Resubmissions
06-08-2022 17:40
220806-v8vdbshbgk 8Analysis
-
max time kernel
1048s -
max time network
1051s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 17:40
Static task
static1
Behavioral task
behavioral1
Sample
DriverPack-17-Online.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
DriverPack-17-Online.exe
Resource
win10-20220718-en
Behavioral task
behavioral3
Sample
DriverPack-17-Online.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral4
Sample
DriverPack-17-Online.exe
Resource
win11-20220223-en
General
-
Target
DriverPack-17-Online.exe
-
Size
8.6MB
-
MD5
b2bd71bc2ca60dc56ce7a249fff69c42
-
SHA1
6b8d4ec65300d9147105d1b72a4731ce68afb9fa
-
SHA256
4f99a508b9a1ee927425cb60dabbef9262afff15f36b8bed21eb02771955a95b
-
SHA512
ce28dad8b6ddf721aa3c894ed78b1da64714ffd39156dbaf79a717065e7f3ec7f1d89d65281a782d32003b9f2db7a059f264d6d8f4173db730f2d1843648cc1d
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
Processes:
mshta.exeflow pid process 6 2972 mshta.exe 7 2972 mshta.exe 9 2972 mshta.exe 11 2972 mshta.exe 13 2972 mshta.exe 15 2972 mshta.exe 20 2972 mshta.exe 23 2972 mshta.exe 24 2972 mshta.exe 26 2972 mshta.exe 28 2972 mshta.exe 32 2972 mshta.exe 33 2972 mshta.exe 34 2972 mshta.exe 35 2972 mshta.exe 37 2972 mshta.exe 38 2972 mshta.exe 39 2972 mshta.exe 40 2972 mshta.exe 44 2972 mshta.exe 45 2972 mshta.exe 46 2972 mshta.exe 47 2972 mshta.exe 48 2972 mshta.exe 49 2972 mshta.exe 53 2972 mshta.exe 54 2972 mshta.exe 55 2972 mshta.exe 56 2972 mshta.exe 57 2972 mshta.exe 64 2972 mshta.exe 65 2972 mshta.exe 66 2972 mshta.exe 67 2972 mshta.exe 68 2972 mshta.exe 69 2972 mshta.exe 70 2972 mshta.exe 71 2972 mshta.exe 72 2972 mshta.exe 73 2972 mshta.exe 74 2972 mshta.exe 75 2972 mshta.exe 76 2972 mshta.exe 85 2972 mshta.exe 86 2972 mshta.exe 87 2972 mshta.exe 88 2972 mshta.exe 89 2972 mshta.exe 90 2972 mshta.exe 91 2972 mshta.exe 92 2972 mshta.exe 93 2972 mshta.exe 94 2972 mshta.exe 95 2972 mshta.exe 96 2972 mshta.exe 97 2972 mshta.exe 98 2972 mshta.exe 99 2972 mshta.exe 100 2972 mshta.exe 102 2972 mshta.exe 103 2972 mshta.exe 104 2972 mshta.exe 105 2972 mshta.exe 106 2972 mshta.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
wmiprvse.exedriverpack-wget.exedriverpack-wget.exeConhost.exegacutil.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exeConhost.exeConhost.exedriverpack-wget.exedriverpack-wget.exeregtlib.exedriverpack-wget.execmd.exedriverpack-wget.exedriverpack-wget.exearia2c.exereg.exearia2c.exearia2c.exeConhost.execompact.exedriverpack-wget.exedriverpack-wget.execompact.exeDriverPack-Alice.execmd.exedriverpack-wget.execmd.exedriverpack-wget.exeregsvr32.exeregtlib.exedriverpack-wget.exesrtasks.exedriverpack-wget.exedriverpack-wget.exegacutil.exedriverpack-wget.execmd.exedriverpack-wget.exeinstaller.exedriverpack-wget.exedriverpack-wget.execompact.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exeConhost.execmd.exeDotNetXP.exedriverpack-wget.exenetsh.execmd.exeDirectX.exedriverpack-wget.execompact.exedriverpack-wget.exedriverpack-wget.exeregsvr32.execmd.exepid process 1532 wmiprvse.exe 4228 driverpack-wget.exe 3812 driverpack-wget.exe 2136 Conhost.exe 3592 gacutil.exe 2016 driverpack-wget.exe 2664 driverpack-wget.exe 4272 driverpack-wget.exe 4304 Conhost.exe 3472 Conhost.exe 4668 driverpack-wget.exe 4340 driverpack-wget.exe 2156 regtlib.exe 2652 driverpack-wget.exe 4332 cmd.exe 4168 driverpack-wget.exe 4376 driverpack-wget.exe 2188 aria2c.exe 4632 reg.exe 4772 aria2c.exe 4648 aria2c.exe 2156 regtlib.exe 2700 Conhost.exe 4584 compact.exe 2924 driverpack-wget.exe 1636 driverpack-wget.exe 2140 compact.exe 3908 DriverPack-Alice.exe 4552 cmd.exe 3380 driverpack-wget.exe 828 cmd.exe 3816 driverpack-wget.exe 2212 regsvr32.exe 2704 regtlib.exe 1400 driverpack-wget.exe 1492 srtasks.exe 4896 driverpack-wget.exe 3008 driverpack-wget.exe 3640 gacutil.exe 2868 driverpack-wget.exe 816 cmd.exe 3168 driverpack-wget.exe 2304 installer.exe 4812 driverpack-wget.exe 3872 driverpack-wget.exe 4672 compact.exe 4188 driverpack-wget.exe 5116 driverpack-wget.exe 200 driverpack-wget.exe 1972 Conhost.exe 3532 cmd.exe 2104 DotNetXP.exe 4884 driverpack-wget.exe 4812 driverpack-wget.exe 4852 netsh.exe 5000 cmd.exe 3908 DriverPack-Alice.exe 3408 DirectX.exe 4544 driverpack-wget.exe 2380 compact.exe 4160 driverpack-wget.exe 4548 driverpack-wget.exe 3864 regsvr32.exe 3272 cmd.exe -
Modifies Installed Components in the registry 2 TTPs 29 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\ = "Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\ = "Microsoft .NET Framework 1.1 Security Update (KB2698023)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\ComponentID = "M2698023" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\Version = "1,0,4322,1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\Version = "1,1,4322" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\Locale = "*" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\ = "Microsoft .NET Framework 1.1 Security Update (KB979906)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\Locale msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\IsInstalled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\ComponentID = ".NETFramework" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227}\Version = "1,1,4322" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F736E10-8E5C-4399-A532-D0C00A406227} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\Version = "1,1,4322" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\ = "Microsoft .NET Framework 1.1 Security Update (KB2833941)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\Locale = "*" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\Locale = "*" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\ComponentID = "S867460" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\Version = "1,1,4322" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A3320D6-C805-4280-B423-B665BDE33D8F}\ComponentID = "M979906" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0F0DCDC-99EA-4405-BDAE-CACABD3D2DF0}\ComponentID = "M2833941" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}\ = ".NET Framework" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}\Locale = "*" msiexec.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 4852 netsh.exe 2652 netsh.exe 5080 netsh.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
cmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32 cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_2.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32 cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_5.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_5.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_1.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32 cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_10.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_0.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32 cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_7.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_2.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32\ThreadingModel = "Both" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32 cmd.exe -
Processes:
resource yara_rule C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/1532-992-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2136-1106-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1532-1112-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3812-1111-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4228-1113-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/2016-1467-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3592-1466-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2664-1482-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4272-1486-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3472-1498-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4668-1497-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4340-1502-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4304-1501-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/2652-1698-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2156-1706-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4168-1739-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4332-1743-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2924-2336-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1636-2337-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2700-2335-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2140-2398-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3908-2401-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2140-2422-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3908-2428-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3380-2548-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4552-2555-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/828-2561-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2212-2766-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3816-2761-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2704-2778-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1400-2780-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1492-2784-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4896-2829-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3008-2961-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3640-2963-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2868-2964-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/816-3008-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3168-3142-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4812-3143-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2304-3141-0x0000000000400000-0x00000000004EF000-memory.dmp upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
opera.exeopera.exeopera.exeopera.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Control Panel\International\Geo\Nation opera.exe -
Loads dropped DLL 64 IoCs
Processes:
DriverPack-17-Online.exeopera.exeConhost.execompact.exeopera.exeopera.exeopera.execompact.exeConhost.exeopera.exeregsvr32.exeopera.exeregsvr32.exeregsvr32.exedriverpack-wget.exeConhost.exeConhost.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exelauncher.execompact.exedriverpack-wget.exeregsvr32.exeConhost.execmd.exereg.exegacutil.exeinstaller.exeinstaller.exeinstaller.exeinstaller.exeinstaller.exeMsiExec.exeMsiExec.exeRegSvcs.exepid process 1820 DriverPack-17-Online.exe 1820 DriverPack-17-Online.exe 1820 DriverPack-17-Online.exe 3384 opera.exe 2724 Conhost.exe 3728 compact.exe 208 opera.exe 3828 opera.exe 1952 opera.exe 4584 compact.exe 4992 Conhost.exe 4900 opera.exe 1172 regsvr32.exe 5020 opera.exe 1508 regsvr32.exe 4948 regsvr32.exe 628 driverpack-wget.exe 3928 Conhost.exe 4280 Conhost.exe 2212 regsvr32.exe 3928 Conhost.exe 4584 compact.exe 764 regsvr32.exe 4964 regsvr32.exe 3864 regsvr32.exe 1848 launcher.exe 2136 compact.exe 2208 driverpack-wget.exe 1436 regsvr32.exe 1380 Conhost.exe 4708 cmd.exe 4632 reg.exe 4108 gacutil.exe 1848 launcher.exe 1848 launcher.exe 4520 installer.exe 1160 installer.exe 4576 installer.exe 2304 installer.exe 1584 installer.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3800 MsiExec.exe 3768 RegSvcs.exe 3768 RegSvcs.exe 3768 RegSvcs.exe 3768 RegSvcs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
mshta.exeMsiExec.execmd.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce mshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\DriverPack-Alice = "C:\\Users\\Admin\\AppData\\Roaming\\DRPSu\\Alice\\DriverPackAssistant.exe" mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\NetFxUpdate_v1.1.4322 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\netfxupdate.exe\" 0 v1.1.4322 GAC + NI NID" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearcherBar = "\"C:\\Windows\\system32\\mshta.exe\" \"C:\\SearcherBar\\run.hta\"" cmd.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
mshta.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast mshta.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV mshta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\assembly\Desktop.ini RegSvcs.exe File created C:\Windows\assembly\Desktop.ini RegSvcs.exe -
Enumerates connected drives 3 TTPs 30 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
driverpack-wget.exemsiexec.exeinstaller.exedriverpack-wget.exeinstaller.exeinstaller.execmd.exedescription ioc process File opened (read-only) \??\D: driverpack-wget.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: driverpack-wget.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: cmd.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in System32 directory 64 IoCs
Processes:
reg.exeopera_autoupdate.exexcopy.exeConhost.exeinstaller.exedescription ioc process File opened for modification C:\Windows\System32\D3DCompiler_35.dll reg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7 opera_autoupdate.exe File opened for modification C:\Windows\SysWow64\d3dx9_32.dll xcopy.exe File created C:\Windows\System32\D3DCompiler_38.dll reg.exe File created C:\Windows\System32\d3dx9_34.dll reg.exe File opened for modification C:\Windows\System32\xactengine2_8.dll reg.exe File created C:\Windows\System32\XAPOFX1_3.dll reg.exe File opened for modification C:\Windows\System32\XAudio2_3.dll reg.exe File opened for modification C:\Windows\SysWOW64\ssleay32.dll Conhost.exe File opened for modification C:\Windows\System32\xactengine3_1.dll reg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies installer.exe File created C:\Windows\SysWow64\d3dx9_34.dll xcopy.exe File created C:\Windows\SysWOW64\mfc70deu.dll Conhost.exe File created C:\Windows\System32\d3dx10_41.dll reg.exe File created C:\Windows\System32\d3dx9_26.dll reg.exe File created C:\Windows\System32\d3dx9_31.dll reg.exe File created C:\Windows\System32\d3dx9_35.dll reg.exe File created C:\Windows\SysWOW64\comct232.ocx Conhost.exe File opened for modification C:\Windows\SysWOW64\msvcr70.dll Conhost.exe File created C:\Windows\System32\D3DCompiler_39.dll reg.exe File created C:\Windows\SysWow64\D3DCompiler_35.dll xcopy.exe File opened for modification C:\Windows\SysWow64\d3dx10_36.dll xcopy.exe File created C:\Windows\System32\D3DX9_38.dll reg.exe File created C:\Windows\SysWOW64\comctl32.ocx Conhost.exe File created C:\Windows\SysWOW64\msvcr71.dll Conhost.exe File opened for modification C:\Windows\System32\D3DCompiler_33.dll reg.exe File created C:\Windows\SysWow64\D3DCompiler_36.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat installer.exe File created C:\Windows\SysWow64\d3dx9_32.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content opera_autoupdate.exe File opened for modification C:\Windows\SysWOW64\mfc70deu.dll Conhost.exe File created C:\Windows\SysWOW64\MSVCP70.DLL Conhost.exe File opened for modification C:\Windows\System32\D3DCompiler_41.dll reg.exe File opened for modification C:\Windows\System32\xactengine2_5.dll reg.exe File created C:\Windows\SysWow64\d3dx10_38.dll xcopy.exe File created C:\Windows\System32\d3dx10_40.dll reg.exe File created C:\Windows\SysWow64\xactengine3_6.dll xcopy.exe File created C:\Windows\SysWow64\XAPOFX1_3.dll xcopy.exe File opened for modification C:\Windows\System32\XAPOFX1_2.dll reg.exe File created C:\Windows\SysWow64\xactengine3_3.dll xcopy.exe File created C:\Windows\SysWow64\d3dx10_35.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\MFC71JPN.DLL Conhost.exe File opened for modification C:\Windows\SysWOW64\MSSTKPRP.DLL Conhost.exe File created C:\Windows\System32\XAPOFX1_4.dll reg.exe File opened for modification C:\Windows\System32\XAudio2_1.dll reg.exe File created C:\Windows\System32\XAudio2_3.dll reg.exe File opened for modification C:\Windows\System32\d3dx10_37.dll reg.exe File opened for modification C:\Windows\System32\D3DX9_41.dll reg.exe File opened for modification C:\Windows\SysWow64\D3DCompiler_34.dll xcopy.exe File created C:\Windows\SysWOW64\atl70.dll Conhost.exe File created C:\Windows\System32\xactengine2_1.dll reg.exe File opened for modification C:\Windows\SysWow64\D3DCompiler_37.dll xcopy.exe File created C:\Windows\SysWow64\d3dx10_34.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\atl70.dll Conhost.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Conhost.exe File created C:\Windows\SysWOW64\MShflxgd.ocx Conhost.exe File opened for modification C:\Windows\System32\D3DX9_43.dll reg.exe File opened for modification C:\Windows\System32\xactengine3_2.dll reg.exe File created C:\Windows\SysWOW64\msflxgrd.ocx Conhost.exe File created C:\Windows\System32\X3DAudio1_7.dll reg.exe File created C:\Windows\System32\XAudio2_5.dll reg.exe File created C:\Windows\SysWow64\d3dx9_25.dll xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE installer.exe File opened for modification C:\Windows\SysWOW64\mfc70ita.dll Conhost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DriverPack-17-Online.execmd.exeinstaller.exeConhost.exedriverpack-wget.exeConhost.execompact.exeregsvr32.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exeinstaller.exedriverpack-wget.execompact.execmd.exedriverpack-wget.exedriverpack-wget.exedescription ioc process File created C:\Program Files (x86)\DriverPack\languages\th.js DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\ANTIVIRUS-1.mp3 cmd.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico installer.exe File created C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-regular-webfont.eot DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\charms\reload-sm.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\installation\soft\Backup.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\languages\ru.js DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\TEAM-PROOF-1.mp3 Conhost.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\bn.pak driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico driverpack-wget.exe File created C:\Program Files (x86)\Opera\Assets\70x70Logo.scale-80.png driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\fr-CA.pak installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\opera_crashreporter.exe installer.exe File created C:\Program Files (x86)\DriverPack\drp.css DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_regular-webfont.svg DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\screens\reviews-rating-five.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\onboarding\blocked.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\stories\drivers.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\languages\sk.js DriverPack-17-Online.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\win10_utils.dll driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-adout-3.mp3 Conhost.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-adout-5.mp3 compact.exe File created C:\Program Files (x86)\DriverPack\img\installation\banner_browsers-bg.jpg DriverPack-17-Online.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\ko.pak driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-adout-7.mp3 regsvr32.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-4.mp3 driverpack-wget.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-why-free-5.mp3 driverpack-wget.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-why-free-8.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\fr.pak installer.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\arrow-setup-list.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\programs\installed-programs_info-success.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\WAITING-1.mp3 driverpack-wget.exe File opened for modification C:\Program Files (x86)\Opera installer.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\istart.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\reliability.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\languages\sq.js DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\screens\netral-review.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\opera-opened-browser-ram.png DriverPack-17-Online.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\zh-CN.pak driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\th.pak installer.exe File created C:\Program Files (x86)\Opera\launcher.exe installer.exe File created C:\Program Files (x86)\DriverPack\img\charms\setup.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-8.mp3 driverpack-wget.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-why-free-3.mp3 compact.exe File created C:\Program Files (x86)\Opera\Assets\70x70Logo.scale-180_contrast-white.png installer.exe File created C:\Program Files (x86)\DriverPack\css\roboto.css DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.eot DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-semibold-webfont.eot DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\ISTART_3.mp3 cmd.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\mk.pak driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\wow_helper.exe driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\bn.pak installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\kk.pak installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\ms.pak installer.exe File created C:\Program Files (x86)\DriverPack\css\lte-ie8.css DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\assistant-chat\new-chat-off.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\device-class\new-ui\inputdev.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\installation\soft\Browser.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-ui\popups\old.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\languages\cs.js DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\ANTIVIRUS-2.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\audio\en\WAITING-1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\standard_themes\default_theme.zip driverpack-wget.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\FIREFOX_1.mp3 driverpack-wget.exe -
Drops file in Windows directory 64 IoCs
Processes:
msiexec.exengen.execmd.exedllhost.exemigpolwin.exeConhost.exengen.exengen.exedescription ioc process File opened for modification C:\Windows\Installer\MSI4AA0.tmp msiexec.exe File opened for modification C:\Windows\assembly\temp\JAQF5ZAS71\IEHost.dll msiexec.exe File opened for modification C:\Windows\assembly\tmp\12456789\__AssemblyInfo__.ini ngen.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\__AssemblyInfo__.ini cmd.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35 cmd.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\system.drawing.ldo msiexec.exe File opened for modification C:\Windows\Registration\_RegDBWrt.clb dllhost.exe File opened for modification C:\Windows\Installer\MSI475B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5096.tmp msiexec.exe File opened for modification C:\Windows\assembly\temp\JUNQ2UBV30\__AssemblyInfo__.ini msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\config\enterprisesec.config.cch.new migpolwin.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_hightrust.config msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet.mof msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt msiexec.exe File created C:\Windows\Registration\_RegDBWrt.clb dllhost.exe File opened for modification C:\Windows\Installer\MSI5107.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.xml Conhost.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll Conhost.exe File created C:\Windows\assembly\tmp\EK4XKK9O\IIEHost.dll msiexec.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini cmd.exe File created C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\__AssemblyInfo__.ini cmd.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.xml Conhost.exe File opened for modification C:\Windows\Installer\MSI4C83.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\config\security.config.cch.new ngen.exe File created C:\Windows\assembly\tmp\Y1234678\System.Design.dll ngen.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscortim.dll msiexec.exe File created C:\Windows\assembly\tmp\TQXTQB4D\System.Data.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI485C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5057.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7DD8.tmp msiexec.exe File opened for modification C:\Windows\assembly\tmp\3N4EFK5M\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\Installer\MSI1B5.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET Conhost.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\UninstallPersistSqlState.sql msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI460A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4D34.tmp msiexec.exe File opened for modification C:\Windows\assembly\temp\ZKWF3ZBHHF\System.Web.RegularExpressions.dll msiexec.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll cmd.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35 cmd.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.xml Conhost.exe File opened for modification C:\Windows\assembly\tmp\P3P0YX9H\__AssemblyInfo__.ini msiexec.exe File opened for modification C:\Windows\assembly\tmp\FGHIJLMN\__AssemblyInfo__.ini ngen.exe File opened for modification C:\Windows\Installer\MSI165.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\big5.nlp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.tlb msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ldo msiexec.exe File opened for modification C:\Windows\Installer\MSI46CC.tmp msiexec.exe File opened for modification C:\Windows\assembly\tmp\5YB1HR2X\__AssemblyInfo__.ini msiexec.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini cmd.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll Conhost.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll Conhost.exe File opened for modification C:\Windows\assembly\temp\PNGLB47KV1\System.DirectoryServices.dll msiexec.exe File opened for modification C:\Windows\assembly\temp\GEY8GE5DKP\System.Runtime.Remoting.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\MUI\0409\mscorsecr.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI8BB8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E6.tmp msiexec.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\__AssemblyInfo__.ini cmd.exe File opened for modification C:\Windows\Installer\MSIC774.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\XPThemes.manifest msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
opera.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz opera.exe -
Processes:
regsvr32.exedriverpack-wget.exeConhost.execmd.exegacutil.exeConhost.execompact.exeregsvr32.execompact.execompact.exeregsvr32.exereg.exeregsvr32.exelauncher.exeregsvr32.exeConhost.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\AlternateCLSID = "{962F28D6-107D-47A5-9515-2864454CFDD1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\AlternateCLSID = "{F65348F7-505D-4FAB-B66C-D76CFFC2BD78}" driverpack-wget.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B} Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}\AlternateCLSID = "{894BA3A3-3CA3-402F-B4FE-CD08337E9535}" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A} gacutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{4D588145-A84B-4100-85D7-FD2EA1D19831}" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\Compatibility Flags = "1024" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{95F0B3BE-E8AC-4995-9DCA-419849E06410}" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{D3CCB2F7-0D00-4F26-9569-D7C368DE34E2}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}\Compatibility Flags = "1024" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86} compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\AlternateCLSID = "{2BEC8FA8-1193-4A15-B8AF-C6DF6E6930C7}" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{612A8624-0FB3-11CE-8747-524153480004} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Compatibility Flags = "1024" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B} compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED} compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9ED94440-E5E8-101B-B9B5-444553540000}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86} Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}\Compatibility Flags = "1024" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{02A69B00-081B-101B-8933-08002B2F4F5A}\AlternateCLSID = "{E304B70C-0FCE-4E1B-9C81-CDAAD9F7DA55}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1} Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\Compatibility Flags = "1024" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628} Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1} Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\AlternateCLSID = "{D88A442E-9C85-48E3-A6F8-EF61C93989A0}" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9ED94440-E5E8-101B-B9B5-444553540000}\AlternateCLSID = "{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}\AlternateCLSID = "{A57635FC-8D02-4D32-8B6E-4FBD4E2DB8A7}" launcher.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED}\Compatibility Flags = "1024" compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{25A3C2C9-8F6E-4140-BEF3-535D4B9709D8}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1} Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628} Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB} Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}\AlternateCLSID = "{80B51087-CE4C-4FAE-8401-B6B3809DD234}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{612A8624-0FB3-11CE-8747-524153480004}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{02A69B00-081B-101B-8933-08002B2F4F5A} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385} Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC} launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628} Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\AlternateCLSID = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED}\AlternateCLSID = "{7E96FC67-468E-4E70-B246-D42078DD2361}" compact.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Compatibility Flags = "1024" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628} Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\AlternateCLSID = "{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}" Conhost.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
opera_autoupdate.exesvchost.exeinstaller.exeinstaller.exemsiexec.exemsdtc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache installer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Opera Software opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections opera_autoupdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs opera_autoupdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople opera_autoupdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Opera Software\ATTEMPTS = "1" opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust opera_autoupdate.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache msdtc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs opera_autoupdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates opera_autoupdate.exe -
Modifies registry class 64 IoCs
Processes:
compact.exeConhost.execmd.exeConhost.exelauncher.exemsiexec.exeConhost.exeregsvr32.exeregsvr32.exereg.exeregsvr32.execmd.execompact.execompact.exeregtlib.exeregsvr32.exegacutil.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.0" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D646316D-0915-421A-84C1-6A21C2495791}\Version\ = "1.0" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED117630-4090-11CF-8981-00AA00688B10}\TypeLib\Version = "1.2" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFB66F3E-7A33-41E9-A4F7-FE87B64F5555}\MiscStatus\1\ = "132497" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RICHTEXT.RichtextCtrl.1\ = "Microsoft Rich Textbox Control 6.0 (SP6)" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\Version = "5.0" launcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F22DD1A2-9695-3B41-B05E-585E33560EC1}\InprocServer32\ = "C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscormmc.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\TypeLib Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D88A442E-9C85-48E3-A6F8-EF61C93989A0}\InprocServer32 reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_4.dll" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib\Version = "5.0" launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{030B4A80-1B7C-11CF-9D53-00AA003C9CB6}\InprocServer32 compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDE57A53-8B86-11D0-B3C6-00A0C90AEA82}\TypeLib\Version = "1.0" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.4" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D8152C1-0CFD-4968-9684-794046886E31}\Implemented Categories Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.1" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{39977C62-C383-463D-AF61-C71220634656}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB} launcher.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{8830F669-E622-3DA0-BC37-4A02A151E142}\1.0.5000.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{6B7F18AE-F5AC-368F-8DFD-AB5E2D229ED7}\1.0.5000.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{88592805-9549-3E00-8308-03CFA6B93882} regtlib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{030B4A81-1B7C-11CF-9D53-00AA003C9CB6} compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFB66F3E-7A33-41E9-A4F7-FE87B64F5555} Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C} reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DDE7F2BCF1D91C3409CFF425AE1E271A\PackageCode = "4936EDFF16C285447B63A0663D7E483A" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D588145-A84B-4100-85D7-FD2EA1D19831}\ProgID\ = "MSComCtl2.DTPicker.2" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628} Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1270E004-F895-42BE-8070-DF90D60CBB75}\InprocServer32\1.0.5000.0\Assembly = "mscorcfg, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\ = "StatusBar General Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib\Version = "5.0" launcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1348D4-3FAC-3704-840D-20D91E4AD542}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regtlib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSDataGridLib.DataGrid.1\CLSID\ = "{D646316D-0915-421A-84C1-6A21C2495791}" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E404CD92-E7B8-4037-918D-5A18CFD09ED3}\MiscStatus\1 compact.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.1" launcher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\TypeLib gacutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\0\win32\ = "C:\\Windows\\SysWow64\\mshflxgd.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{D32B1206-1440-3664-9991-1AE109ADD173}\1.0.5000.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" cmd.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB39D9A0-557A-11CF-AEBE-00AA00A8F7F3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F06D2F8-F3D4-3585-814C-2E886C465F25}\TypeLib regtlib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2E05A70A-1BBE-31DF-B2A8-B8FA0F130915}\1.0.5000.0\Class = "System.Environment+SpecialFolder" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97992019-74A6-46C7-9CA3-7F8C0D39940B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\MiscStatus Conhost.exe Key created \REGISTRY\MACHINE\Software\Classes\Record\{26170123-45FD-30F7-987D-BF3689662B6C}\1.0.5000.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32 regsvr32.exe -
Processes:
opera.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c040000000100000010000000285ec909c4ab0d2d57f5086b225799aa2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 5c0000000100000004000000001000000f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c040000000100000010000000285ec909c4ab0d2d57f5086b225799aa190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf95c0000000100000004000000001000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000005c0000000100000004000000001000000f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c040000000100000010000000285ec909c4ab0d2d57f5086b225799aa190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a opera.exe Key created \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb4b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c2000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000001400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf92000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f opera.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 3216 regedit.exe 1136 regedit.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 102 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 103 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 111 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 3696 msiexec.exe 3696 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mshta.exepid process 2972 mshta.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
mshta.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: 33 3300 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3300 AUDIODG.EXE Token: 33 2972 mshta.exe Token: SeIncBasePriorityPrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe Token: SeShutdownPrivilege 2972 mshta.exe Token: SeCreatePagefilePrivilege 2972 mshta.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 4556 msiexec.exe 4556 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
DriverPack-17-Online.execmd.exemshta.execmd.execmd.exenet.exenet.execmd.exeDirectX.execmd.exeConhost.exedescription pid process target process PID 1820 wrote to memory of 1584 1820 DriverPack-17-Online.exe cmd.exe PID 1820 wrote to memory of 1584 1820 DriverPack-17-Online.exe cmd.exe PID 1820 wrote to memory of 1584 1820 DriverPack-17-Online.exe cmd.exe PID 1584 wrote to memory of 2972 1584 cmd.exe mshta.exe PID 1584 wrote to memory of 2972 1584 cmd.exe mshta.exe PID 1584 wrote to memory of 2972 1584 cmd.exe mshta.exe PID 2972 wrote to memory of 4184 2972 mshta.exe rundll32.exe PID 2972 wrote to memory of 4184 2972 mshta.exe rundll32.exe PID 2972 wrote to memory of 4184 2972 mshta.exe rundll32.exe PID 2972 wrote to memory of 2144 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 2144 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 2144 2972 mshta.exe cmd.exe PID 2144 wrote to memory of 2652 2144 cmd.exe netsh.exe PID 2144 wrote to memory of 2652 2144 cmd.exe netsh.exe PID 2144 wrote to memory of 2652 2144 cmd.exe netsh.exe PID 2972 wrote to memory of 4396 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4396 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4396 2972 mshta.exe cmd.exe PID 4396 wrote to memory of 5080 4396 cmd.exe netsh.exe PID 4396 wrote to memory of 5080 4396 cmd.exe netsh.exe PID 4396 wrote to memory of 5080 4396 cmd.exe netsh.exe PID 2972 wrote to memory of 3864 2972 mshta.exe net.exe PID 2972 wrote to memory of 3864 2972 mshta.exe net.exe PID 2972 wrote to memory of 3864 2972 mshta.exe net.exe PID 3864 wrote to memory of 4632 3864 net.exe net1.exe PID 3864 wrote to memory of 4632 3864 net.exe net1.exe PID 3864 wrote to memory of 4632 3864 net.exe net1.exe PID 2972 wrote to memory of 4892 2972 mshta.exe net.exe PID 2972 wrote to memory of 4892 2972 mshta.exe net.exe PID 2972 wrote to memory of 4892 2972 mshta.exe net.exe PID 4892 wrote to memory of 4952 4892 net.exe net1.exe PID 4892 wrote to memory of 4952 4892 net.exe net1.exe PID 4892 wrote to memory of 4952 4892 net.exe net1.exe PID 2972 wrote to memory of 4452 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4452 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4452 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 1912 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 1912 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 1912 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 3408 2972 mshta.exe DirectX.exe PID 2972 wrote to memory of 3408 2972 mshta.exe DirectX.exe PID 2972 wrote to memory of 3408 2972 mshta.exe DirectX.exe PID 2972 wrote to memory of 3596 2972 mshta.exe Conhost.exe PID 2972 wrote to memory of 3596 2972 mshta.exe Conhost.exe PID 2972 wrote to memory of 3596 2972 mshta.exe Conhost.exe PID 1912 wrote to memory of 1532 1912 cmd.exe wmiprvse.exe PID 1912 wrote to memory of 1532 1912 cmd.exe wmiprvse.exe PID 1912 wrote to memory of 1532 1912 cmd.exe wmiprvse.exe PID 3408 wrote to memory of 4228 3408 DirectX.exe driverpack-wget.exe PID 3408 wrote to memory of 4228 3408 DirectX.exe driverpack-wget.exe PID 3408 wrote to memory of 4228 3408 DirectX.exe driverpack-wget.exe PID 4452 wrote to memory of 3812 4452 cmd.exe driverpack-wget.exe PID 4452 wrote to memory of 3812 4452 cmd.exe driverpack-wget.exe PID 4452 wrote to memory of 3812 4452 cmd.exe driverpack-wget.exe PID 3596 wrote to memory of 2136 3596 Conhost.exe Conhost.exe PID 3596 wrote to memory of 2136 3596 Conhost.exe Conhost.exe PID 3596 wrote to memory of 2136 3596 Conhost.exe Conhost.exe PID 2972 wrote to memory of 4932 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4932 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4932 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4300 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4300 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 4300 2972 mshta.exe cmd.exe PID 2972 wrote to memory of 2168 2972 mshta.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\DriverPack\start.bat" "DriverPack-17-Online.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DriverPack\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx "DriverPack-17-Online.exe"3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_44100.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="DriverPack aria2c.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_57473.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start wscsvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start wscsvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13522.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13522.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13522.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52987.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_52987.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52987.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19947.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19947.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19947.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11740.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_11740.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11740.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2768.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_2768.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2768.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60032.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_60032.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60032.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31093.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_31093.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31093.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15952.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_15952.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15952.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51619.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_51619.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51619.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23886.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_23886.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23886.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5817.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_5817.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5817.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_41980.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_41980.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_41980.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55514.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_55514.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55514.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96521.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96521.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96521.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8299.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_8299.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8299.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36130.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_36130.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36130.log"5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_85415.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/DirectX.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_85668.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/DirectX.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_16568.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_85705.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_4352.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44528.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44528.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44528.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29701.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_29701.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29701.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77260.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_77260.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77260.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/DotNetXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_75111.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/DotNetXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/RuntimePack.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_54721.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/RuntimePack.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36155.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_36155.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36155.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52531.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_52531.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52531.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31887.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_31887.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31887.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63778.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63778.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63778.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75747.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75747.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75747.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14296.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14296.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14296.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4549.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_4549.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4549.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62804.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_62804.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62804.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35370.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35370.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35370.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_39997.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_39997.txt""4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66570.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_66570.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66570.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62230.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_62230.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62230.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50473.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_50473.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50473.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34799.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_34799.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34799.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33158.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_33158.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33158.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15043.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_15043.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15043.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51306.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_51306.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51306.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14674.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14674.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14674.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96994.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96994.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96994.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63335.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63335.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63335.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27009.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27009.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27009.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_53658.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_53658.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_53658.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9345.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9345.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9345.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62658.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_62658.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62658.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe" /S || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_53313.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe" /S5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_66761.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe"5⤵
- Executes dropped EXE
-
C:\Windows\TEMP\NET\WinPKG.exeC:\Windows\TEMP\NET\WinPKG.exe6⤵
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i C:\Windows\TEMP\NET\1.1\netfx.msi /norestart /qb-!7⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\TEMP\NET\1.1\cleanup.bat7⤵
-
C:\Windows\system32\net.exenet.exe user aspnet /delete8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user aspnet /delete9⤵
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\M928366" /v DisplayName /t reg_sz /d "" /f8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" /v DisplayName /t reg_sz /d "Microsoft .NET Framework 1.1 SP1" /f8⤵
- Drops file in System32 directory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft .NET Framework 1.1 (1033)" /v DisplayName /t reg_sz /d "Microsoft .NET Framework 1.1 SP1" /f8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52569.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_52569.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52569.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33183.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_33183.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33183.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96693.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96693.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96693.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_86025.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe" /S || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_75483.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe" /S5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_70259.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\set_x64.cmd" "6⤵
-
C:\Windows\system32\xcopy.exexcopy x64\GAC C:\Windows\assembly\GAC /s /e /i /y7⤵
-
C:\Windows\system32\xcopy.exexcopy x64\Microsoft.NET C:\Windows\Microsoft.NET /s /e /i /y7⤵
-
C:\Windows\system32\xcopy.exexcopy x64\System32 C:\Windows\System32 /s /e /i /y7⤵
-
C:\Windows\system32\xcopy.exexcopy x64\SysWow64 C:\Windows\SysWow64 /s /e /i /y7⤵
- Drops file in System32 directory
-
C:\Windows\regedit.exeregedit /s x64\64bit.reg7⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89450.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_89450.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89450.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95134.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_95134.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95134.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_24915.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=15⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 --crash-reporter-parent-id=42006⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" --backend --silent --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=4200 --crash-reporter-pid=0 --wait-for-package="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806194521" --initial-proc-handle=D40200006⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" --backend --silent --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=4200 --crash-reporter-pid=0 --wait-for-package="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806194521" --initial-proc-handle=D4020000 --crash-reporter-parent-id=4927⤵
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806194521\installer.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220806194521\installer.exe" --backend --silent --initial-pid=4200 --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --crash-reporter-pid=32247⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe"8⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --ran-launcher9⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe" --ran-launcher --crash-reporter-parent-id=338410⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3384.1.1345530540\242362814"10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3384.2.1657225854\1929454902"10⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3384.3.912578623\930627885"10⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3384.4.2048131\1985352426"10⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="3384.5.40094159\1506616250" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --ignored=" --type=renderer "10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host=https://autoupdate.geo.opera.com/ --pipeid=oauc_pipedbff851fa759ccb33e726f883720ae50 --version=36.0.2130.80 --edition --lang=en-US --producttype --requesttype=start --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --installationdatadir="C:\Program Files (x86)\Opera" --firstrunver=36.0.2130.80 --firstrunts=1659815178 --currentstats="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp3384.6.1360626155"10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="3384.7.1423082518\1759099629" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --ignored=" --type=renderer "10⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="3384.8.133983737\56609546" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --ignored=" --type=renderer "10⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="3384.9.1256455525\676913199" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --ignored=" --type=renderer "10⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --version10⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --start-maximized8⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --start-maximized --ran-launcher9⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe" --start-maximized --ran-launcher --crash-reporter-parent-id=272410⤵
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe" --version6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67282.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_67282.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67282.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_30016.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_30016.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_30016.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51559.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_51559.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51559.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47722.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47722.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47722.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27529.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27529.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27529.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75686.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75686.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75686.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69798.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69798.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69798.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52616.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_52616.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52616.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe" -s || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_42437.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe" -s5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\install.cmd" -s "6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comct232.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comct332.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comctl32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comdlg32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\dblist32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mci32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomct2.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomctl.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomm32.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msdatgrd.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msdatlst.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msflxgrd.ocx"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mshflxgd.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msinet.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msmask32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msstdfmt.dll"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msstkprp.dll"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mswinsck.ocx"7⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\picclp32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\richtx32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\sysinfo.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\tabctl32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msvbvm50.dll"7⤵
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s VBA60_OCX_License.reg7⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\libcrypto-1_1-x64.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\libssl-1_1-x64.dll"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\OpenAL32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\wrap_oal.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\atl70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\atl71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comct232.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comct332.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comctl32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comdlg32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\dblist32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libcrypto-1_1.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libeay32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libssl-1_1.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mci32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70chs.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70cht.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70deu.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70enu.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70esp.dll"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70fra.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70ita.dll"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70jpn.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70kor.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70u.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71CHS.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71CHT.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71DEU.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ENU.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ESP.DLL"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71FRA.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ITA.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71JPN.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71KOR.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71u.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomct2.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomctl.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomm32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msdatgrd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msdatlst.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msflxgrd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MShflxgd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msinet.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msmask32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msstdfmt.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MSSTKPRP.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvbvm50.dll"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvci70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MSVCP70.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcp71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcr70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcr71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcrt10.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mswinsck.ocx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\OpenAL32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\picclp32.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\richtx32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\ssleay32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\sysinfo.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\tabctl32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vb40032.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\wrap_oal.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vb40016.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\vbrun100.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\vbrun200.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vbrun300.dll"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17177.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17177.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17177.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1221.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1221.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1221.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96556.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96556.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96556.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35163.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35163.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35163.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="DriverPack-Alice" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\DRPSu\Alice\cloud.exe"4⤵
- Executes dropped EXE
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_104.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_104.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_104.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49362.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49362.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49362.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3943.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3943.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3943.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84763.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84763.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84763.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3800.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3800.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3800.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_57702.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_57702.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_57702.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72561.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72561.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72561.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58273.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58273.txt""4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58273.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55938.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_55938.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55938.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-all-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42781.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42781.txt""4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-all-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42781.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62010.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_62010.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_62010.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_91445.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_91445.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Loads dropped DLL
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_91445.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64636.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64636.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64636.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83565.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83565.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83565.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23976.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_23976.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23976.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17209.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17209.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17209.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6669.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_6669.txt""4⤵
- Enumerates connected drives
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6669.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43120.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43120.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43120.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9447.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9447.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9447.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92981.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_92981.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92981.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63635.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63635.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63635.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72599.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72599.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72599.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90935.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_90935.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90935.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44530.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44530.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44530.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-16.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75144.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75144.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-16.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75144.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14710.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14710.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14710.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-17.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28626.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_28626.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-17.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28626.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-18.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49853.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49853.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-18.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49853.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55654.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_55654.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55654.log"5⤵
- Enumerates connected drives
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21167.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21167.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21167.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36494.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_36494.txt""4⤵
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36494.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84995.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84995.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84995.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49040.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49040.txt""4⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49040.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87523.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_87523.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87523.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_39139.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_39139.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_39139.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61836.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_61836.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61836.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13377.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13377.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13377.log"5⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40699.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_40699.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40699.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14492.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14492.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14492.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64151.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64151.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64151.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56693.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56693.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56693.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85499.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_85499.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85499.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15906.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_15906.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15906.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73274.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73274.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73274.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22499.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_22499.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22499.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13212.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13212.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13212.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83071.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83071.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83071.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2825.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_2825.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2825.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42507.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42507.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42507.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92927.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_92927.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92927.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27203.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27203.txt""4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27203.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99789.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_99789.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99789.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85968.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_85968.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85968.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11386.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_11386.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11386.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1084.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1084.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1084.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56870.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56870.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56870.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84830.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84830.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84830.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69598.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69598.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69598.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1504.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1504.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1504.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21054.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21054.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21054.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70441.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_70441.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70441.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35697.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35697.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35697.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22975.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_22975.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22975.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86502.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_86502.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86502.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86856.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_86856.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86856.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7721.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7721.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7721.log"5⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63915.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63915.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63915.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21296.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21296.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21296.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85846.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_85846.txt""4⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85846.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21537.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21537.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21537.log"5⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99314.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_99314.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99314.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17664.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17664.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17664.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90292.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_90292.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90292.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7493.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7493.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7493.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REBOOT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96364.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96364.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REBOOT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96364.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61610.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_61610.txt""4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61610.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18236.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18236.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18236.log"5⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xf81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_39997.log"1⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --scheduledautoupdate --autoupdaterequesttype=start1⤵
-
C:\Windows\TEMP\opera autoupdate\installer.exe"C:\Windows\TEMP\opera autoupdate\installer.exe" --version2⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host --pipeid=oauc_task_pipee59e7323ed1cebd78082538c8b9cbe70 --version=36.0.2130.80 --lang=en --producttype --requesttype=start --downloaddir="C:\Windows\TEMP\opera autoupdate" --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Windows\TEMP\opera autoupdate" --nometrics --scheduledtask2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\4440_25231\Opera_42.0.2393.137_Autoupdate.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\4440_25231\Opera_42.0.2393.137_Autoupdate.exe"3⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --forcedcheckforupdates="C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera"3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe" --internalversion4⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe" --stream4⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --install --silent --autoupdate --installfolder --installfolder="C:\Program Files (x86)\Opera" --launchopera=04⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --install --silent --autoupdate --installfolder --installfolder="C:\Program Files (x86)\Opera" --launchopera=0 --crash-reporter-parent-id=45205⤵
- Loads dropped DLL
-
C:\Windows\TEMP\Opera Installer\installer.exe"C:\Windows\TEMP\Opera Installer\installer.exe" --version5⤵
- Loads dropped DLL
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --backend --silent --install --autoupdate --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=0 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --replace32bitwith64bit=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=0 --server-tracking-data=server_tracking_data --initial-pid=4520 --crash-reporter-pid=1160 --wait-for-package="C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing" --initial-proc-handle=440500005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --backend --silent --initial-pid=4520 --install --autoupdate --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=0 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --replace32bitwith64bit=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=0 --server-tracking-data=server_tracking_data --crash-reporter-pid=11606⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F345FA96666DB90C990808C0D5F583212⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E40B3AA90B782074CF2044B70B99281 E Global\MSI00002⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.tlb"3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscoree.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.tlb"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.tlb"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.tlb"3⤵
-
C:\Windows\SysWOW64\URTTEMP\regtlib.exe"C:\Windows\SysWOW64\URTTEMP\regtlib.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb"3⤵
-
C:\Windows\SysWOW64\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet.mof"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe" /bootstrapi3⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe" /i3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll"3⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll"3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Drops file in System32 directory
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" /if "C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll"3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll3⤵
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll3⤵
-
C:\Windows\SysWOW64\lodctr.exe"C:\Windows\SysWOW64\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v1.1.4322\_dataperfcounters.ini3⤵
-
C:\Windows\Microsoft.NET\Framework\v1.1.4322\migpolwin.exe"C:\Windows\Microsoft.NET\Framework\v1.1.4322\migpolwin.exe" -migrate 1.1.4322 1.0.37053⤵
- Drops file in Windows directory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\DriverPack\DriverPackSolution.htmlFilesize
4KB
MD5203ac1542d8e93edbbc80f7b59db5c44
SHA1ba66db0e746bc550ea860f4023c3cb5c72140ba5
SHA2568892e63141854bcf4bb1452abef68dd2c348c59322d697ef11a7ab7c5e3c4aea
SHA51253cb5ad72c66e62d9285c318b606a9819053de729fa18ea72e80a7f09b333cc7868b455048660397086fa80a13ca745e42a6dc22df63d059076befca178a8a95
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\config.jsFilesize
3KB
MD531009d2efb710925bf7f308af59c629b
SHA15215c77b1719d0974dc529b523b758ef85dbebd4
SHA25618f86ef3fad86c97d56274e5577b178a77f40587a80451a971013248e37190a6
SHA51244129d626970c101df41a0bc94ff6120a1034077628da968d9c772fa6125d1f11478480cec7086dfd1625c8fc07820202a711a5598ea131b7742b31211a3f394
-
C:\Program Files (x86)\DriverPack\css\custom-control.cssFilesize
10KB
MD5f7f8703ada2176dc144343a2c2acb1cd
SHA1091334a48056a8baafff0cd672232de1c1f6c838
SHA2567d7853e95258a7a3f8eaf41795f7124e7d2dacdeb5f1efe212b3ff7ed0da9e50
SHA51227d46472c06103e0bdd9d40149804c16f469305752c3a6d8473c2f2ab22b2c8fa5d65d61dda7c617a3f12d8526b56a10320b8683f31d210ac2185fd0daed8e97
-
C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.eotFilesize
7KB
MD5d85a00ccb58d531afd9ad80a067fbf0e
SHA10a3c0cfea5b9c0fdd5f17a1df49cb1512316330d
SHA2560a04d85875091cc334f63b90c8ccfa0838f20023945d949296363369066870e3
SHA512bce1796d0c71291cb779e2e99399a213b030663d5968330932b4a059ba48f3679e2df9e9c84201efb090a44b499bc5f46d174ad40b4b1d3afb5df5d2f3299261
-
C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-regular-webfont.eotFilesize
40KB
MD588a9c629f26f8563a72eac95cb0744bc
SHA1484bca13532678133dc14a668c580be2c1346526
SHA2563ae576bfa96d7cf6614c8c97290c7abe03191a8ceb0c837a21e7ffe70d66ca62
SHA512b4cdaa3a5a46ef368e9138c9874aa1173b466bc660d5bbbd13fc3f10f509cda9af151a2667ecd079935d60992b1436f6d5843ced5a063769e19e67f84c402af9
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.eotFilesize
141KB
MD5be0e58130a84b19c8523345478a0bd3f
SHA135dfea056f715d8191f2647e56c214afaf819eec
SHA2561c3a470bf710204b1dbd65679b914af4b94e7f018b1f7df3d61ff863d6f335d9
SHA512c0ca4a33842d69fad8f1795864c9b592d2cedd62b14efeb46676823460ea50693ccc884891d16f4ba1ffdd5e0a80f9d06fd6e65fe184f3ea283ff441e7b874c6
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.woffFilesize
57KB
MD5a3932b53cb250b684b63d1e04af5603e
SHA1b06c657df6b320b915a17455848e66695a9fc68e
SHA2562a8f208d9d8556ff58da8a420316de6d634a568a0eeb94c043430659fff7d338
SHA512e8e68301dde147b7c79e21689066b7c9653a82f9898c2c76f4060af1a48c7f997f4797de5002e870e9ffba05efcb47f10cae5b8beadbe7909a85de4c04c54730
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_light-webfont.eotFilesize
61KB
MD5ee9163c34f600221169f8ff531e97182
SHA157f0b2c837c94f2a0df47ee62b4639fd6426bfa0
SHA25653f30a622db68cebe92dbd384cc292aef13ad7e3349a10a77c29326e10634c21
SHA512d51e2a5f6df706eaa2c5ffa071a9a9c08e58a30b4af64a1ccbe81f8e9c38f20429df665cabaf295129490afc639b7e19c0fced428610a284a17899c3290904cb
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_regular-webfont.eotFilesize
64KB
MD5e5835857d5dddda8d5f0725a386a2d0e
SHA14c92001174816e973c374986e52af2428af2f6b6
SHA256750e86dc4965d1d63216327777239692fcaf377106e0ed9e3b1e73e7eb89b2a8
SHA5124eee43c691475031bc219bd6bd7001128b62a22b69b89e7668434318b72db61942a58ee85ab49f4864abebeb451b68145543325f1d42840dae7f90b7ea363dd9
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eotFilesize
65KB
MD5044aa0b596161750cb58aca15c52cf38
SHA1d40e645b34188a54d909fa40f7eddeefb8b9df03
SHA256790579e11608136663d073bc6f99848c04b4dcd69216df7daf5be00df573a3fd
SHA5121a3b3abc614a7ddf673e34a936de63809f8c18a86409364b2bbdeb608fbcd845095ba7cfb34a0826e2ac18cfc5ccd4d47d4bfa13fae3caba7fbc4470d36c8086
-
C:\Program Files (x86)\DriverPack\css\icons-checkbox.cssFilesize
444B
MD53be98220035017d9b818f3cc94f87587
SHA1bc07f11d0a59f942ac942dba02214a7041ad6e3a
SHA256cb134dcb95a407795c671a512c389894d3525fba3f6a2168fc5b9b7e875e78dc
SHA512d2e7d57cb7b7e771c82c75a04fbfb86ebecbb409ecf2c5666aeaa99695474a7985e3367f6a5b3d4ac59f775f60fb084efa9bdda99ce3c077df2690a5f0a6b1d1
-
C:\Program Files (x86)\DriverPack\css\icons.cssFilesize
509B
MD5ebae852f3327fdaf3e2fc2bf1cdecb8f
SHA1f9753fe176069974fc9bce49eae877745282e183
SHA256b5f111103f7f090c246a223b1ff497b94c4dd3ac64bf5b3fb2d91555fcfd6f2c
SHA512bf8e7c5db7a1eacd4344d5facfee1cd66e883389b53bc28e4e387cdb67ea40ee26266ba4282e50eb50a7bc3c810d9fdbb50792a46135761b2e8ce52ddc9e394a
-
C:\Program Files (x86)\DriverPack\css\normalize.min.cssFilesize
1KB
MD5e8908cf9cb9504b285327d240187f53b
SHA120eadf1695eb38bcd92d1706de5335db61b96502
SHA25686235e2c477078adfe1188d07ca1e5d8198443aaf2436de1785a169f3e1d5463
SHA5129c828e8942d40da89f33d1db459a7fc12621660331bef307df8649e89758e76b044bf97a2cd36d656915e19a8b04f571cdb61d7cb6f926a3ba151ee67bbcdc4b
-
C:\Program Files (x86)\DriverPack\css\open-sans.cssFilesize
1KB
MD59ed298542b45ef98492e159f68e89f48
SHA1c4521d9a5dff8a71804c40a909378e8eb5bd66c2
SHA256b9bd51ae6ccc7df20417e0ef341295b86bf8f74f6e235ee99ddefd675806f47f
SHA5121c7d5b378d6c627fbbef864035b157c3e7647b699a50d64f6ebf22faac38bf774e0c025bc8dd4ecc9bde7b377b729bc89bf6fbac4d2409240e2d03753cfe680e
-
C:\Program Files (x86)\DriverPack\css\proximanova.cssFilesize
2KB
MD5487b553f5f73b30b8d565df02b4103cc
SHA16defcf202ce7a04f2bea8aaac8bb01ed44407fa5
SHA256931071422410d73d9d7d3583745e476eac23c0cac5fbe344f8436499ee40ac46
SHA5125a94da5d685f6e74f6576c179b8b65b719727163afebf24557b5f23718a8c034f5e2782ff33021c4d029abaa7cdf464ad0a49cce0602b31191b3b6b642bda9ce
-
C:\Program Files (x86)\DriverPack\css\roboto.cssFilesize
1001B
MD5f5f5b5e4955262430e7b496247425d2d
SHA1d4bea186a0d525ce3060e8dd7901311ae4a0735a
SHA2562537efe2fb974f58cddbc99abfcd7aed6e9df81992eed3e528b5f1748167b8fa
SHA51216a7ec3d95ed773a0a1ce2c2dc4430677106f0d1042e34cb39ed48f4a495f637ec3eefad05a4ebbddbea71a67e933fa0b56e6beef69700c6e3ac9cda9c17e7ca
-
C:\Program Files (x86)\DriverPack\css\style.cssFilesize
14KB
MD52f4fe7647aa460b8984556a25a74c234
SHA18fb2a5135e61a034ecdfef279e92078a7b463123
SHA2563f8ec31a3c08de6c1aac117347b1b83f391bb0a91c9dbdc57ba9d11d5ba372d5
SHA512bad4c1419e302f8e5a84c28fb0862dc56167a7353cc5420d8226883203fe03eca7ec8a9f554cfee560523e9ef292cc38200bce6015c80a428ce4c05222be3a58
-
C:\Program Files (x86)\DriverPack\drp.cssFilesize
190KB
MD55fdaf0fd106200153f8243ebb8bc6b18
SHA14b9524224954987a07fe1ce5f6f6e83becd5a20b
SHA256439bfd8bf9f9176c1757ba277850525f0abec59bb3ef7cd8a974a5ad1d2b3004
SHA5121db1cfcd7e8188594d5b136a479a29797ce1382c471bdd592f7f44f1026e5da845d231eeb09aa6b1b0d36ac2329b3277ee69c9e53049f2726df936a50b898228
-
C:\Program Files (x86)\DriverPack\drp.jsFilesize
3.7MB
MD50f62a60e249a6f77428cba73ee22780b
SHA15ce7ef0d538bce26d250d427d17cdedefcad1904
SHA25606643527422e7f6e3fc094f2314488cb8758bff19f677499d27a4289eb15627e
SHA51207b6cf625640a9765d28a386a16dc5f3ad7bc8d3baa9756b9869240c60d566bb3e273bdbdc547863bb86bfadf490bc04ae92739e9b59da2062eb05e51a2243ef
-
C:\Program Files (x86)\DriverPack\img\assistant-chat\assistant-icons-sprite.pngFilesize
3KB
MD5c283858d15a9593aacec23dc2bd5b880
SHA15e3af0289ced8541a282d72ec493f100530492f4
SHA25657b11ce3770fba0479784deb6352f8821f9255740796d1ccd79199b36c208f2f
SHA51217bd48db45f661dd67a395caee7e0bbb249f1b8a0716797799d4ef79efee021c1e2c1e31c43308832f4b5bf198284ba0299e6865d9259b68784d5fc6b8a88485
-
C:\Program Files (x86)\DriverPack\img\assistant-faces\chat\5.pngFilesize
70KB
MD51cdf86375475f5fedc439494f3bbb40e
SHA1f117db3ba1d17e18a9002b6dd60c68b7d270f8e3
SHA2569c6444e7cb0412dc06f66b46ad31b3cf464d7029acf942ee3e8136f891941430
SHA51222f9f6ad980e4107098bab58a877a26765f490bb4291113512def54c53923882b6f9147cdc48df3c1c1dafa70b0df887345742320b54c7f242768fb7b051ecd7
-
C:\Program Files (x86)\DriverPack\img\assistant-faces\start-screen\5.pngFilesize
75KB
MD540353d51881300e6cea13d94ae01b756
SHA15718f730dcb3349ad6d23972657962663fb38fc1
SHA256ad615ef1f7016826d475fe90b4363cc149b060de2b9406b4c58cb4a4f1938bef
SHA5128bc29ecdce2d5f558dd31a1e2424cd1ca94f72e36ea72a491cbcd46f52762f1f44106c749bcb41e6fecd87f9cba2bf6898dbc022a5c46f2ae15aafda3ac3c734
-
C:\Program Files (x86)\DriverPack\img\header\new-header-logo.pngFilesize
4KB
MD510eb51f76f3df7a82b05ed747e27c6a7
SHA1157e45f82ba308431cecede2d753d775b54e83c8
SHA25698856383428042c14739159f4a62168e9394f774bf2b696d62f46d70fc2ba175
SHA512c497fad9597c699a7c6355a5aee999d8e240b1bcfbc39031f0c8b50bdb53f30f7fd43451ba3ea6b99e3fc414bfdd5dae11a499cc9585322b039e6ef87bc31917
-
C:\Program Files (x86)\DriverPack\img\installation-loader.gifFilesize
32KB
MD5753622cdb83a6a695b5e98d7410a3072
SHA1aa08f1e0ffeea39d3279d5fc8c0f490458b4966a
SHA25630f1b256b3c6f1b99a240ef7054cc5894aa19f1cd5aae2b977fc5beb9923b556
SHA512849a4f08728901d4cd907b06b043e250e8166af09f343df3b127302eb5a66ebd4d127384c87d3b18efd27fc964f92e4d2fc9e928f69c40a96dc6cf9e8071ff33
-
C:\Program Files (x86)\DriverPack\img\new-ui-assistant\arrow-recommend.pngFilesize
1KB
MD5a2b5d78a49f66313a203f666faa64393
SHA199c22fd6116d69cd2d21aba072f050b5d8f51006
SHA256fd42158b4e01b5c86360c9450e9e3db5e399e0eadb28e5420ac69f7da1dc0fc5
SHA51203a7abce1b4c2bf82f40ba9af1f25022bc20aaddd745b08fada7ac01dffaab05697880f080d38b4672905aad2d0bed319a83e13c3d247b3900673e76fab8cadc
-
C:\Program Files (x86)\DriverPack\img\new-ui-assistant\icon-footer-splite.pngFilesize
4KB
MD59d355f967c8a9312dc7453f97af3d393
SHA128dec943e5cbbb56f9676e9f420b0b7742bc861a
SHA2565e45160ca10f9237661f7c76880f1fed2dc5d2e147061daeeac7080df1502774
SHA512d42b873275465473ef4539b83a7f9b6807a9dae24a35b47ab47840733e00ca7ff4ebe7cfbc297162bd8d78c2b7a63fd4dea01f05e076d7b6637517ed49060696
-
C:\Program Files (x86)\DriverPack\img\onboarding-new\continuous.pngFilesize
35KB
MD5306c9eeed47ce489282cc4189ccd25a6
SHA1ac811a1c2eb151eee644e11dd5a97e4bf95ec5ce
SHA256c5d7aca39bd800c99281f9ae48f9b0e5421da18e3261eced170a46a9dca56016
SHA512334b446717c4b193b14df72daa22305a88adee5c0035047443663cd93cc1eafd5fd7183aba2c50ab0fde77ae1cef471dcd6909f317655e7d2fb466153d701a96
-
C:\Program Files (x86)\DriverPack\img\screens\arrow-top.pngFilesize
2KB
MD5c88c78c9dcf11880a801e44e705f9708
SHA17b98255e87f81c3a655d375f112c188d9bd241a7
SHA2564f2785a950320440acd22fcc0274944b971d5975de008f69bf81d19d44842925
SHA512ea1fd00c23c7abdcdcecfce5d93b1946763043bc18cb17846ab3ecb607f19a7ede63ca5308cae6e2395053b223a4e438111cb6170264cc42c817130bd178ff4e
-
C:\Program Files (x86)\DriverPack\img\screens\new-ui-logo2021.pngFilesize
5KB
MD5ed623a69120325b464bc149ba5829465
SHA117ba0cbe9a7297824d8792becae98d8853c56af6
SHA256a11af07103005c27c0a5f721d99482e4700c21c85afcbc8e44e4e785af5fa902
SHA512fc18cde812cd2ac9e8f835971f4226092213737220e70e095bc5186042c061bf335501b098966c34a8c55610afea626061856740532166ea26c71c018b6059e7
-
C:\Program Files (x86)\DriverPack\languages\en.jsFilesize
86KB
MD57507c4174ced52a6c0e1b2bb12ce9f3e
SHA16bad4ef261e7b7ab1a02d46341bd1f8a922987da
SHA256a3df7c1b150504fb96555d8d7f7b9c4129a3225ba241da983d56a9c7a1404aec
SHA512d13d045bd66bbf104ec533903e4b7bb76dd56f6a1c8346787f419bf1cd0eafc082e757e0c244024d778755c4ab4468da455f2f92fad7f5fdb7a0135c9c6e26cf
-
C:\Program Files (x86)\DriverPack\run.htaFilesize
2KB
MD56bcab16cd99663b1093d10f827ca0323
SHA147b2d7f33da12d88095379fc8ea5bb7114ce75e9
SHA25602bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
SHA51267c23c1f3e8023001336ff7fc9c9052220f2ab67df280ef269b0239d67dfc67e6783dda44dec747ba6689c239d7efdb55262d098868e43ab70a055429349210e
-
C:\Program Files (x86)\DriverPack\start.batFilesize
90B
MD5f66f13d4770eb90e6d81222fe3525a3f
SHA1f21bc06a179c108d13c783600b98ea0641076127
SHA25688ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
SHA5123f321a339dee086f474d5ac9e8b247805d070b6c0ab5f9d85c5f1075021a3eb7ae23ab2b577000adc30ad32e66a1e291993f435f8539bb0032a1aca038e1f1b2
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_44100.txtFilesize
9B
MD502466847c63e90c5041b8dd7990dce27
SHA1fdcf71f16e2efcb8815730b4cca5f580b185cf5c
SHA256195418a93d769a17558aa804568eff487979e62d0731aa8c63d8d0ffc1723321
SHA51286b11957db369afa71831c72848b897aafd155887467a377484d0346dcaeaac88476cad2331e34a24e7f8ac3a07335dd1e639ae27bfa0d4491dcc6a48a7e6ff3
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_57473.txtFilesize
9B
MD547a22a7a342fd09177c62fcb8054933c
SHA1d2b7928a34eedb04acc61c3a0e01d3138295e855
SHA25651e6af14fa1e9032300dbf76a85cb8561e523e89c363cec09cdc2128801a191d
SHA512b9ab174618fe617b061e27c8f0d4b7960271952a67245c2ad6155e93e0c08cab696191fbc7069c89f05ff545318f930cbd0dd7dc41b9cca0e7356143d3b47d98
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11740.logFilesize
672B
MD5f522eb7dd1ad950490454dfdba12f74e
SHA1515aa72d09df55d748294e4634b05a9fa4725719
SHA25680575ff61352d770f662f486f5359b5b1d619623d7997f2b6f218d5b27273bf7
SHA512a973ff1ea5e09e8a1927212a1d66481f48423615f343e4d59dde28848ca8f0996f53d7c36924460f9c6b49ae86f17cec759c65946775ce2f6c507ba4d967a4c6
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13522.logFilesize
648B
MD5425ab2af792bcefb536ec777a8ce974f
SHA1d21c7386b13687d90b0de1b166c6d23503a3c6d6
SHA2563930db7eebed52128180d59fcbe41fdd9209d08f0a774c8d12351a24f7246679
SHA5123d7816be2b2251edbc7aad26e5a4ea06dbe79151dc6db7469839fb18f7fea319d77e8184a2de8d88d612bca964e05f406cb413ce406f7bbad0af98a8f257f444
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15952.logFilesize
745B
MD5f52a1012749b796f4779fc42cea1a285
SHA1928dbd31ea3435495808540b2fa2f99eec78ce20
SHA256a54a1a8d2c1df5d8011466d8293bb2fc31f8de809bf78ee1343334b316ff373d
SHA512a1c950dca967d5099b264f262a9f98bf28cd3bfa99ea36cfc7e034592969a318a4b110fb34ae2c8d33df9484364863e856d371cd22b62aa381ab57629af49077
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19947.logFilesize
675B
MD5e57ea57e1a790854078cf2fc63f23bc5
SHA1d86ab9afc7c56ef1cd142148f29146d62821f44a
SHA256d2728a616d8286f3f8cf257abe952d86a7b2cc814deed7c7c5a7c8f88e6f95ab
SHA512c3bba9748c6699e147343814f376ca0d694882be1293dffa8af1437258dd033f30b32c8b6722dba841f55d2524b19d3d4a4ec4ccc77f87b22219ae617bcc0837
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23886.logFilesize
664B
MD5a741f8509de0b4457e3ec69df1c82a4e
SHA19e8f0bb031dca4d0eb601eab5b096c570ff346f7
SHA2565ba05f43f22385af651fefda3311fa7ff32bbc39ca5e51e40d05ab60b4b54fe7
SHA51207d49045c6ed0b59a6f1963819dc98038a4b5edc62256a11b85a2403fe9e7382140bd0808dc116bf4a9ab8d814bb12b04638d8ce86eaeee6e4e7bfa532d62064
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2768.logFilesize
681B
MD542f8e34d7844e360c9e623cb4dd62a38
SHA1854e626685f7a59c91cca72daf57f44e56cf866c
SHA2569ecf9c4a01d3597c9885cece5dfce6c69a4e53a0819a7a931775d0bbe6d514d8
SHA512a83976cbc2c5bdd6c6f63b45fdf0475afc9554f3fa592080b8c148ad77e3ae3ad750737d86267fdd813233b15a0ac5449643d1a2132ca574fd14b73b12fd68f5
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31093.logFilesize
668B
MD56b9ab900bd9e2d0b1d7582d6a3e5b9c8
SHA1bb8d24a17ebf9cbe74f9f0857d2e47b9b096a3c2
SHA256b13fefcfb8e58c3106039a773be04743f976454614556a9fb6ac31e68a417d98
SHA512a361be635dd0aa207d5a46b25a8915b7d0cbfa2b303a7ee411be45457831c5986d1ec440de229c26218dffa0ede273809fa9cb32565d24766645959f8b3bdc0a
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_41980.logFilesize
680B
MD53ebf9179649cd68103583f634b251be3
SHA11a1d5dbabdd7e5cb5e29e47869375eaba9e02956
SHA256e69aa4803cf0cb6a5c8528c52ebc8d1efe47bd1120dd8a407e72fe86fbccf94c
SHA51239632aaf48e97dd3b8e0f7fb912f1576725f3dbc8860848b917b337f467189efeb58b329778795b2f7f0702f7d70c4e14642e9b4d962fb166a3cc15a837773d3
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51619.logFilesize
669B
MD55fe99322dd7671d51d077af7fe845f15
SHA18118fb32b5856e60ba9e7f6a891440d699eb82d9
SHA256407f8a2d76f3f8d7bdcdcb326c7213d82b5ec26c640e7c57f5ce6215f8024c27
SHA512ec213cd1fca04927b3af7e24393f2672db5354e532a4071e9b8a9174d0bbe6b7d5b7ed97413a71907086db7c03a20a2780e9d20a88dcaa777490e0775b604fa2
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52987.logFilesize
678B
MD59ccbf15faf9a9d6cb2ce9fadd5878aac
SHA19729bf0c5dfe5687f791b34c144db234b3793681
SHA256e85464c3fd8847edb461c2b12aee31299991dd988fd9553208e82cab66aa91b6
SHA51216e88bce23a4a775cb14e56acf7820d185c1a566ebcdb6b42446b163b62a7a490d90df5f8b5d3e406fdecf8cdf19b8ebcdd9ec0e67a45ec6f6e7b40d8c68f693
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5817.logFilesize
668B
MD505d23cfff37a132417e73150ab0aec59
SHA1bdd3519f309af112969c9d80e29338c7d1c5ecef
SHA256e83fa69be1e74ed298eb31f17b4595272025649f8d4097095a653775b0fa9008
SHA5122215f9e375cc55690e1efc1dd7a223b70259b67fb406d4063fab10bb96399bbaeab058bed902b45a361e32b0e2e71d00dc9ebe1556d9ee3294f89c088144d784
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60032.logFilesize
680B
MD59790a92bb6ffc8dcb166fca1d5172d96
SHA111bcb9e7b550da36fad636655d966f87c8524baa
SHA2565ea699ddb7f8c9aa0334720b5682845e4c65fc6d0e574b2b664b375e3176f7cd
SHA512da37aded690703e98d7d0e9b06081946a91fca0a72f248b638e766f67213ecbd495e81d077d9dbc2314016c789ac0071142c329c9721a4eb969079c82eada572
-
\Users\Admin\AppData\Local\Temp\nsp6F3B.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
\Users\Admin\AppData\Local\Temp\nsp6F3B.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
\Users\Admin\AppData\Local\Temp\nsp6F3B.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
memory/416-1515-0x0000000000000000-mapping.dmp
-
memory/816-3008-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/828-2561-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1196-1518-0x0000000000000000-mapping.dmp
-
memory/1400-2780-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1492-2784-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1504-1974-0x0000000000000000-mapping.dmp
-
memory/1532-1112-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1532-992-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1532-943-0x0000000000000000-mapping.dmp
-
memory/1576-1749-0x0000000000000000-mapping.dmp
-
memory/1584-184-0x0000000000000000-mapping.dmp
-
memory/1588-1744-0x0000000000000000-mapping.dmp
-
memory/1636-2337-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1636-2120-0x0000000000000000-mapping.dmp
-
memory/1636-1142-0x0000000000000000-mapping.dmp
-
memory/1820-149-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-145-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-166-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-165-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-163-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-162-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-161-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-160-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-159-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-158-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-157-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-156-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-155-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-154-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-153-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-152-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-168-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-132-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-169-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-151-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-171-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-131-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-150-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-133-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-170-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-172-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-129-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-134-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-173-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-181-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-136-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-130-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-174-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-175-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-148-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-176-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-147-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-135-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-146-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-167-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-127-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-177-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-128-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-178-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-137-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-118-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-144-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-143-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-142-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-140-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-119-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-180-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-183-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-126-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-120-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-117-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-121-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-138-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-122-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-123-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-125-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-141-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-139-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1820-124-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1912-910-0x0000000000000000-mapping.dmp
-
memory/2016-1168-0x0000000000000000-mapping.dmp
-
memory/2016-1467-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2120-1975-0x0000000000000000-mapping.dmp
-
memory/2128-1132-0x0000000000000000-mapping.dmp
-
memory/2136-963-0x0000000000000000-mapping.dmp
-
memory/2136-1106-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2140-2398-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2140-2422-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2144-434-0x0000000000000000-mapping.dmp
-
memory/2156-1706-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2156-1537-0x0000000000000000-mapping.dmp
-
memory/2156-2117-0x0000000000000000-mapping.dmp
-
memory/2168-1122-0x0000000000000000-mapping.dmp
-
memory/2188-1823-0x0000000000000000-mapping.dmp
-
memory/2212-2766-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2304-3141-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2652-1698-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2652-440-0x0000000000000000-mapping.dmp
-
memory/2652-1538-0x0000000000000000-mapping.dmp
-
memory/2664-1175-0x0000000000000000-mapping.dmp
-
memory/2664-1482-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2700-2335-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2704-2778-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2868-2964-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2924-2336-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2924-2119-0x0000000000000000-mapping.dmp
-
memory/2972-2708-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2470-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-3058-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-3009-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-3130-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1285-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-236-0x0000000000000000-mapping.dmp
-
memory/2972-1152-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2031-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1977-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1207-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2921-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2882-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-3161-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2845-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2815-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2404-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2608-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1577-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-3163-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1809-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1347-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-988-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-2738-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/2972-1215-0x00000000098D0000-0x00000000098E0000-memory.dmpFilesize
64KB
-
memory/3008-2961-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3168-3142-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3380-2548-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3408-913-0x0000000000000000-mapping.dmp
-
memory/3472-1195-0x0000000000000000-mapping.dmp
-
memory/3472-1498-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3592-1167-0x0000000000000000-mapping.dmp
-
memory/3592-1466-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3596-914-0x0000000000000000-mapping.dmp
-
memory/3640-2963-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3812-954-0x0000000000000000-mapping.dmp
-
memory/3812-1111-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3816-2761-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3864-806-0x0000000000000000-mapping.dmp
-
memory/3868-1748-0x0000000000000000-mapping.dmp
-
memory/3908-2401-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3908-2428-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4168-1593-0x0000000000000000-mapping.dmp
-
memory/4168-1739-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4184-386-0x0000000000000000-mapping.dmp
-
memory/4188-1514-0x0000000000000000-mapping.dmp
-
memory/4228-946-0x0000000000000000-mapping.dmp
-
memory/4228-1113-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4272-1486-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4272-1178-0x0000000000000000-mapping.dmp
-
memory/4300-1120-0x0000000000000000-mapping.dmp
-
memory/4304-1501-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4304-1187-0x0000000000000000-mapping.dmp
-
memory/4332-1587-0x0000000000000000-mapping.dmp
-
memory/4332-1743-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4340-1502-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4340-1194-0x0000000000000000-mapping.dmp
-
memory/4376-1822-0x0000000000000000-mapping.dmp
-
memory/4380-1125-0x0000000000000000-mapping.dmp
-
memory/4396-619-0x0000000000000000-mapping.dmp
-
memory/4428-1750-0x0000000000000000-mapping.dmp
-
memory/4452-908-0x0000000000000000-mapping.dmp
-
memory/4464-1571-0x0000000000000000-mapping.dmp
-
memory/4520-1136-0x0000000000000000-mapping.dmp
-
memory/4528-1745-0x0000000000000000-mapping.dmp
-
memory/4552-2555-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4564-1970-0x0000000000000000-mapping.dmp
-
memory/4568-1972-0x0000000000000000-mapping.dmp
-
memory/4580-1747-0x0000000000000000-mapping.dmp
-
memory/4584-2118-0x0000000000000000-mapping.dmp
-
memory/4604-1973-0x0000000000000000-mapping.dmp
-
memory/4632-1824-0x0000000000000000-mapping.dmp
-
memory/4632-826-0x0000000000000000-mapping.dmp
-
memory/4648-1825-0x0000000000000000-mapping.dmp
-
memory/4668-1204-0x0000000000000000-mapping.dmp
-
memory/4668-1497-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4772-1826-0x0000000000000000-mapping.dmp
-
memory/4812-3143-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4892-869-0x0000000000000000-mapping.dmp
-
memory/4896-2829-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4900-1519-0x0000000000000000-mapping.dmp
-
memory/4916-1128-0x0000000000000000-mapping.dmp
-
memory/4932-1118-0x0000000000000000-mapping.dmp
-
memory/4952-889-0x0000000000000000-mapping.dmp
-
memory/5080-625-0x0000000000000000-mapping.dmp