b2020c969fb90ba978584f81b75969891b4e8d83783c74bd02a18f6351cdd516

Analysis

user interaction
yes
max time kernel
72s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/06/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windscribe_2.22.10_amd64.exe
Size 39.8MB
Sample260621-pkr1eaes21
SHA256 b2020c969fb90ba978584f81b75969891b4e8d83783c74bd02a18f6351cdd516
MD5 a108b5d0a2b1cbd0271ae0005c51ead5
SHA1 fe42dfa0bd4073fe8d77b9effd1fe55735ea9454
SHA512 b27d5f610d20d53c8d46492ab06f4a2ecfea48793ac6dc44a4e5ab261ed010a84c0b634132e09e3ff259f2840504d3f4e77449fa5e0ceac92b8afaa3985599e2
SSDEEP 786432:wwetpyKLxWIdWuBLCqiBrmBKiAfV/Ta/Br23y6mLwv1SalNeku:wwetpnkmPiBsKiAfwpr2QL8XlN+
TLSH
T128973356F1688275D073C075C6A29755EEB3388A173086CB139687B93F23BE58E7A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\windscribesplittunnel.sys	Windscribe_2.22.10_amd64.exe
File opened for modification	C:\Windows\system32\drivers\windscribesplittunnel.sys	Windscribe_2.22.10_amd64.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\SET562B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\SET562C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\SET562C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\SET562A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\ovpn-dco.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\SET562B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\ovpn-dco.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\ovpn-dco.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b6e7d4d4-a1a9-2445-9f1e-b07d294df3fb}\SET562A.tmp	DrvInst.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002b436-76.dat	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\Windscribe\open_source_licenses.txt	7zr.exe
File created	C:\Program Files\Windscribe\devcon.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.sys	7zr.exe
File created	C:\Program Files\Windscribe\tunnel.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tunnel.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\devcon.exe	7zr.exe
File created	C:\Program Files\Windscribe\tapctl.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribeopenvpn.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribe_service.log	WindscribeService.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\qt\qt.conf	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.sys	7zr.exe
File created	C:\Program Files\Windscribe\windscribewstunnel.exe	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.inf	7zr.exe
File created	C:\Program Files\Windscribe\WindscribeService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\wintun.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\InstallHelper.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribectrld.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\WindscribeService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\uninstall.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\WireguardService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\open_source_licenses.txt	7zr.exe
File created	C:\Program Files\Windscribe\qt\qt.conf	7zr.exe
File created	C:\Program Files\Windscribe\windscribectrld.exe	7zr.exe
File created	C:\Program Files\Windscribe\amneziawgtunnel.dll	7zr.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys	7zr.exe
File opened for modification	C:\Program Files\Windscribe\Windscribe.exe	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf	7zr.exe
File opened for modification	C:\Program Files\Windscribe\wireguard.dll	7zr.exe
File created	C:\Program Files\Windscribe\WireguardService.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.cat	7zr.exe
File created	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.sys	7zr.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.cat	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.sys	7zr.exe
File opened for modification	C:\Program Files\Windscribe\tapctl.exe	7zr.exe
File created	C:\Program Files\Windscribe\uninstall.exe	7zr.exe
File created	C:\Program Files\Windscribe\windscribe-cli.exe	7zr.exe
File created	C:\Program Files\Windscribe\windscribeopenvpn.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10	7zr.exe
File opened for modification	C:\Program Files\Windscribe\qt	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.inf	7zr.exe
File created	C:\Program Files\Windscribe\InstallHelper.exe	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribe-cli.exe	7zr.exe
File created	C:\Program Files\Windscribe\wintun.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\amneziawgtunnel.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\windscribewstunnel.exe	7zr.exe
File created	C:\Program Files\Windscribe\wireguard.dll	7zr.exe
File opened for modification	C:\Program Files\Windscribe\config\WindscribeWireguard.conf	WindscribeService.exe
File opened for modification	C:\Program Files\Windscribe\splittunnel	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win10\ovpn-dco.cat	7zr.exe
File created	C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.inf	7zr.exe
File created	C:\Program Files\Windscribe\Windscribe.exe	7zr.exe
File created	C:\Program Files\Windscribe\installer.log	Windscribe_2.22.10_amd64.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco	7zr.exe
File opened for modification	C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf	7zr.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
1196	7zr.exe
5008	Windscribe_2.22.10_amd64.exe
2700	7zr.exe
1096	WindscribeService.exe
3232	devcon.exe
588	Windscribe.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3236	taskkill.exe
4952	taskkill.exe
2868	taskkill.exe
3784	taskkill.exe
5044	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WindscribeService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WindscribeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WindscribeService.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{DBA29BE0-B533-4A76-B6B0-077134A084FB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5008	Windscribe_2.22.10_amd64.exe
588	Windscribe.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
588	Windscribe.exe
588	Windscribe.exe
1096	WindscribeService.exe
1096	WindscribeService.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5008	Windscribe_2.22.10_amd64.exe
588	Windscribe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	1196	7zr.exe
Token: 35	1196	7zr.exe
Token: SeSecurityPrivilege	1196	7zr.exe
Token: SeSecurityPrivilege	1196	7zr.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeRestorePrivilege	2700	7zr.exe
Token: 35	2700	7zr.exe
Token: SeSecurityPrivilege	2700	7zr.exe
Token: SeSecurityPrivilege	2700	7zr.exe
Token: SeAuditPrivilege	3700	svchost.exe
Token: SeSecurityPrivilege	3700	svchost.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
4544	msedge.exe
588	Windscribe.exe
4544	msedge.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe
588	Windscribe.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1196	1292	Windscribe_2.22.10_amd64.exe	80
PID 1292 wrote to memory of 5008	1292	Windscribe_2.22.10_amd64.exe	82
PID 5008 wrote to memory of 3236	5008	Windscribe_2.22.10_amd64.exe	83
PID 5008 wrote to memory of 4952	5008	Windscribe_2.22.10_amd64.exe	86
PID 5008 wrote to memory of 2868	5008	Windscribe_2.22.10_amd64.exe	88
PID 5008 wrote to memory of 2700	5008	Windscribe_2.22.10_amd64.exe	90
PID 5008 wrote to memory of 3232	5008	Windscribe_2.22.10_amd64.exe	93
PID 3700 wrote to memory of 3292	3700	svchost.exe	96
PID 1096 wrote to memory of 3784	1096	WindscribeService.exe	100
PID 588 wrote to memory of 5044	588	Windscribe.exe	102
PID 588 wrote to memory of 4544	588	Windscribe.exe	104
PID 4544 wrote to memory of 2316	4544	msedge.exe	105
PID 4544 wrote to memory of 1460	4544	msedge.exe	107
PID 4544 wrote to memory of 4952	4544	msedge.exe	106
PID 4544 wrote to memory of 1460	4544	msedge.exe	107
PID 4544 wrote to memory of 1460	4544	msedge.exe	107
PID 4544 wrote to memory of 3432	4544	msedge.exe	109
PID 4544 wrote to memory of 3432	4544	msedge.exe	109
PID 4544 wrote to memory of 3636	4544	msedge.exe	111
PID 4544 wrote to memory of 3636	4544	msedge.exe	111
PID 4544 wrote to memory of 3636	4544	msedge.exe	111
PID 4544 wrote to memory of 4428	4544	msedge.exe	110
PID 4544 wrote to memory of 4428	4544	msedge.exe	110
PID 4544 wrote to memory of 4428	4544	msedge.exe	110
PID 4544 wrote to memory of 4340	4544	msedge.exe	112
PID 4544 wrote to memory of 4340	4544	msedge.exe	112
PID 4544 wrote to memory of 4340	4544	msedge.exe	112
PID 4544 wrote to memory of 1100	4544	msedge.exe	113
PID 4544 wrote to memory of 1100	4544	msedge.exe	113
PID 4544 wrote to memory of 1100	4544	msedge.exe	113
PID 4544 wrote to memory of 1948	4544	msedge.exe	114
PID 4544 wrote to memory of 3156	4544	msedge.exe	115
PID 4544 wrote to memory of 1948	4544	msedge.exe	114
PID 4544 wrote to memory of 1948	4544	msedge.exe	114
PID 4544 wrote to memory of 3156	4544	msedge.exe	115
PID 4544 wrote to memory of 3156	4544	msedge.exe	115
PID 4544 wrote to memory of 4932	4544	msedge.exe	116
PID 4544 wrote to memory of 4932	4544	msedge.exe	116
PID 4544 wrote to memory of 4328	4544	msedge.exe	117
PID 4544 wrote to memory of 4328	4544	msedge.exe	117
PID 4544 wrote to memory of 3452	4544	msedge.exe	119
PID 4544 wrote to memory of 5012	4544	msedge.exe	120
PID 4544 wrote to memory of 3452	4544	msedge.exe	119
PID 4544 wrote to memory of 5012	4544	msedge.exe	120
PID 4544 wrote to memory of 4836	4544	msedge.exe	121
PID 4544 wrote to memory of 2868	4544	msedge.exe	123
PID 4836 wrote to memory of 4160	4836	msedge.exe	124
PID 4544 wrote to memory of 2288	4544	msedge.exe	125
PID 4544 wrote to memory of 2288	4544	msedge.exe	125
PID 4544 wrote to memory of 4628	4544	msedge.exe	126
PID 4544 wrote to memory of 4628	4544	msedge.exe	126
PID 4544 wrote to memory of 2692	4544	msedge.exe	127
PID 4544 wrote to memory of 2692	4544	msedge.exe	127
PID 4544 wrote to memory of 3080	4544	msedge.exe	128
PID 4544 wrote to memory of 3080	4544	msedge.exe	128
PID 4544 wrote to memory of 2488	4544	msedge.exe	129
PID 4544 wrote to memory of 2488	4544	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\Windscribe_2.22.10_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\Windscribe_2.22.10_amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\Temp\WindscribeInstaller7795\7zr.exe
  "C:\Windows\Temp\WindscribeInstaller7795\7zr.exe" x -y -bb3 -bd -o"C:\Windows\Temp\WindscribeInstaller7795" "C:\Windows\Temp\WindscribeInstaller7795\windscribeinstaller.7z"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\Temp\WindscribeInstaller7795\Windscribe_2.22.10_amd64.exe
  "C:\Windows\Temp\WindscribeInstaller7795\Windscribe_2.22.10_amd64.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /t /im windscribeopenvpn.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /t /im windscribewstunnel.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /t /im windscribectrld.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\Temp\WindscribeInstaller7795\7zr.exe
    "C:\Windows\Temp\WindscribeInstaller7795\7zr.exe" x -y -bb3 -bd -o"C:\Program Files\Windscribe" "C:\Windows\Temp\WindscribeInstaller7795\windscribe.7z"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2700
- - C:\Program Files\Windscribe\devcon.exe
    "C:\Program Files\Windscribe\devcon.exe" dp_add openvpndco\win11\ovpn-dco.inf
    3⤵
    - Drops file in Windows directory
    - Executes dropped EXE
    PID:3232

C:\Program Files\Windscribe\WindscribeService.exe
"C:\Program Files\Windscribe\WindscribeService.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /t /im windscribeopenvpn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{46069bfb-d5bc-a546-8e56-a298efe6eb8a}\ovpn-dco.inf" "9" "4df7dbc87" "000000000000015C" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Windscribe\openvpndco\win11"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3292

C:\Program Files\Windscribe\Windscribe.exe
"C:\Program Files\Windscribe\Windscribe.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /t /im windscribectrld.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.windscribe.com/installed/desktop?1sm9510h
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff9153ec188,0x7ff9153ec194,0x7ff9153ec1a0
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12312148963122624784,10433519469530641355,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,13298521264314366027,499130765721809472,262144 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,14064882230402442820,11798188886619618787,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,7273695899325526100,16273063996002374314,2097152 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,8536029962420535214,548382613002358075,2097152 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,4608580159282777077,12392066190277491994,2097152 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,8632289599714535032,16855295590532855049,2097152 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,9493504239678132805,13329995823915495399,2097152 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,8766052407557439848,5031368825349786933,2097152 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:9
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2459626854470292802,4804897571456521581,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,4851226753470255717,1978563553694106888,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,2477151000949737980,3135267189588617431,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,3935217469323925825,13474817753449072038,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,13720781089353477299,12021410721376032543,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1104
      4⤵
      PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11984140213893682253,11253244438319234890,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11984140213893682253,11253244438319234890,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,9216162533460906206,1653931398059234154,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,2362312636341142656,12200809866419250333,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,1633980251148238028,14555840161810817876,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,2628767742947571097,8573048665963926928,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,11668646347022279693,1280278158786423086,524288 --field-trial-handle=2168,i,7800614858312997449,10952873269498004480,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ovpn-dco.sys

Path C:\PROGRA~1\WINDSC~1\OPENVP~1\win11\ovpn-dco.sys
Size 143KB
SHA256 4c677a57efbd2cbe40a9c29235446a8c2eaa0a4e32f648c7f195e0e660495392
MD5 499bffff683abdf3df9d06d468c39f34
SHA1 7a93d22428b068350070b7f6c19b12c639b8afeb
SHA512 cfe1c72e32eea59e61d471f7e411f408676367ba6a2c20654606531ca2b8ffc792b39584b401834b33bdd5255120c5a71bcf4a10cbbc1e57fb434a0a52386038
SSDEEP 3072:5+H8w0ndII2ZwfjXC9HJfFXwd1S2AxZox:5+Hm/2ZwbSTMA27
TLSH
T122E32975A5D010D4E43BD1B89AB64E41BFB0BA523F3295EF05008AA80F36BD8FE39755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallHelper.exe

Path C:\Program Files\Windscribe\InstallHelper.exe
Size 489KB
SHA256 18a6de617dcae311e0ca3ac7066f0afc201ffbae8af8789217149a935d78cefb
MD5 e78a3461f6915409c1bd037842b910af
SHA1 a785e984f695f13b0f3047f5935a037cb582f2ea
SHA512 7fbc73a2f2a3be71cc3d686675ac581ae31ccffb6443ec9d4f5cdfafc3f022cea3733b714c904c25394336bd4aaa2c9fdb224f5b090f2fa7ebf982cc5826cdad
SSDEEP 6144:3NnB/m/iaeiMTTZ7HywLtuPlGmVlfZrEgYCwQ0JSJFrNFjzNBx7szNtqI4SYTg9+:rZnb9OVzICemzVszNtqfY+
TLSH
T1A2B48D5AA39842F9E167E178C9424502FBF1784A5370A3CF03E09AB62F677E15E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windscribe.exe

Path C:\Program Files\Windscribe\Windscribe.exe
Size 41.7MB
SHA256 2379ed47a0365e9f697d93094a330e80c44b8609e2207b128f2cdee7417d3adc
MD5 68630086dc1d24be56c3ecb9637cd9a6
SHA1 5fbcd87177a8568c69350be29872ea6cb32e1ac0
SHA512 5f8e8143811a41c17a1618cf17cf25e8738c23aa3d4b3e529e71692a66227f6d376a19cd0e0fd2f81f952109528dd3e944b623da0c42abe888e5c1dba24f906f
SSDEEP 393216:5wCjXsaCSAk47rFU6A5ZQFVA1rKaJUXw2L+IiBnchjS7dd1mP5KFdu9CwJsv6tXO:5XzIO7IPiMveRBAmoKbaiLDfjejYN
TLSH
T184A79C5763F400C5E5BBC178CBA79613EB727896177056CF02A0A6A91F33BE05E3A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindscribeService.exe

Path C:\Program Files\Windscribe\WindscribeService.exe
Size 8.2MB
SHA256 6b0dd3e2ebd32c7e697c9713ae974630c106d1f4003edaef60c363de175cde4d
MD5 f64cc15ed7878c5da0154ea520f45609
SHA1 688a96a459419950b64d47e08c7ede923838306a
SHA512 e68288df32b6b256e29e20bad0d823f87b585aee7e97dc49d9cabe16f56d2e8a02f13613ec94802264abbbad70742c268a106b2da074d4840feef572697e3559
SSDEEP 196608:97y0GxXj4rt9UmjJiD5owSl6um8aITdYMYwp:00GBj4rt9UmjJiD5owSljm8aITmMYC
TLSH
T13C969E6AA6BC00E9E47BC1BCC6865227E7B1B45517B057DF1A6086F60F23BE01E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WireguardService.exe

Path C:\Program Files\Windscribe\WireguardService.exe
Size 583KB
SHA256 abe7804235253dadd220a6e1c1383464d99e2511c97b364be6d82fd090621d73
MD5 44d1d5350813ec9831e2405c998b59eb
SHA1 3a7fecfeb4f0d94641e84d97b64a1cb82dc041d3
SHA512 f6faddaedf1fac8832467e7019c26b9e2e8d629eacf15be052ab7dff32d79c2292a1fa1fe518372aa9cb770b13d7b5a5f6f96d9c36ccd13e07c5c203270ca394
SSDEEP 12288:i25iQvBOrOX65uHDZ5jrRsTDQN1YaSj1fy4Uw0wRKn:i25ivt5W5jcaSj16feKn
TLSH
T1B6D46B6AB79813E8D17BC1B8C9468906FB72384547609BCF17A087AA1F17AE05F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devcon.exe

Path C:\Program Files\Windscribe\devcon.exe
Size 91KB
SHA256 58beb1ffbda32d7056ebec62544f0cff6faa6d149b12ae1732a3ce26e9742a9a
MD5 580aca657155d8018a9f98d3d1631891
SHA1 715781d551102f1a51704e015860184caa7d0486
SHA512 5b44e4ced6b40f04a4012d5e4ed2d110f9ffac77d44a45100e32f806f3df0ff20c2cd3352801550ae881c81fd2f782aabada5182af8fadc460997dd759bf5f0d
SSDEEP 1536:z1Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WHb7pB:z1M2fAggGnD89NJ1cPZCM3W71B
TLSH
T17693F70263E81649F5F37A3469B552355A737CA1AE38C69E029C912D0FE3EC0DD74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.inf

Path C:\Program Files\Windscribe\openvpndco\win11\ovpn-dco.inf
Size 2KB
SHA256 f4ad125570e5e96da38ca0e6f35cb6c614b59d7d7f9844705595db78c29706a5
MD5 2892ed63170b894aa7e7d0b2a82562df
SHA1 2da352f5bb5fe4c67e70d0007ca936fe20cacaca
SHA512 3cbfb2d8322ec20717502608f09243fa146751d0e10a581bc292d1b4ea895584dd4be7ae3177e637c435c5a3eb9f7b462fd6c94e2e57d1894b72820075ab4c8f
TLSH
T1C441F14A52C20FF93B432D7596077BA2B9D6910050C8152AF48C96468B8FF99B31B7FB
MD5 SHA1 SHA512 TLSH

Submit Download

windscribesplittunnel.sys

Path C:\Program Files\Windscribe\splittunnel\windscribesplittunnel.sys
Size 38KB
SHA256 13633300348db21d961ea361e0fb65ae9361bbaae82012c63af8ec7359c373c5
MD5 9b9cca17e659b6f5a7115dc94576b94b
SHA1 54a6768dfa82daf17c4f18b65ca754f1ff46f5ac
SHA512 3818de9553fb3c3284f98af4da99e54650bd132c46fa3c233f52ba914a7afdb162e9dac87a61c61c6f49623dccbcb9d2891f6eb2ec50747468c2b357dface4d7
SSDEEP 768:1a+kFshCWcYi2AMxkEzSWcYiIAMxkEhH3y9zr:1k/7ExP27Wx9Hezr
TLSH
T14C035CB286646C42CD5B9C70B1D4D927BE7977971B8081E3229DC1504B923C6BBBC1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tapctl.exe

Path C:\Program Files\Windscribe\tapctl.exe
Size 159KB
SHA256 b9ce5a746cf4fa1ad16e581d3acd4b45986e16d79090543ab8d66197abccb688
MD5 6bdb95b00873ed8634f9529878fc0e0a
SHA1 79b0053e60a9eac957da4696f5508706648b893d
SHA512 adbc2f039eb7839fa5b65ef266b45edd9b9a8b5edca8d127ebded742fd5a1d170a73e6721807dca76697ba9cd8963b7fc31d23f45a7e60e71ae4430eadd175e4
SSDEEP 3072:Yj3q17ql+2OlkDYZek/e45PUiJevg1oGip:HVlHZek/FPpc
TLSH
T137F34A53B7A430F9D577863889620506EB73783117709B9F03A8427A6F277D1AE3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Windscribe\uninstall.exe
Size 818KB
SHA256 7a1e2f45300608262ea3eb9139cb3cfe2897700a862941833034f060794d883e
MD5 3dfa55ada5927c8515ecb1a4dad39efc
SHA1 c5f797d5312c675cfd8480565082fb8a0f78cda7
SHA512 ff38e32fd8a11870cf735697c8e35149e35f95e8c86721c5ac5fba81674a4c48a23744a48fc00424cc172ff10060990804ff9a36dd57c9321107732a1368a5c6
SSDEEP 12288:qkOCBAjuM8K+juP7Ytw94LXVFDfKfNwJaQp3gXjct:qkOCBiwUawihFKCJYXjC
TLSH
T1A3057D2ABBDC01E8E0B7D179C9569502FBB178051370AACF17A04BAA1F276E45E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribe-cli.exe

Path C:\Program Files\Windscribe\windscribe-cli.exe
Size 8.9MB
SHA256 31ea13b9cacc1ac1e803fbf702cec52cc6c958316dc523e03ce1e499c6f90ae9
MD5 d23a781a3cd406fc2f9c77b104f62984
SHA1 ddd0a4718bc66ffe637ae19381524bc77ca23f99
SHA512 68bc3928a8d3e0251e5e38eb5c4185917548aa866b83bf4a732d8c773f89a4503c3655d20120d3e620d5fc9da4f46c77a73bd55634e4f89a52142a32347f4abf
SSDEEP 98304:8qWmFu1EnCsYWKFdu9CwJsv6toJMAR6Wa:865RFKFdu9CwJsv6toSAAWa
TLSH
T1DD96390766FA0141F6F7DA34CAB65262DBB27C866B3096DF025472291D336F09E36327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribectrld.exe

Path C:\Program Files\Windscribe\windscribectrld.exe
Size 7.1MB
SHA256 ded88a689c2fecdb8889195c0805d9da8a84df51ad97cf24839b67af33dc95a2
MD5 f9c162c8efb8d0f90173e7845a781e9b
SHA1 a49f5e7c08cf34034e99b2cc74ccc02851c60795
SHA512 b7c16d33575c38acbbb8324aca5a996140aa179c6ec1b73ef105141351a8d43a7d9950fcd6eecc1b467a80efea63dd6601935165ed146c8194f1ace3df7ac7f9
SSDEEP 196608:RD2Vohgrkbmh3PgXgfsuaXKYqAF5LUZ3BHcw:RDaLkmkg8XbFd0Ww
TLSH
T14476332B909A0C356772C5FC30BA167EA185A87FA1F98014B5BE8F82C677F504ED11F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribeopenvpn.exe

Path C:\Program Files\Windscribe\windscribeopenvpn.exe
Size 6.1MB
SHA256 e898cab3aa2c46d6f750c76ffa8c15ceedce60f81c9ead5cd372b152e4191d2c
MD5 29901adb962c704751b96cca84241a02
SHA1 bc99b3384b95cd81fcc53fd2f50176f3455fbcd2
SHA512 a1fd5d2b35c974c292c0e83be1eadfca9706ec07de4a607667bf81b9d0334168a78b208643dabe6b7eb24d81885332ea6ed837485ef04561d6f2aae6cda64a01
SSDEEP 98304:hTEXsRfg7cksdNvtxRgs5JFSh7v+UeH+egjm:p0sq7ck+NlxRgs5ehLb7Ty
TLSH
T123568E69A7BC00D9D86AC1BCC2869223D7B2B45517B057CF5A6886F90F63AD02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribewstunnel.exe

Path C:\Program Files\Windscribe\windscribewstunnel.exe
Size 7.2MB
SHA256 bf1faa1f0338c6413b472ad445c6ea76833d85470cebc5b37aa586dd64e506b5
MD5 b9fe8db839625ed1901badd1ba304d95
SHA1 0980b85d24ea5a86f5782da86e824ea6240aea1f
SHA512 7ebc1ac6da86c7f094c6adca6ad53fae582aac08ec89e4969c92e5619ecaef401423936221d6a16ff69c49b0b10afcf2669019aa278726dd3af237760c215bf8
SSDEEP 49152:Cwd6jHOWwBJUEaJmxhIl5A34wK+L7azLZNuVbgm7vK3KSM9K8Q8sps15EfF+df8x:CWUEGYbEc1WyxoajTb9w
TLSH
T156762947ECA504E4D0ADC1358A6696277B723C494B3463E73F64B3682F7BBD066BA340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e49ecad01088ee9390772f6d44dc6b5a98155e741c6dfabf8b75eec474994f45
MD5 1ecb03f3e040207bfa8916e35fb3f7bb
SHA1 64b1e0e89d52ae72d5bef0a67960ada72d947dab
SHA512 338933585d44ecfc34b7a648d3a69fe14e20ef04982764721c6805c40f4e08331cbb8e6da5f6b54fd8795f67ee9bdfd26d8d70fe7ef4372b5c4f148c95c8d412
SSDEEP 96:KXeHj/Fml7DDnfyVH65hA/F49rvzSD0QQ87TVAMW2qmGYxcpN9y9:KOHj/Fml7vfyVH65hAd493xj8XVAMW2P
TLSH
T1F9915157838A347CF7E25AF272C119A9B37A80744F1B7E992EC5D8F1A13670102A9DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 23eedbdcfbf2fbc995fc7914fdc0f4e796aab9a29059af8a89a2dc40e8ac16dc
MD5 b0464d1952fcdbd9be83993df03dc4b1
SHA1 845a60b20841ed8b763072cd74e76d8e1ac2d879
SHA512 1dd828a057964ac19f96fc2ed992f73d3e5c4cb4cb37ceb0ca7b0470d34e5ce0ac1ece46ea17acc5f8ef8e4c8566fa9ddc4205fd1153613e4c4773da86ff3292
SSDEEP 192:sxZfRvyM/jK1Ml8M2N/fwsQIlGyIdpNx/W6+WNfhN/Y0srBCCIg4J:sxZfxeN/fwsQIg7v/bf/50c
TLSH
T1F9520A16AA345977CCDBD309F945BB53DAF44573A2900E489AFCCA1C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0d18a6b260a2a2bc4b4dc507eaf945fa5867bc8af2308e11a4138f3ec0a3494e
MD5 408c763e6b34f5b506fc462950778237
SHA1 8280da8f0069e670735bf9efe66a73be06f3d5bb
SHA512 8e527dc18d33fea003595fcc5fa0bd552d2f0bc1c1bc57d2ddafaf601f6fe75e8d08ee07bb1f24a474870be9e36b2ca97a2c8d7d9b9746813599406c91c39a41
SSDEEP 768:Wx/Xh8dF2qm7pLuL7wkWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3yxgjLl2:Wx/Xh8dF2qGE7wkWRmwcQDwu1jaKyxg8
TLSH
T196032B7B2C0CCB7F4F844E9CEC267E9A6DE8028B5698895447FA890C03C67EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0fd074a5e50f4c757f3bb3a89e858c23335295708d830185c1d6caa598b66089
MD5 a77a5ecd7709c08e00b927d0ec0746a0
SHA1 737bf921671bdf84d4f0d60b30c20d1e7024aaab
SHA512 70f277878ef369a480030cde6866df9cedb00c52c92df07e0b273ded636823e9899187dd04a9fd76f247638a6c76b90ed348e1f055c2047a650692a99ba11e46
SSDEEP 48:KXVBDPTgvXqzImpgKB1p7gF5wMabRtyBkIvKxGEry1HIlKYcwyLkXL9VlmTB:Kg+MKfq6ykgKxGK+HyKYcfV
TLSH
T1A191041371BA13013C7E384D86A587674A41B2E37429753B3BA850B12E6BE215EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c73bd3471c48fcd292dc45a6fc7e4922acc9a130f4eeb27ec9149729e734d391
MD5 d562a601475d604c982006e57869f95c
SHA1 7b559faf5b04623dac750bad48cea9ead0f772ea
SHA512 23250c213ae27827cf34a5bb1d8ca2b9ecec4da597d3a40a4fd869cb1f63352a9ed372f9b5b09d2dc73f6e5dddabc2b9104f9c93d77f9cc3404e2f1412916ef6
SSDEEP 384:nhtNn/s3n9S58NP0WcnXiTxMqr/E5I+xsbT7xUITGT0I4x9a:hj+9qCqg/Ey02T7ai+0dva
TLSH
T1E7928C311879ACAB4DE79105F90A339B4EB014BB9AC52F89D4ED5F0D08CB3D8275AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f3e98f2ba7c2676473a03a4f66ac8f58e06585e0f4929480a9256b7a0f07cad
MD5 9e2f7ac8b0fc2272b99b5f400469ec78
SHA1 4f2ace2b738111c367d963ad31218201c2b0ec8c
SHA512 d8a90b28ea74f003653a1afeb451c22d21ef0c5e862f4bdfd256f47ec42f636ce04bd3f60face02af71c9b31be91439eaf87707d49ae24bb19275e2836e5aea7
SSDEEP 192:1GNe6t6H3BQmiUyHHBHdR2Qq/rUH5ml+xPUD9MeZU6:1GNe6MXfcfR2Qq/E5I+xzmU6
TLSH
T1ED02EA3878786CBB8DA35E45B44B77235F95216FE7955F88D9E80B1C01DB28C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0aa32bdbb369ccf43ff5061e1d7a52fd6d85c40428e0394147334edd4551bc82
MD5 b898d0aad77a5947b8a78a5dc2544d48
SHA1 45f48677f621bf43a66e836de42234d01c1c8ad6
SHA512 8bf8dc5520f4d1df706c70ba0be270f9ee5db33fff0ac6c92417fd3e85ca56ed9f655218e9d08f21a6140f01d0cbbc06b1b4ca0417b8b9fac14813f7102fcab5
SSDEEP 192:wGN66t6H3HQmiUyc0dR2n2q/rUH5ml+xPEbTZ/9nYqppP8U6:wGN66MXpQR22q/E5I+xsbTHxUU6
TLSH
T19F121B34686CAC6B4DE79501B48B33A34E94217BDFC55F89E5E50B1C04DB3CC270A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

650241a3-f786-45c9-b9b7-36132dc9074f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\650241a3-f786-45c9-b9b7-36132dc9074f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0c84dd7f-d6f2-4783-b12c-30b41ca8af1e.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c84dd7f-d6f2-4783-b12c-30b41ca8af1e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a99f21f-dd6a-4ab1-8059-f423634603d0.tmp

Path C:\Users\Admin\AppData\Local\Temp\3a99f21f-dd6a-4ab1-8059-f423634603d0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_1473012701\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bda5b84-48a7-42d9-bd18-bea10d1e3a5b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_980116678\8bda5b84-48a7-42d9-bd18-bea10d1e3a5b.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.cat

Path C:\Users\Admin\AppData\Local\Temp\{46069bfb-d5bc-a546-8e56-a298efe6eb8a}\ovpn-dco.cat
Size 11KB
SHA256 fd66051a004582a47190503e67c4d2ad67e1312ea8b166536a04f3999f6b7be2
MD5 3b2081410b8c42085a40fad73780d4d8
SHA1 a55f58c377712bcf5367de708c661bcb892aeaf3
SHA512 f5a4e1d6b7a2b67ada6d67f7b9aaaaa49594f5dd66314927f73bd95a8864acbec26fbb1e638505224bcd5833f62e45d54f23ab52cfc2deaadf3fcfe88a6ada2f
SSDEEP 192:CuFTN6maJCHpPXWEwGJhYCKSUHWX01k9z3Az3E+QlHnr7:Ce2spP3h3/jR9zmAlHr7
TLSH
T1EE323BE2549C81C2DD87BC6053E8E8477C3E37CB581059A922DBF6195DA73C4FB2826E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zr.exe

Path C:\Windows\Temp\WindscribeInstaller7795\7zr.exe
Size 921KB
SHA256 f998608126c11ee1ce7d219777042799dbc5f22bf93031d4374b293ac5027022
MD5 24d3197d0d8ffe822c62d970439d3c26
SHA1 124e385abc31d54fac42303f6d0d520a3d96cf0b
SHA512 acf8f18f075056e9dd53f8376abff2a99b89a664f57934e4a3df77f0fcfce30bd7043441823127cf41d4db3a0ab32b39148113ceefd8a01935f1cc8c975bd460
SSDEEP 12288:LZcsd0c7n+9FONoc0r6PxspOJsKe9Yhkst6UUElE/TzhWY2yhleWLr:vdtniYec86kExtPUEe/TzIyr
TLSH
T1AF152B66F6788271D073C0B9C5D29A9AEE723085173086C71286D77C3F57BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribe.7z

Path C:\Windows\Temp\WindscribeInstaller7795\windscribe.7z
Size 31.5MB
SHA256 ab50d276eba84a5c1e8ec78c8a164fa09ef98c1259118a73285e2583b4b4a0e9
MD5 272b8070d060d3f68efa1f88f919dc56
SHA1 5a99e84b297dc6e581ddfc7b44bf80aafadffa65
SHA512 86d2a35e8f9305538cffb938fc9c4e3765b4085e39bbb104d1759a458941e2efa220e664e204eb5defe33c58486b251781563c1acf593551e7cafba13a123c7d
SSDEEP 786432:gSN1HTwU64yYC+T318BBqBcWOYj/RfkkuBLhwD:9jwUyYC+TS0Bck/p4BL+
TLSH
T10477334FB8BBD15CA6BD8682A3170320AEA3385EF355435835DA45DCCBA7F1525E3A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windscribeinstaller.7z

Path C:\Windows\Temp\WindscribeInstaller7795\windscribeinstaller.7z
Size 38.2MB
SHA256 b798df16c20b0eb37768f30875a248562b0bacf3530a8f56c0bb36b03bc1b2fd
MD5 2c142bc261ded3f18449ee50252f6474
SHA1 54be92d6f48ce68f1aa1d2f54485409b44809cf3
SHA512 9f43bbcaea6e304f0eace27f2bd3ca8aa0506ab78e8ad81b3aacc79747292f84d689f02b0a2b7bd1255795a4d30c43419f9634d54018cb8b27d8b8d442618dd2
SSDEEP 786432:8wetpyKLxWIdWuBLCqiBrmBKiAfV/Ta/Br23y6mLwv1SalNekP:8wetpnkmPiBsKiAfwpr2QL8XlNf
TLSH
T1C697334F74A7925C76BD9282D32A07209D633DAEF309436431EA56EC8AB7F0552F7630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download