8a4bc3c07e092cff01adc4db11e1638425ce9659d1bc5ae7f2bf892786a25d71

Analysis

max time kernel
56s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Windscribe_2.10.15.exe
Size

24.6MB
MD5

86b2e5afec657a4524fb0807403d64fa
SHA1

47434dfda77637d58bf89e9068a200a8c57f46b1
SHA256

8a4bc3c07e092cff01adc4db11e1638425ce9659d1bc5ae7f2bf892786a25d71
SHA512

2a511bd968ba121bc2fbf8fc5885d50c6e819c221c98093f40b4fc21741b721541e30cf552eb0fe60311bf6279e252955d4cdf7d9b85bd6c4834e28eab70686a
SSDEEP

786432:AthwIlasS4HIka0h4qkcfwKL1CfkEdtgce:uO4HpMU1ge

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\windscribesplittunnel.sys	Windscribe_2.10.15.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	Windscribe_2.10.15.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
4244	Windscribe_2.10.15.exe
1612	WindscribeService.exe
1704	devcon.exe
1208	Windscribe.exe

Loads dropped DLL 64 IoCs

pid	Process
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
1612	WindscribeService.exe
4244	Windscribe_2.10.15.exe
4244	Windscribe_2.10.15.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_f135de63b169e67c\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET199F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\ovpn-dco.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_f135de63b169e67c\ovpn-dco.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET19A0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET19A0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET199E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET199E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\ovpn-dco.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET199F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_f135de63b169e67c\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windscribe\cares.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\platforms\qwindows.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-filesystem-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\ws_com.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.cat	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-namedpipe-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\ucrtbase.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\imageformats\qico.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\Qt6Svg.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\qt.conf	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\ws_com_server.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\msvcp140_2.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\Qt6Gui.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-errorhandling-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-processenvironment-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\WireguardService.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\log_installer.txt	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\WindscribeService.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-process-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-console-l1-2-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-file-l2-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\vccorlib140.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-processthreads-l1-1-1.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\imageformats\qgif.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-handle-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\windscribeopenvpn.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\msvcp140_1.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-synch-l1-2-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\wsnet.dll	Windscribe_2.10.15.exe
File opened for modification	C:\Program Files\Windscribe\concrt140.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-timezone-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-environment-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.sys	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\tls\qschannelbackend.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\windscribeservice.log	WindscribeService.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.cat	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-file-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-interlocked-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-runtime-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\windscribe-cli.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\vcruntime140.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-locale-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\spdlog.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\imageformats\qsvg.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\open_source_licenses.txt	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-util-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\Qt6Network.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-math-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-time-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\tunnel.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.inf	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-profile-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-heap-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-convert-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-crt-utility-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\WindscribeInstallHelper.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-debug-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\api-ms-win-core-string-l1-1-0.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\Qt6Core5Compat.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\imageformats\qjpeg.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\windscribectrld.exe	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\concrt140.dll	Windscribe_2.10.15.exe
File created	C:\Program Files\Windscribe\vcruntime140_1.dll	Windscribe_2.10.15.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023534-190.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1520	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\InProcServer32\ = "C:\\Program Files\\Windscribe\\ws_proxy_stub.dll"	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ProxyStubClsid32	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\NumMethods\ = "3"	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InprocServer32\ = "C:\\Program Files\\Windscribe\\ws_proxy_stub.dll"	Windscribe_2.10.15.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\CLSID	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7160B73-174A-4559-89B5-F1E99BA45F1B}	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ = "PSFactoryBuffer"	Windscribe_2.10.15.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Interface	Windscribe_2.10.15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\Elevation\Enabled = "1"	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\Elevation\IconReference = "@C:\\Program Files\\Windscribe\\ws_com.dll,-102"	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ProxyStubClsid32\ = "{C7160B73-174A-4559-89B5-F1E99BA45F1B}"	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalizedString = "@C:\\Program Files\\Windscribe\\ws_com.dll,-101"	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\InprocServer32	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalServer32	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clsid\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\Elevation	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\InProcServer32	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\InProcServer32\ThreadingModel = "Both"	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\ = "IAuthHelper"	Windscribe_2.10.15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7160B73-174A-4559-89B5-F1E99BA45F1B}\NumMethods	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\ = "Windscribe CAuthHelper"	Windscribe_2.10.15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B8E661E9-A6D5-463D-9EF3-0434D51AEA3B}\LocalServer32\ = "C:\\Program Files\\Windscribe\\ws_com_server.exe"	Windscribe_2.10.15.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4244	Windscribe_2.10.15.exe
1208	Windscribe.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1208	Windscribe.exe
1208	Windscribe.exe
1012	msedge.exe
1012	msedge.exe
5108	msedge.exe
5108	msedge.exe
904	identity_helper.exe
904	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4244	Windscribe_2.10.15.exe
1208	Windscribe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAuditPrivilege	2144	svchost.exe
Token: SeSecurityPrivilege	2144	svchost.exe
Token: SeDebugPrivilege	1520	taskkill.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4244	Windscribe_2.10.15.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
1208	Windscribe.exe
1208	Windscribe.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe
1208	Windscribe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4244	2192	Windscribe_2.10.15.exe	86
PID 2192 wrote to memory of 4244	2192	Windscribe_2.10.15.exe	86
PID 4244 wrote to memory of 1704	4244	Windscribe_2.10.15.exe	90
PID 4244 wrote to memory of 1704	4244	Windscribe_2.10.15.exe	90
PID 2144 wrote to memory of 2764	2144	svchost.exe	93
PID 2144 wrote to memory of 2764	2144	svchost.exe	93
PID 1612 wrote to memory of 1520	1612	WindscribeService.exe	96
PID 1612 wrote to memory of 1520	1612	WindscribeService.exe	96
PID 1208 wrote to memory of 5108	1208	Windscribe.exe	100
PID 1208 wrote to memory of 5108	1208	Windscribe.exe	100
PID 5108 wrote to memory of 4384	5108	msedge.exe	101
PID 5108 wrote to memory of 4384	5108	msedge.exe	101
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 4348	5108	msedge.exe	102
PID 5108 wrote to memory of 1012	5108	msedge.exe	103
PID 5108 wrote to memory of 1012	5108	msedge.exe	103
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104
PID 5108 wrote to memory of 3556	5108	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\Windscribe_2.10.15.exe
"C:\Users\Admin\AppData\Local\Temp\Windscribe_2.10.15.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\Temp\WindscribeInstaller26782\Windscribe_2.10.15.exe
  "C:\Windows\Temp\WindscribeInstaller26782\Windscribe_2.10.15.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files\Windscribe\devcon.exe
    "C:\Program Files\Windscribe\devcon.exe" dp_add openvpndco\win10\ovpn-dco.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1704

C:\Program Files\Windscribe\WindscribeService.exe
"C:\Program Files\Windscribe\WindscribeService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /t /im "C:\Program Files\Windscribe\windscribeopenvpn.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1259f5fa-8574-fc49-b347-145f826621a5}\ovpn-dco.inf" "9" "4da2b0e67" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Windscribe\openvpndco\win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2764

C:\Program Files\Windscribe\Windscribe.exe
"C:\Program Files\Windscribe\Windscribe.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/signup?cpid=app_windows
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbbb4546f8,0x7ffbbb454708,0x7ffbbb454718
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2289766513990884689,4621257439692595379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windscribe\WindscribeService.exe

Filesize
555KB

MD5
64a2e76ee90cc50c042b5b648dfd3870

SHA1
e50d09632d4ffcbdeba4bf7a748a974b954958f1

SHA256
dba5fbd404a2fb32e74ce962b4115da6507e1f3f0f1a4fd605243e082b113cab

SHA512
386831b7d66e6eb8af37d9197aaa2fc08ca8f4e841f80bb5b4304a821196adff8a48aaaf8c74b677989fc76b58a509b1d3c65ad2ba5e00a47cf85d763792d12c

Download Submit
C:\Program Files\Windscribe\boost_serialization-vc142-mt-x64-1_84.dll

Filesize
221KB

MD5
714bf512807f97b90b97d9ebd175b7db

SHA1
9b243a8683976eaa57919fd0fcbfa993fbe571bf

SHA256
e559ef6cf20172412d791cd47c44b3c67198cfe99eff583f57a6ebdb5045443c

SHA512
79cb3c689839604315e6a766294f33c9788c475941c1b369738c7fb4fd1ffeaabc9537c6a9282ea03e15c94583a0ccd3ef09d7a6152dad06ee27f27e4826d289

Download Submit
C:\Program Files\Windscribe\cares.dll

Filesize
153KB

MD5
4fc41b12e541697732281141d52af223

SHA1
5aa24d35e7f8739ae4eb33ea0a419f773c2cb12e

SHA256
5b65c11de0ac989ef7d59e1a328f68f8f6bb0815335aecc086ba0a691c05ef6a

SHA512
8dfdfc183fa7b2755b565dec88eb5031dfd07aef13b06a86ea4947523259fbf86d1027edbcf6b6a296eacf22875f9a1c472a3f84a3b05cc7d91b92ba9e83305e

Download Submit
C:\Program Files\Windscribe\fmt.dll

Filesize
146KB

MD5
bf065e11b04d9bccbce2a5cb4fe635a1

SHA1
e8c59d4e0e249c3be146da53343dea0e0530b2a5

SHA256
0d2e9dac453a9dc0bc21b7dbdb90b9e280dc69387bdc497cb205dfb33202f7c3

SHA512
3d62538517a28ee903197453f5e3be992d84dba327746d5fb2f9034abe1e3cb6ab86869d1ca0dc976486dcd0187e156408cb3216593ce724783cbd2a499c7168

Download Submit
C:\Program Files\Windscribe\libcrypto-3-x64.dll

Filesize
4.4MB

MD5
0bf17fb26cec131e23d3f1c8ffb420f2

SHA1
a8c96cbf1b8318fa09a83b7893867a6609e613a1

SHA256
c8c2ed7d21002a834899fa3a89f9f5afccb54224d4f085baf5031185527bb823

SHA512
7725e0b0e506c5b9ec9856b1c86f68189d16b12221ec14b3fece057f896fa48d06e85957afde782aeea1cd4c98cacfdd3514a3c7001e6f585d697b04a141b8b4

Download Submit
C:\Program Files\Windscribe\libcurl.dll

Filesize
578KB

MD5
a0e6e901eccefd133b1927df8e723bd0

SHA1
bb3f7158b5f1f62e884384fb26844d7838b2a502

SHA256
631a338d41bacadaf106116a390a94c1e49bf45498a1a91f877018649225cf2f

SHA512
ff0ea1cee57c8e6fcbc1de10726773fca73cd52db244d570090f118f0c99f265d28e9ead8364d2040b8b88355a73f7b82e5a0085e08fe11b712efac40178d66b

Download Submit
C:\Program Files\Windscribe\libssl-3-x64.dll

Filesize
840KB

MD5
04e775be867bd37b47bf4b2965838f25

SHA1
c772740f488f830f7d4a025343dd5fd8c8a52701

SHA256
6a725dfd17976729c66ede3bba77adc19982861cb21e83fa18a946b71156dadc

SHA512
ed18b67c2b2472aa0678b402fce866684739c436f099a4082a1402ec0b42e4631ea61007cd71fe9746d114c63bfc388143eebb1399ee8b9b741d6babaa4b3753

Download Submit
C:\Program Files\Windscribe\spdlog.dll

Filesize
258KB

MD5
82746a023a711fc1e25c727840ca055b

SHA1
528676ebebb6e0c6f99d26bdac0f98af2e2f2e74

SHA256
b71a6eed1c192e5a5fdc4283f02943b40282a26e09401df5959ad7d5d2481da2

SHA512
26dbc548a53dd569d15e3097cc37997d08ae4988b6c72fb0496d6096b12e428a39a7a8916f87e0ceb72a686321bd58a2f4bb5b0a64c22c959f3f1d0c50c057a6

Download Submit
C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys

Filesize
37KB

MD5
645f0da18db24e49fe1be0e95b00df55

SHA1
e04171e15df495abbc2f0f638df825332eae436e

SHA256
6deee2b12d2d8b5fd0fbb50fa740fedadf64ce6b148346f40fc3c100b31ac7d3

SHA512
90a5483b06d7c07f19d491cc3e93d084f128aa952053fa3e41f921937145861ddc2948da595970bb6804a1363ce73fac24028546970bab38653bccfe3541c6e5

Download Submit
C:\Program Files\Windscribe\wsnet.dll

Filesize
2.6MB

MD5
4dce9d986223031cb3404813165ab26b

SHA1
1b63b85bb165eb97eae80eb81b40707869a5e4ee

SHA256
435cdfdf5af4b47ff8f3b4a9c7fcf14c2c00d73fbab46a286a6222055b947c87

SHA512
c13c8116aa4cc46bea9758f7987315bb9ada367ab5b87c1f493e6a34ecb9ecdfd835cf040dbb8f4879faa5fde01ac99b72c5e9d1e0f592293e870c7cb19d4c9e

Download Submit
C:\Program Files\Windscribe\zlib1.dll

Filesize
96KB

MD5
dd5bb2d872b16a1414ef87104ba469c4

SHA1
351ae2942082cee79b28b32a9b618fb1d45328a2

SHA256
7f7512472fc8acf452d1d997cfc666cf6a4ab324635d87c7aea13bd6ff41d05e

SHA512
8403675faf951c102d1d9be1e9beb95a077eeb35f736b2d2a034f608e29cbec33e30fe78d69b71792801b787d2eac82729197e114ca0414bee72c65e12bbdd45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4be1b96484d4b2f08633739efc4df93c

SHA1
b80f2e94bb0f3c4f8d9daf3327487b9e5454d97a

SHA256
67e265f1d2e1d53343f895188f67bbb571ff039438ae51207c92ce8ff278cd6d

SHA512
1eba673a99e27634dfe8907d8599f4fa5b3c9f17af08d0c0319ba27850520ae01e7b9575972ae4f8c32e8a8dc6eb63ef2e9f6b946c1b445b35cbbd0472777eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22f4fc6a1c162dc3dd50c211673704e1

SHA1
2e1fe7385e6a32c69de59880f8055410d2a2bf7d

SHA256
facae1e092296ebbf209b36973391c2826401dc3ab13404e0c792ff7d18e7fe8

SHA512
8465dc155c30e5bf02df83e6e50188008748694d84cc683e39b40629979f47c14a1b184bab66d6910370662d39b7855a81b8f611750cabf0c017c7ca82be8936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
338b87eb0d78ce4f2b987b5c9be1d189

SHA1
c19e64a5af9e9783039f089eee87bde4e232834c

SHA256
e09e269a6e27cbc9dbe51c03ecd44ae1f160e15e3c61d92c00b1ab8b7e3ce2ae

SHA512
efe67c91041ac070c2205459dbf1b6fc4eca8902ad7f985b2c723385231c8b75914c098b5e73e4ba7e87b866919ff48a737b9a4306d4b71be65577301b0330ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f029fac3fb58db330087c61f248e9bb

SHA1
67834ab39b56de00e897f3145a7484d943176d0d

SHA256
b55e097547c89905fff7a370fcd42c7fd4c54e12ea70cc228b64b1f61739eab6

SHA512
11ec237ce13a79bf010f3f64bd7545ebe065a913dca486ac975a9c41398a16801fd377ed53f933be84e003b19249bc73c36df64bbc5d5dee846cc4e2804fa271

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1259f5fa-8574-fc49-b347-145f826621a5}\ovpn-dco.inf

Filesize
2KB

MD5
848543a017a9f39bc60a28691cbcd584

SHA1
503ca00b8638c79004890c40efd1bcbc13291b04

SHA256
274e7b2e7f1c15cfaf645a8dbc50c36450eea729af884289854783b702f80e66

SHA512
eb410aa1d6beafb7991703460d1b845b59fd1c0110df99a5d03ab38c4f7e5e07de0429a7a09215b704ccfa2d6a6d6c73d196d1f848894d762fa6b32d3e9834b8

Download Submit
C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET199E.tmp

Filesize
11KB

MD5
aef0e27079a550a9bfcefef6527f9d1c

SHA1
55c550b83cbd9028980dec0cc2eeb6a03f2fc14f

SHA256
8a3e337bc299c6d8891639cb2e73c45b6683d48d42b43bfb8c1f6f40a1679018

SHA512
ba241bacd54afdafeac4f166e8a61a10fb4c7fc2eb3ad8e6b10a2416e7e2ce437d51b22f86c6eee3538548715d3bd0771b888660a8a5c74c5fece20eed9012e8

Download Submit
C:\Windows\System32\DriverStore\Temp\{a65832e8-b89f-2541-9413-8e533d102ade}\SET19A0.tmp

Filesize
89KB

MD5
b24000bb104d39e8b8b07855ff6f04d8

SHA1
8241a82a0387b17a3d90f3297c43187d0d684fb1

SHA256
d2d80e8ab1116d478ab8146605536eb68408d245b520cee0ff4de666e5050bb7

SHA512
b72190a5da7bc2648737bd525a89d737599fedf8f900ff61b9ab0448354e91c2323ea70987952fc191acdeddf0733085179d507282f9910a8ae1456617d913af

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\MSVCP140.dll

Filesize
554KB

MD5
0d89995cc45c7eb40e5a7e287506c1e9

SHA1
096c27b06ee7fff2bcd290af0264cdafd04cded9

SHA256
e0a22a594e148fa55ceef3e49969bfa77011a801267a0bd7805b681b593c9d0b

SHA512
3497c2957d10fcddeec8f312fb15c53f82d770dcc3e771a94daf4f4435c3ddf323ecd33310baaf1ad56673bac7c6268a9ef921d5f32cf7e4a7c9dcb0d8aafa63

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\Qt6Core.dll

Filesize
5.5MB

MD5
970df5d767e87c18ebed28381b0f4adc

SHA1
7526a65c6de1ef8971076395655aa7a82f18a6e0

SHA256
238b6dad34d40eb3e1c4999ecd224be2ef0fff3cc7b2587d6b4d9dd260effa49

SHA512
01d7942bcc808a924b881cc9e12add558a70166472e446d787bad0881d69b1802dce4a2e9ab7e17bd33129c5b66528756045dfc189332391a4de49f894e235f5

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\Qt6Gui.dll

Filesize
7.4MB

MD5
0ab8efed44e94227d814f456e51f0b57

SHA1
22a55fa81689d7314424083e515f9c8819c9cf17

SHA256
1c7b79a164335b8c43d7267fa8a0ee43a2bdeb957aef167b38bfedda21cff825

SHA512
95cf380fa921f127deb40da22788b1b41c0a47f8a31d7656e02c11ba69d360609527b6b9ff7ec236bec139cea59453634e845058d06adfe9fbce0dd82bd36b23

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\Qt6Svg.dll

Filesize
355KB

MD5
8699b8bada8fec14462321757e89cf9a

SHA1
d5b7e1d0e96d3f73f65221a625e4d5f6033cfcfc

SHA256
70bd4c4cdf70865645e86a0b1dea58eff111a1d588f6654a972a137c000b87e1

SHA512
395e9efbe2e992e15a7a89424b86f394e32c19563a5da2dbc1afd14f1f453cfd72ae76754c475075e7b7f99b4a88a23cf8f2d5330ec211e44c4eee1623b900bd

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\Qt6Widgets.dll

Filesize
5.8MB

MD5
fe5d94996b8128747762cf0fdcab1f82

SHA1
3cb1bc591d55c4e5f76be53c3993eaab7e67541c

SHA256
05362dfd5ce0ab18988d878240f1daec2c505fb60cfb85636444c1843692e4a3

SHA512
c91be91786e38341ad83eb38ba27e4110d18c24b03f088aced46b32eb3fe9d81bf89c5bec4b8da1b84252fe78d3294dee1230ff79bd9308e979d0b9b219eab53

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\VCRUNTIME140_1.dll

Filesize
37KB

MD5
9f4eac207cb58e8d110477e7fd19d565

SHA1
687051b863f7a7178cabf9c06ab3b534b1e23dd3

SHA256
7cf38d20d00b6640d510eab70171e1c6f8fa2e42040832e17c7433ab61d94a8e

SHA512
9c5c4499adfc7b61751510f52a1288ff386dd1c1aaf8e8a9660990194813394329f8123f38e026ea10c6e30b4a5506625b9060329d524db68e48f36ab2691a05

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\Windscribe_2.10.15.exe

Filesize
17.9MB

MD5
9d98b2b4d6f9ce1952cc88987b3e87c8

SHA1
b0d43f100ef316fed7671aa2bca169b83172e75c

SHA256
c0958bdb7d952cafca3266897ca43338bfa0567dcc2e7bcd0e7b6f326727cb4d

SHA512
592fc73cd3323660674e0d09e0684a290017c577091f4ba66b5091c41e7481689e677b4bdbbce6fcb7cbaf69d74529dc415129e1723082f8a0bb0fa8c07226e4

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\concrt140.dll

Filesize
310KB

MD5
b7ff8e74ab911b76f4fe2fbdc2c3cea1

SHA1
7ca4395c9083838052677ca55af0c15bc7f6c94d

SHA256
d1a9b1a0ebe71e886b42a59faa67d4bf7646c3f46e0153dd2519b0e77ebbcdc5

SHA512
37125fd1fc0de5f3101437b7a0ce6b72737d5a6093d26e3fe911b575aa0116c0e7c64b67c4b66da20173f9c72b3617e42aeeeb2eb67f4d2a04846e5f24311ff2

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\imageformats\qgif.dll

Filesize
47KB

MD5
26574147ca3f4b70e868cd717e69a58f

SHA1
fd3f725c56c4d2baa2d831b077a9ce2f101e2689

SHA256
ce34841b2350a0fcfc9250203c81192ea4babca587375ec9fac2e55267a6fcf3

SHA512
8b75a6afb0ccd50f5a1cbbc16f0a04e170263e7629980e8fc7406dfa6f4e074d33317a4a3c8c6f9e201faf14ebfcbe99a7584a88351d3786b4e2dbf31ca41911

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\imageformats\qico.dll

Filesize
46KB

MD5
3db1047b43a8eab09b9789529889341d

SHA1
4604eb1d86c6bb1561d1f2fb75ef61c3f959a1c3

SHA256
7d689613ff4784dd8afd3ee4429027c46432119b25786691d7da67f24b7ebd6d

SHA512
6490788dcc4b8f071d52dbcb12967ea37e4dda930f2fa548621f88e28ae096b084ada0822676a3ba6157b802fe0b40d9185cf3715efe5d78cbcfb830e3f104da

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\imageformats\qjpeg.dll

Filesize
445KB

MD5
ee879fe49a874af52b6abf9076ae8fe9

SHA1
7bc23a9615bdf2ff32e961faae1d0223e40d5fdf

SHA256
3e1d675563585303e4c3276baa3915a88d540af2a22d04fcda43f4645d1c05e6

SHA512
f3e9cbdbf9fef3e9014c5fc3edb6bd8e001b6575b263d43dc8df7281e6104f88a8bf7ad25657183b91368e6fd8a8c6da608b7dbdf3f8fee393c4a1a9ac8722a6

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\imageformats\qsvg.dll

Filesize
39KB

MD5
5bee238b2ca3eca6ab04aa9a61ce3224

SHA1
097a4273e0ca8d1f29f78e9fbbfdb95a4894a1b1

SHA256
c540dc238325fdc9b183efc6f95639b58df4400dc4074e43e43588e3eb3d2451

SHA512
aaf32a8bded590c711c292fdf6d7382d818460033f730a67376ed475226a0989b0941d54067e44ae4138ba0f4b487b32a7e7311059afdfb7c6e0ca1f2324d4df

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\msvcp140_1.dll

Filesize
24KB

MD5
c060bb176a671f068362db2673a08c5e

SHA1
1d6b4ae5e778f1daf3573d4817777a51c35cbac4

SHA256
768e0829decea713afb35a7de07e276f051581c8ff2c17e1bae9b07dd1445dd0

SHA512
78a6c8f76d3ebd8db9c784d7775ec44647c4776fcb11d0b32ae2b3a6f2837c0b3be12f053ef6a25811a68da17d0eea83077521f496e238757f5539b445a58a7d

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\msvcp140_2.dll

Filesize
182KB

MD5
94bc7a22ec7308f851cc58fd6de90b2d

SHA1
cb4d8dcd2c8e9bbf049c1628246cb12cdd34b353

SHA256
5c12eaef6db18b168f712bff9b55793e0effddf15b89552e7f5ca4f8f1887b9b

SHA512
87791e992ccb43c833ea6ef2b0fa146031e0fd26305c93d77bc693473292f5b54d36516f3294edcc1c253d2decc166fdd1767c659f65e7d7e447cd8c318b7c96

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\platforms\qwindows.dll

Filesize
823KB

MD5
b282a6b3a3e4ed8c42f4419a9db87e41

SHA1
4a39e285182a5c5c311efe0c04ac8ab5f0e5dfdb

SHA256
5918f2fdbe3be8410d8c255f7174a92e407e299ba8f66616b52f75fe25fda618

SHA512
e1b9cc8108102dff6c98818787f5921e4cf6f4cba26d1b24a443c5c58129be2e9d533d7026125ab19238af05fd7854a8b3399ecda643f48824b51e6ab7b523b5

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\styles\qwindowsvistastyle.dll

Filesize
138KB

MD5
a9ea33827f593d4ff121eb27da14017c

SHA1
2b45c65e083b05559ddd27f23d61c359b9b527d4

SHA256
f605cf01582c022a21f0c2faffd13e4f46d596727806793a708eaaa1ec3f7859

SHA512
586f11f2899b1ed8f2257d0e9cc433bcaede5c64c0e702981483b059a12c5899e972bea9fcbfc638e13d9659562b4f3a735b6ff9a0507f141b7405afab8caeac

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\vccorlib140.dll

Filesize
327KB

MD5
b2b992faefa1bdf7445ae4e6435bd0b5

SHA1
499e221690ce4f0ac4ecd11968fa15fd09ffb84b

SHA256
3e194d5ab03fdb1e97b0bae61070994013487c567f82c9338e7adc202f7d7d67

SHA512
90de9bdb6011f2c611ea5549a296e62656d1e66dd7dbe44b6fdefc655a613599ab3991ed5a390c22c9c0aa9ba5432da97a62bdc79e656659c9ef2a071469a0f8

Download Submit
C:\Windows\Temp\WindscribeInstaller26782\vcruntime140.dll

Filesize
96KB

MD5
a4cf5c1f71c540c69371c861abe57726

SHA1
f272b34182db8a78ffc71755b46a57a253fcd384

SHA256
c179d8914ba8e57b2f8f4d6c101c2c550c7c6712a7f0f9920a97db340f9d9574

SHA512
f2b53f28a6369f76b22e99fddfb86730f3d33e87c68dae7aa3d05808223693bb86ade263cccb99d5462cf98eeeaa6a6f1cfe5ea3aa1739f8ad6eb624caff1045

Download Submit
memory/1208-262-0x00007FF73F150000-0x00007FF73F907000-memory.dmp

Filesize
7.7MB

Download
memory/1208-263-0x00007FFBB9180000-0x00007FFBB9746000-memory.dmp

Filesize
5.8MB

Download
memory/1208-264-0x00007FF73F150000-0x00007FF73F907000-memory.dmp

Filesize
7.7MB

Download
memory/4244-48-0x00007FFBBACD0000-0x00007FFBBB296000-memory.dmp

Filesize
5.8MB

Download