Analysis
-
max time kernel
880s -
max time network
884s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe
Resource
win7-20220718-en
General
-
Target
610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe
-
Size
8.6MB
-
MD5
ff95f4df8c378534fb1a0978a1af81de
-
SHA1
4b9d7167774a89fd9cad3093341e2cab2913f96b
-
SHA256
610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14
-
SHA512
0f2014cfccd29806db02c84adeb8b673b4d07b8c38795e6b47d73d91ba6c90d4645a636b6f29684fdc3a6f0aa4889645cd60b6401e82a7d22b6fc12030354db4
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
Processes:
mshta.execmd.execmd.execmd.execmd.exeflow pid process 33 1616 mshta.exe 34 1616 mshta.exe 38 1616 mshta.exe 40 1616 mshta.exe 42 1616 mshta.exe 45 1616 mshta.exe 48 1616 mshta.exe 49 1616 mshta.exe 51 1616 mshta.exe 52 1616 mshta.exe 54 1616 mshta.exe 56 1616 mshta.exe 68 1616 mshta.exe 70 1616 mshta.exe 72 1616 mshta.exe 73 1616 mshta.exe 74 1616 mshta.exe 76 1616 mshta.exe 78 1616 mshta.exe 81 1616 mshta.exe 95 1616 mshta.exe 96 1616 mshta.exe 97 1616 mshta.exe 98 1616 mshta.exe 99 1616 mshta.exe 100 1616 mshta.exe 101 1616 mshta.exe 102 1616 mshta.exe 106 1012 cmd.exe 112 1808 cmd.exe 117 1616 mshta.exe 118 1616 mshta.exe 119 1616 mshta.exe 120 1616 mshta.exe 121 1824 cmd.exe 126 1616 mshta.exe 127 1616 mshta.exe 128 1616 mshta.exe 132 1616 mshta.exe 133 1616 mshta.exe 134 1616 mshta.exe 135 1616 mshta.exe 136 1616 mshta.exe 137 1616 mshta.exe 138 1616 mshta.exe 139 1616 mshta.exe 140 1616 mshta.exe 141 1616 mshta.exe 142 1616 mshta.exe 143 1616 mshta.exe 158 1616 mshta.exe 159 1616 mshta.exe 161 1616 mshta.exe 196 1616 mshta.exe 197 1616 mshta.exe 198 1616 mshta.exe 199 1616 mshta.exe 200 1616 mshta.exe 205 4280 cmd.exe 207 1616 mshta.exe 209 1616 mshta.exe 210 1616 mshta.exe 211 1616 mshta.exe 216 1616 mshta.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
driverpack-wget.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.execmd.exeregsvr32.exeopera.execompact.execmd.exedriverpack-wget.exedriverpack-wget.execmd.execompact.exegacutil.exeConhost.exeConhost.exedriverpack-wget.exenetsh.execompact.exearia2c.exearia2c.exeinstaller.exedriverpack-wget.exearia2c.exedriverpack-wget.exeConhost.execompact.exedriverpack-wget.exeConhost.exeDllHost.execmd.exeopera.exeConhost.execompact.exedriverpack-wget.exedriverpack-wget.exeConhost.execmd.execmd.exedriverpack-wget.exedriverpack-wget.exeConhost.exedriverpack-wget.exedriverpack-wget.exeChrone.exedriverpack-wget.exedriverpack-wget.exeregsvr32.exedriverpack-wget.exeConhost.exeConhost.exedriverpack-wget.exedriverpack-wget.exegacutil.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.execompact.exepid process 1096 driverpack-wget.exe 2228 driverpack-wget.exe 4940 driverpack-wget.exe 3500 driverpack-wget.exe 3960 driverpack-wget.exe 1012 cmd.exe 3320 regsvr32.exe 4188 opera.exe 332 compact.exe 1808 cmd.exe 4900 driverpack-wget.exe 1516 driverpack-wget.exe 1824 cmd.exe 4556 compact.exe 4252 gacutil.exe 4912 Conhost.exe 4088 Conhost.exe 4188 opera.exe 4168 driverpack-wget.exe 3720 netsh.exe 3324 compact.exe 4296 aria2c.exe 1816 aria2c.exe 2800 installer.exe 1304 driverpack-wget.exe 1280 aria2c.exe 4444 driverpack-wget.exe 3228 Conhost.exe 4284 compact.exe 176 driverpack-wget.exe 3500 Conhost.exe 5000 DllHost.exe 4280 cmd.exe 2856 opera.exe 5016 Conhost.exe 4644 compact.exe 516 driverpack-wget.exe 4756 driverpack-wget.exe 4860 Conhost.exe 1452 cmd.exe 2436 cmd.exe 2044 driverpack-wget.exe 400 driverpack-wget.exe 3940 Conhost.exe 3528 driverpack-wget.exe 620 driverpack-wget.exe 3860 Chrone.exe 4364 driverpack-wget.exe 2856 opera.exe 1056 driverpack-wget.exe 3012 regsvr32.exe 3332 driverpack-wget.exe 4520 Conhost.exe 2792 Conhost.exe 2672 driverpack-wget.exe 2384 driverpack-wget.exe 916 gacutil.exe 516 driverpack-wget.exe 3584 driverpack-wget.exe 3500 Conhost.exe 3324 compact.exe 2444 driverpack-wget.exe 3888 driverpack-wget.exe 4840 compact.exe -
Modifies Installed Components in the registry 2 TTPs 29 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\Version = "1,0,4322,1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\Version = "1,1,4322" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\Version = "1,1,4322" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\Locale = "*" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\ComponentID = "M2698023" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\ComponentID = ".NETFramework" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\ = ".NET Framework" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\ComponentID = "S867460" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\ = "Microsoft .NET Framework 1.1 Security Update (KB979906)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\Locale = "*" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\ComponentID = "M979906" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\ = "Microsoft .NET Framework 1.1 Security Update (KB2698023)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\Version = "1,1,4322" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\Version = "1,1,4322" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\ComponentID = "M2833941" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\ = "Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\Locale = "*" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\ = "Microsoft .NET Framework 1.1 Security Update (KB2833941)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\Locale msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\Locale = "*" msiexec.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 1556 netsh.exe 3720 netsh.exe 3172 netsh.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
compact.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_6.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_5.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_2.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_7.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_4.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_1.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ThreadingModel = "Both" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_3.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ThreadingModel = "Both" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32 compact.exe -
Processes:
resource yara_rule C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/1096-182-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/2228-185-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4940-186-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3500-187-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3500-188-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/1012-216-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3320-222-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/4188-225-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4188-228-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3320-230-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/332-232-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4900-233-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1516-234-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1808-235-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1516-229-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4900-227-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/332-226-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/3960-219-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/1824-255-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4556-256-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/4912-261-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4912-262-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4252-259-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4088-273-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4188-274-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4168-275-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3720-292-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3324-294-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3720-295-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4444-296-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4284-298-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3228-297-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/176-301-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5000-303-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4280-306-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/176-305-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2856-304-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5016-308-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3500-302-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/516-311-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4756-312-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4644-310-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4860-314-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1452-316-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2436-317-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2044-318-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/400-321-0x0000000000400000-0x00000000004EF000-memory.dmp upx -
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
opera.exeRuntimePack.exeopera.exengen.exeopera.execmd.exemshta.exeDirectX.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation RuntimePack.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation ngen.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation DirectX.exe -
Loads dropped DLL 64 IoCs
Processes:
610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exeopera.exeopera.exeConhost.exeopera.exengen.exeopera.exeopera.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.execompact.execompact.exeregsvr32.execompact.exeregsvr32.exeregsvr32.exelauncher.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exegacutil.exeDllHost.exeinstaller.exeinstaller.exeinstaller.exegacutil.exeinstaller.exeopera.exeMsiExec.exeMsiExec.exeConhost.exepid process 3024 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe 3024 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe 3024 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe 5084 opera.exe 3776 opera.exe 4788 Conhost.exe 4188 opera.exe 3876 ngen.exe 1692 opera.exe 2824 opera.exe 1628 regsvr32.exe 1504 regsvr32.exe 3320 regsvr32.exe 4648 regsvr32.exe 4092 regsvr32.exe 4292 regsvr32.exe 4796 compact.exe 4420 compact.exe 3188 regsvr32.exe 1496 compact.exe 4452 regsvr32.exe 3276 regsvr32.exe 2896 launcher.exe 3012 regsvr32.exe 5108 regsvr32.exe 4768 regsvr32.exe 4672 regsvr32.exe 4412 regsvr32.exe 548 regsvr32.exe 4940 regsvr32.exe 5020 regsvr32.exe 4732 gacutil.exe 2108 DllHost.exe 3460 installer.exe 2800 installer.exe 3680 installer.exe 756 gacutil.exe 4424 installer.exe 2856 opera.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1216 MsiExec.exe 1320 Conhost.exe 1320 Conhost.exe 1320 Conhost.exe 1320 Conhost.exe 1320 Conhost.exe 1320 Conhost.exe 1320 Conhost.exe 1320 Conhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
Conhost.exemshta.exeMsiExec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearcherBar = "\"C:\\Windows\\system32\\mshta.exe\" \"C:\\SearcherBar\\run.hta\"" Conhost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce mshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\DriverPack-Alice = "C:\\Users\\Admin\\AppData\\Roaming\\DRPSu\\Alice\\DriverPackAssistant.exe" mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\NetFxUpdate_v1.1.4322 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\netfxupdate.exe\" 0 v1.1.4322 GAC + NI NID" MsiExec.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
mshta.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast mshta.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV mshta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
Conhost.exedescription ioc process File opened for modification C:\Windows\assembly\Desktop.ini Conhost.exe File created C:\Windows\assembly\Desktop.ini Conhost.exe -
Enumerates connected drives 3 TTPs 30 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exemsiexec.exegacutil.exeopera.exeinstaller.exeinstaller.exeOperaXP.exedescription ioc process File opened (read-only) \??\D: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: gacutil.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: opera.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: OperaXP.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in System32 directory 64 IoCs
Processes:
xcopy.execmd.exexcopy.exeaspnet_regiis.exemsdtc.exedescription ioc process File created C:\Windows\System32\xactengine3_5.dll xcopy.exe File opened for modification C:\Windows\System32\xinput1_1.dll xcopy.exe File created C:\Windows\SysWOW64\tabctl32.ocx cmd.exe File opened for modification C:\Windows\System32\d3dx9_34.dll xcopy.exe File created C:\Windows\SysWow64\D3DCompiler_37.dll xcopy.exe File created C:\Windows\SysWow64\d3dx10_33.dll xcopy.exe File created C:\Windows\SysWow64\d3dx9_32.dll xcopy.exe File created C:\Windows\SysWow64\xactengine2_3.dll xcopy.exe File created C:\Windows\SysWOW64\msvcr71.dll cmd.exe File created C:\Windows\System32\d3dx10_40.dll xcopy.exe File created C:\Windows\System32\x3daudio1_0.dll xcopy.exe File created C:\Windows\System32\XAudio2_2.dll xcopy.exe File created C:\Windows\SysWOW64\comct332.ocx cmd.exe File opened for modification C:\Windows\System32\xactengine3_7.dll xcopy.exe File opened for modification C:\Windows\SysWow64\XAPOFX1_2.dll xcopy.exe File created C:\Windows\SysWOW64\msmask32.ocx cmd.exe File created C:\Windows\SysWow64\d3dx9_34.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\dblist32.ocx cmd.exe File opened for modification C:\Windows\SysWOW64\libcrypto-1_1.dll cmd.exe File opened for modification C:\Windows\SysWow64\x3daudio1_0.dll xcopy.exe File created C:\Windows\System32\xactengine2_0.dll xcopy.exe File opened for modification C:\Windows\System32\xactengine3_0.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\MFC71ESP.DLL cmd.exe File opened for modification C:\Windows\System32\D3DCompiler_35.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\MSSTKPRP.DLL cmd.exe File opened for modification C:\Windows\SysWOW64\tabctl32.ocx cmd.exe File created C:\Windows\system32\perfc009.dat aspnet_regiis.exe File created C:\Windows\System32\d3dx9_34.dll xcopy.exe File created C:\Windows\System32\xactengine2_6.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\comct232.ocx cmd.exe File created C:\Windows\SysWow64\D3DX9_37.dll xcopy.exe File created C:\Windows\System32\xactengine2_8.dll xcopy.exe File created C:\Windows\System32\xinput1_3.dll xcopy.exe File opened for modification C:\Windows\System32\d3dx10_38.dll xcopy.exe File opened for modification C:\Windows\System32\xactengine3_4.dll xcopy.exe File opened for modification C:\Windows\system32\libcrypto-1_1-x64.dll cmd.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx cmd.exe File opened for modification C:\Windows\System32\xactengine2_10.dll xcopy.exe File opened for modification C:\Windows\SysWow64\xactengine2_8.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\MFC71JPN.DLL cmd.exe File created C:\Windows\SysWOW64\mswinsck.ocx cmd.exe File opened for modification C:\Windows\SysWow64\xactengine3_3.dll xcopy.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\d3dx9_33.dll xcopy.exe File created C:\Windows\System32\X3DAudio1_2.dll xcopy.exe File created C:\Windows\SysWow64\d3dx10_38.dll xcopy.exe File created C:\Windows\SysWow64\d3dx9_26.dll xcopy.exe File opened for modification C:\Windows\SysWow64\d3dcsx_43.dll xcopy.exe File created C:\Windows\SysWow64\d3dx9_28.dll xcopy.exe File opened for modification C:\Windows\SysWow64\d3dx9_29.dll xcopy.exe File created C:\Windows\SysWow64\X3DAudio1_3.dll xcopy.exe File opened for modification C:\Windows\System32\D3DCompiler_39.dll xcopy.exe File created C:\Windows\System32\d3dx10_35.dll xcopy.exe File opened for modification C:\Windows\System32\d3dx9_27.dll xcopy.exe File opened for modification C:\Windows\System32\XAudio2_4.dll xcopy.exe File opened for modification C:\Windows\SysWow64\xactengine2_6.dll xcopy.exe File opened for modification C:\Windows\SysWow64\xactengine3_4.dll xcopy.exe File created C:\Windows\SysWow64\XAPOFX1_2.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\Vb40032.dll cmd.exe File opened for modification C:\Windows\SysWOW64\msvcp71.dll cmd.exe File opened for modification C:\Windows\SysWOW64\richtx32.ocx cmd.exe File opened for modification C:\Windows\System32\d3dx10_34.dll xcopy.exe File created C:\Windows\System32\xactengine2_4.dll xcopy.exe File opened for modification C:\Windows\System32\xactengine2_4.dll xcopy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
cmd.exedriverpack-wget.exeinstaller.exeinstaller.exeConhost.exedriverpack-wget.exe610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exedriverpack-wget.exedriverpack-wget.exeConhost.exedriverpack-wget.exeregsvr32.exedriverpack-wget.exedriverpack-wget.exedescription ioc process File created C:\Program Files (x86)\DriverPack\audio\en\UTILS-1.mp3 cmd.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-adout-6.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\icudtl.dat installer.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\pl.pak installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\resources\standard_themes\grey.zip installer.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\CONTINUOUS-3.mp3 Conhost.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-2.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico installer.exe File created C:\Program Files (x86)\DriverPack\languages\hy.js 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\audio\en\WAITING-1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\libGLESv2.dll installer.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\sr.pak installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\id.pak installer.exe File created C:\Program Files (x86)\DriverPack\img\installation\icon-details.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\Opera\Assets\70x70Logo.scale-80_contrast-white.png installer.exe File created C:\Program Files (x86)\DriverPack\Tools\Icon.ico 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\audio\en\intro.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\ev_hashes_whitelist.bin installer.exe File created C:\Program Files (x86)\Opera\Assets\70x70Logo.scale-140_contrast-white.png installer.exe File created C:\Program Files (x86)\Opera\pref_default_overrides installer.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\awesome.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\installation\banner_cloud-bg.jpg 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\languages\bn.js 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.ttf 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\programs\star-full.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico installer.exe File created C:\Program Files (x86)\DriverPack\img\installation\banner_social-fb.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\installation\soft\Archiver.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\languages\ps.js 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\uk.pak installer.exe File created C:\Program Files (x86)\Opera\pref_default_overrides installer.exe File created C:\Program Files (x86)\DriverPack\css\fonts\Roboto\roboto-light-webfont.ttf 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\languages\te.js 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\EXPERT-SETTINGS-1.mp3 Conhost.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\FINAL-1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\resources\standard_themes\feathers.zip installer.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\second-browser-tor.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\charms\help.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\installation\drivers\inputdev.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\languages\fa.js 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\css\roboto.css 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\installation\drivers\zBad.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\lt.pak installer.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\uz.pak installer.exe File created C:\Program Files (x86)\DriverPack\img\device-class\new-ui\undefined-device.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\installation\controls\more_normal.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\final\final_aside-failure$2x.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\new-ui\popups\with-ads.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\TEAM-PROOF-2.mp3 regsvr32.exe File created C:\Program Files (x86)\DriverPack\img\device-class\cardreader.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\assistant-faces\start-screen\5.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\screens\new-ui-logo2021.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_regular-webfont.eot 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-false-positive-1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\dbghelp.dll installer.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-all-1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\img\installation\drivers\wifi.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\Opera\Assets\150x150Logo.scale-180.png installer.exe File created C:\Program Files (x86)\DriverPack\img\installation\drivers\printer.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\snapshot_blob.bin installer.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico installer.exe File created C:\Program Files (x86)\DriverPack\img\device-class\webcamera.png 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe File created C:\Program Files (x86)\DriverPack\img\games\games-top-civilization.jpg 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe -
Drops file in Windows directory 64 IoCs
Processes:
msiexec.exedllhost.exexcopy.exegacutil.exexcopy.exegacutil.exengen.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\csc.exe.config msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorcfg.msc msiexec.exe File opened for modification C:\Windows\Registration\_RegDBWrt.clb dllhost.exe File opened for modification C:\Windows\assembly\temp\U86E3W2V85\IEExecRemote.dll msiexec.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35 xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll xcopy.exe File opened for modification C:\Windows\Installer\MSIF5F2.tmp msiexec.exe File created C:\Windows\assembly\tmp\AVYH0JQC\System.DirectoryServices.dll gacutil.exe File opened for modification C:\Windows\assembly\tmp\02NYE9LI\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File created C:\Windows\assembly\tmp\F1VWHZX1\Microsoft_VsaVb.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.tlb msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\regasm.exe.config msiexec.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll xcopy.exe File opened for modification C:\Windows\assembly\tmp\GI0GK8SS\__AssemblyInfo__.ini gacutil.exe File opened for modification C:\Windows\Installer\MSI18CE.tmp msiexec.exe File opened for modification C:\Windows\assembly\temp\P6F1QGTT1A\System.Security.dll msiexec.exe File opened for modification C:\Windows\assembly\tmp\D9TD0XQU\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini xcopy.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIF7A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFAE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI11A2.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe.config msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\_Networkingperfcounters.ini msiexec.exe File opened for modification C:\Windows\assembly\temp\83YVJFGLY6\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\assembly\temp\P6F1QGTT1A\__AssemblyInfo__.ini msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\ksc.nlp msiexec.exe File created C:\Windows\assembly\tmp\02NYE9LI\System.ServiceProcess.dll msiexec.exe File created C:\Windows\assembly\tmp\9WKQ2LJ9\System.Web.RegularExpressions.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\shfusion.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIDD8D.tmp msiexec.exe File created C:\Windows\assembly\tmp\UJ58V723\mscorcfg.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIDCCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF9CD.tmp msiexec.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File created C:\Windows\Installer\e5cf6eb.mst msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\prcp.nlp msiexec.exe File opened for modification C:\Windows\assembly\temp\4D31BOJOTN\RegCode.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\config\security.config.cch.new ngen.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll xcopy.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.hkf msiexec.exe File opened for modification C:\Windows\assembly\tmp\ZKRV0TC4\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\assembly\temp\328VGS6WK1\System.Management.dll msiexec.exe File created C:\Windows\assembly\tmp\NK3WLUA2\System.Configuration.Install.dll msiexec.exe File created C:\Windows\assembly\tmp\KS7HFCO1\System.Web.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_minimaltrust.config msiexec.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\__AssemblyInfo__.ini xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\CharInfo.nlp msiexec.exe File created C:\Windows\assembly\tmp\8DVEAF95\IIEHost.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIFA7F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2FE.tmp msiexec.exe File opened for modification C:\Windows\assembly\temp\MHIKL57I92\System.Web.Mobile.dll msiexec.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini xcopy.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000024aabe40d3e837210000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000024aabe400000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090024aabe40000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000024aabe4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000024aabe4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
opera.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz opera.exe -
Processes:
compact.exeregsvr32.exeregsvr32.exeregsvr32.execompact.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.execompact.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exelauncher.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FAEEE760-117E-101B-8933-08002B2F4F5A}\AlternateCLSID = "{30854451-8F2D-4282-8070-73A801B560A3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C1A8AF25-1257-101B-8FB0-0020AF039CA3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B} compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\Compatibility Flags = "1024" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\Compatibility Flags = "1024" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\AlternateCLSID = "{261399BF-4DBC-4731-B79F-EF8871D7CB36}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\AlternateCLSID = "{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{25A3C2C9-8F6E-4140-BEF3-535D4B9709D8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9ED94440-E5E8-101B-B9B5-444553540000} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{612A8624-0FB3-11CE-8747-524153480004} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D646316D-0915-421A-84C1-6A21C2495791} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{612685EF-57C8-469F-88AB-E4E0B595C5AB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\AlternateCLSID = "{2B577565-36F7-4351-B2E7-DAFC75E9D72A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\Compatibility Flags = "1024" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{648A5600-2C6E-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6B7E638F-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628} compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\AlternateCLSID = "{225957BB-0005-48B9-8BFB-11AEE66779FB}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{CEDFFAFD-3C2F-4552-9FD3-3DC4299057FD}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628} compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}\AlternateCLSID = "{74DD2713-BA98-4D10-A16E-270BBEB9B555}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Compatibility Flags = "1024" launcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\AlternateCLSID = "{CFA7636D-CAA1-4F18-868F-8720624C8B86}" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{D3CCB2F7-0D00-4F26-9569-D7C368DE34E2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}" launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1} compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}" compact.exe -
Modifies data under HKEY_USERS 54 IoCs
Processes:
opera_autoupdate.exemsiexec.exeinstaller.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Opera Software\ATTEMPTS = "1" opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Opera Software opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs opera_autoupdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" installer.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exelauncher.exemsiexec.exeDllHost.execompact.exeregsvr32.exeregsvr32.exeregsvr32.execompact.execompact.execompact.exeregsvr32.exeregsvr32.exeregtlib.exeregsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Version\ = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\0\win32\ = "C:\\Windows\\SysWow64\\mshflxgd.ocx" launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80B51087-CE4C-4FAE-8401-B6B3809DD234}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}\InprocServer32\ThreadingModel = "Apartment" launcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0B2DCA19-1224-351A-B372-C7B59A70560A}\1.0.5000.0\Class = "Microsoft.CLRAdmin.MMC_TASK_DISPLAY_OBJECT" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{962F28D6-107D-47A5-9515-2864454CFDD1}\CONTROL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DllHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}\Version\ = "1.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\comctl32.ocx, 10" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\ = "IListSubItems" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A227305-5C14-4EFD-AC52-516FE226F947}\MiscStatus launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27395F88-0C0C-101B-A3C9-08002B2F49FB}\1.1\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D6CC9B0-DF77-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{27395F88-0C0C-101B-A3C9-08002B2F49FB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1254089D-0104-3BFB-B6BA-9168F994DCA6}\1.0.5000.0\Assembly = "mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{79179AA0-E14C-35EA-A666-66BE968AF69F}\1.0.5000.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B0D1EC3-C33B-454E-A530-DCCD3660C4CA}\Implemented Categories msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|Microsoft.NET|Framework|v1.1.4322|System.Web.Mobile.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB39D9A0-557A-11CF-AEBE-00AA00A8F7F3}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ = "INodes" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComCtl2.Animation.2\CLSID\ = "{B09DE715-87C1-11D1-8BE3-0000F8754DA1}" compact.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E} launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\4D553650-6ABE-11cf-8ADB-00AA00C00905 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2BEC8FA8-1193-4A15-B8AF-C6DF6E6930C7}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib DllHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0D2F211-CCB0-11D0-A316-00AA00688B10}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E304B70C-0FCE-4E1B-9C81-CDAAD9F7DA55}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\VersionIndependentProgID launcher.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{A2BA85AC-C24E-3EB2-9404-80AB01181433}\1.0.5000.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88592805-9549-3E00-8308-03CFA6B93882}\ = "_Console" regtlib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{261399BF-4DBC-4731-B79F-EF8871D7CB36}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38911D8F-E448-11D0-84A3-00DD01104159}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0D2F21A-CCB0-11D0-A316-00AA00688B10}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\ = "Microsoft Hierarchical FlexGrid Control 6.0 (SP6) (OLEDB)" launcher.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{B3E5A7FF-AFC6-3F2B-8FFF-300C7C567693}\1.0.5000.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e} compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962F28D6-107D-47A5-9515-2864454CFDD1}\ProgID\ = "COMCTL.SBarCtrl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EAC2F2A-251F-4BA8-8617-99A8DD715453}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0B0D1EC3-C33B-454E-A530-DCCD3660C4CA}\ProgId msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\ = "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20DD1B9B-87C4-11D1-8BE3-0000F8754DA1} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20DD1B9B-87C4-11D1-8BE3-0000F8754DA1}\TypeLib compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{875EB8B7-663D-3B83-B702-5AF34662B9B5}\1.0.5000.0\Assembly = "mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9ABE23BD-D5D5-30F6-B127-9B3AB98F7DBB}\1.0.5000.0\Assembly = "mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5522DAFA-06D6-11D2-8D70-00A0C98B28E2}\VERSION regsvr32.exe -
Processes:
opera.exeopera_autoupdate.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 5c0000000100000004000000001000000f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c040000000100000010000000285ec909c4ab0d2d57f5086b225799aa190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera_autoupdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c040000000100000010000000285ec909c4ab0d2d57f5086b225799aa2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf95c0000000100000004000000001000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf92000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000005c0000000100000004000000001000000f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c040000000100000010000000285ec909c4ab0d2d57f5086b225799aa190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 opera_autoupdate.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 4284 regedit.exe 3992 regedit.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 76 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 132 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 133 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 137 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 2100 msiexec.exe 2100 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mshta.exepid process 1616 mshta.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
mshta.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: 33 2812 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2812 AUDIODG.EXE Token: 33 1616 mshta.exe Token: SeIncBasePriorityPrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe Token: SeShutdownPrivilege 1616 mshta.exe Token: SeCreatePagefilePrivilege 1616 mshta.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 3700 msiexec.exe 3700 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.execmd.exemshta.execmd.execmd.exenet.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3024 wrote to memory of 624 3024 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe cmd.exe PID 3024 wrote to memory of 624 3024 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe cmd.exe PID 3024 wrote to memory of 624 3024 610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe cmd.exe PID 624 wrote to memory of 1616 624 cmd.exe mshta.exe PID 624 wrote to memory of 1616 624 cmd.exe mshta.exe PID 624 wrote to memory of 1616 624 cmd.exe mshta.exe PID 1616 wrote to memory of 1916 1616 mshta.exe rundll32.exe PID 1616 wrote to memory of 1916 1616 mshta.exe rundll32.exe PID 1616 wrote to memory of 1916 1616 mshta.exe rundll32.exe PID 1616 wrote to memory of 1108 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 1108 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 1108 1616 mshta.exe cmd.exe PID 1108 wrote to memory of 3172 1108 cmd.exe netsh.exe PID 1108 wrote to memory of 3172 1108 cmd.exe netsh.exe PID 1108 wrote to memory of 3172 1108 cmd.exe netsh.exe PID 1616 wrote to memory of 3776 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3776 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3776 1616 mshta.exe cmd.exe PID 3776 wrote to memory of 1556 3776 cmd.exe netsh.exe PID 3776 wrote to memory of 1556 3776 cmd.exe netsh.exe PID 3776 wrote to memory of 1556 3776 cmd.exe netsh.exe PID 1616 wrote to memory of 1020 1616 mshta.exe net.exe PID 1616 wrote to memory of 1020 1616 mshta.exe net.exe PID 1616 wrote to memory of 1020 1616 mshta.exe net.exe PID 1020 wrote to memory of 3948 1020 net.exe net1.exe PID 1020 wrote to memory of 3948 1020 net.exe net1.exe PID 1020 wrote to memory of 3948 1020 net.exe net1.exe PID 1616 wrote to memory of 4168 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 4168 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 4168 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3940 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3940 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3940 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3860 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3860 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3860 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 4912 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 4912 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 4912 1616 mshta.exe cmd.exe PID 4168 wrote to memory of 1096 4168 cmd.exe driverpack-wget.exe PID 4168 wrote to memory of 1096 4168 cmd.exe driverpack-wget.exe PID 4168 wrote to memory of 1096 4168 cmd.exe driverpack-wget.exe PID 4912 wrote to memory of 2228 4912 cmd.exe driverpack-wget.exe PID 4912 wrote to memory of 2228 4912 cmd.exe driverpack-wget.exe PID 4912 wrote to memory of 2228 4912 cmd.exe driverpack-wget.exe PID 3940 wrote to memory of 4940 3940 cmd.exe driverpack-wget.exe PID 3940 wrote to memory of 4940 3940 cmd.exe driverpack-wget.exe PID 3940 wrote to memory of 4940 3940 cmd.exe driverpack-wget.exe PID 3860 wrote to memory of 3500 3860 cmd.exe driverpack-wget.exe PID 3860 wrote to memory of 3500 3860 cmd.exe driverpack-wget.exe PID 3860 wrote to memory of 3500 3860 cmd.exe driverpack-wget.exe PID 1616 wrote to memory of 3004 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3004 1616 mshta.exe cmd.exe PID 1616 wrote to memory of 3004 1616 mshta.exe cmd.exe PID 3004 wrote to memory of 3192 3004 cmd.exe net1.exe PID 3004 wrote to memory of 3192 3004 cmd.exe net1.exe PID 3004 wrote to memory of 3192 3004 cmd.exe net1.exe PID 1616 wrote to memory of 1504 1616 mshta.exe regsvr32.exe PID 1616 wrote to memory of 1504 1616 mshta.exe regsvr32.exe PID 1616 wrote to memory of 1504 1616 mshta.exe regsvr32.exe PID 1616 wrote to memory of 4192 1616 mshta.exe compact.exe PID 1616 wrote to memory of 4192 1616 mshta.exe compact.exe PID 1616 wrote to memory of 4192 1616 mshta.exe compact.exe PID 1616 wrote to memory of 1072 1616 mshta.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe"C:\Users\Admin\AppData\Local\Temp\610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\DriverPack\start.bat" "610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe""2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DriverPack\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx "610b44ef29643f5bfc1bf571e13e92155856eabac8706f45ea040da2ed48ea14.exe"3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_39947.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="DriverPack aria2c.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_55973.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start wscsvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44373.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44373.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44373.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87083.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_87083.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87083.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97302.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_97302.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97302.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59319.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_59319.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59319.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start wscsvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35429.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35429.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35429.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19306.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19306.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19306.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43663.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43663.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43663.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9142.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9142.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9142.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28978.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_28978.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28978.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99918.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_99918.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99918.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67852.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_67852.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67852.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82581.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_82581.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82581.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6910.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_6910.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6910.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_76024.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_76024.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_76024.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85383.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_85383.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85383.log"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61365.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_61365.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61365.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37439.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_37439.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37439.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17228.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17228.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17228.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92196.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_92196.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92196.log"5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_11997.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96924.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96924.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96924.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5210.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_5210.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5210.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/DirectX.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_23804.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/DirectX.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_52685.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_63320.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_22337.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4085.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_4085.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4085.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9752.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9752.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9752.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25509.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_25509.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25509.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7820.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7820.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7820.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14438.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14438.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14438.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71629.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_71629.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71629.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98713.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_98713.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84829.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84829.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27342.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27342.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49430.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49430.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49430.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18329.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18329.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18329.log"5⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89580.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84031.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84031.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79044.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_79044.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79044.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20042.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_20042.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20042.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99495.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_99495.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58232.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58232.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37991.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_37991.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37991.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13168.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13168.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13168.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71540.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_71540.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_857.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_857.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_857.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89580.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_89580.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75370.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75370.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73576.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73576.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73576.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20345.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_20345.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20345.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72959.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72959.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72959.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24692.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24692.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24692.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65334.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_65334.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65334.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84809.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84809.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84809.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31670.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_31670.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31670.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47146.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47146.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42453.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42453.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42453.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24257.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24257.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24257.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6430.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_6430.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6430.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79309.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_79309.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79309.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85401.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_85401.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85401.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3331.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3331.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3331.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74854.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74854.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74854.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3889.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3889.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3889.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_39841.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_39841.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_39841.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60368.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_60368.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60368.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75937.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75937.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75937.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83018.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83018.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83018.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52661.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_52661.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52661.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78325.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_78325.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78325.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73065.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73065.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73065.log"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67621.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_67621.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67621.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31905.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_31905.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31905.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75138.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75138.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75138.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-all-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42892.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42892.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-all-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42892.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44103.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44103.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44103.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64966.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64966.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64966.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21555.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21555.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21555.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72786.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72786.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72786.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47949.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47949.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47949.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44995.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44995.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44995.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70609.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_70609.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70609.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_985.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_985.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_985.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3566.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3566.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3566.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86453.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_86453.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86453.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_32417.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_32417.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_32417.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18575.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18575.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18575.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6113.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_6113.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6113.log"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26295.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_26295.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26295.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-18.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21139.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21139.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-18.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21139.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-17.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29735.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_29735.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-17.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29735.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-16.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19329.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19329.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-16.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19329.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9462.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9462.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9462.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51692.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_51692.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51692.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/RuntimePack.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_88775.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/RuntimePack.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46846.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_46846.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46846.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65124.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_65124.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65124.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94815.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_94815.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94815.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65860.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_65860.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65860.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69395.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69395.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69395.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe" /S || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_29504.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe" /S5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74395.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74395.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74395.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43301.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43301.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43301.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5267.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_5267.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5267.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10073.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_10073.txt""4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10073.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84909.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84909.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84909.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40741.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_40741.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40741.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43133.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43133.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43133.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94940.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_94940.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94940.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78440.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_78440.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78440.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6783.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_6783.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6783.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74322.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74322.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74322.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_30376.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_30376.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_30376.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71964.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_71964.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71964.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35040.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35040.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35040.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44913.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44913.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44913.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69897.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69897.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69897.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59151.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_59151.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59151.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44875.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44875.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44875.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79414.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_79414.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79414.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42465.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42465.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42465.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24420.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24420.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24420.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94651.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_94651.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94651.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4097.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_4097.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4097.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19975.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19975.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19975.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73591.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73591.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73591.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93853.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93853.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93853.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43215.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43215.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43215.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83677.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83677.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83677.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28001.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_28001.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28001.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27016.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27016.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27016.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10609.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_10609.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10609.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95019.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_95019.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95019.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75746.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75746.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75746.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46045.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_46045.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46045.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80508.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_80508.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80508.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18005.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18005.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18005.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20257.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_20257.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20257.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44957.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44957.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44957.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21219.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21219.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21219.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56900.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56900.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56900.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REBOOT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_54451.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_54451.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REBOOT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_54451.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14114.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14114.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14114.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65742.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_65742.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65742.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/DotNetXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_99302.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/DotNetXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_28797.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=15⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 --crash-reporter-parent-id=16926⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" --backend --silent --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=1692 --crash-reporter-pid=4676 --wait-for-package="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806155757" --initial-proc-handle=040300006⤵
- Enumerates connected drives
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806155757\installer.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806155757\installer.exe" --backend --silent --initial-pid=1692 --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --crash-reporter-pid=46767⤵
- Enumerates connected drives
- Drops file in Program Files directory
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe"8⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --ran-launcher9⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe" --ran-launcher --crash-reporter-parent-id=508410⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5084.1.893166558\1481476097"10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5084.2.660523698\705661932"10⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5084.3.504243098\411279890"10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="5084.4.52763868\449270827"10⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="5084.5.1033337273\320162470" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --ignored=" --type=renderer "10⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host=https://autoupdate.geo.opera.com/ --pipeid=oauc_pipedbff851fa759ccb33e726f883720ae50 --version=36.0.2130.80 --edition --lang=en-US --producttype --requesttype=start --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --installationdatadir="C:\Program Files (x86)\Opera" --firstrunver=36.0.2130.80 --firstrunts=1659801499 --currentstats="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp5084.6.1599612201"10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="5084.7.948897649\1197359131" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --ignored=" --type=renderer "10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="5084.8.1719121911\1906022345" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --crash-reporter-pid=1136 --ignored=" --type=renderer "10⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --version10⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --start-maximized8⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --start-maximized --ran-launcher9⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe" --start-maximized --ran-launcher --crash-reporter-parent-id=377610⤵
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe" --version6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_52480.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe"5⤵
- Checks computer location settings
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\set_x64.cmd" "6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Windows\system32\xcopy.exexcopy x64\GAC C:\Windows\assembly\GAC /s /e /i /y7⤵
- Drops file in Windows directory
-
C:\Windows\system32\xcopy.exexcopy x64\Microsoft.NET C:\Windows\Microsoft.NET /s /e /i /y7⤵
- Drops file in Windows directory
-
C:\Windows\system32\xcopy.exexcopy x64\System32 C:\Windows\System32 /s /e /i /y7⤵
- Drops file in System32 directory
-
C:\Windows\system32\xcopy.exexcopy x64\SysWow64 C:\Windows\SysWow64 /s /e /i /y7⤵
- Drops file in System32 directory
-
C:\Windows\regedit.exeregedit /s x64\64bit.reg7⤵
- Runs .reg file with regedit
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe" /S || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_74980.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe" /S5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_84329.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe" -s || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_43508.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe" -s5⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\install.cmd" -s "6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver7⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comct232.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comct332.ocx"7⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comctl32.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comdlg32.ocx"7⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\dblist32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mci32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomct2.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomctl.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomm32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msdatgrd.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msdatlst.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msflxgrd.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mshflxgd.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msinet.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msmask32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msstdfmt.dll"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msstkprp.dll"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mswinsck.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\picclp32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\richtx32.ocx"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\sysinfo.ocx"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\tabctl32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msvbvm50.dll"7⤵
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s VBA60_OCX_License.reg7⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\libcrypto-1_1-x64.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\libssl-1_1-x64.dll"7⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\OpenAL32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\wrap_oal.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\atl70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\atl71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comct232.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comct332.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comctl32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comdlg32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\dblist32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libcrypto-1_1.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libeay32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libssl-1_1.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mci32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70chs.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70cht.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70deu.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70enu.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70esp.dll"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70fra.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70ita.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70jpn.dll"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70kor.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70u.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71CHS.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71CHT.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71DEU.DLL"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ENU.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ESP.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71FRA.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ITA.DLL"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71JPN.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71KOR.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71u.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomct2.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomctl.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomm32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msdatgrd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msdatlst.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msflxgrd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MShflxgd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msinet.ocx"7⤵
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msmask32.ocx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msstdfmt.dll"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MSSTKPRP.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvbvm50.dll"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvci70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MSVCP70.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcp71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcr70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcr71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcrt10.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mswinsck.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\OpenAL32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\picclp32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\richtx32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\ssleay32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\sysinfo.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\tabctl32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vb40032.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\wrap_oal.dll"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vb40016.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\vbrun100.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\vbrun200.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vbrun300.dll"7⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="DriverPack-Alice" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\DRPSu\Alice\cloud.exe"4⤵
- Executes dropped EXE
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_13608.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe"5⤵
-
C:\Windows\TEMP\NET\WinPKG.exeC:\Windows\TEMP\NET\WinPKG.exe6⤵
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\Windows\TEMP\NET\1.1\netfx.msi /norestart /qb-!7⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\TEMP\NET\1.1\cleanup.bat7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Loads dropped DLL
-
C:\Windows\system32\net.exenet.exe user aspnet /delete8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user aspnet /delete9⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\M928366" /v DisplayName /t reg_sz /d "" /f8⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" /v DisplayName /t reg_sz /d "Microsoft .NET Framework 1.1 SP1" /f8⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft .NET Framework 1.1 (1033)" /v DisplayName /t reg_sz /d "Microsoft .NET Framework 1.1 SP1" /f8⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x408 0x2b81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27342.log"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84829.log"1⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98713.log"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84031.log"1⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58232.log"1⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99495.log"1⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71540.log"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75370.log"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47146.log"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --scheduledautoupdate --autoupdaterequesttype=start1⤵
-
C:\Windows\TEMP\opera autoupdate\installer.exe"C:\Windows\TEMP\opera autoupdate\installer.exe" --version2⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host --pipeid=oauc_task_pipee59e7323ed1cebd78082538c8b9cbe70 --version=36.0.2130.80 --lang=en --producttype --requesttype=start --downloaddir="C:\Windows\TEMP\opera autoupdate" --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Windows\TEMP\opera autoupdate" --nometrics --scheduledtask2⤵
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\1316_421\Opera_42.0.2393.137_Autoupdate.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\1316_421\Opera_42.0.2393.137_Autoupdate.exe"3⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --forcedcheckforupdates="C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera"3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe" --internalversion4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe" --stream4⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --install --silent --autoupdate --installfolder --installfolder="C:\Program Files (x86)\Opera" --launchopera=04⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies data under HKEY_USERS
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --install --silent --autoupdate --installfolder --installfolder="C:\Program Files (x86)\Opera" --launchopera=0 --crash-reporter-parent-id=34605⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\TEMP\Opera Installer\installer.exe"C:\Windows\TEMP\Opera Installer\installer.exe" --version5⤵
- Loads dropped DLL
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --backend --silent --install --autoupdate --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=0 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --replace32bitwith64bit=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=0 --server-tracking-data=server_tracking_data --initial-pid=3460 --crash-reporter-pid=2800 --wait-for-package="C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing" --initial-proc-handle=BC0500005⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --backend --silent --initial-pid=3460 --install --autoupdate --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=0 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --replace32bitwith64bit=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=0 --server-tracking-data=server_tracking_data --crash-reporter-pid=28006⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6726515EE31C430AD4D0A9364455B1782⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3478C2BD0BCB61CCCAF980F1C88FF872 E Global\MSI00002⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.tlb"3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscoree.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb"3⤵
-
C:\Windows\SysWOW64\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet.mof"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe" /bootstrapi3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe" /i3⤵
- Drops file in System32 directory
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll"3⤵
- Loads dropped DLL
- Enumerates connected drives
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll"3⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll"3⤵
- Loads dropped DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll"3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll"3⤵
- Drops file in Windows directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\lodctr.exe"C:\Windows\SysWOW64\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\_dataperfcounters.ini3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\migpolwin.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\migpolwin.exe" -migrate 1.1.4322 1.0.37053⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Drops file in System32 directory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{48DA6741-1BF0-4A44-8325-293086C79077}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\DriverPack\DriverPackSolution.htmlFilesize
4KB
MD5203ac1542d8e93edbbc80f7b59db5c44
SHA1ba66db0e746bc550ea860f4023c3cb5c72140ba5
SHA2568892e63141854bcf4bb1452abef68dd2c348c59322d697ef11a7ab7c5e3c4aea
SHA51253cb5ad72c66e62d9285c318b606a9819053de729fa18ea72e80a7f09b333cc7868b455048660397086fa80a13ca745e42a6dc22df63d059076befca178a8a95
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\config.jsFilesize
3KB
MD531009d2efb710925bf7f308af59c629b
SHA15215c77b1719d0974dc529b523b758ef85dbebd4
SHA25618f86ef3fad86c97d56274e5577b178a77f40587a80451a971013248e37190a6
SHA51244129d626970c101df41a0bc94ff6120a1034077628da968d9c772fa6125d1f11478480cec7086dfd1625c8fc07820202a711a5598ea131b7742b31211a3f394
-
C:\Program Files (x86)\DriverPack\css\custom-control.cssFilesize
10KB
MD5f7f8703ada2176dc144343a2c2acb1cd
SHA1091334a48056a8baafff0cd672232de1c1f6c838
SHA2567d7853e95258a7a3f8eaf41795f7124e7d2dacdeb5f1efe212b3ff7ed0da9e50
SHA51227d46472c06103e0bdd9d40149804c16f469305752c3a6d8473c2f2ab22b2c8fa5d65d61dda7c617a3f12d8526b56a10320b8683f31d210ac2185fd0daed8e97
-
C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.eotFilesize
7KB
MD5d85a00ccb58d531afd9ad80a067fbf0e
SHA10a3c0cfea5b9c0fdd5f17a1df49cb1512316330d
SHA2560a04d85875091cc334f63b90c8ccfa0838f20023945d949296363369066870e3
SHA512bce1796d0c71291cb779e2e99399a213b030663d5968330932b4a059ba48f3679e2df9e9c84201efb090a44b499bc5f46d174ad40b4b1d3afb5df5d2f3299261
-
C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-regular-webfont.eotFilesize
40KB
MD588a9c629f26f8563a72eac95cb0744bc
SHA1484bca13532678133dc14a668c580be2c1346526
SHA2563ae576bfa96d7cf6614c8c97290c7abe03191a8ceb0c837a21e7ffe70d66ca62
SHA512b4cdaa3a5a46ef368e9138c9874aa1173b466bc660d5bbbd13fc3f10f509cda9af151a2667ecd079935d60992b1436f6d5843ced5a063769e19e67f84c402af9
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.eotFilesize
141KB
MD5be0e58130a84b19c8523345478a0bd3f
SHA135dfea056f715d8191f2647e56c214afaf819eec
SHA2561c3a470bf710204b1dbd65679b914af4b94e7f018b1f7df3d61ff863d6f335d9
SHA512c0ca4a33842d69fad8f1795864c9b592d2cedd62b14efeb46676823460ea50693ccc884891d16f4ba1ffdd5e0a80f9d06fd6e65fe184f3ea283ff441e7b874c6
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.woffFilesize
57KB
MD5a3932b53cb250b684b63d1e04af5603e
SHA1b06c657df6b320b915a17455848e66695a9fc68e
SHA2562a8f208d9d8556ff58da8a420316de6d634a568a0eeb94c043430659fff7d338
SHA512e8e68301dde147b7c79e21689066b7c9653a82f9898c2c76f4060af1a48c7f997f4797de5002e870e9ffba05efcb47f10cae5b8beadbe7909a85de4c04c54730
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_light-webfont.eotFilesize
61KB
MD5ee9163c34f600221169f8ff531e97182
SHA157f0b2c837c94f2a0df47ee62b4639fd6426bfa0
SHA25653f30a622db68cebe92dbd384cc292aef13ad7e3349a10a77c29326e10634c21
SHA512d51e2a5f6df706eaa2c5ffa071a9a9c08e58a30b4af64a1ccbe81f8e9c38f20429df665cabaf295129490afc639b7e19c0fced428610a284a17899c3290904cb
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eotFilesize
65KB
MD5044aa0b596161750cb58aca15c52cf38
SHA1d40e645b34188a54d909fa40f7eddeefb8b9df03
SHA256790579e11608136663d073bc6f99848c04b4dcd69216df7daf5be00df573a3fd
SHA5121a3b3abc614a7ddf673e34a936de63809f8c18a86409364b2bbdeb608fbcd845095ba7cfb34a0826e2ac18cfc5ccd4d47d4bfa13fae3caba7fbc4470d36c8086
-
C:\Program Files (x86)\DriverPack\css\icons-checkbox.cssFilesize
444B
MD53be98220035017d9b818f3cc94f87587
SHA1bc07f11d0a59f942ac942dba02214a7041ad6e3a
SHA256cb134dcb95a407795c671a512c389894d3525fba3f6a2168fc5b9b7e875e78dc
SHA512d2e7d57cb7b7e771c82c75a04fbfb86ebecbb409ecf2c5666aeaa99695474a7985e3367f6a5b3d4ac59f775f60fb084efa9bdda99ce3c077df2690a5f0a6b1d1
-
C:\Program Files (x86)\DriverPack\css\icons.cssFilesize
509B
MD5ebae852f3327fdaf3e2fc2bf1cdecb8f
SHA1f9753fe176069974fc9bce49eae877745282e183
SHA256b5f111103f7f090c246a223b1ff497b94c4dd3ac64bf5b3fb2d91555fcfd6f2c
SHA512bf8e7c5db7a1eacd4344d5facfee1cd66e883389b53bc28e4e387cdb67ea40ee26266ba4282e50eb50a7bc3c810d9fdbb50792a46135761b2e8ce52ddc9e394a
-
C:\Program Files (x86)\DriverPack\css\normalize.min.cssFilesize
1KB
MD5e8908cf9cb9504b285327d240187f53b
SHA120eadf1695eb38bcd92d1706de5335db61b96502
SHA25686235e2c477078adfe1188d07ca1e5d8198443aaf2436de1785a169f3e1d5463
SHA5129c828e8942d40da89f33d1db459a7fc12621660331bef307df8649e89758e76b044bf97a2cd36d656915e19a8b04f571cdb61d7cb6f926a3ba151ee67bbcdc4b
-
C:\Program Files (x86)\DriverPack\css\open-sans.cssFilesize
1KB
MD59ed298542b45ef98492e159f68e89f48
SHA1c4521d9a5dff8a71804c40a909378e8eb5bd66c2
SHA256b9bd51ae6ccc7df20417e0ef341295b86bf8f74f6e235ee99ddefd675806f47f
SHA5121c7d5b378d6c627fbbef864035b157c3e7647b699a50d64f6ebf22faac38bf774e0c025bc8dd4ecc9bde7b377b729bc89bf6fbac4d2409240e2d03753cfe680e
-
C:\Program Files (x86)\DriverPack\css\proximanova.cssFilesize
2KB
MD5487b553f5f73b30b8d565df02b4103cc
SHA16defcf202ce7a04f2bea8aaac8bb01ed44407fa5
SHA256931071422410d73d9d7d3583745e476eac23c0cac5fbe344f8436499ee40ac46
SHA5125a94da5d685f6e74f6576c179b8b65b719727163afebf24557b5f23718a8c034f5e2782ff33021c4d029abaa7cdf464ad0a49cce0602b31191b3b6b642bda9ce
-
C:\Program Files (x86)\DriverPack\css\roboto.cssFilesize
1001B
MD5f5f5b5e4955262430e7b496247425d2d
SHA1d4bea186a0d525ce3060e8dd7901311ae4a0735a
SHA2562537efe2fb974f58cddbc99abfcd7aed6e9df81992eed3e528b5f1748167b8fa
SHA51216a7ec3d95ed773a0a1ce2c2dc4430677106f0d1042e34cb39ed48f4a495f637ec3eefad05a4ebbddbea71a67e933fa0b56e6beef69700c6e3ac9cda9c17e7ca
-
C:\Program Files (x86)\DriverPack\css\style.cssFilesize
14KB
MD52f4fe7647aa460b8984556a25a74c234
SHA18fb2a5135e61a034ecdfef279e92078a7b463123
SHA2563f8ec31a3c08de6c1aac117347b1b83f391bb0a91c9dbdc57ba9d11d5ba372d5
SHA512bad4c1419e302f8e5a84c28fb0862dc56167a7353cc5420d8226883203fe03eca7ec8a9f554cfee560523e9ef292cc38200bce6015c80a428ce4c05222be3a58
-
C:\Program Files (x86)\DriverPack\drp.cssFilesize
190KB
MD55fdaf0fd106200153f8243ebb8bc6b18
SHA14b9524224954987a07fe1ce5f6f6e83becd5a20b
SHA256439bfd8bf9f9176c1757ba277850525f0abec59bb3ef7cd8a974a5ad1d2b3004
SHA5121db1cfcd7e8188594d5b136a479a29797ce1382c471bdd592f7f44f1026e5da845d231eeb09aa6b1b0d36ac2329b3277ee69c9e53049f2726df936a50b898228
-
C:\Program Files (x86)\DriverPack\drp.jsFilesize
3.7MB
MD50f62a60e249a6f77428cba73ee22780b
SHA15ce7ef0d538bce26d250d427d17cdedefcad1904
SHA25606643527422e7f6e3fc094f2314488cb8758bff19f677499d27a4289eb15627e
SHA51207b6cf625640a9765d28a386a16dc5f3ad7bc8d3baa9756b9869240c60d566bb3e273bdbdc547863bb86bfadf490bc04ae92739e9b59da2062eb05e51a2243ef
-
C:\Program Files (x86)\DriverPack\img\assistant-faces\start-screen\5.pngFilesize
75KB
MD540353d51881300e6cea13d94ae01b756
SHA15718f730dcb3349ad6d23972657962663fb38fc1
SHA256ad615ef1f7016826d475fe90b4363cc149b060de2b9406b4c58cb4a4f1938bef
SHA5128bc29ecdce2d5f558dd31a1e2424cd1ca94f72e36ea72a491cbcd46f52762f1f44106c749bcb41e6fecd87f9cba2bf6898dbc022a5c46f2ae15aafda3ac3c734
-
C:\Program Files (x86)\DriverPack\img\header\new-header-logo.pngFilesize
4KB
MD510eb51f76f3df7a82b05ed747e27c6a7
SHA1157e45f82ba308431cecede2d753d775b54e83c8
SHA25698856383428042c14739159f4a62168e9394f774bf2b696d62f46d70fc2ba175
SHA512c497fad9597c699a7c6355a5aee999d8e240b1bcfbc39031f0c8b50bdb53f30f7fd43451ba3ea6b99e3fc414bfdd5dae11a499cc9585322b039e6ef87bc31917
-
C:\Program Files (x86)\DriverPack\img\new-ui-assistant\arrow-recommend.pngFilesize
1KB
MD5a2b5d78a49f66313a203f666faa64393
SHA199c22fd6116d69cd2d21aba072f050b5d8f51006
SHA256fd42158b4e01b5c86360c9450e9e3db5e399e0eadb28e5420ac69f7da1dc0fc5
SHA51203a7abce1b4c2bf82f40ba9af1f25022bc20aaddd745b08fada7ac01dffaab05697880f080d38b4672905aad2d0bed319a83e13c3d247b3900673e76fab8cadc
-
C:\Program Files (x86)\DriverPack\img\new-ui-assistant\icon-footer-splite.pngFilesize
4KB
MD59d355f967c8a9312dc7453f97af3d393
SHA128dec943e5cbbb56f9676e9f420b0b7742bc861a
SHA2565e45160ca10f9237661f7c76880f1fed2dc5d2e147061daeeac7080df1502774
SHA512d42b873275465473ef4539b83a7f9b6807a9dae24a35b47ab47840733e00ca7ff4ebe7cfbc297162bd8d78c2b7a63fd4dea01f05e076d7b6637517ed49060696
-
C:\Program Files (x86)\DriverPack\img\screens\arrow-top.pngFilesize
2KB
MD5c88c78c9dcf11880a801e44e705f9708
SHA17b98255e87f81c3a655d375f112c188d9bd241a7
SHA2564f2785a950320440acd22fcc0274944b971d5975de008f69bf81d19d44842925
SHA512ea1fd00c23c7abdcdcecfce5d93b1946763043bc18cb17846ab3ecb607f19a7ede63ca5308cae6e2395053b223a4e438111cb6170264cc42c817130bd178ff4e
-
C:\Program Files (x86)\DriverPack\img\screens\new-ui-logo2021.pngFilesize
5KB
MD5ed623a69120325b464bc149ba5829465
SHA117ba0cbe9a7297824d8792becae98d8853c56af6
SHA256a11af07103005c27c0a5f721d99482e4700c21c85afcbc8e44e4e785af5fa902
SHA512fc18cde812cd2ac9e8f835971f4226092213737220e70e095bc5186042c061bf335501b098966c34a8c55610afea626061856740532166ea26c71c018b6059e7
-
C:\Program Files (x86)\DriverPack\languages\en.jsFilesize
86KB
MD57507c4174ced52a6c0e1b2bb12ce9f3e
SHA16bad4ef261e7b7ab1a02d46341bd1f8a922987da
SHA256a3df7c1b150504fb96555d8d7f7b9c4129a3225ba241da983d56a9c7a1404aec
SHA512d13d045bd66bbf104ec533903e4b7bb76dd56f6a1c8346787f419bf1cd0eafc082e757e0c244024d778755c4ab4468da455f2f92fad7f5fdb7a0135c9c6e26cf
-
C:\Program Files (x86)\DriverPack\run.htaFilesize
2KB
MD56bcab16cd99663b1093d10f827ca0323
SHA147b2d7f33da12d88095379fc8ea5bb7114ce75e9
SHA25602bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
SHA51267c23c1f3e8023001336ff7fc9c9052220f2ab67df280ef269b0239d67dfc67e6783dda44dec747ba6689c239d7efdb55262d098868e43ab70a055429349210e
-
C:\Program Files (x86)\DriverPack\start.batFilesize
90B
MD5f66f13d4770eb90e6d81222fe3525a3f
SHA1f21bc06a179c108d13c783600b98ea0641076127
SHA25688ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
SHA5123f321a339dee086f474d5ac9e8b247805d070b6c0ab5f9d85c5f1075021a3eb7ae23ab2b577000adc30ad32e66a1e291993f435f8539bb0032a1aca038e1f1b2
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Users\Admin\AppData\Local\Temp\nsvAFBF.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nsvAFBF.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nsvAFBF.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_39947.txtFilesize
9B
MD502466847c63e90c5041b8dd7990dce27
SHA1fdcf71f16e2efcb8815730b4cca5f580b185cf5c
SHA256195418a93d769a17558aa804568eff487979e62d0731aa8c63d8d0ffc1723321
SHA51286b11957db369afa71831c72848b897aafd155887467a377484d0346dcaeaac88476cad2331e34a24e7f8ac3a07335dd1e639ae27bfa0d4491dcc6a48a7e6ff3
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_55973.txtFilesize
9B
MD547a22a7a342fd09177c62fcb8054933c
SHA1d2b7928a34eedb04acc61c3a0e01d3138295e855
SHA25651e6af14fa1e9032300dbf76a85cb8561e523e89c363cec09cdc2128801a191d
SHA512b9ab174618fe617b061e27c8f0d4b7960271952a67245c2ad6155e93e0c08cab696191fbc7069c89f05ff545318f930cbd0dd7dc41b9cca0e7356143d3b47d98
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19306.logFilesize
680B
MD501ad6ce500fc8132df53e884dd0346ef
SHA173ac3caeb2cac1e07a8d68bf46fca6c81e7d45f3
SHA2565f049653326f8f00af7a84c74d524a2d0a6f510d333f79b5af867cd74a6c83b6
SHA5120b8874be75e67d6a6357d11d71da624e5900b6d60acb340ff6887bd37cf66fd873bed6d739e7ce71e58ee560c880189d815c53b0e3dc137fce4146cdecf7044b
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28978.logFilesize
745B
MD5f22e8cd4c351248b6d84833dc967e878
SHA16a9ed35637179e206c07a886e40722b2c2c32fe1
SHA2568a741f42826062199a313f2dd7657d9ae409f518a4566bc212bf74649984b1ed
SHA5120fc1e47d728c69ddc8be0fecbf62d1d4f4b4a384f15477ff2f5f13813f260b7600529b2e3dc77cc622cb1a0e7ca964114eaf4bea3a1f577b1c1c907e869ce310
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35429.logFilesize
681B
MD53676fc30cd56b50fbab73993abe7b63c
SHA159ca745387e4df691432504ecd7609c87a216891
SHA2568a4d7ad244bc7be7587a71ae27f1a307047f9c37a241996c59843d985ba62eb6
SHA512e6a1ec441622aa5b7a12d54f261c27db5767b68c082f6d4e1fcbc02f5df1379e2f35367d679987e750b78fd95c5cd744628633224d9b217f4e3f38528b73f4e7
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43663.logFilesize
668B
MD56210dfeb1f7a0ea703394d2acfec5962
SHA1b65a44c539fe5ae5d557358104c4c6fc73e23b69
SHA256affbd93c071a601c7e90d30604ab50848fd371cc07c35f636c14e1e0ecedb6ef
SHA5126159a6f9dc3c5dd31dea3b88bb8b124a4b3640c5ebe904d20215412fa1bc1fa2be77731a48ac454640617ab48d0d68142684a1edbead4b8d87b698d6174b1fec
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44373.logFilesize
648B
MD5e615500beebe89401adcbfcecf80f3ec
SHA1cd1ea24afa5271e1d0a6921459a74d1a1fb62064
SHA256330626dec26b278ed1c9ffbd39e1dd5468035423bb0ae8621d3dcfd8467ba4e9
SHA512cb9050abb3cf711e8da0caa0d9727cffc52e60e84dc2f1edaa3994f7491847b98215d3fd5cc2333587b48247e0d066bfb7ed0e28564113f2778beeba9eedacbb
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59319.logFilesize
671B
MD5a4a48b59473a1616c570622036da6c18
SHA1729ae71464aa33ba802c1e5d41a807b5694d9240
SHA256eea6ff87bf1da04c078e5fafd7fd4758b6e19dfb2ddf6014257178113f610f6c
SHA5124ceb41a9e29e6a81a629630233ca0f4fbf9341184e300606b198f1466ea5a2afc0228c4eda70361ebeb737f9a19310ed557a6f790339daed10b53eb69350fa84
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61365.logFilesize
669B
MD58788d64f097ebcbb430494b51ab11bed
SHA14205c23df31de7c95fea06b54c5e2297feef1b9e
SHA256d994ce09b5128821788f2f11496f6dde94200b862cef599c1d7e45980c4a420b
SHA5129d2565e471a2fc439cf662564b93cef0952dae2fbb9ade3a346f872f338ee3f075cbf38db962412aa9b382d3de73f9d0ca7159c35c4dd092f51a3d4eb0becdb7
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67852.logFilesize
668B
MD51514ff7d4f2809646278d4b89ee47073
SHA116316aeadd0c31e3c78aa1a3018aea8f835ab8b9
SHA256818a51be8f8174c9036cf54a7b5eb884447e153f0c8fa3d608916236502e4848
SHA512a723b52862fe596a8548753865a89872b7cef6811e0032b6cbd22bfa242f1ea1ac25c898222e207b888887039aac1dac43b7134ffc24c73d62568f8a1594c122
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6910.logFilesize
665B
MD5e0d973e037de5803556e8d2d0797c1bd
SHA15236310ea1eb1716724aac5c4e42133a241354b8
SHA25672e7e59b6a8aeb630b49fcecce06ed7349521a33d32d7e6c2f6d3129b0570952
SHA5123ca92f28229faa8d69c23e07be63561b818d996759ad57c392cf11101a740bc3f3c4185a20ecede7bdffb87fd8826100e2e87336bd9af9e5cb39e9fa902afea9
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_76024.logFilesize
665B
MD5a9391f3f1be983db69dbf0f05618181d
SHA1c4d5f967775b3a26d9cfe025c0f9d87ad8211ed4
SHA256fe33b890c77e68234bcc760cd2e4480484fdcca90e5e640a97e820116f561558
SHA51245b5a1eba8f8c427f7695f6e3c9b8b0db6f9c88f4a7bd39e90ce7bc489bc2e4fd037cc1aea9dc996ea840001ffc1adefce351122711972d59fd49dbed8b1ea16
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82581.logFilesize
666B
MD51bb05961b47428121de72be156cff494
SHA1fe058bb5d087c0df71d40a5874bb7ca6d093e4fb
SHA2562391274f3381a28ac8d65c907a10147646da0d220e531e0c560063cb017c87d5
SHA5128e78e365c9e133ad48432f08bc32922b77ebc4c8adda3093de29e4ff45f3f9b5c318ce9dbf08707c87ced8c805d921b8e32be985da4cc446258cb197837f72a9
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87083.logFilesize
678B
MD5c3a1db63260f4afeed061e22d114bd23
SHA129331f93ce1df9576bc8cde59daeab6af8633203
SHA2567da83781d4223ff365a493408590a84d0acbae95899a0f5dd4faf8734db67e8f
SHA5124a2e68993732bb304e2f30329a64a56d8666add37b392bbfb94df848c31c61a5104718a5ee28189b85198ce5def42effa732721ac66f0a713f9dc334ba911fda
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9142.logFilesize
668B
MD5bf8223c2fe5f157f69b7dbaca1d2b725
SHA15020710148f3f112f50847f0d8c45980be302b7b
SHA2565720dbf1eda0e19c7a5ac4349abdfda92465ca0f11b4656826742dac391a28a2
SHA512b1d85d76af6cf63d9a9804b762a1842cb170b3c25f6a8a44e6aea6b70a0e960b2c34b4d5db46663424b6c1f569afe2d383793da8c94493eca7edf9195a01d60e
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97302.logFilesize
674B
MD509e1028745e91238336786e86871ca14
SHA104e0125b54826eade1fb1cb47f37df84eb48f459
SHA25675fc3b2277d04d757a22bac534fcad4c3b21af72ed75f5425464c92814568e99
SHA512f8f94efc1017dce1935d4e10e7c5ba3bf0967e757d4879936c6f070934329a52f8a4a336bc6b5a057cda825751aa8396f858ce293fdaf79206131128122757a8
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99918.logFilesize
680B
MD5de3e231049fc78993a8af2c565a26fd9
SHA1187478e601002f6d2c52b66ee68c66527b3a9a91
SHA256bc7133428322252647f77608fb59b2795c5b568767b484122d9b4a5cba2c5635
SHA512f29f4bdd789e1d02b94f1d202b2eddcc212e603d493f528fb7917edcf1e347777b96cb1b3dd197d9bd075d8776f41a3632be7e1c93e89b0f2b45ded06d4a0771
-
memory/176-301-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/176-305-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/332-232-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/332-212-0x0000000000000000-mapping.dmp
-
memory/332-226-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/400-321-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/516-311-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/624-133-0x0000000000000000-mapping.dmp
-
memory/1012-216-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1012-267-0x0000000000000000-mapping.dmp
-
memory/1012-206-0x0000000000000000-mapping.dmp
-
memory/1020-169-0x0000000000000000-mapping.dmp
-
memory/1056-247-0x0000000000000000-mapping.dmp
-
memory/1072-198-0x0000000000000000-mapping.dmp
-
memory/1096-182-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1096-175-0x0000000000000000-mapping.dmp
-
memory/1108-163-0x0000000000000000-mapping.dmp
-
memory/1280-293-0x0000000000000000-mapping.dmp
-
memory/1304-290-0x0000000000000000-mapping.dmp
-
memory/1452-316-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1504-196-0x0000000000000000-mapping.dmp
-
memory/1516-229-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1516-218-0x0000000000000000-mapping.dmp
-
memory/1516-234-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1556-167-0x0000000000000000-mapping.dmp
-
memory/1616-320-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-309-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-260-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-319-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-269-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-276-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-236-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-231-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-299-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-315-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-136-0x0000000000000000-mapping.dmp
-
memory/1616-313-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-189-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-220-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-282-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-307-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-300-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1616-203-0x000000000F8B0000-0x000000000F8C0000-memory.dmpFilesize
64KB
-
memory/1620-200-0x0000000000000000-mapping.dmp
-
memory/1652-204-0x0000000000000000-mapping.dmp
-
memory/1692-487-0x0000000001010000-0x0000000001016000-memory.dmpFilesize
24KB
-
memory/1692-488-0x0000000001010000-0x0000000001016000-memory.dmpFilesize
24KB
-
memory/1692-486-0x0000000001010000-0x0000000001016000-memory.dmpFilesize
24KB
-
memory/1808-215-0x0000000000000000-mapping.dmp
-
memory/1808-235-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1816-289-0x0000000000000000-mapping.dmp
-
memory/1824-249-0x0000000000000000-mapping.dmp
-
memory/1824-255-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1868-279-0x0000000000000000-mapping.dmp
-
memory/1916-162-0x0000000000000000-mapping.dmp
-
memory/2044-318-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2228-177-0x0000000000000000-mapping.dmp
-
memory/2228-281-0x0000000000000000-mapping.dmp
-
memory/2228-185-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2436-317-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2440-278-0x0000000000000000-mapping.dmp
-
memory/2664-494-0x0000000000EA0000-0x0000000000EA6000-memory.dmpFilesize
24KB
-
memory/2736-268-0x0000000000000000-mapping.dmp
-
memory/2800-291-0x0000000000000000-mapping.dmp
-
memory/2856-304-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3004-190-0x0000000000000000-mapping.dmp
-
memory/3004-283-0x0000000000000000-mapping.dmp
-
memory/3172-164-0x0000000000000000-mapping.dmp
-
memory/3192-195-0x0000000000000000-mapping.dmp
-
memory/3228-297-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3288-285-0x0000000000000000-mapping.dmp
-
memory/3320-230-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3320-222-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3320-209-0x0000000000000000-mapping.dmp
-
memory/3324-287-0x0000000000000000-mapping.dmp
-
memory/3324-294-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3500-302-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3500-183-0x0000000000000000-mapping.dmp
-
memory/3500-188-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3500-187-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3720-292-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3720-295-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3720-286-0x0000000000000000-mapping.dmp
-
memory/3776-166-0x0000000000000000-mapping.dmp
-
memory/3860-173-0x0000000000000000-mapping.dmp
-
memory/3940-172-0x0000000000000000-mapping.dmp
-
memory/3948-170-0x0000000000000000-mapping.dmp
-
memory/3960-219-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3960-205-0x0000000000000000-mapping.dmp
-
memory/3972-202-0x0000000000000000-mapping.dmp
-
memory/4088-273-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4088-270-0x0000000000000000-mapping.dmp
-
memory/4168-272-0x0000000000000000-mapping.dmp
-
memory/4168-275-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4168-171-0x0000000000000000-mapping.dmp
-
memory/4188-228-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4188-225-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4188-211-0x0000000000000000-mapping.dmp
-
memory/4188-274-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4188-271-0x0000000000000000-mapping.dmp
-
memory/4192-245-0x0000000000000000-mapping.dmp
-
memory/4192-197-0x0000000000000000-mapping.dmp
-
memory/4252-259-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4252-253-0x0000000000000000-mapping.dmp
-
memory/4280-306-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4284-298-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4296-288-0x0000000000000000-mapping.dmp
-
memory/4424-199-0x0000000000000000-mapping.dmp
-
memory/4440-246-0x0000000000000000-mapping.dmp
-
memory/4444-296-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4476-284-0x0000000000000000-mapping.dmp
-
memory/4556-251-0x0000000000000000-mapping.dmp
-
memory/4556-256-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4644-310-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4684-280-0x0000000000000000-mapping.dmp
-
memory/4756-312-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4840-266-0x0000000000000000-mapping.dmp
-
memory/4860-314-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4900-233-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4900-217-0x0000000000000000-mapping.dmp
-
memory/4900-227-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4912-261-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4912-262-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4912-257-0x0000000000000000-mapping.dmp
-
memory/4912-174-0x0000000000000000-mapping.dmp
-
memory/4940-248-0x0000000000000000-mapping.dmp
-
memory/4940-180-0x0000000000000000-mapping.dmp
-
memory/4940-186-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4960-201-0x0000000000000000-mapping.dmp
-
memory/5000-303-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5016-308-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5028-277-0x0000000000000000-mapping.dmp
-
memory/5084-498-0x00000000025D0000-0x00000000025D6000-memory.dmpFilesize
24KB
-
memory/5084-496-0x00000000025D0000-0x00000000025D6000-memory.dmpFilesize
24KB
-
memory/5084-501-0x00000000025D0000-0x00000000025D6000-memory.dmpFilesize
24KB
-
memory/5084-502-0x00000000025D0000-0x00000000025D6000-memory.dmpFilesize
24KB
-
memory/5084-503-0x00000000025D0000-0x00000000025D6000-memory.dmpFilesize
24KB
-
memory/5084-511-0x00000000025D0000-0x00000000025D6000-memory.dmpFilesize
24KB