e4494142a173

                    Download Submit

                  • C:\Program Files\Windscribe\Qt6Widgets.dll
                    Filesize

                    5.7MB

                    MD5

                    a4c2a7999942f52dd7f89c82c8bd82f3

                    SHA1

                    4a4dba97e84659a2a5feb5acbc294ca65283c768

                    SHA256

                    77206c28d16d2b8f8e4a436567fe6821f8d51f9dad33c9f62ba5fee41733d204

                    SHA512

                    622a673ce59915742bae8fa27215a809f63a7c844a98658cb0f65b42062fe738cb30a4c26cbc70c1125d2e28ed316439608c29ac7a4a02ae4e79e4494142a173

                    Download Submit

                  • C:\Program Files\Windscribe\VCRUNTIME140.dll
                    Filesize

                    95KB

                    MD5

                    f34eb034aa4a9735218686590cba2e8b

                    SHA1

                    2bc20acdcb201676b77a66fa7ec6b53fa2644713

                    SHA256

                    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                    SHA512

                    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                    Download Submit

                  • C:\Program Files\Windscribe\Windscribe.exe
                    Filesize

                    5.5MB

                    MD5

                    423476c801b7ee35e066e758276b904d

                    SHA1

                    a5bc2641a78e7991cce7f8c4ce94109930ad2268

                    SHA256

                    612ad77c2c26b8cfb51e3fe71730bc6797c381175ffa57439ef1d311bb82875d

                    SHA512

                    82dcb77d7109947a5b7132c2dc5c2bf260edc7f723e805a8e1bc02f196127886d04d7687019441cba47e08c3d9d680bd32270b3186178984a0d5c3c10b720944

                    Download Submit

                  • C:\Program Files\Windscribe\Windscribe.exe
                    Filesize

                    5.5MB

                    MD5

                    423476c801b7ee35e066e758276b904d

                    SHA1

                    a5bc2641a78e7991cce7f8c4ce94109930ad2268

                    SHA256

                    612ad77c2c26b8cfb51e3fe71730bc6797c381175ffa57439ef1d311bb82875d

                    SHA512

                    82dcb77d7109947a5b7132c2dc5c2bf260edc7f723e805a8e1bc02f196127886d04d7687019441cba47e08c3d9d680bd32270b3186178984a0d5c3c10b720944

                    Download Submit

                  • C:\Program Files\Windscribe\WindscribeLauncher.exe
                    Filesize

                    329KB

                    MD5

                    87055aecaf0fd21b32c276b9a296f133

                    SHA1

                    a1849caa6eeb2b83458881c336be84d2a5c346cb

                    SHA256

                    77cdad81d9e9c5b515230c8b1eebc2af2c09edfa6130768aec6df4b8d0e003b2

                    SHA512

                    f8fbd86670a2bd4db1b08eb7ecf35347f9e2fac886b7faab06e01eb4782b650adaa9ea506bb3d05611520efb14d15921f7dae2d7fe7f23f8633119faa197cc4b

                    Download Submit

                  • C:\Program Files\Windscribe\WindscribeLauncher.exe
                    Filesize

                    329KB

                    MD5

                    87055aecaf0fd21b32c276b9a296f133

                    SHA1

                    a1849caa6eeb2b83458881c336be84d2a5c346cb

                    SHA256

                    77cdad81d9e9c5b515230c8b1eebc2af2c09edfa6130768aec6df4b8d0e003b2

                    SHA512

                    f8fbd86670a2bd4db1b08eb7ecf35347f9e2fac886b7faab06e01eb4782b650adaa9ea506bb3d05611520efb14d15921f7dae2d7fe7f23f8633119faa197cc4b

                    Download Submit

                  • C:\Program Files\Windscribe\cares.dll
                    Filesize

                    213KB

                    MD5

                    cefca7a7494b32c43aa9f29d6d98837e

                    SHA1

                    1298b6298f912556a565bfd880e5dfc7e808e527

                    SHA256

                    0ca51b86740bfc116f43c8adffc0826a2311c80b889c35d8659fb2c512efd3a3

                    SHA512

                    c106ced195d5871d1eecfa30a5ad77ceae099a4f9b6fec0222332daeecebf1d5f25871ab4a687db9055cae410b34f86112820c28a4baf0405dfe85e8b1c0033a

                    Download Submit

                  • C:\Program Files\Windscribe\cares.dll
                    Filesize

                    213KB

                    MD5

                    cefca7a7494b32c43aa9f29d6d98837e

                    SHA1

                    1298b6298f912556a565bfd880e5dfc7e808e527

                    SHA256

                    0ca51b86740bfc116f43c8adffc0826a2311c80b889c35d8659fb2c512efd3a3

                    SHA512

                    c106ced195d5871d1eecfa30a5ad77ceae099a4f9b6fec0222332daeecebf1d5f25871ab4a687db9055cae410b34f86112820c28a4baf0405dfe85e8b1c0033a

                    Download Submit

                  • C:\Program Files\Windscribe\libcrypto-1_1-x64.dll
                    Filesize

                    2.7MB

                    MD5

                    36846b5d42bfb8ad2f11ed0fc5b50876

                    SHA1

                    fd73bbba4c8ee30d6ef6f3d5ce6f98135dbf5412

                    SHA256

                    ce896e9c01bc34843bac4aa5aa5badad82a240f393627958e1cc44ac0755316d

                    SHA512

                    cae0d84d9ba529027f9fcb13fd49f83f220c6cf73350d79bd7b8f4c1fe8f3485883124e840339031e7626086baf0b40054a3c457a7ea7dd1ff3abba194e18f7f

                    Download Submit

                  • C:\Program Files\Windscribe\libcrypto-1_1-x64.dll
                    Filesize

                    2.7MB

                    MD5

                    36846b5d42bfb8ad2f11ed0fc5b50876

                    SHA1

                    fd73bbba4c8ee30d6ef6f3d5ce6f98135dbf5412

                    SHA256

                    ce896e9c01bc34843bac4aa5aa5badad82a240f393627958e1cc44ac0755316d

                    SHA512

                    cae0d84d9ba529027f9fcb13fd49f83f220c6cf73350d79bd7b8f4c1fe8f3485883124e840339031e7626086baf0b40054a3c457a7ea7dd1ff3abba194e18f7f

                    Download Submit

                  • C:\Program Files\Windscribe\libcurl.dll
                    Filesize

                    484KB

                    MD5

                    86b0e373384f593fd83a312efba7ca8f

                    SHA1

                    36a352f0b0658d359af10396df4287360b629d72

                    SHA256

                    41be6574b16c357298c07c556af8992ecdf11d2fe3688cfbf5eb2d3c1e46ae4f

                    SHA512

                    eacf846381e8f117e1868fa4606adbc5a1203c1b3b9e059e056f04176677965f94409a3a755ab9948f6fa16c0b4dcaae03008468907a513f35732fbb61967a67

                    Download Submit

                  • C:\Program Files\Windscribe\libcurl.dll
                    Filesize

                    484KB

                    MD5

                    86b0e373384f593fd83a312efba7ca8f

                    SHA1

                    36a352f0b0658d359af10396df4287360b629d72

                    SHA256

                    41be6574b16c357298c07c556af8992ecdf11d2fe3688cfbf5eb2d3c1e46ae4f

                    SHA512

                    eacf846381e8f117e1868fa4606adbc5a1203c1b3b9e059e056f04176677965f94409a3a755ab9948f6fa16c0b4dcaae03008468907a513f35732fbb61967a67

                    Download Submit

                  • C:\Program Files\Windscribe\libssl-1_1-x64.dll
                    Filesize

                    679KB

                    MD5

                    864b237c026048ac618d4bb2eba28aaa

                    SHA1

                    4c145e752b38fbba9f375f1b44cd60b70369bda5

                    SHA256

                    8a9aa07e4ba061573e252e45732df02775c78506738bdccfd9f30e7ef9dc9655

                    SHA512

                    195c4e8cde3e5daea7700f784fcff67b66fd341474ab981362568a12691ca66542864e59a479c05f2fce83f8520081b78e287736babb72eced2d06ec5d0133a7

                    Download Submit

                  • C:\Program Files\Windscribe\libssl-1_1-x64.dll
                    Filesize

                    679KB

                    MD5

                    864b237c026048ac618d4bb2eba28aaa

                    SHA1

                    4c145e752b38fbba9f375f1b44cd60b70369bda5

                    SHA256

                    8a9aa07e4ba061573e252e45732df02775c78506738bdccfd9f30e7ef9dc9655

                    SHA512

                    195c4e8cde3e5daea7700f784fcff67b66fd341474ab981362568a12691ca66542864e59a479c05f2fce83f8520081b78e287736babb72eced2d06ec5d0133a7

                    Download Submit

                  • C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf
                    Filesize

                    1KB

                    MD5

                    29eceac8c34357624a1517c7d7013ef9

                    SHA1

                    d07447b098c07f119be11de37ade8d95a9ad6bec

                    SHA256

                    b1f52a014cc72cdafc97f325f420c88e835c6a0f8eb8b8881bcad9e85aa9b648

                    SHA512

                    cba0a5bf1832fcc6268fa6d3d159980e8c27e6a4f6b3004678daad9ed6a8908528b0255e0096883fe845a3e909b794c2af5c78ac1cf84e020081f135988b5eb1

                    Download Submit

                  • C:\Program Files\Windscribe\subinacl.exe
                    Filesize

                    292KB

                    MD5

                    f933eb373fcd096535064d73e3ebedb1

                    SHA1

                    8e5242ffab6615c51ba3902dbb4427f774731eb6

                    SHA256

                    724ef5480cbc2133e2b19d1edd994499756bdb4c92842bc2ab0c9ee441cab492

                    SHA512

                    7963d2fe9cd325ad77213c452ca98412e311da67574fdfbe17fb26c65e4a5dfc8112ed8046e4c7812e1069a790e2e40ef2b5168f51b72e34482336d6b5b0267f

                    Download Submit

                  • C:\Program Files\Windscribe\subinacl.exe
                    Filesize

                    292KB

                    MD5

                    f933eb373fcd096535064d73e3ebedb1

                    SHA1

                    8e5242ffab6615c51ba3902dbb4427f774731eb6

                    SHA256

                    724ef5480cbc2133e2b19d1edd994499756bdb4c92842bc2ab0c9ee441cab492

                    SHA512

                    7963d2fe9cd325ad77213c452ca98412e311da67574fdfbe17fb26c65e4a5dfc8112ed8046e4c7812e1069a790e2e40ef2b5168f51b72e34482336d6b5b0267f

                    Download Submit

                  • C:\Program Files\Windscribe\tap\OemVista.inf
                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                    Download Submit

                  • C:\Program Files\Windscribe\tap\tapinstall.exe
                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                    Download Submit

                  • C:\Program Files\Windscribe\tap\tapinstall.exe
                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                    Download Submit

                  • C:\Program Files\Windscribe\vcruntime140.dll
                    Filesize

                    95KB

                    MD5

                    f34eb034aa4a9735218686590cba2e8b

                    SHA1

                    2bc20acdcb201676b77a66fa7ec6b53fa2644713

                    SHA256

                    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                    SHA512

                    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                    Download Submit

                  • C:\Program Files\Windscribe\wintun\tapinstall.exe
                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                    Download Submit

                  • C:\Program Files\Windscribe\wintun\tapinstall.exe
                    Filesize

                    97KB

                    MD5

                    fbddee14978c60a90eccb2b9304304f1

                    SHA1

                    9f726861b81c570860c2922b128bbbe2004e6295

                    SHA256

                    cdd68fd57d504110f27224c135f56aa68ad5b148ce3776aaeaf92a718552f7e0

                    SHA512

                    bc734e2aae853d736851a109c58ceff645abdf25a1e038e4325e972b75ec35bb5512eb771c46889a9fe992c5098fe4b00ae33e7ecd720a97b2375f0ca52493b2

                    Download Submit

                  • C:\Program Files\Windscribe\wintun\windtun420.inf
                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                    Download Submit

                  • C:\Program Files\Windscribe\ws_com.dll
                    Filesize

                    444KB

                    MD5

                    c3ba9a97f27c4b76149c4b10aea9a7a9

                    SHA1

                    2f43e443fdad83c39124c9ab161fe31fbc3347af

                    SHA256

                    cae0987b7a4906f80199b2768166c44877ef4f90280cea859dc4b41462b14b7a

                    SHA512

                    59a820a2bc8098c199b523d3fdd178669f9fd84c6a698a421e9e8246844d04e0694e3bea35b8352c611050210a675f4343580911a20c1047a00190e3f724763c

                    Download Submit

                  • C:\Program Files\Windscribe\ws_proxy_stub.dll
                    Filesize

                    101KB

                    MD5

                    09cc99317316ebbd5816286e23d3c096

                    SHA1

                    28c8ab9ee0bbe6f3be77dc47d91837d98f81a669

                    SHA256

                    38dc7470535b266471ae05c38f5b55fc0aaf5994bb1a01b1b8495d983111ec97

                    SHA512

                    70f6828b1f7f017641f275bef04a4d8dcc17651af37a343ea0761a3bcabe99e63b3d0ecff544516f27aa2c880faf79de9e22d906cd4318c4289c09719d4e2a65

                    Download Submit

                  • C:\Temp\2b3nvEZbyOKVLO0rFX9CQNCe.bat
                    Filesize

                    28B

                    MD5

                    1c0820915b23fa02cd5c9d5ee69e2110

                    SHA1

                    cb03a2ee3817d3fa191364429eada237f1fc15a4

                    SHA256

                    1d73a85802574d06a478525aa333dcbed44c1c2cdec62e637a9a729c6c524fcb

                    SHA512

                    2d16a37ca7542bd7d41f456ddbaa2d9f44f1fc0a862549f262abde4de8728766b8c2d13e641f700c81d7c4ca6158d7ec3ee97bf51a90603e08cbef288f465ec2

                    Download Submit

                  • C:\Temp\Runtime Broker.exe
                    Filesize

                    2.0MB

                    MD5

                    67917ccf46c06770ac8b68d659e0de29

                    SHA1

                    2ab5ae38cc7fef5d40dcb99a75d64f70bb5e96bc

                    SHA256

                    7a65428437ef2479cf54f7feb139f0dfd3c56fb75f51d1c1d373e1658c974c18

                    SHA512

                    0d58f3de18aa45a90ba6c6f78ca07d81ee83c3608d096b4eed15065bda90435130e98990b34858a3b629ee0ef51e71cdbfa47c3429fbdfa0caac6809e6471947

                    Download Submit

                  • C:\Temp\Runtime Broker.exe
                    Filesize

                    2.0MB

                    MD5

                    67917ccf46c06770ac8b68d659e0de29

                    SHA1

                    2ab5ae38cc7fef5d40dcb99a75d64f70bb5e96bc

                    SHA256

                    7a65428437ef2479cf54f7feb139f0dfd3c56fb75f51d1c1d373e1658c974c18

                    SHA512

                    0d58f3de18aa45a90ba6c6f78ca07d81ee83c3608d096b4eed15065bda90435130e98990b34858a3b629ee0ef51e71cdbfa47c3429fbdfa0caac6809e6471947

                    Download Submit

                  • C:\Temp\tmTZAu0ww6EK.vbe
                    Filesize

                    205B

                    MD5

                    c1b104067034ac2b7fdd77ed7da7cd0f

                    SHA1

                    9dc28714822c1a33ba6e634c0a068f7bb6c3ad2e

                    SHA256

                    54d0b9ec8a5a9a11da51dec73b72633be8046c01798b78c89507594b3b4b0a49

                    SHA512

                    869bafe2f1a2ae32362f4c9a6ac4ae82278c21b338773a9a818372f8b93b08ec2ad368338a17e049952a2f1bd9129cc34a1de1fc551a0c3ea58e8d563481ba52

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                    Filesize

                    152B

                    MD5

                    f6f47b83c67fe32ee32811d6611d269c

                    SHA1

                    b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

                    SHA256

                    ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

                    SHA512

                    6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                    Filesize

                    120B

                    MD5

                    8f4f39a7bb7e7a5c4196643008aca17f

                    SHA1

                    652a4efdfadce3bc303dd6411edcfdbaf49201d1

                    SHA256

                    a68b3fc1d8420a549c6b9c8b49496bd7e20a26c116509a029c2fd1165426913e

                    SHA512

                    5e04b29e064a71e49f6823d9d69f07c21a4b7927fb03a244ab8bdf47722dd8be6421f2c34185e3ba831e88acb6b4b4def0fe5b7eade9c96916743727c5c01ced

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                    Filesize

                    858B

                    MD5

                    8516c1af4cca39375c6930425c7a4a1f

                    SHA1

                    663bdf9321a2a9a3698b2ba23601e4ec1bb34392

                    SHA256

                    f1366822a7fe83df08a615f86efdfeea1d9b45111789b7af94f4bd4f9a1bef97

                    SHA512

                    94689ff30f2407a570bc82208c2215ead9cbd84c036d894db08874dbc329098c690eb3f2c1593c598269654e9afa5420905c61979a0b1615110be174e2917d13

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                    Filesize

                    5KB

                    MD5

                    2b12de0e097bbc510267e5deb423ffd3

                    SHA1

                    4635dece4ab479847cad3f8b5fe5e24f491c98d5

                    SHA256

                    d965a469324e5a37bf479191b252f590586e92769a846a10819a2dc924b2e486

                    SHA512

                    7eaffc59e686ae686702363848eabc5375c63abe6bbbc3b49695db7bd46f65667dcfb6553ad955dae2aa2115e815369f6ae3b47f3ff18b2ae2e32dc53bb9c0be

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                    Filesize

                    6KB

                    MD5

                    b7cdf23f20fd6844bae3315128d3ee46

                    SHA1

                    4d5dc2b4f6a1b0c94af6dfa6df17495649b134c2

                    SHA256

                    8b9cd55b54ae614f04758be1741a887c6e01dd8633a2604260d155da268b08f8

                    SHA512

                    0d2c33d72b59dc96392fa0206b28c59e83038ce572a256280778f856499491778635bf1b0b6ccd5cc830a75f54fe3f0f9358f9ad2bac461c235dd65b414a981d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                    Filesize

                    24KB

                    MD5

                    4b781306eef375e7a60cf1e186ae3d54

                    SHA1

                    e9d718868bb4f5bdeb1658da532477159c9e11d0

                    SHA256

                    2171b47efeb585994751e106a8014a21fe355109b7de1d032cd7190242e59a4c

                    SHA512

                    aa738ade4ba51982fec15d6da8368be77491c0d220b0b0340af52626f6b18478842705472d4fb18d61de9a39e21d5a7e70b53ccc63617ff3147ee9d5a05423dc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    Filesize

                    10KB

                    MD5

                    d379517243edb75292ae8f3bc8a4bf86

                    SHA1

                    5ea1a0b2fe878972dd23e95461901a06b73127c9

                    SHA256

                    8f8ef3dd964f73568df16182cde6bb6c37425ae8aa7379a6dff5eefa7358eda4

                    SHA512

                    7384b9c36b0c5e8d8e78a6980b5fb13c90031c41b29d3bdd0092f1f5f700473ea6b1f18923595890f43d5026a2adaaaa1e1a50ec2ecb5de838a46dc873b49fc3

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18.exe
                    Filesize

                    2.3MB

                    MD5

                    6a4743cb09423008c69f5051470aecb8

                    SHA1

                    3795816b9a20af3ad0ce0186e0978fc7d0b99908

                    SHA256

                    ace228d260a36bdbf8d349d2140dfe5a98a9ef202129e02f1173d7baf1b6e261

                    SHA512

                    1af678abd2d8670400695802fb2b3036feca2152baedc4ba841bd59d7763df4b220c3b27e65f29749b1b36eb0f1901622ad46958f46bf3e977f1c66292d0da4d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18.exe
                    Filesize

                    2.3MB

                    MD5

                    6a4743cb09423008c69f5051470aecb8

                    SHA1

                    3795816b9a20af3ad0ce0186e0978fc7d0b99908

                    SHA256

                    ace228d260a36bdbf8d349d2140dfe5a98a9ef202129e02f1173d7baf1b6e261

                    SHA512

                    1af678abd2d8670400695802fb2b3036feca2152baedc4ba841bd59d7763df4b220c3b27e65f29749b1b36eb0f1901622ad46958f46bf3e977f1c66292d0da4d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18.exe
                    Filesize

                    2.3MB

                    MD5

                    6a4743cb09423008c69f5051470aecb8

                    SHA1

                    3795816b9a20af3ad0ce0186e0978fc7d0b99908

                    SHA256

                    ace228d260a36bdbf8d349d2140dfe5a98a9ef202129e02f1173d7baf1b6e261

                    SHA512

                    1af678abd2d8670400695802fb2b3036feca2152baedc4ba841bd59d7763df4b220c3b27e65f29749b1b36eb0f1901622ad46958f46bf3e977f1c66292d0da4d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18_licensekey.exe
                    Filesize

                    18.8MB

                    MD5

                    5729d7f8fff698e46f35abc7d904ece9

                    SHA1

                    7017eb70ff16eeaf91e9e9f7d60b938f83fb0169

                    SHA256

                    a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475

                    SHA512

                    e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18_licensekey.exe
                    Filesize

                    18.8MB

                    MD5

                    5729d7f8fff698e46f35abc7d904ece9

                    SHA1

                    7017eb70ff16eeaf91e9e9f7d60b938f83fb0169

                    SHA256

                    a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475

                    SHA512

                    e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Windscribe_2.5.18_licensekey.exe
                    Filesize

                    18.8MB

                    MD5

                    5729d7f8fff698e46f35abc7d904ece9

                    SHA1

                    7017eb70ff16eeaf91e9e9f7d60b938f83fb0169

                    SHA256

                    a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475

                    SHA512

                    e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{18432bbe-e558-8142-b299-937b60cc2d9d}\oemvista.inf
                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{18432~1\tapwindscribe0901.cat
                    Filesize

                    10KB

                    MD5

                    18ef4501d1f4acb8de464796cb2780b5

                    SHA1

                    7e76c6703081ac711ac75c36616c4fc38fdee3e2

                    SHA256

                    7a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86

                    SHA512

                    bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{18432~1\tapwindscribe0901.sys
                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{405B2~1\windtun420.cat
                    Filesize

                    10KB

                    MD5

                    4d00baa194a2e39eaa0d9aa32bff8f04

                    SHA1

                    a7d501754bb5d570a95c46ff1df6ad3cbce867fb

                    SHA256

                    4e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b

                    SHA512

                    594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{405B2~1\windtun420.sys
                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\{405b23cd-fe78-3045-ab2f-6c19c7b8fc15}\windtun420.inf
                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                    Download Submit

                  • C:\Windows\INF\oem3.inf
                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                    Download Submit

                  • C:\Windows\INF\oem4.inf
                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                    Download Submit

                  • C:\Windows\System32\CatRoot2\dberr.txt
                    Filesize

                    146KB

                    MD5

                    063019b9dd281bb648eed9434730b19a

                    SHA1

                    50d100b4081a1c4db49448579336f5cccf7d65fc

                    SHA256

                    78386dbd1eedff0eb0e83d52a79facef846dfe480cb384b26e35d29244a6f827

                    SHA512

                    e248ca577cf144f2d050b3e7c7c75174025ec6b97f12f84e6bd8e4173d35a7929fc78cf8eb68dc5586154c03353a12535db856d65231be7d7d85c9d8a96c4607

                    Download Submit

                  • C:\Windows\System32\DriverStore\FileRepository\OEMVIS~1.INF\tapwindscribe0901.sys
                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                    Download Submit

                  • C:\Windows\System32\DriverStore\FileRepository\WINDTU~1.INF\windtun420.sys
                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                    Download Submit

                  • C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_2c4931cd70af38ac\oemvista.inf
                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                    Download Submit

                  • C:\Windows\System32\DriverStore\FileRepository\windtun420.inf_amd64_fef6efb45cfbe4be\windtun420.inf
                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                    Download Submit

                  • C:\Windows\System32\DriverStore\Temp\{563ed83f-677a-9a4a-b4e1-0cb0baa5b058}\SETB2C5.tmp
                    Filesize

                    10KB

                    MD5

                    4d00baa194a2e39eaa0d9aa32bff8f04

                    SHA1

                    a7d501754bb5d570a95c46ff1df6ad3cbce867fb

                    SHA256

                    4e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b

                    SHA512

                    594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670

                    Download Submit

                  • C:\Windows\System32\DriverStore\Temp\{563ed83f-677a-9a4a-b4e1-0cb0baa5b058}\SETB2D6.tmp
                    Filesize

                    1KB

                    MD5

                    85db3aa1f72f02c9a731a83d7c8a479c

                    SHA1

                    1d133344ff4dd14e16bc130b00d3f44520178e0c

                    SHA256

                    14626c3fe1ddb392a87cb53bc1444a35d1f842d5b9943a2025a5c3c0dd2bd118

                    SHA512

                    11e89da36c1ad5c32422473c80cba34301d7717edc5dee4b04fe263c179520afbcf84fd25178cbb206020c89262a0f843f714461aa1ef5a89ad860fa5b888822

                    Download Submit

                  • C:\Windows\System32\DriverStore\Temp\{563ed83f-677a-9a4a-b4e1-0cb0baa5b058}\SETB2D7.tmp
                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                    Download Submit

                  • C:\Windows\System32\DriverStore\Temp\{e3647958-d1d2-4a45-9dcc-b9aa37436177}\SETA4EB.tmp
                    Filesize

                    7KB

                    MD5

                    51b1f2168f66b3efb3ab6ef3d3e39e2e

                    SHA1

                    28950c1715fb88f9bba794c99eceea2af45c620b

                    SHA256

                    edc65872fa478033c623c4f29fc65ae34820deff38c04bdb472a242255051af0

                    SHA512

                    bb608013d9dec301a5d354e2128defc99db6c01575b1b409fad6756cc3a4474ad7bac7c95e1e2d658eac258c5bd9a51438b6ed05c0369fe90376b5be398d811c

                    Download Submit

                  • C:\Windows\System32\DriverStore\Temp\{e3647958-d1d2-4a45-9dcc-b9aa37436177}\SETA4FB.tmp
                    Filesize

                    10KB

                    MD5

                    18ef4501d1f4acb8de464796cb2780b5

                    SHA1

                    7e76c6703081ac711ac75c36616c4fc38fdee3e2

                    SHA256

                    7a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86

                    SHA512

                    bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff

                    Download Submit

                  • C:\Windows\System32\DriverStore\Temp\{e3647958-d1d2-4a45-9dcc-b9aa37436177}\SETA4FC.tmp
                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                    Download Submit

                  • \??\c:\PROGRA~1\WINDSC~1\tap\TAPWIN~1.SYS
                    Filesize

                    56KB

                    MD5

                    a06a6cca3c5685775a54b1af6c0dc5f6

                    SHA1

                    5b7a5bf57610f7e06b30793c4196242cc238bb54

                    SHA256

                    17c4ab6752636d286ac2bf511484bfa403019dc6ae51d4eb4259604377fce012

                    SHA512

                    7179e7304b176f71aedd0f2a4d0ac9c4baee0603025ae72ec8c4d57aba3a13e598c8b505cff91dae18868cbf0d5e3f31d9cda4325cbfbfe99b4e9aa18264c184

                    Download Submit

                  • \??\c:\PROGRA~1\WINDSC~1\wintun\WINDTU~1.SYS
                    Filesize

                    46KB

                    MD5

                    204f64debf2647874545421e6feaed2b

                    SHA1

                    fc3b676f92d9579d90f4c7bee33eaeb395f9b27f

                    SHA256

                    e36fc07fa803a4c949991ab0a16f5059eab1b91bb280f54ebfda2032ae096b92

                    SHA512

                    5b58282d72e82361720b62f3eb4583f7f56c43fa262f6a335fb37f222288d39e88ec1855d7cd51769ce17cfc1f1c5ccd92f15a1d30be9ddf2df562caf6293195

                    Download Submit

                  • \??\c:\program files\windscribe\tap\tapwindscribe0901.cat
                    Filesize

                    10KB

                    MD5

                    18ef4501d1f4acb8de464796cb2780b5

                    SHA1

                    7e76c6703081ac711ac75c36616c4fc38fdee3e2

                    SHA256

                    7a4e28d944340d2e739fdfe8e3de7c7a254b770e8060ad70ac09e26c1cb10a86

                    SHA512

                    bf834399a4dd776fb44514e2abce1e3ef6ea65543ad67bbc1267400fda8d837b2f42b016e01ea4a3f8d7368d5168157d90735699ce1836944031b5c501f77fff

                    Download Submit

                  • \??\c:\program files\windscribe\wintun\windtun420.cat
                    Filesize

                    10KB

                    MD5

                    4d00baa194a2e39eaa0d9aa32bff8f04

                    SHA1

                    a7d501754bb5d570a95c46ff1df6ad3cbce867fb

                    SHA256

                    4e5c09d6260aab18dc288298f77c8ad977d395ce5fefd4b84bc93df3bdee231b

                    SHA512

                    594d90de4568834f09dd233f28f8765fe8d7e4eca864932572388439462520bf55d19dd0dd3f5ed8544c107d6c0df4556ce37611ee3e7d727bf85d10236a1670

                    Download Submit

                  • memory/1724-336-0x00007FFA99F70000-0x00007FFA9A52F000-memory.dmp

                    Filesize

                    5.7MB

                    Download

                  • memory/1724-357-0x0000015A72FC0000-0x0000015A72FD0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1724-337-0x0000015A72FC0000-0x0000015A72FD0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1724-335-0x00007FF7C5FF0000-0x00007FF7C656F000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/4920-44-0x00007FFA9A780000-0x00007FFA9B241000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4920-35-0x0000000002E90000-0x0000000002EA0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4920-34-0x00007FFA9A780000-0x00007FFA9B241000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4920-33-0x0000000000CF0000-0x0000000000EF8000-memory.dmp

                    Filesize

                    2.0MB

                    Download