Analysis
-
max time kernel
1800s -
max time network
1805s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2022 07:02
Static task
static1
Behavioral task
behavioral1
Sample
DriverPack-17-Online.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
DriverPack-17-Online.exe
Resource
win10-20220718-en
General
-
Target
DriverPack-17-Online.exe
-
Size
8.6MB
-
MD5
b2bd71bc2ca60dc56ce7a249fff69c42
-
SHA1
6b8d4ec65300d9147105d1b72a4731ce68afb9fa
-
SHA256
4f99a508b9a1ee927425cb60dabbef9262afff15f36b8bed21eb02771955a95b
-
SHA512
ce28dad8b6ddf721aa3c894ed78b1da64714ffd39156dbaf79a717065e7f3ec7f1d89d65281a782d32003b9f2db7a059f264d6d8f4173db730f2d1843648cc1d
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
Processes:
mshta.execmd.execmd.execmd.execmd.exeflow pid process 13 2016 mshta.exe 14 2016 mshta.exe 16 2016 mshta.exe 18 2016 mshta.exe 20 2016 mshta.exe 22 2016 mshta.exe 23 2016 mshta.exe 25 2016 mshta.exe 27 2016 mshta.exe 29 2016 mshta.exe 31 2016 mshta.exe 33 2016 mshta.exe 35 2016 mshta.exe 36 2016 mshta.exe 37 2016 mshta.exe 38 2016 mshta.exe 40 2016 mshta.exe 41 2016 mshta.exe 42 2016 mshta.exe 43 2016 mshta.exe 44 2016 mshta.exe 45 2016 mshta.exe 50 3940 cmd.exe 52 2016 mshta.exe 53 2016 mshta.exe 54 2016 mshta.exe 55 2016 mshta.exe 61 4180 cmd.exe 65 2016 mshta.exe 66 2016 mshta.exe 67 2016 mshta.exe 68 2016 mshta.exe 69 2016 mshta.exe 70 2016 mshta.exe 71 2016 mshta.exe 72 2016 mshta.exe 73 2016 mshta.exe 74 2016 mshta.exe 75 2016 mshta.exe 76 2016 mshta.exe 77 2016 mshta.exe 78 2016 mshta.exe 79 2016 mshta.exe 80 2016 mshta.exe 81 2016 mshta.exe 82 2016 mshta.exe 83 2016 mshta.exe 84 2016 mshta.exe 85 2016 mshta.exe 86 2016 mshta.exe 87 2016 mshta.exe 88 2016 mshta.exe 89 2016 mshta.exe 90 2016 mshta.exe 91 2016 mshta.exe 92 5072 cmd.exe 93 5040 cmd.exe 96 2016 mshta.exe 98 2016 mshta.exe 99 2016 mshta.exe 100 2016 mshta.exe 101 2016 mshta.exe 102 2016 mshta.exe 103 2016 mshta.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
driverpack-wget.exedriverpack-wget.execmd.exedriverpack-wget.exearia2c.exedriverpack-wget.exeConhost.exedriverpack-wget.execmd.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.execmd.execmd.exeinstaller.execompact.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.execompact.exedriverpack-wget.exeConhost.execmd.exearia2c.exearia2c.exedriverpack-wget.exeConhost.execmd.exeConhost.exeregsvr32.exedriverpack-wget.execmd.exeregsvr32.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.exeopera.exedriverpack-wget.exedriverpack-wget.exedriverpack-wget.execmd.exedriverpack-wget.exedriverpack-wget.exeopera_autoupdate.exedriverpack-wget.execompact.execompact.exeDriverPack-Alice.exeregedit.execmd.exedriverpack-wget.exeregsvr32.exedriverpack-wget.execompact.execmd.exedriverpack-wget.execmd.exedriverpack-wget.exepid process 4044 driverpack-wget.exe 2660 driverpack-wget.exe 3940 cmd.exe 1328 driverpack-wget.exe 2260 aria2c.exe 2176 driverpack-wget.exe 4132 Conhost.exe 4152 driverpack-wget.exe 4180 cmd.exe 4192 driverpack-wget.exe 4228 driverpack-wget.exe 4264 driverpack-wget.exe 5040 cmd.exe 5072 cmd.exe 5096 installer.exe 4208 compact.exe 3116 driverpack-wget.exe 956 driverpack-wget.exe 4784 driverpack-wget.exe 4676 driverpack-wget.exe 4836 compact.exe 4424 driverpack-wget.exe 4412 Conhost.exe 4248 cmd.exe 4440 aria2c.exe 4428 aria2c.exe 4384 driverpack-wget.exe 4380 Conhost.exe 4252 cmd.exe 5048 Conhost.exe 5092 regsvr32.exe 4176 driverpack-wget.exe 4288 cmd.exe 4328 regsvr32.exe 1384 driverpack-wget.exe 4572 driverpack-wget.exe 4080 driverpack-wget.exe 2228 opera.exe 4652 driverpack-wget.exe 5068 driverpack-wget.exe 4944 driverpack-wget.exe 5108 cmd.exe 2228 opera.exe 4500 driverpack-wget.exe 5112 driverpack-wget.exe 4752 opera_autoupdate.exe 4692 driverpack-wget.exe 1340 compact.exe 368 compact.exe 5096 installer.exe 5048 Conhost.exe 1184 DriverPack-Alice.exe 3684 regedit.exe 3208 cmd.exe 4040 driverpack-wget.exe 4204 regsvr32.exe 396 driverpack-wget.exe 4988 compact.exe 5020 cmd.exe 4312 driverpack-wget.exe 4596 cmd.exe 2260 aria2c.exe 4968 driverpack-wget.exe 3116 driverpack-wget.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 3936 netsh.exe 2260 netsh.exe 4448 netsh.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
regedit.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_4.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_5.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_0.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_7.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_7.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_1.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_6.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_5.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll" regedit.exe -
Processes:
resource yara_rule C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe upx behavioral2/memory/4044-969-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/4044-1096-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2660-1103-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3940-1109-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1328-1114-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/2260-1459-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2176-1461-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4132-1467-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4152-1482-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4180-1491-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4192-1489-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4228-1496-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4264-1487-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe upx behavioral2/memory/5040-1693-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5096-1698-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4208-1699-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5072-1696-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/3116-1863-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/956-1874-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4784-1881-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4836-1977-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4676-2036-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4836-2047-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4384-2360-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4380-2361-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4252-2362-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4384-2411-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4252-2413-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4380-2412-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5092-2578-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4288-2660-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5048-2659-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4328-2662-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4176-2656-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/1384-2681-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4080-2808-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4572-2811-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/2228-2815-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4652-2861-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/4944-2994-0x0000000000400000-0x00000000004EF000-memory.dmp upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
opera.exeopera.exeopera.exeopera.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Control Panel\International\Geo\Nation opera.exe -
Loads dropped DLL 38 IoCs
Processes:
DriverPack-17-Online.exeopera.exeopera.exeopera.exeConhost.exeopera.exeregsvr32.exeDotNetXP.exeopera.exeopera.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.execompact.exeregsvr32.exeregsvr32.exeinstaller.exeinstaller.exeinstaller.exeinstaller.exeinstaller.exepid process 512 DriverPack-17-Online.exe 512 DriverPack-17-Online.exe 512 DriverPack-17-Online.exe 3404 opera.exe 2228 opera.exe 2176 opera.exe 3232 Conhost.exe 1896 opera.exe 4204 regsvr32.exe 1216 DotNetXP.exe 5008 opera.exe 4460 opera.exe 3292 regsvr32.exe 4992 regsvr32.exe 236 regsvr32.exe 576 regsvr32.exe 4912 regsvr32.exe 816 regsvr32.exe 416 regsvr32.exe 5092 regsvr32.exe 416 regsvr32.exe 2980 regsvr32.exe 4696 regsvr32.exe 816 regsvr32.exe 1600 regsvr32.exe 4328 regsvr32.exe 3356 regsvr32.exe 2412 regsvr32.exe 816 regsvr32.exe 4612 regsvr32.exe 5012 compact.exe 3560 regsvr32.exe 4108 regsvr32.exe 1008 installer.exe 5096 installer.exe 4708 installer.exe 4300 installer.exe 5028 installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SearcherBar.exemshta.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run SearcherBar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearcherBar = "\"C:\\Windows\\system32\\mshta.exe\" \"C:\\SearcherBar\\run.hta\"" SearcherBar.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce mshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\DriverPack-Alice = "C:\\Users\\Admin\\AppData\\Roaming\\DRPSu\\Alice\\DriverPackAssistant.exe" mshta.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
mshta.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV mshta.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast mshta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
installer.exeinstaller.execompact.exeOperaXP.execompact.exeinstaller.exedescription ioc process File opened (read-only) \??\D: installer.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\D: compact.exe File opened (read-only) \??\D: OperaXP.exe File opened (read-only) \??\D: compact.exe File opened (read-only) \??\D: installer.exe -
Drops file in System32 directory 64 IoCs
Processes:
compact.execompact.execmd.exeopera_autoupdate.exeinstaller.exedescription ioc process File created C:\Windows\System32\d3dx9_33.dll compact.exe File opened for modification C:\Windows\System32\XAPOFX1_0.dll compact.exe File opened for modification C:\Windows\System32\xinput1_3.dll compact.exe File opened for modification C:\Windows\SysWow64\xactengine2_1.dll compact.exe File created C:\Windows\SysWow64\xactengine2_4.dll compact.exe File opened for modification C:\Windows\SysWOW64\mfc70deu.dll cmd.exe File opened for modification C:\Windows\System32\d3dx10_40.dll compact.exe File created C:\Windows\SysWow64\d3dx10_38.dll compact.exe File opened for modification C:\Windows\SysWow64\D3DX9_41.dll compact.exe File opened for modification C:\Windows\SysWow64\xactengine2_4.dll compact.exe File created C:\Windows\SysWOW64\mfc70.dll cmd.exe File created C:\Windows\SysWOW64\mscomctl.ocx cmd.exe File opened for modification C:\Windows\SysWow64\d3dcsx_43.dll compact.exe File created C:\Windows\SysWow64\xinput1_1.dll compact.exe File opened for modification C:\Windows\SysWOW64\msflxgrd.ocx cmd.exe File created C:\Windows\System32\d3dx9_30.dll compact.exe File created C:\Windows\SysWow64\D3DCompiler_43.dll compact.exe File opened for modification C:\Windows\SysWow64\xactengine2_3.dll compact.exe File created C:\Windows\SysWow64\xactengine2_6.dll compact.exe File opened for modification C:\Windows\SysWow64\XAPOFX1_0.dll compact.exe File opened for modification C:\Windows\SysWOW64\msvcrt10.dll cmd.exe File created C:\Windows\SysWOW64\Vb40032.dll cmd.exe File created C:\Windows\SysWow64\D3DCompiler_34.dll compact.exe File opened for modification C:\Windows\SysWow64\xactengine2_9.dll compact.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content opera_autoupdate.exe File created C:\Windows\SysWOW64\msvbvm50.dll cmd.exe File created C:\Windows\System32\D3DCompiler_43.dll compact.exe File opened for modification C:\Windows\System32\D3DX9_43.dll compact.exe File created C:\Windows\System32\XAPOFX1_5.dll compact.exe File opened for modification C:\Windows\SysWow64\xactengine3_3.dll compact.exe File opened for modification C:\Windows\SysWOW64\comct232.ocx cmd.exe File opened for modification C:\Windows\System32\d3dx9_35.dll compact.exe File opened for modification C:\Windows\System32\xinput1_1.dll compact.exe File opened for modification C:\Windows\SysWow64\d3dx9_27.dll compact.exe File opened for modification C:\Windows\System32\xactengine2_2.dll compact.exe File created C:\Windows\SysWOW64\dblist32.ocx cmd.exe File created C:\Windows\SysWOW64\mfc70deu.dll cmd.exe File opened for modification C:\Windows\System32\D3DCompiler_35.dll compact.exe File created C:\Windows\SysWow64\D3DX9_38.dll compact.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 installer.exe File created C:\Windows\System32\D3DCompiler_35.dll compact.exe File created C:\Windows\System32\xactengine2_6.dll compact.exe File created C:\Windows\System32\xactengine3_1.dll compact.exe File opened for modification C:\Windows\SysWow64\d3dx9_26.dll compact.exe File created C:\Windows\SysWOW64\msvcrt10.dll cmd.exe File opened for modification C:\Windows\SysWOW64\OpenAL32.dll cmd.exe File opened for modification C:\Windows\SysWow64\D3DX9_42.dll compact.exe File created C:\Windows\SysWOW64\mfc70enu.dll cmd.exe File opened for modification C:\Windows\SysWOW64\mscomm32.ocx cmd.exe File opened for modification C:\Windows\System32\d3dx10_34.dll compact.exe File opened for modification C:\Windows\System32\xactengine3_7.dll compact.exe File opened for modification C:\Windows\SysWOW64\msmask32.ocx cmd.exe File opened for modification C:\Windows\SysWOW64\richtx32.ocx cmd.exe File opened for modification C:\Windows\SysWOW64\ssleay32.dll cmd.exe File created C:\Windows\System32\OpenAL32.dll cmd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache opera_autoupdate.exe File created C:\Windows\SysWow64\xactengine3_1.dll compact.exe File opened for modification C:\Windows\SysWOW64\mscomct2.ocx cmd.exe File created C:\Windows\System32\wrap_oal.dll cmd.exe File opened for modification C:\Windows\System32\xinput1_2.dll compact.exe File opened for modification C:\Windows\SysWow64\D3DCompiler_42.dll compact.exe File created C:\Windows\SysWow64\d3dx10_33.dll compact.exe File opened for modification C:\Windows\SysWow64\xactengine2_5.dll compact.exe File created C:\Windows\SysWOW64\MFC71ITA.DLL cmd.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DriverPack-17-Online.exedriverpack-wget.exeinstaller.exearia2c.exeregedit.execompact.execompact.exedriverpack-wget.exedriverpack-wget.exeregsvr32.exedriverpack-wget.exeConhost.exedriverpack-wget.execompact.exedriverpack-wget.execompact.execmd.exedriverpack-wget.exeopera.execompact.exedescription ioc process File created C:\Program Files (x86)\DriverPack\img\loading.gif DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\device-class\phone.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\screens\install-programs-grey.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\FIREFOX_3.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\pt-PT.pak installer.exe File created C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_semibold-webfont.woff DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\assistant-chat\ny-chat-icon.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\installation\banner_catalog-bg-ru.jpg DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\languages\ta.js DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\EXPERT-DRIVERS-2.mp3 aria2c.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-6.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\img\bugreport\BugReport_icon_skip.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\drivers-icon\tire.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\languages\pt-br.js DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-false-positive-13.mp3 regedit.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\opera-touch-left.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\second-browser-tor.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-logo.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\RELIABILITY-3.mp3 compact.exe File opened for modification C:\Program Files (x86)\Opera compact.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\af.pak installer.exe File created C:\Program Files (x86)\DriverPack\img\programs\protector-bg.png DriverPack-17-Online.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\vcruntime140.dll installer.exe File created C:\Program Files (x86)\DriverPack\img\onboarding-new\reliability.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\ISTART_1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-16.mp3 driverpack-wget.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\vccorlib140.dll installer.exe File created C:\Program Files (x86)\DriverPack\img\installation\controls\pause_hover.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\EXPERT-DIAGNOSTICS-1.mp3 regsvr32.exe File created C:\Program Files (x86)\DriverPack\audio\en\EXPERT-SETTINGS-1.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\audio\en\RELIABILITY-1.mp3 Conhost.exe File created C:\Program Files (x86)\DriverPack\img\med_logo.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\device-class\new-ui\printer.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\loading-finish.png DriverPack-17-Online.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico compact.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\fil.pak installer.exe File created C:\Program Files (x86)\DriverPack\img\device-class\new-ui\video.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\screens\language-arrow.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\EXPERT-DIAGNOSTICS-6.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-8.mp3 compact.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-why-free-8.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eot DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\med_logo_ui2.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\installation\drivers\webcamera.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\screens\icon-device-manager.png DriverPack-17-Online.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\localization\sk.pak compact.exe File created C:\Program Files (x86)\Opera\36.0.2130.80\resources\standard_themes\reine.zip compact.exe File created C:\Program Files (x86)\DriverPack\img\final\final_partial-success$2x.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\audio\en\STORIES-why-free-2.mp3 compact.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\ru.pak installer.exe File created C:\Program Files (x86)\Opera\42.0.2393.137\localization\sw.pak installer.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\drivers-icon\file-system.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\screens\reviews-rating-four.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\START-INITIAL-1.mp3 cmd.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-why-free-4.mp3 driverpack-wget.exe File created C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.eot DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\screens\icon-system-restore.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\screens\new-ui-logo2021.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\EXPERT-CONFIGURATOR-3.mp3 opera.exe File created C:\Program Files (x86)\DriverPack\img\charms\gears.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\final\final_success$2x.png DriverPack-17-Online.exe File created C:\Program Files (x86)\DriverPack\img\new-ui-assistant\cursor.png DriverPack-17-Online.exe File opened for modification C:\Program Files (x86)\DriverPack\audio\en\STORIES-technologies-15.mp3 compact.exe File created C:\Program Files (x86)\DriverPack\img\header\new-header-logo.png DriverPack-17-Online.exe -
Drops file in Windows directory 64 IoCs
Processes:
compact.exexcopy.execompact.exedescription ioc process File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35 compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35 compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.xml xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35 compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35 compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.xml xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Diagnostics compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35 compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3D compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35 compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.xml xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35 compact.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35 compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.xml xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.xml xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.xml xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0 xcopy.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectDraw compact.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35 compact.exe File created C:\Windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll compact.exe File created C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\Microsoft.Ink.dll compact.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0 xcopy.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35 compact.exe File created C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.xml xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File created C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\Microsoft.Ink.dll compact.exe File created C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\__AssemblyInfo__.ini compact.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll xcopy.exe File opened for modification C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0 xcopy.exe File opened for modification C:\Windows\SysWow64 compact.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
regsvr32.exeregsvr32.execompact.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\AlternateCLSID = "{D88A442E-9C85-48E3-A6F8-EF61C93989A0}" compact.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\AlternateCLSID = "{8F0F480A-4366-4737-8265-2AD6FDAC8C31}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2B11E9B0-9F09-11D0-9484-00A0C91110ED} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{02A69B00-081B-101B-8933-08002B2F4F5A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{F1651457-356D-4CA2-989D-701606A4C828}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{648A5600-2C6E-101B-82B6-000000000014} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9ED94440-E5E8-101B-B9B5-444553540000} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{02A69B00-081B-101B-8933-08002B2F4F5A}\AlternateCLSID = "{E304B70C-0FCE-4E1B-9C81-CDAAD9F7DA55}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{53749718-F78D-4A67-8703-8AE050075170}\AlternateCLSID = "{25A3C2C9-8F6E-4140-BEF3-535D4B9709D8}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D646316D-0915-421A-84C1-6A21C2495791} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}\AlternateCLSID = "{80B51087-CE4C-4FAE-8401-B6B3809DD234}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6B7E638F-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C1A8AF25-1257-101B-8FB0-0020AF039CA3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D646316D-0915-421A-84C1-6A21C2495791}\AlternateCLSID = "{225957BB-0005-48B9-8BFB-11AEE66779FB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{D3CCB2F7-0D00-4F26-9569-D7C368DE34E2}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\AlternateCLSID = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}\Compatibility Flags = "1024" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{4D588145-A84B-4100-85D7-FD2EA1D19831}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Compatibility Flags = "1024" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{CEDFFAFD-3C2F-4552-9FD3-3DC4299057FD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{E404CD92-E7B8-4037-918D-5A18CFD09ED3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}\AlternateCLSID = "{A57635FC-8D02-4D32-8B6E-4FBD4E2DB8A7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\AlternateCLSID = "{2BEC8FA8-1193-4A15-B8AF-C6DF6E6930C7}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024" regsvr32.exe -
Modifies data under HKEY_USERS 60 IoCs
Processes:
opera_autoupdate.exeinstaller.exeinstaller.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed opera_autoupdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Opera Software\ATTEMPTS = "1" opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" installer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" installer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" installer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Opera Software opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust opera_autoupdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs opera_autoupdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing installer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs opera_autoupdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs opera_autoupdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix installer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache installer.exe -
Modifies registry class 64 IoCs
Processes:
DotNetXP.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregedit.exeinstaller.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregedit.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38911D9C-E448-11D0-84A3-00DD01104159}\ = "BandProperties" DotNetXP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F4DF280-531B-11CF-91F6-C2863C385E30}\ = "IMSFlexGrid" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\5.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\ = "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBCombo.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F65348F7-505D-4FAB-B66C-D76CFFC2BD78}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\E32E2733-1BC5-11d0-B8C3-00A0C90DCA10\ = "kmhfimlflmmfpffmsgfmhmimngtghmoflhsg" regedit.exe Key created \REGISTRY\MACHINE\Software\Classes\OperaStable installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38911D87-E448-11D0-84A3-00DD01104159}\ = "Band" DotNetXP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeaders11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A948063-66C3-4F63-AB46-582EDAA35047}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mscomctl.ocx, 10" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1\CLSID\ = "{F6565773-FA54-45E9-941C-2505E54D5710}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0D2F217-CCB0-11D0-A316-00AA00688B10}\TypeLib\ = "{F0D2F211-CCB0-11D0-A316-00AA00688B10}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D8C1B55B-12DC-457F-97EC-4B84305FAA13}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612685EF-57C8-469F-88AB-E4E0B595C5AB}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\msdatlst.ocx, 2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\ = "IToolbar10" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\ = "ITreeView" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80B51087-CE4C-4FAE-8401-B6B3809DD234}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{603C7E7F-87C2-11D1-8BE3-0000F8754DA1}\ = "DUpDownEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDE57A41-8B86-11D0-B3C6-00A0C90AEA82}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\HELPDIR\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ThreadingModel = "Both" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\CLSID\ = "{7DC6F291-BF55-4E50-B619-EF672D9DCC58}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\ = "Microsoft Hierarchical FlexGrid Control 6.0 (SP6) (OLEDB)" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38911D8A-E448-11D0-84A3-00DD01104159}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" DotNetXP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.oex\ = "OperaStable.Extension" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\comctl32.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\DC4D7920-6AC8-11cf-8ADB-00AA00C00905 regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CEDFFAFD-3C2F-4552-9FD3-3DC4299057FD}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\ = "IListItems" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2BEC8FA8-1193-4A15-B8AF-C6DF6E6930C7}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32\ = "C:\\Windows\\SysWow64\\mscomctl.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{942085FD-8AEE-465F-ADD7-5E7AA28F8C14}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CLSID\ = "{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3} regsvr32.exe -
Processes:
opera_autoupdate.exeopera.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 opera_autoupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a opera.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a opera.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 opera_autoupdate.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 3684 regedit.exe 4664 regedit.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 99 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 103 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 98 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mshta.exepid process 2016 mshta.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
mshta.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: 33 752 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 752 AUDIODG.EXE Token: 33 2016 mshta.exe Token: SeIncBasePriorityPrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe Token: SeShutdownPrivilege 2016 mshta.exe Token: SeCreatePagefilePrivilege 2016 mshta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
DriverPack-17-Online.execmd.exemshta.execmd.execmd.exenet.exenet.execmd.execmd.execmd.exeConhost.exedescription pid process target process PID 512 wrote to memory of 544 512 DriverPack-17-Online.exe cmd.exe PID 512 wrote to memory of 544 512 DriverPack-17-Online.exe cmd.exe PID 512 wrote to memory of 544 512 DriverPack-17-Online.exe cmd.exe PID 544 wrote to memory of 2016 544 cmd.exe mshta.exe PID 544 wrote to memory of 2016 544 cmd.exe mshta.exe PID 544 wrote to memory of 2016 544 cmd.exe mshta.exe PID 2016 wrote to memory of 3140 2016 mshta.exe rundll32.exe PID 2016 wrote to memory of 3140 2016 mshta.exe rundll32.exe PID 2016 wrote to memory of 3140 2016 mshta.exe rundll32.exe PID 2016 wrote to memory of 3204 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 3204 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 3204 2016 mshta.exe cmd.exe PID 3204 wrote to memory of 3936 3204 cmd.exe netsh.exe PID 3204 wrote to memory of 3936 3204 cmd.exe netsh.exe PID 3204 wrote to memory of 3936 3204 cmd.exe netsh.exe PID 2016 wrote to memory of 3372 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 3372 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 3372 2016 mshta.exe cmd.exe PID 3372 wrote to memory of 2260 3372 cmd.exe netsh.exe PID 3372 wrote to memory of 2260 3372 cmd.exe netsh.exe PID 3372 wrote to memory of 2260 3372 cmd.exe netsh.exe PID 2016 wrote to memory of 3984 2016 mshta.exe net.exe PID 2016 wrote to memory of 3984 2016 mshta.exe net.exe PID 2016 wrote to memory of 3984 2016 mshta.exe net.exe PID 3984 wrote to memory of 3140 3984 net.exe net1.exe PID 3984 wrote to memory of 3140 3984 net.exe net1.exe PID 3984 wrote to memory of 3140 3984 net.exe net1.exe PID 2016 wrote to memory of 3536 2016 mshta.exe net.exe PID 2016 wrote to memory of 3536 2016 mshta.exe net.exe PID 2016 wrote to memory of 3536 2016 mshta.exe net.exe PID 2016 wrote to memory of 3312 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 3312 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 3312 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 2836 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 2836 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 2836 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 2720 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 2720 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 2720 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 1508 2016 mshta.exe Conhost.exe PID 2016 wrote to memory of 1508 2016 mshta.exe Conhost.exe PID 2016 wrote to memory of 1508 2016 mshta.exe Conhost.exe PID 3536 wrote to memory of 2132 3536 net.exe net1.exe PID 3536 wrote to memory of 2132 3536 net.exe net1.exe PID 3536 wrote to memory of 2132 3536 net.exe net1.exe PID 2720 wrote to memory of 4044 2720 cmd.exe driverpack-wget.exe PID 2720 wrote to memory of 4044 2720 cmd.exe driverpack-wget.exe PID 2720 wrote to memory of 4044 2720 cmd.exe driverpack-wget.exe PID 3312 wrote to memory of 2660 3312 cmd.exe driverpack-wget.exe PID 3312 wrote to memory of 2660 3312 cmd.exe driverpack-wget.exe PID 3312 wrote to memory of 2660 3312 cmd.exe driverpack-wget.exe PID 2836 wrote to memory of 3940 2836 cmd.exe cmd.exe PID 2836 wrote to memory of 3940 2836 cmd.exe cmd.exe PID 2836 wrote to memory of 3940 2836 cmd.exe cmd.exe PID 1508 wrote to memory of 1328 1508 Conhost.exe driverpack-wget.exe PID 1508 wrote to memory of 1328 1508 Conhost.exe driverpack-wget.exe PID 1508 wrote to memory of 1328 1508 Conhost.exe driverpack-wget.exe PID 2016 wrote to memory of 760 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 760 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 760 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 1188 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 1188 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 1188 2016 mshta.exe cmd.exe PID 2016 wrote to memory of 748 2016 mshta.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\DriverPack\start.bat" "DriverPack-17-Online.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DriverPack\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx "DriverPack-17-Online.exe"3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_93691.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="DriverPack aria2c.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_94505.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start wscsvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start wscsvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31379.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_31379.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31379.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89190.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_89190.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89190.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87638.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_87638.txt""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87638.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83359.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83359.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83359.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72743.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72743.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72743.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19578.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19578.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19578.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22561.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_22561.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22561.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95138.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_95138.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95138.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97318.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_97318.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97318.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74447.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74447.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74447.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90280.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_90280.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90280.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43935.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43935.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43935.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20602.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_20602.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20602.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47623.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47623.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47623.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47091.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47091.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47091.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60810.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_60810.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60810.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79764.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_79764.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_79764.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72440.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72440.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72440.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_53543.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_53543.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_53543.log"5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32 kernel32,Sleep4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8338.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_8338.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8338.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28277.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_28277.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28277.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/DirectX.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_61302.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/DirectX.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_18409.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_37757.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_47145.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_30096.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42918.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42918.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42918.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97406.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_97406.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97406.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1833.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1833.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1833.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25836.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_25836.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25836.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80546.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_80546.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80546.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42995.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42995.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42995.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10945.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_10945.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10945.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2557.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_2557.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2557.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6472.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_6472.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_6472.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4955.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_4955.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4955.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35133.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35133.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35133.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24641.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24641.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24641.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69614.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69614.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69614.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77716.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_77716.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77716.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8766.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_8766.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8766.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29056.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_29056.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29056.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84394.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84394.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84394.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72303.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_72303.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72303.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_45087.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_45087.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_45087.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_81299.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_81299.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_81299.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83525.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83525.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83525.log"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73935.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73935.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73935.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10382.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_10382.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10382.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98755.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_98755.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98755.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42063.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42063.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42063.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3195.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3195.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3195.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93994.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93994.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93994.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13561.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13561.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13561.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33080.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_33080.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33080.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18378.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18378.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18378.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14481.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_14481.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_14481.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35469.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35469.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35469.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97089.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_97089.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97089.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21600.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21600.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21600.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43398.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43398.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43398.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29008.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_29008.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29008.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93536.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93536.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93536.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15535.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_15535.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_15535.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78579.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_78579.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78579.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10283.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_10283.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_10283.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44008.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44008.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/UTILS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44008.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93474.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93474.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93474.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96191.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96191.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96191.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49654.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49654.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/RELIABILITY-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49654.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18162.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18162.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18162.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43703.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43703.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CHECKING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43703.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58113.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58113.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58113.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1847.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1847.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REVIEWS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1847.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-all-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3430.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3430.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-all-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3430.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25696.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_25696.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25696.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46581.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_46581.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46581.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47212.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47212.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47212.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36439.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_36439.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36439.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19586.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19586.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19586.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/RuntimePack.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_53468.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/RuntimePack.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_71995.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DriverPack-Alice.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5524.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_5524.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5524.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63771.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63771.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63771.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43523.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43523.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43523.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63008.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63008.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-adout-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63008.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe" /S || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_88608.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\SearcherBar.exe" /S5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_21644.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=15⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 --crash-reporter-parent-id=1646⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" --backend --silent --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=164 --crash-reporter-pid=0 --wait-for-package="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220812090903" --initial-proc-handle=C00200006⤵
- Enumerates connected drives
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" --backend --silent --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=164 --crash-reporter-pid=0 --wait-for-package="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220812090903" --initial-proc-handle=C0020000 --crash-reporter-parent-id=44687⤵
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220812090903\installer.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220812090903\installer.exe" --backend --silent --initial-pid=164 --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --crash-reporter-pid=07⤵
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220812090903\installer.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20220812090903\installer.exe" --backend --silent --initial-pid=164 --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --crash-reporter-pid=0 --crash-reporter-parent-id=42168⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe"8⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --ran-launcher9⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe" --ran-launcher --crash-reporter-parent-id=340410⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3404.1.1559260102\1158588518"10⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3404.2.1134537950\1709019273"10⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3404.3.1047055198\1891645449"10⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host=https://autoupdate.geo.opera.com/ --pipeid=oauc_pipedbff851fa759ccb33e726f883720ae50 --version=36.0.2130.80 --edition --lang=en-US --producttype --requesttype=start --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --installationdatadir="C:\Program Files (x86)\Opera" --firstrunver=36.0.2130.80 --firstrunts=1660295422 --currentstats="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp3404.4.270238457"10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=utility --channel="3404.5.956656711\2002152796" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --ignored=" --type=renderer "10⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --enable-features=DownloadResumption --lang=en-US --disable-client-side-phishing-detection --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-and-features=off --with-feature:installer-pref-default-overrides-support=on --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3404.6.860438926\320864727"10⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host=https://autoupdate.geo.opera.com/ --pipeid=oauc_pipedbff851fa759ccb33e726f883720ae50 --version=36.0.2130.80 --edition --lang=en-US --producttype --requesttype=shutdown --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" --installationdatadir="C:\Program Files (x86)\Opera" --firstrunver=36.0.2130.80 --firstrunts=1660295422 --currentstats="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\ssdfp3404.7.1265947573"10⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --start-maximized8⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera.exe" --start-maximized --ran-launcher9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_crashreporter.exe" --start-maximized --ran-launcher --crash-reporter-parent-id=222810⤵
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe" --version6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/DotNetXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_32079.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\aria2c.exe"tools\aria2c.exe" "http://dl.driverpack.io/soft/DotNetXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=1205⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28789.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_28789.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_28789.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71981.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_71981.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71981.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40272.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_40272.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40272.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96859.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96859.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96859.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93928.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93928.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93928.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-16.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83978.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83978.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-16.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83978.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-18.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_88009.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_88009.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-18.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_88009.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-17.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74177.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74177.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-17.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74177.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37400.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_37400.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37400.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23877.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_23877.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23877.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe" /S || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_73042.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\Chrone.exe" /S5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_47687.txt""4⤵
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\set_x64.cmd" "6⤵
-
C:\Windows\system32\xcopy.exexcopy x64\GAC C:\Windows\assembly\GAC /s /e /i /y7⤵
-
C:\Windows\system32\xcopy.exexcopy x64\Microsoft.NET C:\Windows\Microsoft.NET /s /e /i /y7⤵
- Drops file in Windows directory
-
C:\Windows\system32\xcopy.exexcopy x64\System32 C:\Windows\System32 /s /e /i /y7⤵
-
C:\Windows\system32\xcopy.exexcopy x64\SysWow64 C:\Windows\SysWow64 /s /e /i /y7⤵
-
C:\Windows\regedit.exeregedit /s x64\64bit.reg7⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98966.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_98966.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98966.log"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_12267.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_12267.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_12267.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40506.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_40506.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40506.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84878.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_84878.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_84878.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80280.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_80280.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80280.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_32313.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_32313.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_32313.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44709.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44709.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44709.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66067.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_66067.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-technologies-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66067.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe" -s || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_62598.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe" -s5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\install.cmd" -s "6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comct232.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comct332.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comctl32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\comdlg32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\dblist32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mci32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomct2.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomctl.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mscomm32.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msdatgrd.ocx"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msdatlst.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msflxgrd.ocx"7⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mshflxgd.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msinet.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msmask32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msstdfmt.dll"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msstkprp.dll"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\mswinsck.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\picclp32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\richtx32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\sysinfo.ocx"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\tabctl32.ocx"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /S "C:\Windows\System32\msvbvm50.dll"7⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s VBA60_OCX_License.reg7⤵
- Modifies registry class
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\libcrypto-1_1-x64.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\libssl-1_1-x64.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\OpenAL32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\Sysnative\wrap_oal.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\atl70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\atl71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comct232.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comct332.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comctl32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\comdlg32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\dblist32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libcrypto-1_1.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libeay32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\libssl-1_1.dll"7⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mci32.ocx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70.dll"7⤵
- Enumerates connected drives
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70chs.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70cht.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70deu.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70enu.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70esp.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70fra.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70ita.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70jpn.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70kor.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mfc70u.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71CHS.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71CHT.DLL"7⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71DEU.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ENU.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ESP.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71FRA.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71ITA.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71JPN.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71KOR.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MFC71u.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomct2.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomctl.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mscomm32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msdatgrd.ocx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msdatlst.ocx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msflxgrd.ocx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MShflxgd.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msinet.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msmask32.ocx"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msstdfmt.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MSSTKPRP.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvbvm50.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvci70.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\MSVCP70.DLL"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcp71.dll"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcr70.dll"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcr71.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\msvcrt10.dll"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\mswinsck.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\OpenAL32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\picclp32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\richtx32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\ssleay32.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\sysinfo.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\tabctl32.ocx"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vb40032.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\wrap_oal.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vb40016.dll"7⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\vbrun100.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\vbrun200.dll"7⤵
-
C:\Windows\SysWOW64\compact.execompact.exe /i /c /a /f /EXE:LZX "C:\Windows\System32\Vbrun300.dll"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59279.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_59279.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_59279.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37118.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_37118.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37118.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27163.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27163.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27163.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16507.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_16507.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16507.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38744.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_38744.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38744.log"5⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="DriverPack-Alice" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\DRPSu\Alice\cloud.exe"4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70664.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_70664.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-15.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70664.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37122.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_37122.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-11.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_37122.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36537.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_36537.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_36537.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86960.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_86960.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-14.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86960.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16892.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_16892.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16892.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19348.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19348.txt""4⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19348.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23724.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_23724.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23724.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50717.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_50717.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-why-free-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50717.log"5⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38209.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_38209.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38209.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26937.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_26937.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26937.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11794.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_11794.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11794.log"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17939.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17939.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17939.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21538.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21538.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21538.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35104.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35104.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-13.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35104.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_19247.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe"C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\DotNetXP.exe"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\TEMP\NET\WinPKG.exeC:\Windows\TEMP\NET\WinPKG.exe6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17006.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17006.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-8.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17006.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21628.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21628.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-9.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21628.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38680.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_38680.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-10.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38680.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_68821.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_68821.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-12.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_68821.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58013.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58013.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58013.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11777.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_11777.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-false-positive-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11777.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27615.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27615.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27615.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82743.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_82743.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82743.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51360.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_51360.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Loads dropped DLL
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51360.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83196.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83196.txt""4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83196.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13504.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13504.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13504.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69837.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69837.txt""4⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-drivers-7.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69837.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73178.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73178.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73178.log"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48346.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_48346.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48346.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50498.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_50498.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50498.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_30637.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_30637.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_30637.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66012.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_66012.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66012.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98216.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_98216.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/STORIES-vpn-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98216.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REBOOT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25989.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_25989.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/REBOOT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25989.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46035.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_46035.txt""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_46035.log"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58512.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58512.txt""4⤵
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe"tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FINAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58512.log"5⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --scheduledautoupdate --autoupdaterequesttype=start1⤵
-
C:\Windows\TEMP\opera autoupdate\installer.exe"C:\Windows\TEMP\opera autoupdate\installer.exe" --version2⤵
-
C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe"C:\Program Files (x86)\Opera\36.0.2130.80\opera_autoupdate.exe" --host --pipeid=oauc_task_pipee59e7323ed1cebd78082538c8b9cbe70 --version=36.0.2130.80 --lang=en --producttype --requesttype=start --downloaddir="C:\Windows\TEMP\opera autoupdate" --operadir="C:\Program Files (x86)\Opera\36.0.2130.80" --installdir="C:\Program Files (x86)\Opera" --profile="C:\Windows\TEMP\opera autoupdate" --nometrics --scheduledtask2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\1188_10875\Opera_42.0.2393.137_Autoupdate.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\1188_10875\Opera_42.0.2393.137_Autoupdate.exe"3⤵
-
C:\Program Files (x86)\Opera\launcher.exe"C:\Program Files (x86)\Opera\launcher.exe" --forcedcheckforupdates="C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera"3⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe" --internalversion4⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\ready\launcher.exe" --stream4⤵
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --install --silent --autoupdate --installfolder --installfolder="C:\Program Files (x86)\Opera" --launchopera=04⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --install --silent --autoupdate --installfolder --installfolder="C:\Program Files (x86)\Opera" --launchopera=0 --crash-reporter-parent-id=10085⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\TEMP\Opera Installer\installer.exe"C:\Windows\TEMP\Opera Installer\installer.exe" --version5⤵
- Loads dropped DLL
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --backend --silent --install --autoupdate --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=0 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --replace32bitwith64bit=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=0 --server-tracking-data=server_tracking_data --initial-pid=1008 --crash-reporter-pid=5096 --wait-for-package="C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing" --initial-proc-handle=E40400005⤵
- Loads dropped DLL
- Enumerates connected drives
-
C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe"C:\Windows\TEMP\opera autoupdate\CProgram Files (x86)Opera\installing\installer.exe" --backend --silent --initial-pid=1008 --install --autoupdate --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=0 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --replace32bitwith64bit=0 --setdefaultbrowser=0 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=0 --server-tracking-data=server_tracking_data --crash-reporter-pid=50966⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\DriverPack\DriverPackSolution.htmlFilesize
4KB
MD5203ac1542d8e93edbbc80f7b59db5c44
SHA1ba66db0e746bc550ea860f4023c3cb5c72140ba5
SHA2568892e63141854bcf4bb1452abef68dd2c348c59322d697ef11a7ab7c5e3c4aea
SHA51253cb5ad72c66e62d9285c318b606a9819053de729fa18ea72e80a7f09b333cc7868b455048660397086fa80a13ca745e42a6dc22df63d059076befca178a8a95
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Program Files (x86)\DriverPack\config.jsFilesize
3KB
MD531009d2efb710925bf7f308af59c629b
SHA15215c77b1719d0974dc529b523b758ef85dbebd4
SHA25618f86ef3fad86c97d56274e5577b178a77f40587a80451a971013248e37190a6
SHA51244129d626970c101df41a0bc94ff6120a1034077628da968d9c772fa6125d1f11478480cec7086dfd1625c8fc07820202a711a5598ea131b7742b31211a3f394
-
C:\Program Files (x86)\DriverPack\css\custom-control.cssFilesize
10KB
MD5f7f8703ada2176dc144343a2c2acb1cd
SHA1091334a48056a8baafff0cd672232de1c1f6c838
SHA2567d7853e95258a7a3f8eaf41795f7124e7d2dacdeb5f1efe212b3ff7ed0da9e50
SHA51227d46472c06103e0bdd9d40149804c16f469305752c3a6d8473c2f2ab22b2c8fa5d65d61dda7c617a3f12d8526b56a10320b8683f31d210ac2185fd0daed8e97
-
C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.eotFilesize
7KB
MD5d85a00ccb58d531afd9ad80a067fbf0e
SHA10a3c0cfea5b9c0fdd5f17a1df49cb1512316330d
SHA2560a04d85875091cc334f63b90c8ccfa0838f20023945d949296363369066870e3
SHA512bce1796d0c71291cb779e2e99399a213b030663d5968330932b4a059ba48f3679e2df9e9c84201efb090a44b499bc5f46d174ad40b4b1d3afb5df5d2f3299261
-
C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-regular-webfont.eotFilesize
40KB
MD588a9c629f26f8563a72eac95cb0744bc
SHA1484bca13532678133dc14a668c580be2c1346526
SHA2563ae576bfa96d7cf6614c8c97290c7abe03191a8ceb0c837a21e7ffe70d66ca62
SHA512b4cdaa3a5a46ef368e9138c9874aa1173b466bc660d5bbbd13fc3f10f509cda9af151a2667ecd079935d60992b1436f6d5843ced5a063769e19e67f84c402af9
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.eotFilesize
141KB
MD5be0e58130a84b19c8523345478a0bd3f
SHA135dfea056f715d8191f2647e56c214afaf819eec
SHA2561c3a470bf710204b1dbd65679b914af4b94e7f018b1f7df3d61ff863d6f335d9
SHA512c0ca4a33842d69fad8f1795864c9b592d2cedd62b14efeb46676823460ea50693ccc884891d16f4ba1ffdd5e0a80f9d06fd6e65fe184f3ea283ff441e7b874c6
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.woffFilesize
57KB
MD5a3932b53cb250b684b63d1e04af5603e
SHA1b06c657df6b320b915a17455848e66695a9fc68e
SHA2562a8f208d9d8556ff58da8a420316de6d634a568a0eeb94c043430659fff7d338
SHA512e8e68301dde147b7c79e21689066b7c9653a82f9898c2c76f4060af1a48c7f997f4797de5002e870e9ffba05efcb47f10cae5b8beadbe7909a85de4c04c54730
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_light-webfont.eotFilesize
61KB
MD5ee9163c34f600221169f8ff531e97182
SHA157f0b2c837c94f2a0df47ee62b4639fd6426bfa0
SHA25653f30a622db68cebe92dbd384cc292aef13ad7e3349a10a77c29326e10634c21
SHA512d51e2a5f6df706eaa2c5ffa071a9a9c08e58a30b4af64a1ccbe81f8e9c38f20429df665cabaf295129490afc639b7e19c0fced428610a284a17899c3290904cb
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_regular-webfont.eotFilesize
64KB
MD5e5835857d5dddda8d5f0725a386a2d0e
SHA14c92001174816e973c374986e52af2428af2f6b6
SHA256750e86dc4965d1d63216327777239692fcaf377106e0ed9e3b1e73e7eb89b2a8
SHA5124eee43c691475031bc219bd6bd7001128b62a22b69b89e7668434318b72db61942a58ee85ab49f4864abebeb451b68145543325f1d42840dae7f90b7ea363dd9
-
C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eotFilesize
65KB
MD5044aa0b596161750cb58aca15c52cf38
SHA1d40e645b34188a54d909fa40f7eddeefb8b9df03
SHA256790579e11608136663d073bc6f99848c04b4dcd69216df7daf5be00df573a3fd
SHA5121a3b3abc614a7ddf673e34a936de63809f8c18a86409364b2bbdeb608fbcd845095ba7cfb34a0826e2ac18cfc5ccd4d47d4bfa13fae3caba7fbc4470d36c8086
-
C:\Program Files (x86)\DriverPack\css\icons-checkbox.cssFilesize
444B
MD53be98220035017d9b818f3cc94f87587
SHA1bc07f11d0a59f942ac942dba02214a7041ad6e3a
SHA256cb134dcb95a407795c671a512c389894d3525fba3f6a2168fc5b9b7e875e78dc
SHA512d2e7d57cb7b7e771c82c75a04fbfb86ebecbb409ecf2c5666aeaa99695474a7985e3367f6a5b3d4ac59f775f60fb084efa9bdda99ce3c077df2690a5f0a6b1d1
-
C:\Program Files (x86)\DriverPack\css\icons.cssFilesize
509B
MD5ebae852f3327fdaf3e2fc2bf1cdecb8f
SHA1f9753fe176069974fc9bce49eae877745282e183
SHA256b5f111103f7f090c246a223b1ff497b94c4dd3ac64bf5b3fb2d91555fcfd6f2c
SHA512bf8e7c5db7a1eacd4344d5facfee1cd66e883389b53bc28e4e387cdb67ea40ee26266ba4282e50eb50a7bc3c810d9fdbb50792a46135761b2e8ce52ddc9e394a
-
C:\Program Files (x86)\DriverPack\css\normalize.min.cssFilesize
1KB
MD5e8908cf9cb9504b285327d240187f53b
SHA120eadf1695eb38bcd92d1706de5335db61b96502
SHA25686235e2c477078adfe1188d07ca1e5d8198443aaf2436de1785a169f3e1d5463
SHA5129c828e8942d40da89f33d1db459a7fc12621660331bef307df8649e89758e76b044bf97a2cd36d656915e19a8b04f571cdb61d7cb6f926a3ba151ee67bbcdc4b
-
C:\Program Files (x86)\DriverPack\css\open-sans.cssFilesize
1KB
MD59ed298542b45ef98492e159f68e89f48
SHA1c4521d9a5dff8a71804c40a909378e8eb5bd66c2
SHA256b9bd51ae6ccc7df20417e0ef341295b86bf8f74f6e235ee99ddefd675806f47f
SHA5121c7d5b378d6c627fbbef864035b157c3e7647b699a50d64f6ebf22faac38bf774e0c025bc8dd4ecc9bde7b377b729bc89bf6fbac4d2409240e2d03753cfe680e
-
C:\Program Files (x86)\DriverPack\css\proximanova.cssFilesize
2KB
MD5487b553f5f73b30b8d565df02b4103cc
SHA16defcf202ce7a04f2bea8aaac8bb01ed44407fa5
SHA256931071422410d73d9d7d3583745e476eac23c0cac5fbe344f8436499ee40ac46
SHA5125a94da5d685f6e74f6576c179b8b65b719727163afebf24557b5f23718a8c034f5e2782ff33021c4d029abaa7cdf464ad0a49cce0602b31191b3b6b642bda9ce
-
C:\Program Files (x86)\DriverPack\css\roboto.cssFilesize
1001B
MD5f5f5b5e4955262430e7b496247425d2d
SHA1d4bea186a0d525ce3060e8dd7901311ae4a0735a
SHA2562537efe2fb974f58cddbc99abfcd7aed6e9df81992eed3e528b5f1748167b8fa
SHA51216a7ec3d95ed773a0a1ce2c2dc4430677106f0d1042e34cb39ed48f4a495f637ec3eefad05a4ebbddbea71a67e933fa0b56e6beef69700c6e3ac9cda9c17e7ca
-
C:\Program Files (x86)\DriverPack\css\style.cssFilesize
14KB
MD52f4fe7647aa460b8984556a25a74c234
SHA18fb2a5135e61a034ecdfef279e92078a7b463123
SHA2563f8ec31a3c08de6c1aac117347b1b83f391bb0a91c9dbdc57ba9d11d5ba372d5
SHA512bad4c1419e302f8e5a84c28fb0862dc56167a7353cc5420d8226883203fe03eca7ec8a9f554cfee560523e9ef292cc38200bce6015c80a428ce4c05222be3a58
-
C:\Program Files (x86)\DriverPack\drp.cssFilesize
190KB
MD55fdaf0fd106200153f8243ebb8bc6b18
SHA14b9524224954987a07fe1ce5f6f6e83becd5a20b
SHA256439bfd8bf9f9176c1757ba277850525f0abec59bb3ef7cd8a974a5ad1d2b3004
SHA5121db1cfcd7e8188594d5b136a479a29797ce1382c471bdd592f7f44f1026e5da845d231eeb09aa6b1b0d36ac2329b3277ee69c9e53049f2726df936a50b898228
-
C:\Program Files (x86)\DriverPack\drp.jsFilesize
3.7MB
MD50f62a60e249a6f77428cba73ee22780b
SHA15ce7ef0d538bce26d250d427d17cdedefcad1904
SHA25606643527422e7f6e3fc094f2314488cb8758bff19f677499d27a4289eb15627e
SHA51207b6cf625640a9765d28a386a16dc5f3ad7bc8d3baa9756b9869240c60d566bb3e273bdbdc547863bb86bfadf490bc04ae92739e9b59da2062eb05e51a2243ef
-
C:\Program Files (x86)\DriverPack\img\assistant-faces\chat\5.pngFilesize
70KB
MD51cdf86375475f5fedc439494f3bbb40e
SHA1f117db3ba1d17e18a9002b6dd60c68b7d270f8e3
SHA2569c6444e7cb0412dc06f66b46ad31b3cf464d7029acf942ee3e8136f891941430
SHA51222f9f6ad980e4107098bab58a877a26765f490bb4291113512def54c53923882b6f9147cdc48df3c1c1dafa70b0df887345742320b54c7f242768fb7b051ecd7
-
C:\Program Files (x86)\DriverPack\img\assistant-faces\start-screen\5.pngFilesize
75KB
MD540353d51881300e6cea13d94ae01b756
SHA15718f730dcb3349ad6d23972657962663fb38fc1
SHA256ad615ef1f7016826d475fe90b4363cc149b060de2b9406b4c58cb4a4f1938bef
SHA5128bc29ecdce2d5f558dd31a1e2424cd1ca94f72e36ea72a491cbcd46f52762f1f44106c749bcb41e6fecd87f9cba2bf6898dbc022a5c46f2ae15aafda3ac3c734
-
C:\Program Files (x86)\DriverPack\img\header\new-header-logo.pngFilesize
4KB
MD510eb51f76f3df7a82b05ed747e27c6a7
SHA1157e45f82ba308431cecede2d753d775b54e83c8
SHA25698856383428042c14739159f4a62168e9394f774bf2b696d62f46d70fc2ba175
SHA512c497fad9597c699a7c6355a5aee999d8e240b1bcfbc39031f0c8b50bdb53f30f7fd43451ba3ea6b99e3fc414bfdd5dae11a499cc9585322b039e6ef87bc31917
-
C:\Program Files (x86)\DriverPack\img\installation-loader.gifFilesize
32KB
MD5753622cdb83a6a695b5e98d7410a3072
SHA1aa08f1e0ffeea39d3279d5fc8c0f490458b4966a
SHA25630f1b256b3c6f1b99a240ef7054cc5894aa19f1cd5aae2b977fc5beb9923b556
SHA512849a4f08728901d4cd907b06b043e250e8166af09f343df3b127302eb5a66ebd4d127384c87d3b18efd27fc964f92e4d2fc9e928f69c40a96dc6cf9e8071ff33
-
C:\Program Files (x86)\DriverPack\img\new-ui-assistant\arrow-recommend.pngFilesize
1KB
MD5a2b5d78a49f66313a203f666faa64393
SHA199c22fd6116d69cd2d21aba072f050b5d8f51006
SHA256fd42158b4e01b5c86360c9450e9e3db5e399e0eadb28e5420ac69f7da1dc0fc5
SHA51203a7abce1b4c2bf82f40ba9af1f25022bc20aaddd745b08fada7ac01dffaab05697880f080d38b4672905aad2d0bed319a83e13c3d247b3900673e76fab8cadc
-
C:\Program Files (x86)\DriverPack\img\new-ui-assistant\icon-footer-splite.pngFilesize
4KB
MD59d355f967c8a9312dc7453f97af3d393
SHA128dec943e5cbbb56f9676e9f420b0b7742bc861a
SHA2565e45160ca10f9237661f7c76880f1fed2dc5d2e147061daeeac7080df1502774
SHA512d42b873275465473ef4539b83a7f9b6807a9dae24a35b47ab47840733e00ca7ff4ebe7cfbc297162bd8d78c2b7a63fd4dea01f05e076d7b6637517ed49060696
-
C:\Program Files (x86)\DriverPack\img\onboarding-new\continuous.pngFilesize
35KB
MD5306c9eeed47ce489282cc4189ccd25a6
SHA1ac811a1c2eb151eee644e11dd5a97e4bf95ec5ce
SHA256c5d7aca39bd800c99281f9ae48f9b0e5421da18e3261eced170a46a9dca56016
SHA512334b446717c4b193b14df72daa22305a88adee5c0035047443663cd93cc1eafd5fd7183aba2c50ab0fde77ae1cef471dcd6909f317655e7d2fb466153d701a96
-
C:\Program Files (x86)\DriverPack\img\screens\arrow-top.pngFilesize
2KB
MD5c88c78c9dcf11880a801e44e705f9708
SHA17b98255e87f81c3a655d375f112c188d9bd241a7
SHA2564f2785a950320440acd22fcc0274944b971d5975de008f69bf81d19d44842925
SHA512ea1fd00c23c7abdcdcecfce5d93b1946763043bc18cb17846ab3ecb607f19a7ede63ca5308cae6e2395053b223a4e438111cb6170264cc42c817130bd178ff4e
-
C:\Program Files (x86)\DriverPack\img\screens\new-ui-logo2021.pngFilesize
5KB
MD5ed623a69120325b464bc149ba5829465
SHA117ba0cbe9a7297824d8792becae98d8853c56af6
SHA256a11af07103005c27c0a5f721d99482e4700c21c85afcbc8e44e4e785af5fa902
SHA512fc18cde812cd2ac9e8f835971f4226092213737220e70e095bc5186042c061bf335501b098966c34a8c55610afea626061856740532166ea26c71c018b6059e7
-
C:\Program Files (x86)\DriverPack\languages\en.jsFilesize
86KB
MD57507c4174ced52a6c0e1b2bb12ce9f3e
SHA16bad4ef261e7b7ab1a02d46341bd1f8a922987da
SHA256a3df7c1b150504fb96555d8d7f7b9c4129a3225ba241da983d56a9c7a1404aec
SHA512d13d045bd66bbf104ec533903e4b7bb76dd56f6a1c8346787f419bf1cd0eafc082e757e0c244024d778755c4ab4468da455f2f92fad7f5fdb7a0135c9c6e26cf
-
C:\Program Files (x86)\DriverPack\run.htaFilesize
2KB
MD56bcab16cd99663b1093d10f827ca0323
SHA147b2d7f33da12d88095379fc8ea5bb7114ce75e9
SHA25602bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
SHA51267c23c1f3e8023001336ff7fc9c9052220f2ab67df280ef269b0239d67dfc67e6783dda44dec747ba6689c239d7efdb55262d098868e43ab70a055429349210e
-
C:\Program Files (x86)\DriverPack\start.batFilesize
90B
MD5f66f13d4770eb90e6d81222fe3525a3f
SHA1f21bc06a179c108d13c783600b98ea0641076127
SHA25688ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
SHA5123f321a339dee086f474d5ac9e8b247805d070b6c0ab5f9d85c5f1075021a3eb7ae23ab2b577000adc30ad32e66a1e291993f435f8539bb0032a1aca038e1f1b2
-
C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_93691.txtFilesize
9B
MD502466847c63e90c5041b8dd7990dce27
SHA1fdcf71f16e2efcb8815730b4cca5f580b185cf5c
SHA256195418a93d769a17558aa804568eff487979e62d0731aa8c63d8d0ffc1723321
SHA51286b11957db369afa71831c72848b897aafd155887467a377484d0346dcaeaac88476cad2331e34a24e7f8ac3a07335dd1e639ae27bfa0d4491dcc6a48a7e6ff3
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_94505.txtFilesize
9B
MD547a22a7a342fd09177c62fcb8054933c
SHA1d2b7928a34eedb04acc61c3a0e01d3138295e855
SHA25651e6af14fa1e9032300dbf76a85cb8561e523e89c363cec09cdc2128801a191d
SHA512b9ab174618fe617b061e27c8f0d4b7960271952a67245c2ad6155e93e0c08cab696191fbc7069c89f05ff545318f930cbd0dd7dc41b9cca0e7356143d3b47d98
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19578.logFilesize
665B
MD5276b1bd7b6e447185841197cd9a8686b
SHA1a19e2f0bf29e7a845121e62262f11bc06c2fa107
SHA2567790abfe5a9e6d6d47317fba0b0ec25af97db35ee08d9c457dde3cdb873b4078
SHA512294345940775985af6e0428efb439c7b70e8df3146acc1acc1bdee078692e470a50ab6dad8a1aa079187e8c3d6d6a028f32bd7b209428ebc5eac438241036160
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22561.logFilesize
666B
MD55914925856eeaebdc1a4a4cb87d341f4
SHA108d8d06e67f5a931ac926188c88521bd3e42d6c0
SHA256591fc820b8b12c9393fb1d0764edf1eb358906c9d30fe1a2e3112955de8ce81d
SHA51240c33e1cbe6e414a3bc4b7d5628be9005c6144327980fd0cc412bf4050f9add320b78daa594e51fe26a4648cf23b87ae2bb36a6f1e532a2bb0f31fe1093034c2
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31379.logFilesize
644B
MD53c8d8b49c1b2a4720b962519d32db716
SHA14217b21b70f60c757ad164392dc50786ad46507e
SHA256146e2d516ab1d50cbfaa40214bdc13d6fc50862b3d69eb353d21cd3b366e530a
SHA51235177abf09a303a915920c1975b5ce63c0301d4e7a82de41b6a9195c0c0decda39f3ecefbf0dd5fc0a7f1ef4973ab7e8156ce2914bbb3a78a7e796386e17ad66
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43935.logFilesize
676B
MD599dc7cdc41c1aa8669896b71831e6a9a
SHA151c052a07010923f8da1437ea98505842b47d65f
SHA256803b0b3ae0a6facccabb94a33600f361d58480a022ef7f202b9f70eacbe90066
SHA5124a47257a4af2fcf926363db81b61cd4e7b9761a4c198c20744b1911ada29285491458341fee240b6819093075378ce3f15183be939f1f1ba81bef56b524ac879
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_72743.logFilesize
677B
MD563189117a66643b2c7f4641ce3ac608c
SHA13d17a5fbde9ad9cc10cb8706d286d607b30d7c69
SHA256026750bf9a5e46f6849bf8b24da8a01b01b1b5a03a7b2522c2fb3cc80e3d773d
SHA512e865750d86831d7c15b357635821f69f76725935fa71961c2912b5f2f9931ce8f4f9700d4995069fc97df061e5f315acdeb53110ace0185cf8841f29440b2e9a
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74447.logFilesize
742B
MD58c428f46ac9158a98e575f8b47d7ab79
SHA142581a55b52c969312274806cc1e7d3bef82c8b6
SHA2566d68857430fd47090c0db9da8bf10bdc4aeba1ae905680120e2cfb1270fe5417
SHA51278121d0179235a454999fcaed37ad9079fe5218e20480c9186b19472eca6718eb18176663fe39ab25bcd1c533256e71df91b2a13b878c5edda987cf840aa9a61
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83359.logFilesize
668B
MD557dc33e4053f2878369556a26406bc80
SHA1570087be6668029b251313665ecda6bf1ec25424
SHA256c31bf126ab04cf39c57a6b602c158907acf3fdf8284f6725a880b563b3d9e907
SHA512e34606c8d16c1baae500930d2b585ed4d96dc580ecfd311e5c0f438b4d4fdadb17b4b95867308fada2da9f45ba33668204d961e8f979e8eac1cc71acb1a021ac
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87638.logFilesize
674B
MD59c2e01db77a2a35987bef5afcb83f9af
SHA1486b9af36ed1399dcee25931b445a043bb6523cb
SHA256e75d5dcf08f9fecc67fa2277844cc1f19dd0c209525906707cde577bb3808c59
SHA5128623c46cff59a1db1f2477c77d708cfc91257f149b32cc414ed794de8e18431cab25fa4ec525024c44d222943ace10868b1a551a8ed4f18ecf69ea56003da61b
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89190.logFilesize
670B
MD538cb9dd43201301420d6a359f1462483
SHA18fa14b8ddd17cec79f45f57ae737b745b2820ef1
SHA256fb79feba922bea7eb89cb65bb4bec83eb1d3bf4fc264b65b6182f1cc77965edc
SHA51258b0c5a25af57989d4a28cc1f0282cf5131b64135cca83676731b2af8e39b17100f9be7e00c617be959995739cbce8466f155ff21d5f9a7e5f0a8fd1e74a235b
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_90280.logFilesize
678B
MD5df727a29ef35c695f219bb4dcf1203f5
SHA121c853c7c09a818205ea5748b7820003e925bee6
SHA256d5fbdf83fc3bab121c737457697433776eca7ac1ba60519b0058cf7b1f4cfb00
SHA51209adb05fae804519d5f72344ac192bc8147ae0bd8a6da0c07f57c415d6a62e5dfaaed5e11a8ad46f0e00845d960f87936d92892d93591671d6f2c2826f4a7c21
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95138.logFilesize
664B
MD5da8b8c1f821108b4309207b44984b790
SHA18efcbe5a6e9d6183266fadd29b9f2b60d6b53958
SHA2567ffc748e97f3ef3cd0a39cb3a0bdaef2f00c6a0299847683bb344da6561a74c2
SHA512eb5423e803b31e058704e1d949b9e7d66beb3184b917506df8c22b46f6cace919858b6fa7859b9c7d062061eb4f54d425c9b47afdfb963c5254dbfd9990fc27b
-
C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97318.logFilesize
665B
MD530db40afcac682c1654262f46a52d8ac
SHA122116ee663c320e763cc78a89163000ceb7d6310
SHA25674a3c5f3f97a28744b9e2a4606f572349357cba009d77ca474e240d69e4e34c0
SHA5126d890eee2ea52f0545b7f6fc5d87a400e614bf4804e89d24c61aadb277b0f9872eb49fc308993d98216396eb4e33b84738d5237613624a4e82faebb82645d0a1
-
\Users\Admin\AppData\Local\Temp\nsq6374.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
\Users\Admin\AppData\Local\Temp\nsq6374.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
\Users\Admin\AppData\Local\Temp\nsq6374.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
memory/512-180-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-151-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-183-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-140-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-117-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-178-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-141-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-177-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-176-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-175-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-174-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-173-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-170-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-172-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-171-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-169-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-168-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-167-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-166-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-165-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-163-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-162-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-161-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-160-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-159-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-158-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-157-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-156-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-155-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-154-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-153-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-152-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-142-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-118-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-119-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-143-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-120-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-121-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-150-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-122-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-123-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-124-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-125-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-126-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-127-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-128-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-129-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-130-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-149-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-148-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-131-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-132-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-147-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-146-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-181-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-145-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-133-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-134-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-135-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-136-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-137-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-139-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-138-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-144-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/544-184-0x0000000000000000-mapping.dmp
-
memory/748-1123-0x0000000000000000-mapping.dmp
-
memory/760-1119-0x0000000000000000-mapping.dmp
-
memory/956-1874-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/956-1723-0x0000000000000000-mapping.dmp
-
memory/1056-1126-0x0000000000000000-mapping.dmp
-
memory/1164-1144-0x0000000000000000-mapping.dmp
-
memory/1188-1120-0x0000000000000000-mapping.dmp
-
memory/1328-962-0x0000000000000000-mapping.dmp
-
memory/1328-1114-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1384-2681-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1508-896-0x0000000000000000-mapping.dmp
-
memory/1544-1888-0x0000000000000000-mapping.dmp
-
memory/2016-1550-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2822-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1978-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2987-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2434-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-236-0x0000000000000000-mapping.dmp
-
memory/2016-2911-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2538-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1023-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1173-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2870-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-964-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1232-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2562-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2816-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2263-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1754-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1927-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1701-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1499-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2734-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2697-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1889-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-2675-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2016-1602-0x0000000009760000-0x0000000009770000-memory.dmpFilesize
64KB
-
memory/2132-923-0x0000000000000000-mapping.dmp
-
memory/2136-1883-0x0000000000000000-mapping.dmp
-
memory/2176-1461-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2176-1167-0x0000000000000000-mapping.dmp
-
memory/2228-2815-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2260-635-0x0000000000000000-mapping.dmp
-
memory/2260-1459-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2260-1168-0x0000000000000000-mapping.dmp
-
memory/2300-1134-0x0000000000000000-mapping.dmp
-
memory/2488-1139-0x0000000000000000-mapping.dmp
-
memory/2660-930-0x0000000000000000-mapping.dmp
-
memory/2660-1103-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/2720-878-0x0000000000000000-mapping.dmp
-
memory/2736-1704-0x0000000000000000-mapping.dmp
-
memory/2836-877-0x0000000000000000-mapping.dmp
-
memory/2984-1130-0x0000000000000000-mapping.dmp
-
memory/3116-1721-0x0000000000000000-mapping.dmp
-
memory/3116-1863-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3140-836-0x0000000000000000-mapping.dmp
-
memory/3140-387-0x0000000000000000-mapping.dmp
-
memory/3204-397-0x0000000000000000-mapping.dmp
-
memory/3312-874-0x0000000000000000-mapping.dmp
-
memory/3372-629-0x0000000000000000-mapping.dmp
-
memory/3372-1886-0x0000000000000000-mapping.dmp
-
memory/3536-869-0x0000000000000000-mapping.dmp
-
memory/3936-430-0x0000000000000000-mapping.dmp
-
memory/3940-1703-0x0000000000000000-mapping.dmp
-
memory/3940-943-0x0000000000000000-mapping.dmp
-
memory/3940-1109-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/3984-816-0x0000000000000000-mapping.dmp
-
memory/3988-1884-0x0000000000000000-mapping.dmp
-
memory/4044-969-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4044-928-0x0000000000000000-mapping.dmp
-
memory/4044-1096-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4080-2808-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4132-1467-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4132-1180-0x0000000000000000-mapping.dmp
-
memory/4152-1183-0x0000000000000000-mapping.dmp
-
memory/4152-1482-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4176-2656-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4180-1882-0x0000000000000000-mapping.dmp
-
memory/4180-1188-0x0000000000000000-mapping.dmp
-
memory/4180-1491-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4192-1189-0x0000000000000000-mapping.dmp
-
memory/4192-1489-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4208-1699-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4208-1556-0x0000000000000000-mapping.dmp
-
memory/4228-1195-0x0000000000000000-mapping.dmp
-
memory/4228-1496-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4248-2004-0x0000000000000000-mapping.dmp
-
memory/4252-2362-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4252-2413-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4264-1202-0x0000000000000000-mapping.dmp
-
memory/4264-1487-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4288-2660-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4328-2662-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4380-2412-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4380-2361-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4384-2360-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4384-2411-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4412-2002-0x0000000000000000-mapping.dmp
-
memory/4424-2001-0x0000000000000000-mapping.dmp
-
memory/4428-2003-0x0000000000000000-mapping.dmp
-
memory/4440-2005-0x0000000000000000-mapping.dmp
-
memory/4472-1885-0x0000000000000000-mapping.dmp
-
memory/4572-2811-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4588-1706-0x0000000000000000-mapping.dmp
-
memory/4608-1887-0x0000000000000000-mapping.dmp
-
memory/4652-2861-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4676-1925-0x0000000000000000-mapping.dmp
-
memory/4676-2036-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4712-1506-0x0000000000000000-mapping.dmp
-
memory/4744-1507-0x0000000000000000-mapping.dmp
-
memory/4768-1509-0x0000000000000000-mapping.dmp
-
memory/4784-1737-0x0000000000000000-mapping.dmp
-
memory/4784-1881-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4808-1512-0x0000000000000000-mapping.dmp
-
memory/4836-1933-0x0000000000000000-mapping.dmp
-
memory/4836-2047-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4836-1977-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4904-1753-0x0000000000000000-mapping.dmp
-
memory/4944-2994-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5040-1531-0x0000000000000000-mapping.dmp
-
memory/5040-1693-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5048-2659-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5072-1537-0x0000000000000000-mapping.dmp
-
memory/5072-1696-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5092-2578-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5096-1698-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/5096-1539-0x0000000000000000-mapping.dmp