Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

Windscribe_2.9.9.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/06/2024, 17:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windscribe_2.9.9.exe

  • Size

    23.5MB

  • MD5

    fa06ef3b79d6858a9c9325624e55f8cc

  • SHA1

    127cb9d116b0256f7eaf993343b87cce82b7fcb2

  • SHA256

    d2a817e8f2738cacc646d3dc2194d7fd28f2ce1de435be24fa98ed8928b4daa2

  • SHA512

    68ba874faf6fede8f0689d4e3835f0cdf79c01aebe91c2fab9a5c981821ee6f52a50e4ff208015e886ee954560f8e1031e926e5362b488e3863aa9a605ec3ba7

  • SSDEEP

    393216:WntmQlURIlyJLsE/sYj0Opz66ggNEMegUplkW1BsxHQSJi7YSl6m7NMo2YgzW1U:ethwIlasS4szNggNPgplHfSdwYS/NMh7

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 52 IoCs
  • Registers COM server for autorun 1 TTPs 7 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windscribe_2.9.9.exe
    "C:\Users\Admin\AppData\Local\Temp\Windscribe_2.9.9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\Temp\WindscribeInstaller5380\Windscribe_2.9.9.exe
      "C:\Windows\Temp\WindscribeInstaller5380\Windscribe_2.9.9.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Program Files\Windscribe\devcon.exe
        "C:\Program Files\Windscribe\devcon.exe" dp_add openvpndco\win11\ovpn-dco.inf
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        PID:988
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\setupapi.dll,InstallHinfSection DefaultInstall 132 C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf
        3⤵
        • Drops file in Drivers directory
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4032
        • C:\Windows\system32\runonce.exe
          "C:\Windows\system32\runonce.exe" -r
          4⤵
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:2124
          • C:\Windows\System32\grpconv.exe
            "C:\Windows\System32\grpconv.exe" -o
            5⤵
              PID:2428
    • C:\Program Files\Windscribe\WindscribeService.exe
      "C:\Program Files\Windscribe\WindscribeService.exe"
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\system32\taskkill.exe
        C:\Windows\system32\taskkill.exe /f /t /im windscribeopenvpn.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2276
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{94c6b6bb-a5fa-e942-a357-e166f26f44fd}\ovpn-dco.inf" "9" "4df7dbc87" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Windscribe\openvpndco\win11"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4132
    • C:\Program Files\Windscribe\Windscribe.exe
      "C:\Program Files\Windscribe\Windscribe.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/signup?cpid=app_windows
        2⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd71533cb8,0x7ffd71533cc8,0x7ffd71533cd8
          3⤵
            PID:1316
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
            3⤵
              PID:3668
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1516
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
              3⤵
                PID:2664
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
                3⤵
                  PID:2252
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                  3⤵
                    PID:648
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:856
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
                    3⤵
                      PID:4824
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
                      3⤵
                        PID:1092
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                        3⤵
                          PID:564
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                          3⤵
                            PID:2980
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
                            3⤵
                              PID:2076
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1782372362483972509,11651136210321704230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1308 /prefetch:2
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2900
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/signup?cpid=app_windows
                            2⤵
                              PID:4020
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd71533cb8,0x7ffd71533cc8,0x7ffd71533cd8
                                3⤵
                                  PID:4744
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2900
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1460

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\PROGRA~1\WINDSC~1\OPENVP~1\win11\ovpn-dco.cat
                                  Filesize

                                  11KB

                                  MD5

                                  959381407468967636f89fb34b5fc7f6

                                  SHA1

                                  451b6b6b5002abed1988ea352a0d50d54c02c72b

                                  SHA256

                                  0d5865336c076505b44083ee3fc3bc66cf9ef4ccd402bebaeeb04cf410755ef1

                                  SHA512

                                  2d8f60cd3ec5bbb3160c9b794750727342e302b9a8f7e422b31d53765c5fe1af9a3bbd72bf823f3e7ddf94f158939fd5c7ee747bfb033b31d96787e0d6bf9cc6

                                  Download Submit

                                • C:\PROGRA~1\WINDSC~1\OPENVP~1\win11\ovpn-dco.sys
                                  Filesize

                                  90KB

                                  MD5

                                  b14e327b9e488acaac78f87f23477dd8

                                  SHA1

                                  9f1a118fd2832b64ff71bdaccecf11077f0d6b2e

                                  SHA256

                                  286da6062f93e3fcbf6cfbc87d78d5b97cb772218b29144667b7307c21477116

                                  SHA512

                                  ca0cb0b6f9e54b5c980dd2e4bf44d4058749dd0ee2c2229aa8b9ab9a229936f3d69b284bbe21e54d42990a8dde5bdda64e5d0aeadcd640237cce413f4f3e84ea

                                  Download Submit

                                • C:\PROGRA~1\WINDSC~1\SPLITT~1\WindscribeSplitTunnel.sys
                                  Filesize

                                  37KB

                                  MD5

                                  645f0da18db24e49fe1be0e95b00df55

                                  SHA1

                                  e04171e15df495abbc2f0f638df825332eae436e

                                  SHA256

                                  6deee2b12d2d8b5fd0fbb50fa740fedadf64ce6b148346f40fc3c100b31ac7d3

                                  SHA512

                                  90a5483b06d7c07f19d491cc3e93d084f128aa952053fa3e41f921937145861ddc2948da595970bb6804a1363ce73fac24028546970bab38653bccfe3541c6e5

                                  Download Submit

                                • C:\Program Files\Windscribe\Windscribe.exe
                                  Filesize

                                  8.1MB

                                  MD5

                                  e4cae8d1b6d0fc03961381d5c289d4cf

                                  SHA1

                                  0623cb9b6cea077f174525c3603661dd22aceaaf

                                  SHA256

                                  4f1068f12361f6dd670c6b78cfed04be7b1903e45dd1520f8b4c9241795da626

                                  SHA512

                                  2ebcf87963d9cc11b9d831afbcf5cef5a21ec4d4507e909951f0f9298275ae5b267bbe3b431208d11143a22d49a23ddb274c969770c6dadd3375105da10efe51

                                  Download Submit

                                • C:\Program Files\Windscribe\WindscribeInstallHelper.exe
                                  Filesize

                                  61KB

                                  MD5

                                  26023b78386d32f4d9a93426caf6ce1f

                                  SHA1

                                  cbe67cfd76ff3c023a784ec9797d172ec34ba274

                                  SHA256

                                  27e2473683428b15affb968507653f33db0b30b5bf202fc719ecafe0b73890fd

                                  SHA512

                                  9d3ef93a75e84cca47fdd1e40c2dec58bc4e646630462e3df40a80e9eb3c5b0c1a0602afd755c8bc31a50b873af4927e18c81ad0ea4076377d67383405a7923c

                                  Download Submit

                                • C:\Program Files\Windscribe\WindscribeService.exe
                                  Filesize

                                  1.0MB

                                  MD5

                                  5add9f80e34104b35ca1b31f98219c29

                                  SHA1

                                  accbafc269c943c5518a9212c76ec39b82610d5b

                                  SHA256

                                  e4a8ca0d014101374d63ce4647f51f1c6d7aa4839226cfb1866ad65754ad85b8

                                  SHA512

                                  857e8e190f74838f1279f42755d048e56760442d4f6d1c873753efb9178afe53601700b0eddce86f022bcc801c7921e744d4bc4fcc9b1b17c07bcf72227d44b0

                                  Download Submit

                                • C:\Program Files\Windscribe\WireguardService.exe
                                  Filesize

                                  309KB

                                  MD5

                                  5e236743db9d174e812f795d652025ef

                                  SHA1

                                  14178ad83fbd0266647d00d567eefc14abc9aa4d

                                  SHA256

                                  888e3a2347d9f6c3a5d15221c48088fb2cda31d0891b5fedf051d217887c99ef

                                  SHA512

                                  746123055100ff28091b3f78dbbd2f20ebca8ed282f7a3c59610b86a9082fa2e64954dc8a211c9dbbc649532e5f7104591db9065d73c4b7fc1b2bd7f5bd98d80

                                  Download Submit

                                • C:\Program Files\Windscribe\cares.dll
                                  Filesize

                                  281KB

                                  MD5

                                  b1ee5c5de28fdca4dc9a67913d268505

                                  SHA1

                                  d031a7b756dd7243e679e69860b8e6c93770d86e

                                  SHA256

                                  8da8dc6456e4dc845063d6335ae7d2fcad4d7f4e0471f9747232259015d79b6d

                                  SHA512

                                  18624c5048e6d4eb5016f6f2302066573c925d4bcb086f8c1eb28e71faff2e3641f105d1668097d9fc0713270a3cea04f306904bb19e04a28be6e4ca97eba842

                                  Download Submit

                                • C:\Program Files\Windscribe\devcon.exe
                                  Filesize

                                  90KB

                                  MD5

                                  4233a3ac58d7883ef1fe5ed5f4807a92

                                  SHA1

                                  d9297b675a3337c2cd92df89ecf3150fd612e12d

                                  SHA256

                                  737196cbeeaf15a4c07c24ccaaa0d3cadb14d49004b3e844cc8385bacc3c25c5

                                  SHA512

                                  cd239d6cbd6475b014898c78c176d9968c692c4c97811eb7a7a55aafd484f36a8d881c2738b120b978c0860f4c48790219dd374df4d003554691b035b09fe865

                                  Download Submit

                                • C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf
                                  Filesize

                                  2KB

                                  MD5

                                  848543a017a9f39bc60a28691cbcd584

                                  SHA1

                                  503ca00b8638c79004890c40efd1bcbc13291b04

                                  SHA256

                                  274e7b2e7f1c15cfaf645a8dbc50c36450eea729af884289854783b702f80e66

                                  SHA512

                                  eb410aa1d6beafb7991703460d1b845b59fd1c0110df99a5d03ab38c4f7e5e07de0429a7a09215b704ccfa2d6a6d6c73d196d1f848894d762fa6b32d3e9834b8

                                  Download Submit

                                • C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf
                                  Filesize

                                  1KB

                                  MD5

                                  90307437aba720a05a4f6568ec8dba2a

                                  SHA1

                                  57ce630dea43cb9b950e39921eaa76e09f598198

                                  SHA256

                                  cfece9ccd31306f8d93bff6e7c5884a5a2c5d3731f051347ae5e491778822b72

                                  SHA512

                                  20b99d2a1e20dbe321239093eca7e261a4d29d5503b21c102c82506363f643f73572028a2c33490458150a8a2b260da6601bd87cfec9ca15a2b6a89744526553

                                  Download Submit

                                • C:\Program Files\Windscribe\tapctl.exe
                                  Filesize

                                  39KB

                                  MD5

                                  dbdce269d97e8c2f567e5e1aaed23ad4

                                  SHA1

                                  f1cd1bf7cd0854080a682ee1ea9b7b32c8f208d5

                                  SHA256

                                  22d933598efbdaa09992e3d2062ed6b02669cafbc77fa0febff66545f93d1715

                                  SHA512

                                  00b24d9c4b75202f5c4e79110bbe187ec9fc074a2e3177df280d436e1267a8bc9bf3fcfdc16ad138c83c0a21e74c5efa36d9ff5c9592544cb343c24c55cf4b69

                                  Download Submit

                                • C:\Program Files\Windscribe\uninstall.exe
                                  Filesize

                                  568KB

                                  MD5

                                  09e2f6a699777f499e251173b1b15704

                                  SHA1

                                  bc50ac01feca63bf968ab37774a9ac83b424fc29

                                  SHA256

                                  57331d263d492a0e223acb714737db0b0597cb142cccde76f9bb83fcf785eaae

                                  SHA512

                                  5833708129256000bc2a8a0e72fa4a996116953aaa6c7934c18b0601960de4266821e87927501f44ae5f8b622ef40718d4c7909ca6ca02b0f78c009d942856ed

                                  Download Submit

                                • C:\Program Files\Windscribe\windscribe-cli.exe
                                  Filesize

                                  109KB

                                  MD5

                                  70240b052b51c1bfa33f290c4ed42988

                                  SHA1

                                  be90860b66562d69e09d3f965fcdd56e4179bccc

                                  SHA256

                                  c5f19caa2ff469434fe65ffe8bf8cd4f9de21631a895a77faff91522820844c9

                                  SHA512

                                  64f727f2859304770dac28f406b47583b10d731bde99f0ee0f9dbc832295d01e66b0282668b127800404a3bf03cab181f7a01516c9a5551b9d87d92f2d9c1df0

                                  Download Submit

                                • C:\Program Files\Windscribe\windscribeopenvpn.exe
                                  Filesize

                                  937KB

                                  MD5

                                  3a4d6052d81c3ef19e5cba44d9a30db0

                                  SHA1

                                  ac0418a8e30567a90d62601d70f40a4dc543e30d

                                  SHA256

                                  21d70b77fed61523a9f35ef1f14d7bd4a453f6a0c536e6e775ae1b9369a20626

                                  SHA512

                                  59b7fb96564b502becb529119a163ded25d8b90c4c512bdbb095d287864c1f149ff16000ae8d58a8e5dcd8cdff81d981a2cc8e04309e864f8cd1ea962ef8762b

                                  Download Submit

                                • C:\Program Files\Windscribe\windscribewstunnel.exe
                                  Filesize

                                  7.8MB

                                  MD5

                                  4214d8f5a1e453242a3b7888462473de

                                  SHA1

                                  b0d12dd0d0b4d9ef4659f9edaf179c1bb232e9ae

                                  SHA256

                                  6d16f92ecba28216a264f33f602d2aa732779781ac249b1d2b0b4d52008f8fcb

                                  SHA512

                                  97dbad12d7aee1acb561d28f900cef79c33d30697b94988ee955cc0b0c3f3c15c73ea784d65696f72a6981e83fc3a1e2e68ad8564066a494adf5705a26a2d9ea

                                  Download Submit

                                • C:\Program Files\Windscribe\ws_com_server.exe
                                  Filesize

                                  121KB

                                  MD5

                                  0be0ce40a74932414f1bad28ee78a09c

                                  SHA1

                                  5d356948bb404d49d6ad7a170b36f0bf724defed

                                  SHA256

                                  d8726f39f1434ae40fa64d20d866f2f5139278ed3802603c68f83e0ea0e5e48f

                                  SHA512

                                  8d34ab378cfeed6769c890c54fd7b555c685395f2c8b25c128c28484111389e7d04be32a21b5602f122d6a8c9e03c670400ef1e2d69c0354b79780f19f62ddf3

                                  Download Submit

                                • C:\Program Files\Windscribe\ws_proxy_stub.dll
                                  Filesize

                                  101KB

                                  MD5

                                  b274d056b9ea01013bab749a5577c532

                                  SHA1

                                  ba3245035cde72c89694b0ea83a0db68a7b78b65

                                  SHA256

                                  4fefcd4b1ce976d65b01b5dee648430a0f0f5b5db138f4f65d2bbb6a0eab55eb

                                  SHA512

                                  4b20eabfd91331b9a1abec18d081140d683f1ef3d327e995140957bc3599f68ee66228d2ffc0d792b55e5ec782570ea28b988b046c8b6c37e74dcc1a407953c5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  Filesize

                                  152B

                                  MD5

                                  bbfb66ff6f5e565ac00d12dbb0f4113d

                                  SHA1

                                  8ee31313329123750487278afb3192d106752f17

                                  SHA256

                                  165401ef4e6bbd51cb89d3f9e6dc13a50132669d5b0229c7db12f2ec3f605754

                                  SHA512

                                  8ea206daabc7895923f3df9798bfd96f459bf859c78f3e5640fad550678b5090539f2a1b590883cd9797efee999acccac16d499772f61f5390e91bcc44d60560

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  Filesize

                                  152B

                                  MD5

                                  9a91b6dd57fc9c4880d34e9e7c6b760f

                                  SHA1

                                  77a09da6ef4343a8b232386e000cd2d6b9fc30a3

                                  SHA256

                                  0170297f0103d4e415653f86dedc31b0827580042f86862206fd3f6f135b543a

                                  SHA512

                                  9fc3b9be931b3edebc4a6809d62d805046bdceb4c27a7db21cfbbcb0e5e253ab529c54d64e465e60904a6ab3b83156e26b97f852c9526f46f037944f806a7f0f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  Filesize

                                  216B

                                  MD5

                                  47e225193457988b862436d5d1a974d4

                                  SHA1

                                  1578447c9dd88c8ee877eea3df10c22925fda4d1

                                  SHA256

                                  df9c110ee5305eaec94a22bfdb84500fe2fc2e62e5c703badb4020b80f749f31

                                  SHA512

                                  a2fbdbf56479bd08fbd62e8662923241de165a58c754df37ee934def44fa810a264c8a0b68dc1a33363b68507e655d30201a2363a3825bd51f3c6f4cd58a7b5d

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  Filesize

                                  240B

                                  MD5

                                  61a53bb581ebda8aa2ca426ed3e6a743

                                  SHA1

                                  4ea9c558fb14a3cf1dd90c50dd135f98480e813d

                                  SHA256

                                  4e2f71f949ac7ecf23c77c5646609b36a5bbf7dcf9f64e187efc44fa00fdc48f

                                  SHA512

                                  0b8f72d625e9d7719266b3e80add5c84d222899b63c5b8c4510497af257e2bd3f4d849851e8fb0ead93c3c879339d178b15ee9ef7af7aca9c5e452ecf90cfe11

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                  Filesize

                                  352B

                                  MD5

                                  4c09eb86f5553764bb2d70e1a6d09d45

                                  SHA1

                                  660c8f20814ad151f083e9413070abc257ca26e5

                                  SHA256

                                  8ad2614e5e8b3d6a73cff09cbe4eb71eedde08adb884b6d8ff3f6402cb101c1e

                                  SHA512

                                  f67ef98dad66daf4ec2cbe4d187d92768d50ed62aad65f4fc95d17dc49e7566a3a3daff1057076cc3437b8a50867caebf812831ac30a48034ff9d3abe76685c9

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  Filesize

                                  5KB

                                  MD5

                                  5222607afa1e8cecc5ffef4b0a18dce6

                                  SHA1

                                  2b94808f5808c91ba9aa9227a2de2d4107cb64ec

                                  SHA256

                                  b6904c225d42b1c466648235d5ccf6286b5676c92a890f8cca0d0c3ba8c97e69

                                  SHA512

                                  6a3148fd3a1ca2c37b4c709cd7d214a97667192e1d14380d2a0ce444f2cea739e4a73ecd5e94295c97e6f91ea7e4c757e90bcb82d79f4ff01e4f71262ec9df6b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  Filesize

                                  6KB

                                  MD5

                                  b5a6b45ac8489c7fc8337d6bf60f3481

                                  SHA1

                                  e70cdd24bd4de20177f9a2b250bb52ffe61c4cd7

                                  SHA256

                                  cbf446db4c73bc442c91cbfa8846109c482527e2a07467db646fbfa05a47f088

                                  SHA512

                                  f9a68949a7c0a98da5fecaed00a99c839badad385292ed6e844f5ee7541b3b54eda0bcb97d8844308c78c0a6932c290fa8e2b3fc64492b6a9d1e9c46c1485be2

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  Filesize

                                  6KB

                                  MD5

                                  b40c611e2fd46a407adf90b1751401d2

                                  SHA1

                                  0f92cbe13a25602e17080e7e5ee50f9b0cfa5d86

                                  SHA256

                                  01a030d1d8e96a86705bf5cdd897dee131053a8ba5b7816bdd5b4b624e08a8ba

                                  SHA512

                                  2621094f622d2bb4cdb2b9ae072eb4c35377505774898c6d54c655bb609d23dd5242f81f75791ca04e13be3f5c26de6bc55cc3836b115fcc96ec8856390e571e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                  Filesize

                                  203B

                                  MD5

                                  57ae29a56f61c43470b014bdb7dbf714

                                  SHA1

                                  6dc476c2c581c4282064de2d61378e2eb6c5a05b

                                  SHA256

                                  cb37043b7fd726f4586a9034c514aaf3baf17d2b2255ea63b809c8aff585b42d

                                  SHA512

                                  81b78cc9f9607441c19f8eb1155913d8c40eebff030474cf313611c5b6689ec3cca999c4f16199d3aec73272d78f86dd7acc570b9b63be7221c1933610b5869f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                  Filesize

                                  203B

                                  MD5

                                  b28e2a76342729be8c2f24be196a5498

                                  SHA1

                                  220ad73ce09e9708c8fcd34905738db49c04b309

                                  SHA256

                                  42ef4991bdeb50c6cfb89ca92d369cf6f611ed559a9d7b5da5cf669fa90a71ba

                                  SHA512

                                  0121241bbd4b6a6cd3826866e49d48d45fc0c75927f06b21ff773673a69e1f7e4e6bf8cc9e45d28eb00b567e70617984848a6d169a5d4cd41d4cbb3413053c7c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                  Filesize

                                  203B

                                  MD5

                                  3aa7507aea1502f3ff6383609b17b8e8

                                  SHA1

                                  a36dc0ddbd54d3a1f64ce2e6d6dbbefaefda7bc1

                                  SHA256

                                  af9f264ac499533b83af4d4a0543f35dfe5d650770ac49080b0aca4f3ffd77cd

                                  SHA512

                                  e60f7d168b3958f89d56f07a856a161d3358c09005218d0e573693715eb44bcc70cd31367c86d9f6b15d25640a280e161441c89bd8b62a4fd73cc16de0752639

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                  Filesize

                                  203B

                                  MD5

                                  912d05268b1187985cd9cfb83c48792f

                                  SHA1

                                  564dac721c21b34d0bfaa89f8ca308891620b144

                                  SHA256

                                  efeb0f4d3ce183a55a363661a3344807941b2ba22e022b035a91980f36dee0ff

                                  SHA512

                                  816879710ff8aed333a51295f80719a18e4e447b505ca4f4e33c829d6166ab3fbcca1f8c3f4a4056790c134b04c8e407319a1fcac0e46cc452480fe656e39921

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                  Filesize

                                  203B

                                  MD5

                                  df572be87febadeed59afeed29f6d9a0

                                  SHA1

                                  83bc03926ccfd15ac5f9a997c167d60cd59ee32d

                                  SHA256

                                  4be7106ae4c2f9075f6e61961d96678a63e6778eefa150e4544607609527605b

                                  SHA512

                                  be111d57bd458fe5be20c04769105b48e0447d9f24c6d86ca97245411a6fd8236f82036180cd34f2f2b782224b2d3588b8c807683aefabf203642232ad92aa6c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f9f0.TMP
                                  Filesize

                                  203B

                                  MD5

                                  be3b5fd56d8533fbbe1f77b03fc4b838

                                  SHA1

                                  3be05de1c0a2d444a3d300fed6785ed40396315d

                                  SHA256

                                  bbdf795dbc210f22cc022e67792637aea74259433edf276add51d5d525c42005

                                  SHA512

                                  fdb75f1cdeb27942be9bfb9ec8ecfdd69d5853736a6a61e91aa2229acce2a75b1d9bfa0d268e3ae60d05bff47c8f2316326b7122464bbb0a58246e5b8529d01d

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  Filesize

                                  11KB

                                  MD5

                                  d15dfeaedfa48e531e4aafd2db63b6cf

                                  SHA1

                                  fd5fdbcaeefca78e46973b1b857626278e6e5344

                                  SHA256

                                  5358fa0460b17ae16ec032e23cec703a8c46d0b5d2fef276e0c47db20e54cef2

                                  SHA512

                                  28580e0564084caf17e2338d90ffd87883e40758d4eea761ff1ed5a2d978ccb54e25c18cf36ff39b4b39f337138038bcba8351e8132786f51221c8d89d5999bc

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                  Filesize

                                  2B

                                  MD5

                                  f3b25701fe362ec84616a93a45ce9998

                                  SHA1

                                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                  SHA256

                                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                  SHA512

                                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\Qt6Core.dll
                                  Filesize

                                  5.5MB

                                  MD5

                                  970df5d767e87c18ebed28381b0f4adc

                                  SHA1

                                  7526a65c6de1ef8971076395655aa7a82f18a6e0

                                  SHA256

                                  238b6dad34d40eb3e1c4999ecd224be2ef0fff3cc7b2587d6b4d9dd260effa49

                                  SHA512

                                  01d7942bcc808a924b881cc9e12add558a70166472e446d787bad0881d69b1802dce4a2e9ab7e17bd33129c5b66528756045dfc189332391a4de49f894e235f5

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\Qt6Gui.dll
                                  Filesize

                                  7.4MB

                                  MD5

                                  0ab8efed44e94227d814f456e51f0b57

                                  SHA1

                                  22a55fa81689d7314424083e515f9c8819c9cf17

                                  SHA256

                                  1c7b79a164335b8c43d7267fa8a0ee43a2bdeb957aef167b38bfedda21cff825

                                  SHA512

                                  95cf380fa921f127deb40da22788b1b41c0a47f8a31d7656e02c11ba69d360609527b6b9ff7ec236bec139cea59453634e845058d06adfe9fbce0dd82bd36b23

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\Qt6Svg.dll
                                  Filesize

                                  355KB

                                  MD5

                                  8699b8bada8fec14462321757e89cf9a

                                  SHA1

                                  d5b7e1d0e96d3f73f65221a625e4d5f6033cfcfc

                                  SHA256

                                  70bd4c4cdf70865645e86a0b1dea58eff111a1d588f6654a972a137c000b87e1

                                  SHA512

                                  395e9efbe2e992e15a7a89424b86f394e32c19563a5da2dbc1afd14f1f453cfd72ae76754c475075e7b7f99b4a88a23cf8f2d5330ec211e44c4eee1623b900bd

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\Qt6Widgets.dll
                                  Filesize

                                  5.8MB

                                  MD5

                                  fe5d94996b8128747762cf0fdcab1f82

                                  SHA1

                                  3cb1bc591d55c4e5f76be53c3993eaab7e67541c

                                  SHA256

                                  05362dfd5ce0ab18988d878240f1daec2c505fb60cfb85636444c1843692e4a3

                                  SHA512

                                  c91be91786e38341ad83eb38ba27e4110d18c24b03f088aced46b32eb3fe9d81bf89c5bec4b8da1b84252fe78d3294dee1230ff79bd9308e979d0b9b219eab53

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\Windscribe_2.9.9.exe
                                  Filesize

                                  17.2MB

                                  MD5

                                  fdeb9a244513cb4d70317c94a6c867c4

                                  SHA1

                                  14d9029511fa9fd3ae6a8b3db5e9190ad55978d7

                                  SHA256

                                  5c3b684ef76fee5c626121a6a8ed563df15a7dc420bc04573dca14efc9b5ba8f

                                  SHA512

                                  a741c5b2d990454b9f734ad056f865312064b12de01ea59a57dc1c58af30c88de291812a804a582bab5946e295e129a7a5a719cf3ac901bf3e9ee27b2d65c29a

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\concrt140.dll
                                  Filesize

                                  310KB

                                  MD5

                                  b7ff8e74ab911b76f4fe2fbdc2c3cea1

                                  SHA1

                                  7ca4395c9083838052677ca55af0c15bc7f6c94d

                                  SHA256

                                  d1a9b1a0ebe71e886b42a59faa67d4bf7646c3f46e0153dd2519b0e77ebbcdc5

                                  SHA512

                                  37125fd1fc0de5f3101437b7a0ce6b72737d5a6093d26e3fe911b575aa0116c0e7c64b67c4b66da20173f9c72b3617e42aeeeb2eb67f4d2a04846e5f24311ff2

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\imageformats\qgif.dll
                                  Filesize

                                  47KB

                                  MD5

                                  26574147ca3f4b70e868cd717e69a58f

                                  SHA1

                                  fd3f725c56c4d2baa2d831b077a9ce2f101e2689

                                  SHA256

                                  ce34841b2350a0fcfc9250203c81192ea4babca587375ec9fac2e55267a6fcf3

                                  SHA512

                                  8b75a6afb0ccd50f5a1cbbc16f0a04e170263e7629980e8fc7406dfa6f4e074d33317a4a3c8c6f9e201faf14ebfcbe99a7584a88351d3786b4e2dbf31ca41911

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\imageformats\qico.dll
                                  Filesize

                                  46KB

                                  MD5

                                  3db1047b43a8eab09b9789529889341d

                                  SHA1

                                  4604eb1d86c6bb1561d1f2fb75ef61c3f959a1c3

                                  SHA256

                                  7d689613ff4784dd8afd3ee4429027c46432119b25786691d7da67f24b7ebd6d

                                  SHA512

                                  6490788dcc4b8f071d52dbcb12967ea37e4dda930f2fa548621f88e28ae096b084ada0822676a3ba6157b802fe0b40d9185cf3715efe5d78cbcfb830e3f104da

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\imageformats\qjpeg.dll
                                  Filesize

                                  445KB

                                  MD5

                                  ee879fe49a874af52b6abf9076ae8fe9

                                  SHA1

                                  7bc23a9615bdf2ff32e961faae1d0223e40d5fdf

                                  SHA256

                                  3e1d675563585303e4c3276baa3915a88d540af2a22d04fcda43f4645d1c05e6

                                  SHA512

                                  f3e9cbdbf9fef3e9014c5fc3edb6bd8e001b6575b263d43dc8df7281e6104f88a8bf7ad25657183b91368e6fd8a8c6da608b7dbdf3f8fee393c4a1a9ac8722a6

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\imageformats\qsvg.dll
                                  Filesize

                                  39KB

                                  MD5

                                  5bee238b2ca3eca6ab04aa9a61ce3224

                                  SHA1

                                  097a4273e0ca8d1f29f78e9fbbfdb95a4894a1b1

                                  SHA256

                                  c540dc238325fdc9b183efc6f95639b58df4400dc4074e43e43588e3eb3d2451

                                  SHA512

                                  aaf32a8bded590c711c292fdf6d7382d818460033f730a67376ed475226a0989b0941d54067e44ae4138ba0f4b487b32a7e7311059afdfb7c6e0ca1f2324d4df

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\msvcp140.dll
                                  Filesize

                                  554KB

                                  MD5

                                  0d89995cc45c7eb40e5a7e287506c1e9

                                  SHA1

                                  096c27b06ee7fff2bcd290af0264cdafd04cded9

                                  SHA256

                                  e0a22a594e148fa55ceef3e49969bfa77011a801267a0bd7805b681b593c9d0b

                                  SHA512

                                  3497c2957d10fcddeec8f312fb15c53f82d770dcc3e771a94daf4f4435c3ddf323ecd33310baaf1ad56673bac7c6268a9ef921d5f32cf7e4a7c9dcb0d8aafa63

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\msvcp140_1.dll
                                  Filesize

                                  24KB

                                  MD5

                                  c060bb176a671f068362db2673a08c5e

                                  SHA1

                                  1d6b4ae5e778f1daf3573d4817777a51c35cbac4

                                  SHA256

                                  768e0829decea713afb35a7de07e276f051581c8ff2c17e1bae9b07dd1445dd0

                                  SHA512

                                  78a6c8f76d3ebd8db9c784d7775ec44647c4776fcb11d0b32ae2b3a6f2837c0b3be12f053ef6a25811a68da17d0eea83077521f496e238757f5539b445a58a7d

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\msvcp140_2.dll
                                  Filesize

                                  182KB

                                  MD5

                                  94bc7a22ec7308f851cc58fd6de90b2d

                                  SHA1

                                  cb4d8dcd2c8e9bbf049c1628246cb12cdd34b353

                                  SHA256

                                  5c12eaef6db18b168f712bff9b55793e0effddf15b89552e7f5ca4f8f1887b9b

                                  SHA512

                                  87791e992ccb43c833ea6ef2b0fa146031e0fd26305c93d77bc693473292f5b54d36516f3294edcc1c253d2decc166fdd1767c659f65e7d7e447cd8c318b7c96

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\platforms\qwindows.dll
                                  Filesize

                                  823KB

                                  MD5

                                  b282a6b3a3e4ed8c42f4419a9db87e41

                                  SHA1

                                  4a39e285182a5c5c311efe0c04ac8ab5f0e5dfdb

                                  SHA256

                                  5918f2fdbe3be8410d8c255f7174a92e407e299ba8f66616b52f75fe25fda618

                                  SHA512

                                  e1b9cc8108102dff6c98818787f5921e4cf6f4cba26d1b24a443c5c58129be2e9d533d7026125ab19238af05fd7854a8b3399ecda643f48824b51e6ab7b523b5

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\styles\qwindowsvistastyle.dll
                                  Filesize

                                  138KB

                                  MD5

                                  a9ea33827f593d4ff121eb27da14017c

                                  SHA1

                                  2b45c65e083b05559ddd27f23d61c359b9b527d4

                                  SHA256

                                  f605cf01582c022a21f0c2faffd13e4f46d596727806793a708eaaa1ec3f7859

                                  SHA512

                                  586f11f2899b1ed8f2257d0e9cc433bcaede5c64c0e702981483b059a12c5899e972bea9fcbfc638e13d9659562b4f3a735b6ff9a0507f141b7405afab8caeac

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\vccorlib140.dll
                                  Filesize

                                  327KB

                                  MD5

                                  b2b992faefa1bdf7445ae4e6435bd0b5

                                  SHA1

                                  499e221690ce4f0ac4ecd11968fa15fd09ffb84b

                                  SHA256

                                  3e194d5ab03fdb1e97b0bae61070994013487c567f82c9338e7adc202f7d7d67

                                  SHA512

                                  90de9bdb6011f2c611ea5549a296e62656d1e66dd7dbe44b6fdefc655a613599ab3991ed5a390c22c9c0aa9ba5432da97a62bdc79e656659c9ef2a071469a0f8

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\vcruntime140.dll
                                  Filesize

                                  96KB

                                  MD5

                                  a4cf5c1f71c540c69371c861abe57726

                                  SHA1

                                  f272b34182db8a78ffc71755b46a57a253fcd384

                                  SHA256

                                  c179d8914ba8e57b2f8f4d6c101c2c550c7c6712a7f0f9920a97db340f9d9574

                                  SHA512

                                  f2b53f28a6369f76b22e99fddfb86730f3d33e87c68dae7aa3d05808223693bb86ade263cccb99d5462cf98eeeaa6a6f1cfe5ea3aa1739f8ad6eb624caff1045

                                  Download Submit

                                • C:\Windows\Temp\WindscribeInstaller5380\vcruntime140_1.dll
                                  Filesize

                                  37KB

                                  MD5

                                  9f4eac207cb58e8d110477e7fd19d565

                                  SHA1

                                  687051b863f7a7178cabf9c06ab3b534b1e23dd3

                                  SHA256

                                  7cf38d20d00b6640d510eab70171e1c6f8fa2e42040832e17c7433ab61d94a8e

                                  SHA512

                                  9c5c4499adfc7b61751510f52a1288ff386dd1c1aaf8e8a9660990194813394329f8123f38e026ea10c6e30b4a5506625b9060329d524db68e48f36ab2691a05

                                  Download Submit

                                • memory/2476-259-0x00007FF74ACF0000-0x00007FF74B515000-memory.dmp

                                  Filesize

                                  8.1MB

                                  Download

                                • memory/2476-258-0x00007FFD6F0B0000-0x00007FFD6F676000-memory.dmp

                                  Filesize

                                  5.8MB

                                  Download

                                • memory/3152-51-0x00007FFD702B0000-0x00007FFD70876000-memory.dmp

                                  Filesize

                                  5.8MB

                                  Download