030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3

Analysis

max time kernel
111s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.cmd
Size 86B
Sample260716-w487csft51
SHA256 030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3
MD5 232ebf167ea35163ea69a1570be7b03e
SHA1 b8bc8c8b3f9ebf83ec43244a934389bd98849a0a
SHA512 efe7d716b4c2553b1dc295271b1bb32fccf12e2b64e6de7adbf5f8284bdee1c3a92b5a227c46a6bff6c1298d2e7319b73b7a75651710cad84564f0c4ec4c917f
TLSH
T127A01210003B9930B8650418835A079D080B44611522184C381209520004851C0301C2
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation upx

Malware Config

Signatures

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	1696	mshta.exe
15	1696	mshta.exe
17	1696	mshta.exe
20	1696	mshta.exe
23	1696	mshta.exe
24	1696	mshta.exe
27	1696	mshta.exe
28	1696	mshta.exe
29	1696	mshta.exe
31	1696	mshta.exe
33	1696	mshta.exe
34	1696	mshta.exe
35	1696	mshta.exe
37	1696	mshta.exe
38	1696	mshta.exe
39	1696	mshta.exe
41	1696	mshta.exe
42	1696	mshta.exe
43	1696	mshta.exe
44	1696	mshta.exe
46	1696	mshta.exe
47	1696	mshta.exe
48	1696	mshta.exe
63	1696	mshta.exe
64	1696	mshta.exe
65	1696	mshta.exe
66	1696	mshta.exe
67	1696	mshta.exe
68	1696	mshta.exe
69	1696	mshta.exe
70	1696	mshta.exe
71	1696	mshta.exe
72	1696	mshta.exe
73	1696	mshta.exe
74	1696	mshta.exe
75	1696	mshta.exe
78	1696	mshta.exe
85	1696	mshta.exe
94	1696	mshta.exe
95	1696	mshta.exe
96	1696	mshta.exe
97	1696	mshta.exe
99	1696	mshta.exe
103	1696	mshta.exe
104	1696	mshta.exe
105	1696	mshta.exe
115	1696	mshta.exe
116	1696	mshta.exe
117	1696	mshta.exe
119	1696	mshta.exe
122	1696	mshta.exe
125	1696	mshta.exe
132	1696	mshta.exe
133	1696	mshta.exe
134	1696	mshta.exe
137	1696	mshta.exe
138	1696	mshta.exe
139	1696	mshta.exe
142	1696	mshta.exe
143	1696	mshta.exe
144	1696	mshta.exe
145	1696	mshta.exe
146	1696	mshta.exe
150	1696	mshta.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3080	netsh.exe
4556	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 43 IoCs

pid	Process
3780	driverpack-wget.exe
4916	driverpack-wget.exe
2856	driverpack-wget.exe
2712	driverpack-wget.exe
220	driverpack-wget.exe
4044	driverpack-wget.exe
3672	driverpack-wget.exe
4920	driverpack-wget.exe
4452	driverpack-wget.exe
5020	driverpack-wget.exe
756	driverpack-wget.exe
3364	driverpack-wget.exe
2772	driverpack-wget.exe
3976	driverpack-wget.exe
552	driverpack-wget.exe
3424	driverpack-wget.exe
3728	driverpack-wget.exe
2516	driverpack-wget.exe
1272	driverpack-wget.exe
4992	driverpack-wget.exe
1612	driverpack-wget.exe
640	driverpack-wget.exe
4544	driverpack-wget.exe
1708	driverpack-wget.exe
4872	driverpack-wget.exe
4496	driverpack-wget.exe
4116	driverpack-wget.exe
4768	driverpack-wget.exe
5040	driverpack-wget.exe
1652	driverpack-wget.exe
2020	driverpack-wget.exe
5076	driverpack-wget.exe
4200	driverpack-wget.exe
4972	driverpack-wget.exe
3364	driverpack-wget.exe
1972	driverpack-wget.exe
1664	driverpack-wget.exe
648	driverpack-wget.exe
4816	driverpack-wget.exe
4464	driverpack-wget.exe
1792	driverpack-wget.exe
4980	driverpack-wget.exe
700	driverpack-wget.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/files/0x000700000002476a-1240.dat	upx
behavioral7/memory/3780-1241-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2856-1255-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4916-1270-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3780-1272-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2712-1284-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2856-1278-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/220-1323-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4044-1324-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3672-1325-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4920-1326-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/220-1331-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3672-1357-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3364-1371-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/756-1364-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4452-1356-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4920-1353-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4044-1345-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/5020-1337-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2772-1383-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2772-1406-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/552-1415-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3976-1420-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3424-1423-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3728-1431-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3728-1446-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2516-1450-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1272-1454-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4992-1472-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1612-1478-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/640-1480-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4544-1495-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1708-1501-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/640-1503-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/640-1508-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4872-1510-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4496-1511-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4116-1512-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4116-1533-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4872-1552-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4768-1550-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/5040-1555-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4496-1545-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1652-1563-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1652-1567-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2020-1591-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/5076-1596-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4200-1585-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4972-1602-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4972-1607-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1664-1610-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1972-1609-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1972-1630-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1664-1628-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/3364-1627-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4464-1635-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4816-1634-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4816-1647-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/648-1649-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4464-1653-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/700-1675-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/1792-1673-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/4980-1672-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral7/memory/2076-1696-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverpack-wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1612	driverpack-wget.exe
5020	cmd.exe
1524	cmd.exe
968	cmd.exe
640	driverpack-wget.exe
4116	driverpack-wget.exe
1960	cmd.exe
4040	cmd.exe
3780	driverpack-wget.exe
1600	cmd.exe
1108	cmd.exe
3404	cmd.exe
4212	cmd.exe
3728	driverpack-wget.exe
2020	driverpack-wget.exe
4200	driverpack-wget.exe
228	cmd.exe
700	driverpack-wget.exe
4548	cmd.exe
4452	driverpack-wget.exe
3976	driverpack-wget.exe
3288	cmd.exe
4768	driverpack-wget.exe
1972	driverpack-wget.exe
5096	driverpack-wget.exe
2840	cmd.exe
1172	cmd.exe
4940	cmd.exe
4128	cmd.exe
1396	cmd.exe
2304	cmd.exe
1408	cmd.exe
3064	cmd.exe
1128	cmd.exe
3364	driverpack-wget.exe
1080	cmd.exe
3752	cmd.exe
1792	driverpack-wget.exe
4540	cmd.exe
4180	cmd.exe
2364	driverpack-wget.exe
3924	cmd.exe
5020	driverpack-wget.exe
4728	cmd.exe
1664	driverpack-wget.exe
4816	driverpack-wget.exe
3816	cmd.exe
3504	cmd.exe
4488	driverpack-wget.exe
4920	driverpack-wget.exe
2772	driverpack-wget.exe
4496	driverpack-wget.exe
3364	driverpack-wget.exe
4492	driverpack-wget.exe
2956	cmd.exe
5004	driverpack-wget.exe
1920	driverpack-wget.exe
4792	cmd.exe
4952	cmd.exe
4972	driverpack-wget.exe
592	cmd.exe
1508	cmd.exe
1512	cmd.exe
3824	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1460	aria2c.exe
4452	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{85290FA7-61F0-4380-8BC5-5A6816161EBA}	mshta.exe

Runs net.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	245	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3372	7za.exe
Token: 35	3372	7za.exe
Token: SeSecurityPrivilege	3372	7za.exe
Token: SeSecurityPrivilege	3372	7za.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe
Token: SeShutdownPrivilege	1696	mshta.exe
Token: SeCreatePagefilePrivilege	1696	mshta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3372	4968	cmd.exe	87
PID 4968 wrote to memory of 1696	4968	cmd.exe	88
PID 1696 wrote to memory of 4200	1696	mshta.exe	93
PID 1696 wrote to memory of 888	1696	mshta.exe	94
PID 888 wrote to memory of 3080	888	cmd.exe	96
PID 1696 wrote to memory of 1424	1696	mshta.exe	98
PID 1424 wrote to memory of 4556	1424	cmd.exe	100
PID 1696 wrote to memory of 1128	1696	mshta.exe	102
PID 1696 wrote to memory of 2840	1696	mshta.exe	104
PID 1696 wrote to memory of 1172	1696	mshta.exe	106
PID 1696 wrote to memory of 4084	1696	mshta.exe	108
PID 1128 wrote to memory of 3780	1128	cmd.exe	110
PID 2840 wrote to memory of 4916	2840	cmd.exe	111
PID 1172 wrote to memory of 2856	1172	cmd.exe	112
PID 4084 wrote to memory of 2712	4084	cmd.exe	113
PID 1696 wrote to memory of 2824	1696	mshta.exe	118
PID 1696 wrote to memory of 3552	1696	mshta.exe	120
PID 1696 wrote to memory of 3924	1696	mshta.exe	122
PID 1696 wrote to memory of 4720	1696	mshta.exe	124
PID 1696 wrote to memory of 3312	1696	mshta.exe	126
PID 1696 wrote to memory of 4292	1696	mshta.exe	128
PID 1696 wrote to memory of 852	1696	mshta.exe	130
PID 1696 wrote to memory of 1600	1696	mshta.exe	132
PID 3552 wrote to memory of 220	3552	cmd.exe	134
PID 3924 wrote to memory of 4044	3924	cmd.exe	135
PID 2824 wrote to memory of 3672	2824	cmd.exe	136
PID 3312 wrote to memory of 4920	3312	cmd.exe	137
PID 4720 wrote to memory of 4452	4720	cmd.exe	138
PID 1600 wrote to memory of 5020	1600	cmd.exe	139
PID 4292 wrote to memory of 756	4292	cmd.exe	140
PID 852 wrote to memory of 3364	852	cmd.exe	142
PID 1696 wrote to memory of 1960	1696	mshta.exe	144
PID 1696 wrote to memory of 1016	1696	mshta.exe	146
PID 1696 wrote to memory of 4212	1696	mshta.exe	148
PID 1696 wrote to memory of 4040	1696	mshta.exe	150
PID 1960 wrote to memory of 2772	1960	cmd.exe	152
PID 4040 wrote to memory of 3976	4040	cmd.exe	153
PID 1016 wrote to memory of 552	1016	cmd.exe	154
PID 4212 wrote to memory of 3424	4212	cmd.exe	155
PID 1696 wrote to memory of 4044	1696	mshta.exe	160
PID 1696 wrote to memory of 1108	1696	mshta.exe	162
PID 1696 wrote to memory of 3404	1696	mshta.exe	164
PID 4044 wrote to memory of 3728	4044	cmd.exe	166
PID 3404 wrote to memory of 2516	3404	cmd.exe	167
PID 1108 wrote to memory of 1272	1108	cmd.exe	168
PID 1696 wrote to memory of 1300	1696	mshta.exe	171
PID 1696 wrote to memory of 1512	1696	mshta.exe	173
PID 1300 wrote to memory of 4992	1300	cmd.exe	175
PID 1512 wrote to memory of 1612	1512	cmd.exe	176
PID 1696 wrote to memory of 3824	1696	mshta.exe	178
PID 1696 wrote to memory of 4792	1696	mshta.exe	180
PID 1696 wrote to memory of 4728	1696	mshta.exe	182
PID 3824 wrote to memory of 640	3824	cmd.exe	184
PID 4728 wrote to memory of 4544	4728	cmd.exe	185
PID 4792 wrote to memory of 1708	4792	cmd.exe	186
PID 1696 wrote to memory of 4940	1696	mshta.exe	188
PID 1696 wrote to memory of 1872	1696	mshta.exe	190
PID 1696 wrote to memory of 4128	1696	mshta.exe	192
PID 1696 wrote to memory of 3288	1696	mshta.exe	194
PID 1696 wrote to memory of 2788	1696	mshta.exe	196
PID 4940 wrote to memory of 4872	4940	cmd.exe	198
PID 1872 wrote to memory of 4496	1872	cmd.exe	199
PID 4128 wrote to memory of 4116	4128	cmd.exe	200
PID 3288 wrote to memory of 4768	3288	cmd.exe	201

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.cmd"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\7za.exe
  7za.exe x -y -aoa -pbeetle arc.7z -oext
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\ext\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 kernel32,Sleep
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_86630.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="DriverPack aria2c.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_4447.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89953.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_89953.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89953.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21339.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21339.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21339.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95835.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_95835.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95835.log"
      4⤵
      Executes dropped EXE
      PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9098.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9098.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9098.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97020.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_97020.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97020.log"
      4⤵
      Executes dropped EXE
      PID:3672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56338.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56338.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56338.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24606.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24606.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24606.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71888.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_71888.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71888.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83990.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83990.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83990.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49035.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49035.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49035.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77666.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_77666.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77666.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67359.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_67359.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67359.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92268.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_92268.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92268.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77580.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_77580.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77580.log"
      4⤵
      Executes dropped EXE
      PID:552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78602.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_78602.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78602.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56023.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56023.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56023.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_54837.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_54837.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_54837.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3728
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82444.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_82444.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82444.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80634.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_80634.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80634.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_81074.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_81074.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_81074.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21490.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21490.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21490.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16091.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_16091.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16091.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19773.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19773.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19773.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35334.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35334.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35334.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50440.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_50440.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_50440.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22909.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_22909.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22909.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87366.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_87366.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_87366.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60253.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_60253.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_60253.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3711.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3711.txt""
    3⤵
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3711.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1196.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1196.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1196.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85859.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_85859.txt""
    3⤵
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_85859.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66419.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_66419.txt""
    3⤵
    PID:564
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_66419.log"
      4⤵
      Executes dropped EXE
      PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_12173.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_12173.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_12173.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64037.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64037.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64037.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74376.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74376.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74376.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48632.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_48632.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48632.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48445.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_48445.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48445.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64098.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64098.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64098.log"
      4⤵
      Executes dropped EXE
      PID:648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33451.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_33451.txt""
    3⤵
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33451.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44548.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44548.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44548.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8868.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_8868.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8868.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11102.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_11102.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11102.log"
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34358.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_34358.txt""
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34358.log"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4980
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" start wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43879.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43879.txt""
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43879.log"
      4⤵
      PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74945.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74945.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74945.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58199.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58199.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58199.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1201.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_1201.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_1201.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98884.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_98884.txt""
    3⤵
    PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_98884.log"
      4⤵
      PID:2356
- - C:\Users\Admin\AppData\Local\Temp\ext\Tools\driverpack-7za.exe
    "C:\Users\Admin\AppData\Local\Temp\ext\Tools\driverpack-7za.exe" a "C:\Users\Admin\AppData\Roaming\DRPSu\snapshots\DriverPack_Snapshot_20260716_193202.zip" "C:\Users\Admin\AppData\Roaming\DRPSu\diagnostics\*"
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38051.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_38051.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_38051.log"
      4⤵
      PID:784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4260.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_4260.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4260.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26719.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_26719.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26719.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26900.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_26900.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_26900.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2364
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 kernel32,Sleep
    3⤵
    PID:968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/ab/4/Internet-Start.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_31237.txt""
    3⤵
    - System Time Discovery
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe
      "tools\aria2c.exe" "http://dl.driverpack.io/soft/ab/4/Internet-Start.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
      4⤵
      System Time Discovery
      PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_28272.txt""
    3⤵
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe
      "tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
      4⤵
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaBlink64_win7.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_21009.txt""
    3⤵
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe
      "tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaBlink64_win7.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
      4⤵
      PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_81501.txt""
    3⤵
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe
      "tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
      4⤵
      PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_55438.txt""
    3⤵
    PID:468
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe
      "tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
      4⤵
      PID:4632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63136.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_63136.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:968
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_63136.log"
      4⤵
      PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74914.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_74914.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_74914.log"
      4⤵
      PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5177.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_5177.txt""
    3⤵
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_5177.log"
      4⤵
      PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56728.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56728.txt""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\driverpack-wget.exe
      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56728.log"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_70933.txt""
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\ext\tools\aria2c.exe
      "tools\aria2c.exe" "http://dl.driverpack.io/tools/DriverPack-Alice.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
      4⤵
      PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\installing_14958.txt""
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe
      "C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1
      4⤵
      PID:4492
    - - C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe
        
        "C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" -install -silent -launchopera=1 -setdefaultbrowser=1 --crash-reporter-parent-id=4492
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe" --version
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe
        
        "C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS\OperaXP.exe" --backend --silent --install --import-browser-data=1 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Program Files (x86)\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=1 --setdefaultbrowser=1 --startmenushortcut=1 --desktopshortcut=1 --quicklaunchshortcut=0 --pintotaskbar=1 --server-tracking-data=server_tracking_data --initial-pid=4492 --crash-reporter-pid=2156 --wait-for-package="C:\Users\Admin\AppData\Local\Temp\Opera Installer\opera_installer_20260716193225" --initial-proc-handle=F8020000
        5⤵
        
        PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ANTIVIRUS-1[1].mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\ANTIVIRUS-1[1].mp3
Size 36KB
SHA256 46d1565a9237f7ade1d03a2d70c084f5f688d6a0574220ecc5eb83d5cfd875ed
MD5 7557d8cd4046327c15d600a1d2c94179
SHA1 c5cdb72ff869186fd49bf444b72186d6c64a230c
SHA512 a56981e7b3c9757ff6e11373b5a75e66d70d1f3f5d3539cc647bb229784ba5dc52199eaa4f3f01d9d3fe3ab9730a90fb5e724e3fdfe54bed12e512f76d67a194
SSDEEP 768:Fi2YrUcV2RqhVlhlwK33oNgnGqzhSx8Cm2/bSdDS92IIH:EduqhoKIuzhSx/mB02pH
TLSH
T1B7F2BEFFB2A624F0AB73726DA4DE6245C50A7848B64383DAAC51B31E4453DE1BE0CD4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEAM-PROOF-3[1].mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\TEAM-PROOF-3[1].mp3
Size 17KB
SHA256 91c9b43045e05c5ea9debee09aec46356c9a286369569508181117ac98f6c487
MD5 9935dc6db273291e14ce227eb0542ad9
SHA1 12013732b5d399fa86cff55401345cce39346389
SHA512 37b44a39355a641f3ebcb5cab7dffd03eb67e8c519f384972bd56438ace4065d36c3a26352a9b5065e0365f891dd1a0adc683cc9c0970ff4ce6799feaf3b845d
SSDEEP 384:OjNJcjmOk/ysHjerirOk498vnaNM30XnpFtciSD915I:Oj32mOk/lUCqMkXp3O3I
TLSH
T12F82CF7A792474157F63630E44CE2102D563BAAAB484D2DCFA70A72D9197DC1FF4DC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WAITING-2[1].dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\WAITING-2[1].dat
Size 192KB
SHA256 4bebba087f04d890c8191a8810bf7cbf714c30d590e8861fed90116952414a22
MD5 5bda4fba81ecf48c976be0e82d319acc
SHA1 51b2729b1fe082eceae82377652a1ab0113231be
SHA512 f718eb60b6617310b33e35f362318f82cf2e93befbe733d10a6983427ad5c84643db43a524a68baed381d60668c93bef74893b72e61f465c670a297f18dcae4c
SSDEEP 384:h+IU1mU/tLkndVg7vvHp0R7n4Oz7/qa5gvXiGkIdh8UawNT4js:u1T/t4dUvu/3KyWH8dSgs
TLSH
T1E914BFFFBA087498F0B35D3FA09A1282D4463F25E55053C9A854760FE0738A2AF5DC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

collect[2].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JC22KH2D\collect[2].gif
Size 35B
SHA256 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
MD5 28d6814f309ea289f847c69cf91194c6
SHA1 0f4e929dd5bb2564f7ab9c76338e04e292a42ace
SHA512 1d68b92e8d822fe82dc7563edd7b37f3418a02a89f1a9f0454cca664c2fc2565235e0d85540ff9be0b20175be3f5b7b4eae1175067465d5cca13486aab4c582c
MD5 SHA1 SHA512

Submit Download

sync_cookie_image_finish[1].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JC22KH2D\sync_cookie_image_finish[1].gif
Size 43B
SHA256 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
MD5 df3e567d6f16d040326c7a0ea29a4f41
SHA1 ea7df583983133b62712b5e73bffbcd45cc53736
SHA512 b2ca25a3311dc42942e046eb1a27038b71d689925b7d6b3ebb4d7cd2c7b9a0c7de3d10175790ac060dc3f8acf3c1708c336626be06879097f4d0ecaa7f567041
MD5 SHA1 SHA512

Submit Download

EXPERT-DRIVERS-1[1].mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6MRVMCF\EXPERT-DRIVERS-1[1].mp3
Size 25KB
SHA256 1f19a45b24a98014ab4821a1c80b1d2120f54e24cf2517b73f015141d6aa98ed
MD5 540072f31fd5aa996268425beac11da8
SHA1 2aee0efdd9ed72e969a1bfa8bc4c84656f972f80
SHA512 477fa6616ce8a55f5e6e7d0e28eba3e821189a08edc11a238b1066a4ae0f4930c85c5684e2570110f30cd04f4db5ecc230c1088a511f46ac5b8fa2168e72ceb1
SSDEEP 384:Fg8paY3T/034uc499t5aiMVR7aNhP8qgMU/m7VQX3rFdn20vBbPXrbQ09X6:dYYMb399t0iWRu5One7VgpAYVtX6
TLSH
T14EC25A8B7790712DF9522F7EE67FD275EA18281C2D44DFC882A1570058BF8523BB9E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intro[1].mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6MRVMCF\intro[1].mp3
Size 27KB
SHA256 8fcbf2cede0ba798aabc145593b273d3c76596ca9bce0a3138684fa7b416359f
MD5 691c1edc79b032ea6d150fc291b7613d
SHA1 56049f75783bbed2aae6d03eb91b752bb16548c3
SHA512 df1623c1542bbfe3ca2e6505d46538e6ec0eebbde8d712e03d32e8c22aa2a5e62b8369a3ae9263139f0e523826c15749c188b2005212ce6eb2e033054fdcaaa4
SSDEEP 384:1+qtDTbmf+HQ9QpBGbD355HlxdaUWFt46ffa/3/CshTynT6tJutpPN5zcl2HWi:xtntGQzunFraUWF+B3/C4Tyn5Ffzclkb
TLSH
T1FBC2E023A17F2308F902BE351E519B86C2B4DE42E05968FDAE611B28FF93005E75F831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaXP.exe

Path C:\Users\Admin\AppData\Local\Temp\Opera Installer\OperaXP.exe
Size 3.0MB
SHA256 2a48776472f2e3870d1cdd88ad0b4b096d22ec5b9190de26c3b0e00fc0d85438
MD5 4ab28f96ea835d4d05380e2c712abe87
SHA1 c7547a8369a050e1be9ce98100b640940c812a84
SHA512 5b1261ba372f62a57d607f4f7b475820ba9b74c54c6ec1ec8b83c8f72409b37438a8cb8b94dc259e4ebbebd387f8ac479b8f3666fe044afa2587b5f4dff0fec3
SSDEEP 49152:izBuTugyjxcTkZ3lP5AygUx0ZvH0vr2FvV/0i2oF50WBmIP:i9uhyjh7AygU2ZIE/71F/BlP
TLSH
T19AE5E012B6E94125F5F317B0AAB82B6549BEBD215B3DC2CF53C4181C1C70AE2A771B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverPackSolution.html

Path C:\Users\Admin\AppData\Local\Temp\ext\DriverPackSolution.html
Size 4KB
SHA256 8892e63141854bcf4bb1452abef68dd2c348c59322d697ef11a7ab7c5e3c4aea
MD5 203ac1542d8e93edbbc80f7b59db5c44
SHA1 ba66db0e746bc550ea860f4023c3cb5c72140ba5
SHA512 53cb5ad72c66e62d9285c318b606a9819053de729fa18ea72e80a7f09b333cc7868b455048660397086fa80a13ca745e42a6dc22df63d059076befca178a8a95
SSDEEP 96:622eKxBJq00+PVXzKOCzhBGbpgyvYQ+QNdzaCNqlI51MSLDXBQH0BQwp55FT7mG3:6be8BJq00iDJC1BGbpgyvYQ+QNdzaCN5
TLSH
T103A1BA89CC8B8D95A3B4163387A937178862C3C6A30968B77CDC893F6FDC605D1476B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

driverpack-wget.exe

Path C:\Users\Admin\AppData\Local\Temp\ext\Tools\driverpack-wget.exe
Size 392KB
SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
MD5 bd126a7b59d5d1f97ba89a3e71425731
SHA1 457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA512 3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
SSDEEP 6144:eoxkuaVJiysgokd+8L2LZ9aUedgk+TGk57rrpmNDEpO/YIPOWCiwYFnY:JxkJLiynXvqjggpl57rrpmNQp2YIGRY
TLSH
T1518423487A2AD85DCE83CEBB1A65773C663C6010C9E985EE35DCDF483E7A125360389D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIVIRUS-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\ANTIVIRUS-2.mp3
Size 23KB
SHA256 c87feb5bd45ff4ffb897f53c22e3e2f5732ad49d124724248a06627162bc40ab
MD5 b9d3ff97b96457be067dfc0b4bf06cf8
SHA1 ef1d8323a077aec206027af7616843708e898e9f
SHA512 c0e09060fb1c32d296abd0baebf741b5410ed3923da3b942f6e9d2510323cc223597fd0f7d4c7eb78116df0036d5f9d19115305db104eaa8671e3809672a80b2
SSDEEP 384:OjYSvFciW4GjDlrK2r8R95FR6CrLXHjMD6b5MUt0sJZ8ozL8UnhzF3gSX:OjdvZvGjD5K2IR5rDMWCc0EqoPHnhZgQ
TLSH
T1D1B29EBF222464697EF700DA61096320C10BFC50F63653CBBC53366E52B39A56F53D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANTIVIRUS-3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\ANTIVIRUS-3.mp3
Size 21KB
SHA256 1d23cba7b365efc03cf981a61ad2faf55a93740e077e1ab6569a2ec2c58191fd
MD5 79f67c4b6d219574c7ce29e43d6f8256
SHA1 fdd8dc2e990632b8e76d1c40e4db54c7dcdaf781
SHA512 17ae04ed13d0aebf2668a72f97b761a41fd7b221f7fdd3d01a83711498d18efe2ef452c95547ea6aed1b3937e48e4bcf2729a821b855d1f6c68e287a43ce5364
SSDEEP 384:LODp7nH2kA5e4zn91GI7a4zpYKohR5LLB0LIZkuiHuz9:aN7DA5fp1RjpYhhPmbTHuz9
TLSH
T107A2AEAF2B2861B4F9A354EF620D2400E25FF942FD7683467C65F95E54271417F06E0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COMPILATION-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\COMPILATION-1.mp3
Size 17KB
SHA256 ae70f1cc64550e94420d87adcaad724d1249982742c3bde5febad04eff28f988
MD5 d5800b717dce8df22f91e4fd5d8f9eff
SHA1 f36a1dab13378844b90449f35dd76b7fa962b801
SHA512 9ad4fc956b30ea4bbe35e8acb6837a9732d0cb43bb885857c5c244a9fb5a50a2826415b6f89631a27c3ed4ffd3eef3be93eb1375200fba7100694a098665f1e2
SSDEEP 384:VjevO+Dh58sFIc87nuCcUzfkgj7xnLpanE8xCMi:Vj0fu0mV3kwJ1aE+CMi
TLSH
T1C6829D7F39543168DCE3778AE5EE620005D73924DC1587CA6CA3398E04BA88A7C1AD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COMPILATION-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\COMPILATION-2.mp3
Size 22KB
SHA256 d25c6a14bf6694641f0237ddeb0aef74112e1cae7acf77f753cbe20bb8bbd203
MD5 23729fcb2e9a23176d38d28f15bf66f9
SHA1 514b08f62314a23819c58028500a0db307a97089
SHA512 1cdc4d9f4c5b5c5b81169b4e9191ca9aeb5bf5ed80abb0af38101df633716f62fff99d234a4b42ac080a3129112a485970b67c3534d21740ca2ce4c4ea5475de
SSDEEP 384:UATpNIO7xV6Qx++nJrQ48lsaUfY/ZVY0+WBGAy3sBb1fiKB2nZvc:U8v6k++JcDqa9/ZV13GzWfiKCpc
TLSH
T174B2AFFE640CB696FC6381D6721B1701D96F7804B65117C6EE30F60C46ABA85EF86D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COMPILATION-3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\COMPILATION-3.mp3
Size 17KB
SHA256 0069a0aa7fe69bebf3154744535e3b52ced7362e07e0e832698629f68c02785d
MD5 f517d3db373a1e0842cbdca22ea116d5
SHA1 8fad391e34ac78262055e700668b10150b99590e
SHA512 4a4ee5244476b32b6d1a25e1fcfe040eb50729d31560ad5e6273290e721bf4c523a89b2a821b90fc02e541ff5f7fac0cafbf4775020dc4d8047cd0fcf183b4f2
SSDEEP 384:X0sRQlOrVA7s2qCKnyYVGqDOCUu/xdP+HgqhybKQqgfFv:5RQlOr+sWEZOyouWq
TLSH
T129829E6B379950A59D93F37B62C92622944B7984A94BC3C1FE20630E8393DA5DD4CC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONTINUOUS-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\CONTINUOUS-1.mp3
Size 9KB
SHA256 571aed8d5306ecfa709dc894f6fe66176bc99380ee42694328b3da237fd6b989
MD5 efa6f5d70c558614f18c17d54c155fe9
SHA1 5fcd5fe13f7e8dcb80c8f3f3febf6cdd00c67c9e
SHA512 0e89ef7cb550ed7340b7e7fb612273938c5b0ce61edb8f4aca1782982067fbb51d099ae2fdf27782173ba0182f487c9fc6b11fe67b109f0c510ef8f2dc8f35cd
SSDEEP 192:o/CcMK8ohexpJFaue3BEJTqsv7UO13KBGHYR7BLDrZx1SW0GmzhTR:o6cMZJJFaJ3BiGsAO13KR7BLD3M1Gmzz
TLSH
T1C4129F7E78A572525647094CB3BC2093DEAC3DA9D02553E6F6E2F70D0931A486822C2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONTINUOUS-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\CONTINUOUS-2.mp3
Size 26KB
SHA256 a3857040e7a5e315d3fbab41ddb232465fc2b57db4aaedef2f3b74c699f01a8a
MD5 9dc08ae4415c783e8e6f7658423def22
SHA1 88a708d3e775dc03f72077217561c4ac12d4f801
SHA512 e83e84d6abff2571b97fce5883e37da3aec99c1bff7064a7ba8857da6c13ceed9ddbef26ab37e36f88b85c81e3979cd76f454aa3a22a41e52ec715c6546366cc
SSDEEP 768:N1Tb5JppBi6bZFqnDR5/qLyTNpZOXALHCq8cLrY0:3TbhS6bZFuDDMWN/OX1pcLr1
TLSH
T1A9C2BF7E610479443AB745E8F1171299C28E3E58E95303CE9C63FB4DA2B7884EF4A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CONTINUOUS-3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\CONTINUOUS-3.mp3
Size 26KB
SHA256 88d420fb6a0a847c522066698efec070203c436aa5e2ff2097bb2e5e3692150b
MD5 940828d405c4c92f0bdf931169b6bf14
SHA1 65915dd5622e2ada803525fb3dd259d36546d43f
SHA512 ac18701cb3d4d1e51bd88b35a3be09ee8fd7058e1b4679b5ca8c7e0688f1e27ab834bc955939fd94a2487327f251647c9f46285bfcabb07b2b1bf40e713ad5a4
SSDEEP 384:og2Hn/1EhTJMsjq6e+YcNlfwb3+EW1B7ZlzFKIDKxd0GYDFU2Jk34J:UyZJMyhZYcN435W1BHzMI8d0BDF+4
TLSH
T1BFC2AEBE724B31959D67B62BA0DE365438D33945FE4693CABA12F20D8076EC1BD09C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-CONFIGURATOR-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-CONFIGURATOR-1.mp3
Size 23KB
SHA256 3aa947528d8e22c95fc3c2c189a223293746f65aa04a034ab7e51f07108b0e63
MD5 922abcf8dbba88c31e06d3c359cf44bb
SHA1 7af83f4c518c37c925193348eb985c0f76468f2c
SHA512 4529377aca4503dfcc6a2956f4e9b1fe357b71e7e15c0da6e8214e92d3409b4845bd6e9c66a8f0ec76d225ec5d4fe43f6eda4ebc4fec3304591ae71f999789bf
SSDEEP 384:D90ISP+Z7UVb9ElcSGxKIdZTl2RuA448dGWVScxHnuEVe3Glwu2vgIU/HLlnoFj:pxYVbu9GxFvl9A6NRVnuEVeWq4IU/HLm
TLSH
T103B26A8B3B90300DF9A30F3DBA2FD1B0E558599C0E66DE9ECA41570150BF9213FB9969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-CONFIGURATOR-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-CONFIGURATOR-2.mp3
Size 30KB
SHA256 5a3e6a91181f9c87c354447d4e8c06a49cebfd06b2bb76683f44bb6a3200ee86
MD5 3c47fb862e42d7a657bb02ddacde77d7
SHA1 09d56b2f04121e0a59a5439499c3dd10fecfaf2a
SHA512 9c19726deca2c6c509d1e3b74aecbe7aabb596f081a16c05d2f3a7691d1978bbbf5201bdb2fc09f0ece6e99308aed63ca51552fa020c379dff85ebdb1f8fe7d8
SSDEEP 384:xI+iylxJ9rB46qVMVahTHjyeNJehoMXXK41q8j/htrbI4n67soAA:C+iIx31E4ahTHGewF1HJFE5sU
TLSH
T1CCD26A873B86718ED8872F3EF63FE6719181096C2D28EFC991914B1140FD9403A7EA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-CONFIGURATOR-3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-CONFIGURATOR-3.mp3
Size 21KB
SHA256 78ae68bedd64b4cae4dadcf69c184b62c709756f9e2128bb178311431b4129ee
MD5 991ab55460152ce376b9bf282d7a2569
SHA1 294f940c04d58624aa4099d48e7752dc54f651d1
SHA512 4b470c1766eeb3a22d125768c0e7691cf81b9eb500f0e910bba2546601419a2a56bda79dc8e7bb7be56e71396ad09b6f3565242934b9f3ad02b31b7cc98f918b
SSDEEP 384:NYvlRel3iRZhrvn7QWhYLwLcUjTiqwg7/tzGORJ9W8WgZyfr:+vlROINvn7phY4GqgORJ9W8Wgy
TLSH
T1D4A25A5BB362716AC8433F3FB9BFC67011A4586C2C5ADFC8C260571585FC8613A78E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-DIAGNOSTICS-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-DIAGNOSTICS-1.mp3
Size 50KB
SHA256 f2bf2a1650d308c862394383a09529f8d7ab7313707d6545ceb35f841412645e
MD5 3cb1be978be0c10212b4def521ea8d2c
SHA1 eb78e45b0f9a824d2395ee69dc341b34b7d0cddc
SHA512 bb0e0361e8077ab54734519c7b5c87bce18b65782c381cb7f32ad5727f86314563176c3bca76589f716c2a455360864321af6a2c2cd6c45acbf4a9080e417210
SSDEEP 768:2goikVdMqLhTMuSed7cQ071YY7T/uWxU/ThYcNWyb5U3PvRdI2dfPZcuMafX:2gYzbLVOedze1fX2WxOG6WG5YH7I2UFw
TLSH
T1D1337B8F3711312DF8A21F3EBA3FD6B0D519414E6E24EF8A46919B4108BF5413B3AA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-DIAGNOSTICS-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-DIAGNOSTICS-2.mp3
Size 46KB
SHA256 37570e3dd380a1c779db17d7b4ee8b0ca4a25a2302f7112f087c7ab7dc7da517
MD5 7afb5dcd2817c489e3a501b6e13c9729
SHA1 87ed1fdfd13c41d3e5afc9b9d2f9a5d843e79bca
SHA512 3bd1eba015c363e685e1f7f916c7f522459b4d1fb6e8be678516180d460405097fd4f568c4cd70123fb434037e95ccd607cba36c388283286c9e1a9a98e95aad
SSDEEP 768:Ix16tRHccUdkLofnOZ4IwAoInXXrqdzkE7munlyumw/xhbZf9UiPI:I16tapZf91/Inn+dz964Ow/xhFVnQ
TLSH
T163239D8B7B10302DF9966F7CE93FE239D4155A1D1E45EF4A06A60702843FA2237B9E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-DIAGNOSTICS-6.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-DIAGNOSTICS-6.mp3
Size 13KB
SHA256 0116eef284c5228183cfd27992eda255775e5ea88b4e7739f2779967bd1b6fb8
MD5 ee7ef721982941fedb8891f5778c99c0
SHA1 e105c9f19515e4238c3f0380fd6b25c5dfc0e886
SHA512 922c9fa44da70cf40e6de1d2c644db838fb78c0cc0ea0a89dc1c467ae66378aff77eb2302625b1efbb70108beaf7cb3d67c53872693219496b1480aa92e11022
SSDEEP 192:oAM6j+uSmISddArgzZeSa+CaGi6xZXp48DRI1obzYZ4d:EuSUz2gzZeSXCFiWZXPDRHbbd
TLSH
T1135228477702A029F5566F7EA0BFCB30E6551A1C6C54EFEAC0814B0118FFA44BFB8829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-DRIVERS-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-DRIVERS-2.mp3
Size 25KB
SHA256 9f35f0dbff0fbd1362b8f221550bf9d63e5d30ee8487bb47c78edb1661a52b9b
MD5 009af8af189f6446d8ac3552dc659623
SHA1 77878aa1bb829fcf950fcf0bacd0b5f89e44fbc4
SHA512 88fe7b3bf30ab34976d5f9ead3dce16861c19810bec70c32a7e651d75842390b0a024bd40ad070d0bf5665b4ef62795f03acaa8070aee2f79165797624bfc9fc
SSDEEP 384:9LdAABWv6TyHn4XHOQz2VZz1HhwQTBxU8zpwiwPCvH5smaKPoCe4r:pdAAkv6TyYI9hwQ1xD1rwPMHBAT4r
TLSH
T16CC226CB7F017078F5660FBDA67FD274C009901D0E64EF8A9782675489BF501377AA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-DRIVERS-3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-DRIVERS-3.mp3
Size 36KB
SHA256 540abfdf5e2894d09dded9dfffe2d1be207b484f32f8e0aa237aba52142eeb8a
MD5 4314c886eb7bce481ec3209b96fad7f8
SHA1 e365140263b4903945d6b20926b3b1c66c8d6998
SHA512 9f83709548764477e812157b86fbd0d958b189861b59e8b2f308f734be04f15f8b82938c178b4eda5ee23c12176791f3792ced856ab3f2fd4391513ee37eb706
SSDEEP 768:VIVD2+dfv8Nu4HzFA5d8T2gDWg90YJ8fjV1sdC1M:VcD2+fv8sSXTrtejVeA2
TLSH
T19A036B873B407128F4420FBCFA3FD270D199A55C1E29EF8A97A19B0050BF5127BB6E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3
Size 42KB
SHA256 90b0c57398a3dc95f089121e0873719e3fce5978a66bc3f8468fdb375287d37a
MD5 c2f74bfffef77facd142047ec62053d1
SHA1 6705db85b4d1fb0154862d47112e0a300d5df401
SHA512 683339571a0cf5597087f5b779673ff65be19fa29c00b9a82638ead328ec790e4066ea32f32bedcf15e09febe738153b9c79a23173b00bdcfd06e563365bfe02
SSDEEP 768:aJ0MLZ7Y4Igs8+S6DYqWZLqJxT9QBmSHTYcmrebf:aJ0Ml/s8+S6DYTZIT2CcmSbf
TLSH
T1F7138D8737457229FA865FBCEA3FD635D409211C5E6AEF0987928B0094BF501B77AD30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3
Size 28KB
SHA256 a5062cbc572ce18afb6e590a74a299f288c593de995841c13981c25a5cc3fcf1
MD5 c32b72662de149efdde414c6f62b755a
SHA1 219b03d40974b059bb3a162f61c2aa1446d0fa51
SHA512 f57805be7b781fbc160cabbe2594f3f0aaa45d74608eff486ec077b065abcd87ced756f60ede04d1c9b55bed2932fb7fceabc56e22aa80ec719fb62c6247cbbf
SSDEEP 768:jMeHAiB8Up27VKhkTBRwQc1GUSdp50UTY:bHdeR5TBRwQc1c50UTY
TLSH
T1FBD28C5B7342360DD9933F7EF97FC67292885A1DAC59EFC986804B0258BE8103679D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-PROTECT-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-PROTECT-2.mp3
Size 44KB
SHA256 82d48381d03dba7f4a566420a4921553c6aa15bc6a22bc6e08bb6e8466af8274
MD5 b93826701c603537a71054bca4cde2f4
SHA1 28e4e28877a3fc864c42072770e604790656d98f
SHA512 8231dda9f00aa4517f2b43d55df704296615bb0022e3a04c779295382ea3866f194741b77838fc516cf1f4d1ce59801cb80a98ee010e9b3a719bb28155e3b6dc
SSDEEP 768:TpNXgBviXVgichXwi2g9izczfnJYG13aN6Ga+U5jYGYOAwRrz6dNRZGhbL48WOxb:TpJYaRAwi2zczH13U6GfU5jYGl1zQNTa
TLSH
T131239D4FB322345AE9472F7EE9BFDA3590592A4C2D50EFC98281430251BDA547A3CE39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-PROTECT-3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-PROTECT-3.mp3
Size 27KB
SHA256 996744756df49ce498243a7fcd70cf5cc9c55f399b8027ed712485c6843d1ced
MD5 f0f1e1787b8a0a7080bb3b20cbefb6f1
SHA1 af6cd03851f375bd3606a47693ed7cfac3a91401
SHA512 74075cf3563b27fee97792a20a8953b652a7047c60e82d70e7595159f5e132f3435349e19784d71252fb134a234b603917b5418c919ce4ac068de65692610a75
SSDEEP 384:eA6jvkG4fSswNQX9PQwWwchrVri2Iuv1ZTE7jtGVA:d6j8HOQtPlWwcX22Rv1sD
TLSH
T1F0C25BCB77143019F5422F7DB92FC275E445052C2E58EFCA92A25B0648BF9113BBB9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXPERT-SETTINGS-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\EXPERT-SETTINGS-1.mp3
Size 27KB
SHA256 c924ba594bd39760e0939729a27a0bc201f61f8f2edc5123e4841f13cb7c5ccd
MD5 c71332f76d4e33dcdb1702b6f65c4b0d
SHA1 df6151eec74f279e30fea571e26e1a37f39a6c4c
SHA512 f69e2b356e619de01196f8607043294fd143a5bb224beb7e72eba484107e1350dfc0b04df64186bfcb9ba96041ebe01b5566dd6af6ca3d902ef56ed6a3218361
SSDEEP 768:MzfUpwqf7SR5HUKd5SiNT6REZU8jgwwWqT:Mzf4buF572r8EA8
TLSH
T198C28C4BB71230AEE8472F3EB9BFD632E591692C1D10EFC580942B1018BF9503E3DA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISTART_1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\ISTART_1.mp3
Size 23KB
SHA256 815f5cdc4f714576ff9e5b6ccab5c4cd227aa87add8237b3e5a88913867e8ce5
MD5 196dd2bdcbe9ffec4b388f53334c7034
SHA1 6fa9101d10628145ccc7705bdee98638f45a420a
SHA512 77805a848bcf17aa4b37d8c06d2aee0fa3dcddfbb0b76aaea929e90a293c7c3bd463df5098ac21cb07110e729e896fd32089010a306f001057c47fd8a66f8721
SSDEEP 384:MjTooijSb79d7EyY8nHu6+TcwDP0saqo3g0A1E1lZ7z2JxseroHSwPt5mj2n4t+k:MjsofhRDYxFAwDPrab3got+vsQwn4bv
TLSH
T17BB2AFFF329890347D7382A5A20D2242C88FBE4DDA615F467C61FA1D92B7548EF87C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISTART_2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\ISTART_2.mp3
Size 42KB
SHA256 df1126cb3c694ba6e5fde3e2149cfa536e02072bcc52dce9cf481fe9f9575401
MD5 25e46550547bb81f2a1f26ae24b98fbe
SHA1 08a30a406b94e936403d4ea76d4138ba5a4d5bfc
SHA512 07ac8164b824a62b2e651ea4cdbd0763ad3b8eaed08a937c9e7ca51ec0a083a1149d24c096dfe3a41d26c65593b011f741de364448acc0f88b62092cd52c2027
SSDEEP 768:H+4/YYnBCzx/AUVAThJQcRRGkIBKxdjxN1eKIngalF0iuIq9OjUv:eMYorJ5RRGkdj71e1BIiuIVUv
TLSH
T14213D13E7214E229F6A360CAD09F1281F19B7C50B9B14BD5B8A2F60DD5735815F4ED0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISTART_3.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\ISTART_3.mp3
Size 14KB
SHA256 23a69131f2b1ea74723a087a9e0137c202f4f9439c165c6f0784b2fde7d3e7b6
MD5 5b0d0736e58d2f3cd4a7aa60c9977677
SHA1 3b4774e95fe9e1b66ec856ce4ff15a3437bed244
SHA512 976d76ea6e00c4eeccc9aceba01cab51a096af245ce06b597c61da1062a3f40ce49374fa04c6e9c98fdcb175339d10da5ab547f8c675508cabac83f5f9d46121
SSDEEP 384:LlBIruH4VG48FaLTO7axu4vrMR7qY2G5PIXC8Iyt8AQ:7IfDxLTO7axu4gR7qKQSWQ
TLSH
T1CE528EFBB39EB4AC4FBB6557A0CA224619973C18F90293D9B931221D91B28C46C0DC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISTART_4.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\ISTART_4.mp3
Size 18KB
SHA256 618eb740f1dcaf902215f7a3d77d69a1a07bcc46ee9e96156d524d1eb3ee38f2
MD5 cb1671a5e76e2f608f5c41e041236264
SHA1 8ab07b65b9fe00b8d048af0cd7c67800b140d08c
SHA512 0da2958b38d87cb94f20775ff14538e13184dbbdceb3380a1ec48e630b142011ac9784be65c697870f59de66a1eb8c10fdb91d5532e4a4f6b3eeb2cb92ec9be4
SSDEEP 384:8rRf6ojC7tmwAXpccN8B6hnmuNq9zk4rhz4GvWV/p6aJ3bHXj6D7ndoQ+L3m:8lSRUph8B4mB9zVJ4piahHXOvdB
TLSH
T16F827DAEB54A7491DEA3B327A0DA6B04449B7904F646C3D8B861BB0ED575D80FC0DE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SERVICE_MODE-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\SERVICE_MODE-1.mp3
Size 43KB
SHA256 74ef8c36b37524515e37100952f7a36faa0f3163d6d5388f360dce946ad4fa28
MD5 74bcb7ca280929fead0d144c546937ba
SHA1 416a15e2ee43416423cedb75705c8ae150bb8bde
SHA512 982f124b144e48bda9e7e85f95d4a0f195763a9d7854615b4a46ee9aed4e746920b19c5f1ca8c97453cd0ea6f1e33b3b33617445125eee9fb6127599c2c6afc6
SSDEEP 768:ZH0pyNTeOTKAe/LjtcbBzCpBzSG/svMiTWzIAtrgpTLCeHLLtxv78Fv6O:d0pOSOTKZ/vuboD/svwgpHCe15q6O
TLSH
T12A13CF3EB18A28988CA3F2ABA1CE1A41105A7D95B55593DCB836F34E50B3CD1BD4DC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SERVICE_MODE-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\SERVICE_MODE-2.mp3
Size 36KB
SHA256 527f93a6a3159de9a01242e8a1f85c568651bd711da175e5a6c9fe1942224b97
MD5 553f50841fc352613d9aa55c274b6006
SHA1 549f79fca4f2d46b5351d35a2f13ea1f6ece37a7
SHA512 e3b3577b6de4321e913a700c7d53252a905740c98ddde04a1dc305f0a2197535cacf5bc29261dacf06b68b8ea4f6a97ec51d067f9c9dbc3243f7518d2da87f22
SSDEEP 768:uMY59lQmy4LoJHOcAhxq7E/Hj1nUKjiA59:AyuLA0hxcGHj1UKeM
TLSH
T10EF2B0BE7211610DB9735AAB518A2542C5CAFC50755113CAF832B30D8077D97BF4ED1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

START-INITIAL-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\START-INITIAL-1.mp3
Size 20KB
SHA256 7ce172ba3df0c381dabc6688dc584035860052b57242ec01ee3adc60ccb3bbc3
MD5 95c290a75e2d3d44f0d76142508edcf6
SHA1 a090827bd93cbe812e32d81272f7cfe9a9b31b4a
SHA512 f2bc1232896eefd0b7e27158067bffaa4bacd602a2fd948896ee6123dbb0ad504084f3ced7a9efa3e7c444a1301126f95ae6466fa7004d9c30661dc62b5c9bd3
SSDEEP 384:lkauusAOICwFdH9s4NIdBqBfNM2KKrcIHIyqTV4bgN37fB1veKcZ/:cZ8rsjdBC/dgIHTqTVRl7738/
TLSH
T15692BF3F39632564BD4A80532C5C43C0D458BF86324D2BFE0C756A8E923F66E6BA79C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

START-LOADED-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\START-LOADED-1.mp3
Size 38KB
SHA256 3a2f113b271e4a4a6bc8be28f4396babf7e92331492074c29dbaa83d0c09ad57
MD5 00d14954338cfc5a011e75afe7237355
SHA1 5534fcaafd1e9edae19a514c415b48a929842fcf
SHA512 0c1af04bbf833018d2e39a2d888ef16c9686eb0bf1561030b06e9b257678a5e02328d42d5cc66fa3ebfe8ce8705568012653a0cd236c466ab84ad42a2ede50c7
SSDEEP 768:gKqeT3vsgXNIbSnRjFx1c07/llJ1Uy+HwOcJjh/p9Jnfu0z3:PXt5jPllYDwOc5h/XNfDb
TLSH
T11B03BFFE3915A548FEB314EA920D6191CA4F7985AE7247DDBC36F60E91334807F02C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

START-SETUP-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\START-SETUP-1.mp3
Size 24KB
SHA256 f01ce28bdb7af9b93ed9e255d5f2c4b7860c97d2f0d58339dbd489828b3484ba
MD5 5dfd5ac5c08a629db586c6b737905ffd
SHA1 7d7418ec5c0099ce47476cfc63d160ae2f25d16d
SHA512 90e301b3cc64ba21517823767f5ac44dfd72fcc64eb40b5156c1186c466f2bf1a3e2035f316ee55709051fa47a1fd344e5fddfc88586a55396481e59adedd26d
SSDEEP 384:XbvSAhtUjDNoN9U08XE0juWURACqkDwdpbqwlXN7LSl4Qx4YPe6YX3igLSgzF9I0:Op+ME0izAaDIewlXJQKYWH9I0
TLSH
T1EFB2C0BE73201A32BA974DE5608F3717C857B8D4D5280717AA9DBC0C216FF812BA9D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEAM-PROOF-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\TEAM-PROOF-1.mp3
Size 40KB
SHA256 07eca9f5ef7741062a9081a42dc70200ab38b0a48f31ac62393332ac24e97089
MD5 7eb9029ffd20e9f7d7e496bb74c581e4
SHA1 edc1dcea8f1bf44e16c25ee5ef7e3303494aa835
SHA512 4de329408e48b6e78fabfd37b2a710be76550b822df1a6248f8596c4363e311226b2f03bd4fd2c8ae2d2a5efb57fa87edda5a19594755618336597c02ec15f63
SSDEEP 768:/jmOEZSzvEaf/DgnALbLYhTOLr1Su/BorUInt:/SOXH7LbcyAt
TLSH
T18803CFAF759420A8B9B371AB314F0353C04F79186A6253DA3D95B64E0173985BF0EE0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEAM-PROOF-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\TEAM-PROOF-2.mp3
Size 60KB
SHA256 09bd89dd7b59b6403c9fc495d8e4780840f9ade3ae9744f684e90876b250f981
MD5 50981b671fbad5e721b83245563dcb66
SHA1 42db8a6291d1f3b33a58a505b446c08e13f7d3c3
SHA512 9c7cddbfce10dca0c5359860fe5791be90d3e8a27f77c8c500d9cc8ab180ad691c4a3c9a8044df7577efbb9716150b7cdc23800e54264e2a92af0b4f34b8f1a3
SSDEEP 1536:w0UXRLr3AZ/B13P9qBvUgycfye9W4MW/aT7/cjGIq3lfH+ml:IBvQ9zoBv2wz9abTbc6IqVP+q
TLSH
T10553CFFF340D255D7CB360B5619A2612E89FBC01FA2113DA7812FA8C5577A80FF4AC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WAITING-1.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\WAITING-1.mp3
Size 23KB
SHA256 cc85ff5e54762063c62237ff6e23c59fafe4ccc5b91333aefcc4286b6eb5c68a
MD5 26d845b49a19513397ccd2abe6312682
SHA1 88c4d60e6c73af38bdce1fc346d129b9ec6bd937
SHA512 b9571a5eb1e492b0ba5b260d4ce0e62d507b5cc124b1c092b6d4ab457b7e0612517baa893a04725739f647c8d4a0e1f384443e21d72d48852fa55af9ecd1b6b3
SSDEEP 384:siBZigu/R1reGpT9E25I9nMen3n4zHoTCfwkOYJd5pTYKK+qgb4pK1FKt0tYGG:sCkgpuT+KKVX4zH/ROYJ7pcK6gb4s7Kj
TLSH
T198B2D07DB3B8A65C7B92D16322AE3100FC563D12FB8196D9127EB20E5133845AB33D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WAITING-2.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\en\WAITING-2.mp3
Size 26KB
SHA256 49f80e6ee7ae260d208deea397931f9fd9f6d1cd540e27d2f3e3263385830dba
MD5 ba50ef5294afa47fd8199ceab5bca9c4
SHA1 5822a694810487999ba45b77ff95572e789967ed
SHA512 1fca42480bb91e95155e439caf0a5e7fd5fc12865e942c4068eea20cb5f1df8543d8c8f5fcb1ba2ccc925b80e6868fc38a6cb6531ea81e8c5fb80811ab6e3620
SSDEEP 384:V+IU1mU/tLkndVg7vvHp0R7n4Oz7/qa5gvXiGkIdh8UawNT4jsf:q1T/t4dUvu/3KyWH8dSgsf
TLSH
T1E1C2BFFFBA08749870B35D2FA09A1282D4463F25E55053C9B854760FE0738A2AF5DC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

STORIES-adout-8.mp3

Path C:\Users\Admin\AppData\Local\Temp\ext\audio\ru\STORIES-adout-8.mp3
Size 17KB
SHA256 c2f79a0267df7d522b13e49b406f74892cc6744b88204449387a335cf525550d
MD5 9bfcf4abe7aa3603fdf1e37bbd9908ed
SHA1 7fc9cbe58273939ea9dd04463ca2ccfaf913658d
SHA512 61fc30694f6a12d03fc95fa537d771ee7d6467c8c457eada43062c036e5347637f0461890e8fbae5f476eee1ea74b152adfc7b1617118ede74c43cf36edbd633
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.js

Path C:\Users\Admin\AppData\Local\Temp\ext\config.js
Size 3KB
SHA256 18f86ef3fad86c97d56274e5577b178a77f40587a80451a971013248e37190a6
MD5 31009d2efb710925bf7f308af59c629b
SHA1 5215c77b1719d0974dc529b523b758ef85dbebd4
SHA512 44129d626970c101df41a0bc94ff6120a1034077628da968d9c772fa6125d1f11478480cec7086dfd1625c8fc07820202a711a5598ea131b7742b31211a3f394
TLSH
T18E51AC4E75B3B40312AA70D8F31BB17576A7C4532400FC51FF9C4AD86F518069BF9AA9
MD5 SHA1 SHA512 TLSH

Submit Download

custom-control.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\custom-control.css
Size 10KB
SHA256 7d7853e95258a7a3f8eaf41795f7124e7d2dacdeb5f1efe212b3ff7ed0da9e50
MD5 f7f8703ada2176dc144343a2c2acb1cd
SHA1 091334a48056a8baafff0cd672232de1c1f6c838
SHA512 27d46472c06103e0bdd9d40149804c16f469305752c3a6d8473c2f2ab22b2c8fa5d65d61dda7c617a3f12d8526b56a10320b8683f31d210ac2185fd0daed8e97
SSDEEP 192:fL8UEQ6UEPFaF/FIFUwyivZH5yFo8FMY+BRMYJBSMYzBDMY4BWMYWBfYMYOB1hZs:f6FaF/FIFzU2lpRPAVvvmDR7JZDkRzES
TLSH
T1F1326B7F14B44234F572C968228DC535631BC32086399EEFA2EBBC6C9BE414993675BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DRPicons-webfont.eot

Path C:\Users\Admin\AppData\Local\Temp\ext\css\fonts\DRPicons\DRPicons-webfont.eot
Size 7KB
SHA256 0a04d85875091cc334f63b90c8ccfa0838f20023945d949296363369066870e3
MD5 d85a00ccb58d531afd9ad80a067fbf0e
SHA1 0a3c0cfea5b9c0fdd5f17a1df49cb1512316330d
SHA512 bce1796d0c71291cb779e2e99399a213b030663d5968330932b4a059ba48f3679e2df9e9c84201efb090a44b499bc5f46d174ad40b4b1d3afb5df5d2f3299261
SSDEEP 192:cwjk24oWhEWTmdEIqKaNB/tT5OwCAlPV2K:p41h80/9/CAd5
TLSH
T1A1F10B08E3EDDF73C9439E3C48A463275E79AC3E5E29A34799C015E1E419A35CC2875D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opensans-regular-webfont.eot

Path C:\Users\Admin\AppData\Local\Temp\ext\css\fonts\Open-Sans\opensans-regular-webfont.eot
Size 40KB
SHA256 3ae576bfa96d7cf6614c8c97290c7abe03191a8ceb0c837a21e7ffe70d66ca62
MD5 88a9c629f26f8563a72eac95cb0744bc
SHA1 484bca13532678133dc14a668c580be2c1346526
SHA512 b4cdaa3a5a46ef368e9138c9874aa1173b466bc660d5bbbd13fc3f10f509cda9af151a2667ecd079935d60992b1436f6d5843ced5a063769e19e67f84c402af9
SSDEEP 768:hpfe+ESzTyBcQfZHded8/IGngtqPeOMBxe9tMxfuNrDVZ57qEOmLxodqnglqebz6:h9VFzTyBcced8/IGKBBxebM2DVzqEOAh
TLSH
T1B513F2628D4D11475B6F4B3AC111174D5C0FAE57181BD22F0C2B0D9C89D8AAA92FFAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProximaNova-Bold.eot

Path C:\Users\Admin\AppData\Local\Temp\ext\css\fonts\ProximaNova\ProximaNova-Bold.eot
Size 141KB
SHA256 1c3a470bf710204b1dbd65679b914af4b94e7f018b1f7df3d61ff863d6f335d9
MD5 be0e58130a84b19c8523345478a0bd3f
SHA1 35dfea056f715d8191f2647e56c214afaf819eec
SHA512 c0ca4a33842d69fad8f1795864c9b592d2cedd62b14efeb46676823460ea50693ccc884891d16f4ba1ffdd5e0a80f9d06fd6e65fe184f3ea283ff441e7b874c6
SSDEEP 3072:A/B5s4DYrE3pd5Oobp+wAfyc/rMOHlKqa2E8H7O1j7B3+gAyR17:A/Brfd5Ookqc/rMOne7
TLSH
T102E37D65F3C3CF2DD29A297EA211F39267579179427AE70F7988E8FAD0061E494C0DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProximaNova-Bold.woff

Path C:\Users\Admin\AppData\Local\Temp\ext\css\fonts\ProximaNova\ProximaNova-Bold.woff
Size 57KB
SHA256 2a8f208d9d8556ff58da8a420316de6d634a568a0eeb94c043430659fff7d338
MD5 a3932b53cb250b684b63d1e04af5603e
SHA1 b06c657df6b320b915a17455848e66695a9fc68e
SHA512 e8e68301dde147b7c79e21689066b7c9653a82f9898c2c76f4060af1a48c7f997f4797de5002e870e9ffba05efcb47f10cae5b8beadbe7909a85de4c04c54730
SSDEEP 1536:C/3jSOmOXQEBiJakbFNHi3kX6zXgFIidGXz2hwcZKeBabv+:QSOhXQEBXkbF15WXgFIqm8wc8CaT+
TLSH
T1A54302402D5ACB94A6E9A9DF589E03AC5FEF02914D3F40B4095523CC58BC60E97FEAC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxima_nova_light-webfont.eot

Path C:\Users\Admin\AppData\Local\Temp\ext\css\fonts\ProximaNova\proxima_nova_light-webfont.eot
Size 61KB
SHA256 53f30a622db68cebe92dbd384cc292aef13ad7e3349a10a77c29326e10634c21
MD5 ee9163c34f600221169f8ff531e97182
SHA1 57f0b2c837c94f2a0df47ee62b4639fd6426bfa0
SHA512 d51e2a5f6df706eaa2c5ffa071a9a9c08e58a30b4af64a1ccbe81f8e9c38f20429df665cabaf295129490afc639b7e19c0fced428610a284a17899c3290904cb
SSDEEP 768:bC60ICsNjaND3ryh+u23ocpjGu2a5TvSHyK6QjCiBQryT3Eg+TIhk//eFQz3e:gduh+JxjT2TSK6Qj5QuT3E4k//0Qi
TLSH
T130534C45B1D1A36EDFA70C7B0520E265AE56DB3FDF5583B6F08828B248050F4BFA1E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxima_nova_semibold-webfont.eot

Path C:\Users\Admin\AppData\Local\Temp\ext\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eot
Size 65KB
SHA256 790579e11608136663d073bc6f99848c04b4dcd69216df7daf5be00df573a3fd
MD5 044aa0b596161750cb58aca15c52cf38
SHA1 d40e645b34188a54d909fa40f7eddeefb8b9df03
SHA512 1a3b3abc614a7ddf673e34a936de63809f8c18a86409364b2bbdeb608fbcd845095ba7cfb34a0826e2ac18cfc5ccd4d47d4bfa13fae3caba7fbc4470d36c8086
SSDEEP 768:/jWGHsBEyGYYUonHefoUPHLOA8ZSs3nqcXw1aLy4dsLvdnYnydLeNsnQpvTfrO06:6igonHcAiczsZnYn8znQpDdqsGg7G9BF
TLSH
T1CE535B41B1D1B33FD6630C375531C2A19EABEA7F9F5543F6E08818B298190F46FA1E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons-checkbox.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\icons-checkbox.css
Size 444B
SHA256 cb134dcb95a407795c671a512c389894d3525fba3f6a2168fc5b9b7e875e78dc
MD5 3be98220035017d9b818f3cc94f87587
SHA1 bc07f11d0a59f942ac942dba02214a7041ad6e3a
SHA512 d2e7d57cb7b7e771c82c75a04fbfb86ebecbb409ecf2c5666aeaa99695474a7985e3367f6a5b3d4ac59f775f60fb084efa9bdda99ce3c077df2690a5f0a6b1d1
TLSH
T11CF039730E406106D132198932A286610D2D12263328FC3F76AC64466FFEAEA9153BBF
MD5 SHA1 SHA512 TLSH

Submit Download

icons.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\icons.css
Size 509B
SHA256 b5f111103f7f090c246a223b1ff497b94c4dd3ac64bf5b3fb2d91555fcfd6f2c
MD5 ebae852f3327fdaf3e2fc2bf1cdecb8f
SHA1 f9753fe176069974fc9bce49eae877745282e183
SHA512 bf8e7c5db7a1eacd4344d5facfee1cd66e883389b53bc28e4e387cdb67ea40ee26266ba4282e50eb50a7bc3c810d9fdbb50792a46135761b2e8ce52ddc9e394a
TLSH
T19DF05EC141C8220783711C4E32D29A9F4D8E60057C0DD29FBE69A449CFF7A2B8150B3E
MD5 SHA1 SHA512 TLSH

Submit Download

normalize.min.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\normalize.min.css
Size 1KB
SHA256 86235e2c477078adfe1188d07ca1e5d8198443aaf2436de1785a169f3e1d5463
MD5 e8908cf9cb9504b285327d240187f53b
SHA1 20eadf1695eb38bcd92d1706de5335db61b96502
SHA512 9c828e8942d40da89f33d1db459a7fc12621660331bef307df8649e89758e76b044bf97a2cd36d656915e19a8b04f571cdb61d7cb6f926a3ba151ee67bbcdc4b
TLSH
T1543131736784BA51F7368D3137D77B9936009231C041A5AAE440D9ACCBC65235AF1F4A
MD5 SHA1 SHA512 TLSH

Submit Download

open-sans.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\open-sans.css
Size 1KB
SHA256 b9bd51ae6ccc7df20417e0ef341295b86bf8f74f6e235ee99ddefd675806f47f
MD5 9ed298542b45ef98492e159f68e89f48
SHA1 c4521d9a5dff8a71804c40a909378e8eb5bd66c2
SHA512 1c7d5b378d6c627fbbef864035b157c3e7647b699a50d64f6ebf22faac38bf774e0c025bc8dd4ecc9bde7b377b729bc89bf6fbac4d2409240e2d03753cfe680e
TLSH
T1CC21E46086CB3D35C6522D4AB6EB5E70888D040A7104D0DBB334A5D8CEEA36EF15CB1F
MD5 SHA1 SHA512 TLSH

Submit Download

proximanova.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\proximanova.css
Size 2KB
SHA256 931071422410d73d9d7d3583745e476eac23c0cac5fbe344f8436499ee40ac46
MD5 487b553f5f73b30b8d565df02b4103cc
SHA1 6defcf202ce7a04f2bea8aaac8bb01ed44407fa5
SHA512 5a94da5d685f6e74f6576c179b8b65b719727163afebf24557b5f23718a8c034f5e2782ff33021c4d029abaa7cdf464ad0a49cce0602b31191b3b6b642bda9ce
TLSH
T16A41B4804D457E0A80F9199D33FE86E17E4E0007F8286493FA3D7689BFE66285A51B1F
MD5 SHA1 SHA512 TLSH

Submit Download

roboto.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\roboto.css
Size 1001B
SHA256 2537efe2fb974f58cddbc99abfcd7aed6e9df81992eed3e528b5f1748167b8fa
MD5 f5f5b5e4955262430e7b496247425d2d
SHA1 d4bea186a0d525ce3060e8dd7901311ae4a0735a
SHA512 16a7ec3d95ed773a0a1ce2c2dc4430677106f0d1042e34cb39ed48f4a495f637ec3eefad05a4ebbddbea71a67e933fa0b56e6beef69700c6e3ac9cda9c17e7ca
TLSH
T1A511B1819555255A93E21C8D32D78B50FA9E000C710DF097D33CA44EEFE3A29D285B8B
MD5 SHA1 SHA512 TLSH

Submit Download

style.css

Path C:\Users\Admin\AppData\Local\Temp\ext\css\style.css
Size 14KB
SHA256 3f8ec31a3c08de6c1aac117347b1b83f391bb0a91c9dbdc57ba9d11d5ba372d5
MD5 2f4fe7647aa460b8984556a25a74c234
SHA1 8fb2a5135e61a034ecdfef279e92078a7b463123
SHA512 bad4c1419e302f8e5a84c28fb0862dc56167a7353cc5420d8226883203fe03eca7ec8a9f554cfee560523e9ef292cc38200bce6015c80a428ce4c05222be3a58
SSDEEP 192:XSdGP0LMIIBlx19s/qPry78F6oFD4DeAL6mtkazVEMRDlndC:0NMxPFTkLiMJ3C
TLSH
T153624395CAA35C0AFC0B95697BBA5346233C8003D51FCABC3BB6759DDF822C44267789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drp.css

Path C:\Users\Admin\AppData\Local\Temp\ext\drp.css
Size 190KB
SHA256 439bfd8bf9f9176c1757ba277850525f0abec59bb3ef7cd8a974a5ad1d2b3004
MD5 5fdaf0fd106200153f8243ebb8bc6b18
SHA1 4b9524224954987a07fe1ce5f6f6e83becd5a20b
SHA512 1db1cfcd7e8188594d5b136a479a29797ce1382c471bdd592f7f44f1026e5da845d231eeb09aa6b1b0d36ac2329b3277ee69c9e53049f2726df936a50b898228
SSDEEP 3072:GndD9nVqVGs4v6CgRx74WeA9iHkLTgmaGj0SgHWdogdm:GndD9nVqVGs4v6CgRx0WeA9iHkLTgmaT
TLSH
T19E14A7DA9BB21608B82AD5AAB916676133388003A31FEC7D7BF5605CDFC56D8C56334C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drp.js

Path C:\Users\Admin\AppData\Local\Temp\ext\drp.js
Size 3.7MB
SHA256 c0ae6134f693b80d71ece89965cde42c819e815c7218d54fcfad0372a62dec21
MD5 a7af01062ea3c1687b11930f26a6d9e8
SHA1 b6f418996e5f6c3d7de04b621b78de15dce20a35
SHA512 8d0e40bb128bbb1f01ce38295c4c673884a7f07aef543bb39372fb91f1ab9f20c60dec974cb97beb5a58abecd7b6d137f80631c5ca39831e2b59659704634b38
SSDEEP 49152:8/NhMKGyCt2aB5FdXP7SxoPW11YXmF8bapAz9kv+pobXx+Lw1y/U5k8TpGVcj65J:C4v
TLSH
T1ED06D50DB9F360964257716D972F6816B239841B590CFC10BEDC82946FA582C83FEBBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\assistant-faces\start-screen\5.png
Size 75KB
SHA256 ad615ef1f7016826d475fe90b4363cc149b060de2b9406b4c58cb4a4f1938bef
MD5 40353d51881300e6cea13d94ae01b756
SHA1 5718f730dcb3349ad6d23972657962663fb38fc1
SHA512 8bc29ecdce2d5f558dd31a1e2424cd1ca94f72e36ea72a491cbcd46f52762f1f44106c749bcb41e6fecd87f9cba2bf6898dbc022a5c46f2ae15aafda3ac3c734
SSDEEP 1536:loCPfOAlmxx69Tl2NqDngMc8bpKdv7YXEe05WO/r0us0:qCP2Amxo5RnIG4dv0X+4Y0uj
TLSH
T16B73E019E641C036F3A295627322650BBF7A689B7540CC8501F7B91FA607F3C4E78ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifi.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\device-class\new-ui\wifi.png
Size 1KB
SHA256 4da7ccf08d94f78c5e45554f8998c0e5f6d0a07b8a3a9e4b109543db6bc9ba43
MD5 0b1670795f66ee2a2dbc06e50b513b0a
SHA1 4aa76292ede49e98596f5dc113b0ee50af1cd6b3
SHA512 d96c37b78d05051d50f165ceee27ad1b81307cafdcaf73900ac22c153442209db23ea58804fd95d14a34c5de5e35da63710021f5ed144486cfb5fc9469301b1e
TLSH
T1D731D8F794782A28D7F42374D4B656525EA5107C2A312048A4CECC72E8629700FCFC30
MD5 SHA1 SHA512 TLSH

Submit Download

new-header-logo.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\header\new-header-logo.png
Size 4KB
SHA256 98856383428042c14739159f4a62168e9394f774bf2b696d62f46d70fc2ba175
MD5 10eb51f76f3df7a82b05ed747e27c6a7
SHA1 157e45f82ba308431cecede2d753d775b54e83c8
SHA512 c497fad9597c699a7c6355a5aee999d8e240b1bcfbc39031f0c8b50bdb53f30f7fd43451ba3ea6b99e3fc414bfdd5dae11a499cc9585322b039e6ef87bc31917
SSDEEP 96:hA01037O0U9ioyaEffzO2KptwZi6ybhbrq76entTZV07l4h9GTob8t5yJX9bRUoT:Ra3RGAHzGtwZobdWNZV0l40o4nyJNVUk
TLSH
T1BF917DF99AA27C2BC4D46F39D5B1C2B493090391007539CB8684EF1DC6EFAD01B70020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

banner_catalog-bg-ru.jpg

Path C:\Users\Admin\AppData\Local\Temp\ext\img\installation\banner_catalog-bg-ru.jpg
Size 74KB
SHA256 1fbb1510ae2f6db083cddf7c0f16364d5f5d2938737a297556c268c039a28165
MD5 fc675ccc770f9459495f4c5f5f0e5495
SHA1 483f47962fd59937ef8d7e49a713d0fb6997dc3e
SHA512 65015dd2f41b5e50eddfd9615882061b3e7897005587996e5e009daa62ac6164c4f3444ec3da8fa15ebb07f5fde25f699cdd85f0a9ed7f33a1225240efb1fde9
SSDEEP 1536:uKrip/l9NctUJnE+nOaWRiAo7bxpdHAeY4rEeIZ9ZOQ1X1I/q:Nip/lreUxLWnoXfGe5E1Z9ZOaX1p
TLSH
T1177301D7DBE397A0FF2F9FC40884A46C027AF3D14ED669454215088CD1A8F9979AEC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DP_Touchpad.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\installation\drivers\DP_Touchpad.png
Size 888B
SHA256 025e7e8699fd9c246452c6634d4935149baa6a6acadb91b0f9adf52d11a094f9
MD5 e9c35a488b41ffa9645c0592b13c8c15
SHA1 f54aefb44fe34cceae28a808c270fe8f670b922f
SHA512 33ab1cace6ff121a34d262855219cfaf22c4e3b94eeacabfd3ee290784c261885a270aec9354d639ccd9bbcba3eeb658554ae440373c43cc8cc35313f7867485
TLSH
T1B711E6EC5BC2BD5C080C2C739E8C9C21C5107376C0FA3178A1A71022299EBFF8070D89
MD5 SHA1 SHA512 TLSH

Submit Download

arrow-recommend.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\new-ui-assistant\arrow-recommend.png
Size 1KB
SHA256 fd42158b4e01b5c86360c9450e9e3db5e399e0eadb28e5420ac69f7da1dc0fc5
MD5 a2b5d78a49f66313a203f666faa64393
SHA1 99c22fd6116d69cd2d21aba072f050b5d8f51006
SHA512 03a7abce1b4c2bf82f40ba9af1f25022bc20aaddd745b08fada7ac01dffaab05697880f080d38b4672905aad2d0bed319a83e13c3d247b3900673e76fab8cadc
TLSH
T17411E9E6CBB41932EB915F340D7362349E96C9E50343A8600706AE21447251835CACE2
MD5 SHA1 SHA512 TLSH

Submit Download

icon-footer-splite.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\new-ui-assistant\icon-footer-splite.png
Size 4KB
SHA256 5e45160ca10f9237661f7c76880f1fed2dc5d2e147061daeeac7080df1502774
MD5 9d355f967c8a9312dc7453f97af3d393
SHA1 28dec943e5cbbb56f9676e9f420b0b7742bc861a
SHA512 d42b873275465473ef4539b83a7f9b6807a9dae24a35b47ab47840733e00ca7ff4ebe7cfbc297162bd8d78c2b7a63fd4dea01f05e076d7b6637517ed49060696
SSDEEP 96:tkhshnh/FruEd2bDbCMUgkBKL30ZO9z9Zjad/70BB:MsHxHcbDbCMdh0ZYLuO7
TLSH
T1E2B15B4D23F6A837AACAA37B13B54204B2BD807DCF43350B4B27650270137F96A20AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arrow-top.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\screens\arrow-top.png
Size 2KB
SHA256 4f2785a950320440acd22fcc0274944b971d5975de008f69bf81d19d44842925
MD5 c88c78c9dcf11880a801e44e705f9708
SHA1 7b98255e87f81c3a655d375f112c188d9bd241a7
SHA512 ea1fd00c23c7abdcdcecfce5d93b1946763043bc18cb17846ab3ecb607f19a7ede63ca5308cae6e2395053b223a4e438111cb6170264cc42c817130bd178ff4e
TLSH
T1D9515ACE3419E02EC606B4B1948BEF49DEB8047E6E87440124B411BF2D4F54A9109FB1
MD5 SHA1 SHA512 TLSH

Submit Download

new-ui-logo2021.png

Path C:\Users\Admin\AppData\Local\Temp\ext\img\screens\new-ui-logo2021.png
Size 5KB
SHA256 a11af07103005c27c0a5f721d99482e4700c21c85afcbc8e44e4e785af5fa902
MD5 ed623a69120325b464bc149ba5829465
SHA1 17ba0cbe9a7297824d8792becae98d8853c56af6
SHA512 fc18cde812cd2ac9e8f835971f4226092213737220e70e095bc5186042c061bf335501b098966c34a8c55610afea626061856740532166ea26c71c018b6059e7
SSDEEP 96:4TOaAISyg+Y+bVQjtSiqg/6HicIDFkun8ev5L6HIFJrQSHhwIL29Z33KL6OkY+u7:ja9S/+TQUXO6HIFPn8Q5WozrQSHhwr3Q
TLSH
T11AC18D5A5669D23E740A037B83D5D7F54C0830A06128517BEBF9E9E0B2094CADC66ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.js

Path C:\Users\Admin\AppData\Local\Temp\ext\languages\en.js
Size 86KB
SHA256 a3df7c1b150504fb96555d8d7f7b9c4129a3225ba241da983d56a9c7a1404aec
MD5 7507c4174ced52a6c0e1b2bb12ce9f3e
SHA1 6bad4ef261e7b7ab1a02d46341bd1f8a922987da
SHA512 d13d045bd66bbf104ec533903e4b7bb76dd56f6a1c8346787f419bf1cd0eafc082e757e0c244024d778755c4ab4468da455f2f92fad7f5fdb7a0135c9c6e26cf
SSDEEP 1536:hG6ESF4kZyhhVP7JLMse99ZzVQl3fw1zLG2b8ONtmek0bE65A7bnajoEPX0EtpX6:U6EGZyhXJYNZi2bTRH6
TLSH
T18D83860596248B3B18D213ABB24B56E3B3608E9242B5341D17EFD01D231FA5F52B76EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.hta

Path C:\Users\Admin\AppData\Local\Temp\ext\run.hta
Size 2KB
SHA256 02bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
MD5 6bcab16cd99663b1093d10f827ca0323
SHA1 47b2d7f33da12d88095379fc8ea5bb7114ce75e9
SHA512 67c23c1f3e8023001336ff7fc9c9052220f2ab67df280ef269b0239d67dfc67e6783dda44dec747ba6689c239d7efdb55262d098868e43ab70a055429349210e
TLSH
T19F5160A44CAF6485E02BA0A35BFB36282263816B9544ECCD3ACCA158FF90705C8677F5
MD5 SHA1 SHA512 TLSH

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\ext\start.bat
Size 90B
SHA256 88ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
MD5 f66f13d4770eb90e6d81222fe3525a3f
SHA1 f21bc06a179c108d13c783600b98ea0641076127
SHA512 3f321a339dee086f474d5ac9e8b247805d070b6c0ab5f9d85c5f1075021a3eb7ae23ab2b577000adc30ad32e66a1e291993f435f8539bb0032a1aca038e1f1b2
TLSH
T1AFB012304C3404417012DC18100721551B0C61EFA800154C20E23025C89FE49095E8F4
MD5 SHA1 SHA512 TLSH

Submit Download

run_command_4447.txt

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_4447.txt
Size 9B
SHA256 51e6af14fa1e9032300dbf76a85cb8561e523e89c363cec09cdc2128801a191d
MD5 47a22a7a342fd09177c62fcb8054933c
SHA1 d2b7928a34eedb04acc61c3a0e01d3138295e855
SHA512 b9ab174618fe617b061e27c8f0d4b7960271952a67245c2ad6155e93e0c08cab696191fbc7069c89f05ff545318f930cbd0dd7dc41b9cca0e7356143d3b47d98
MD5 SHA1 SHA512

Submit Download

run_command_86630.txt

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_86630.txt
Size 9B
SHA256 195418a93d769a17558aa804568eff487979e62d0731aa8c63d8d0ffc1723321
MD5 02466847c63e90c5041b8dd7990dce27
SHA1 fdcf71f16e2efcb8815730b4cca5f580b185cf5c
SHA512 86b11957db369afa71831c72848b897aafd155887467a377484d0346dcaeaac88476cad2331e34a24e7f8ac3a07335dd1e639ae27bfa0d4491dcc6a48a7e6ff3
MD5 SHA1 SHA512

Submit Download

wget_finished_56338.txt

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_56338.txt
Size 7B
SHA256 9a25234ae91ada142892f61bb4a52640d8854872909068b7b1c307a8e16591ed
MD5 d0d964be87663c957866cc96319a0f2e
SHA1 5a4af1923a1aa9fbdf7f92e9afbc2e47a0297e7f
SHA512 6f4ded4aeca348cd9234ca0ab1db569338793c586e086db06580a1a879c0c62258fcdfc25fe80d7da376508edd9f023d07183ab89c70ed8663d338ac4163b1e1
MD5 SHA1 SHA512

Submit Download

wget_log_21339.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21339.log
Size 1KB
SHA256 be4b4f771737f4259b027ae3c37ff7f61c37886d993d78fc513047a6d5cdb0cb
MD5 ad1b7b5e1a29ae817a1a3bebe48297e5
SHA1 a0d692106e31fef3e1f0ca3f0a3fa71596754593
SHA512 e0927f083a529bf14c0df15e36d5f36161ca3f20804993e541b69a754e98b78d1bca5deb1396c74da5e7862654ec0c54ac65ec29c415d02dd89621aa4e6416f2
TLSH
T17B219A0581417D38D3F2A281B0A54232AE889D0933E78500B73EE4AEFB3476DF871382
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_24606.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24606.log
Size 1KB
SHA256 5cd4e8b0260bca134ab2fc86c1c797e85b4a072a105fee0567b31e7887b064b7
MD5 31e826a2cf8b05a7e235bb9a8d16f9d0
SHA1 299659dbd379334855a7b1d11bdb84452dadf870
SHA512 13e5e52a0fe3bc7b8bb0106eaa1a3041e19d67d81323e6b401cda75dbcd2a51cc2d105ca4a45e8c8e165f7590712d35136c034af6f2193584c218c61ce106a21
TLSH
T168216D099181BD38C3715A5DA0654236BE89AD4923E78100F73A99DEFF7065DF974382
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_49035.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49035.log
Size 1KB
SHA256 a77fa8ad53bcf95e64668cf3e3b17b42457a93c17c407728538e4f82de0eb07e
MD5 868c3059fe42a8d0f33213443c0649d5
SHA1 e82f4a80bd3f593e80c9b171fd33fc82e1be61d3
SHA512 c596bfccfe66b82037b7f235a8c7fe08d90e273e7728f6d0532138c5cfdc29711dbfebce746b451288dbd5e772e72ac4f13d9b5cc17efc9c41ba968fcb752f59
TLSH
T1C121AC494281ED38D2B65681B0924236BF88DD4823EBC900BB6DD8AFFF34599F9353C1
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_56023.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56023.log
Size 1KB
SHA256 3d64b03dd392bc2415106f7f3025096a888837e16b9a931e8a5e23fb0e4a79f5
MD5 0714513d855e0b6b066946cc6dc58136
SHA1 0519ead2b7ca43443281374a82fcc86d426a671a
SHA512 5853b171a2c3cf2ac711c02e10ff6b7b544e03b20812dcad66914995b12a341388bea3680854bdc1efd9c33871166f8b58282368e5ba546609da420fcdda5128
TLSH
T1E0217C494156BD68C3B26246E0990332AF8D9C4927EB8100B73DD9EEFB74599F970381
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_56338.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_56338.log
Size 1KB
SHA256 6262e562425f11ff313997295472a855bbc26d1a7de204574a4a0a0bb28ce6f4
MD5 e7c92a2e3c08cdffead8e01c83e561e7
SHA1 e0beed8500df0872fae7bb712ad63b5590f5c7cf
SHA512 706b41ac92691e77a551d58f2c6ebaa4711caecbef65bebf305f3af73e4280de1f361f8e182f7556330b7e941f30f3974dfc107980624c8f3a216daaf074ef43
TLSH
T14A217C4DC1417E38C3A1965EA0650233AE89BD8927E78101B72ED8EEBB7465DF974382
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_67359.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_67359.log
Size 1KB
SHA256 38cfaba40a8dda6c6c018f7c20200af947d8d1d84b140a998c55a64fb7fc4bfd
MD5 d8b8ec281404732307ce4cd5da6fec19
SHA1 0b3b912f61524648c30b876ae760b6602204c0a4
SHA512 ec1ebe9bf06b64bae29e1231ddee57fd247f1c726d2645794e34d5ea083b3ca85f63badc5c0acc76efd02bea9a058f9c7c229f60e34d862d0740807f62774f2d
TLSH
T103217C0941566D78C3B26255A0890236AA8C9D0927EB8100B73D98EEFB74599FD34381
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_71888.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71888.log
Size 1KB
SHA256 1b8497b728f089170c59820add18d1e7744ad65b46959349eb2571c869eb44d9
MD5 c7391a36c1eb9209ec8e3065b309d71e
SHA1 fbe02c5d445b5273aeb297f694487edd45113905
SHA512 622d5da6be5511b0209474fa32f22e43398aafead2f364507f0ed30ef2ab58806afd2a4f55cc35d74d67f774020ff4e4014bf82812cee17b623149ec45b93e66
TLSH
T1B421AC494681BD38C3B65681B4814332BE88DD4823EBC900BB6DD5AFFB7055AF935381
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_77580.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77580.log
Size 1KB
SHA256 3098031a363f877e7a215a86591086d438fdad2d7380e2201d8cdae2d7a5f11e
MD5 cc791b76285b68e688d535c0c7804d70
SHA1 8d75547a21e94e68e1b6b394e0b46ef120c352d8
SHA512 5f0094b90d1dacdc827d695de6078f0a0119bfb8795da7453193f3dd7ea4b6ec995b41d888ca8f3480bdbd35ed84400931655cc6a4150a06afd92ce4977e4c8c
TLSH
T1D9217C4E81527D68C7A29745A0510332AE8C9D0827E78101BB6DD9AEFF746DAF9743C1
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_77666.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_77666.log
Size 1KB
SHA256 fa5c5a231725579366ced17734d6ae3944cefc31bd933b2cab843c605d00da04
MD5 e194a1ab302f2b62cc53640af358b604
SHA1 ff101be18bf551ce54706e93171728f7ca561090
SHA512 e6ffbd32437c03926870096e571bcfa756a67d90c28cec172985886d38fc8802fff4c450f599666393be03de28eed61db228f8a09bbc2bafb2d535242de2db33
TLSH
T1DB217C0D81567D78C3A26645F0990232AF8D9C092BEB8100B73DE9EEBB74599F970382
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_78602.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_78602.log
Size 1KB
SHA256 81c2f7682b3895f0bb50f199b62b253765938389377249f16f8fe973f295294c
MD5 611f368c43d1799a15c2fb7a1a1f74b3
SHA1 07996036887ad0b4bea7d4d4a09c86187702c94d
SHA512 a9cce520dd880b48f008c4d26145990a3ee6a8a9f80a56eb95fa068014b3c31197b96c822402bb9a5580bce6f42204b7a96ca720c1d95b3db47607e53d0063d4
TLSH
T19B216A0A81527D68C3B29649B4910337AE8C9C0823E78101B76D95AEFF746DAFC703C1
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_83990.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83990.log
Size 1KB
SHA256 927fc7aff507020c9797eddf550d596e19340fa768b7f79fafdd584481913d0b
MD5 82fb74fb849ce572c389d3e3faeced04
SHA1 45ae990c06b002c06bed7a1ec927b838892a679d
SHA512 1e35d51fdcdce2d30af14ee8b30b3f4e5995a5e3f5607a9c7acf61f3d5c64d8563698105d3a3caef837ed8eb8307e67c306645eba8a3029eb0cf5c028997eca0
TLSH
T1D0216D094285BD28C3B55681B0910336BE889E4923EBC900BB6DD49FBB74559F875381
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_89953.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89953.log
Size 1KB
SHA256 7e8b49990b2b56c007f859909514e14ef52113cbcbe1832ac9144bef44cb2b5e
MD5 a2d5fd078c0ab16024b33e79eb2b4cd2
SHA1 c512f0bb865212fdbbd93c22a6dda25d1a939a18
SHA512 1ec109e5cff525981a825205669b84639906576c71a5b2dcea2dc3d6a77e705649f0ad764679a8ce9e050e3ad7307230a1facc82ac01a02f25995cf1eab5cacd
TLSH
T13B21CB0941817E3CC7B65241F0450336AF8D9E4867E781007B3ED8AEBB7069AF8703C2
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_9098.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9098.log
Size 1KB
SHA256 1bd50e6f3b7740f22718864115dc193615dacb3ed9cef81ff382f8a68044ca46
MD5 eaca7b9ec42d218093c94b5337493b55
SHA1 4d828badf487397655a00b9614f8213bd7bc3955
SHA512 3842a7970dd0dcda34e1abd413e36d8b175ce74f71e3cba2cd725f08134b37763c76cbef4569ff96048188e5433d28b28def4e44595961710ca507aa676a1e10
TLSH
T17E217C594191BD68C3B29382B4524232AEDD9D0533EB8200B77DE5AEF7705AEF875382
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_92268.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92268.log
Size 1KB
SHA256 1777831860a7c27947835a0d4692a0888c2fa1fbd2052b43635b352126c57c34
MD5 46eed01bd7bae4895d7d1fcc7e8a3cd8
SHA1 bc440aefbbec7726ba2750d03c2bd3fb645526ba
SHA512 d0f8010c49f0f4aade86be38b083e8b1355cd3f23f5c25384e23780fbfe790f38f7b4e07eb567f50d5ca4f2d5a8ed4f871e3ac3b50c55e046cfbbedf557b94ac
TLSH
T1CD216A0A4152BD69C3B39645B0610336AE8D9C4923E78101FB6DD5AEFF3069AFA703C1
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_95835.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_95835.log
Size 1KB
SHA256 2a19541e79f5a61938ce39415e1c8058bf165d48f4ac727f57d9bf7b783cd28f
MD5 aabe692b77fba310d8ebffbbc38a9211
SHA1 fc1c9b48d19f1a24f10b4e7f6455f83a3e2a1ed8
SHA512 86c48f8ce89cfcb7bf5882d1381d805e93ec8ffa1f84300f48ac36ff13adeaa9f0daa61848317881df075b51798d98c318b8e7b3c0d041886851c4d219296a6c
TLSH
T1E0217C6942427DB8C3B19781B4514233EE899E0973E781007B6FE5AEFB74579F874382
MD5 SHA1 SHA512 TLSH

Submit Download

wget_log_97020.log

Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_97020.log
Size 1KB
SHA256 1854cbbeb2bdfba2a420b70de2e92d37f273d163100ecdeb1a5720bc90258f79
MD5 903bd1986a121bd0ee308cd43004a78d
SHA1 851d09e4610d374eca85b9c5f64bf573e477fc66
SHA512 33858a94b54b0dc8bb96ffb2babd2cbfbeb178d4911a286f18e5ea9130f5b222c03fd41d867e36ede2ab35a3942e3911de604f0fa0c33dac4e5e824489d96ce9
TLSH
T16921AC0991417D38C7B1975EA0560333AE89AC8923E78101F72EDAEEBB3065DFC74382
MD5 SHA1 SHA512 TLSH

Submit Download

memory/220-1331-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/220-1323-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/552-1415-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/640-1503-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/640-1508-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/640-1480-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/648-1649-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/700-1675-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/756-1364-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/784-1858-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1272-1454-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1460-1904-0x00000000008E0000-0x0000000000E95000-memory.dmp

Download

memory/1612-1478-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1652-1563-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1652-1567-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1664-1891-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1664-1628-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1664-1610-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1708-1501-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1792-1673-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1920-1756-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1920-1849-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1972-1630-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1972-1609-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2020-1591-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2076-1696-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2356-1712-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2356-1738-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2364-1860-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2364-1761-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2516-1450-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2712-1284-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2772-1383-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2772-1406-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2856-1255-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/2856-1278-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3364-1371-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3364-1627-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3424-1423-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3452-1902-0x00000000008E0000-0x0000000000E95000-memory.dmp

Download

memory/3672-1325-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3672-1357-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3728-1431-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3728-1446-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3780-1241-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3780-1272-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/3976-1420-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4044-1324-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4044-1345-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4116-1512-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4116-1533-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4200-1585-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4296-1907-0x00000000008E0000-0x0000000000E95000-memory.dmp

Download

memory/4452-1702-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4452-1356-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4464-1635-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4464-1653-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4480-1888-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4488-1892-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4492-1917-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

Download

memory/4492-1736-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4492-1711-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4492-1916-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

Download

memory/4492-1915-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

Download

memory/4496-1545-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4496-1511-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4544-1495-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4612-1906-0x00000000008E0000-0x0000000000E95000-memory.dmp

Download

memory/4632-1905-0x00000000008E0000-0x0000000000E95000-memory.dmp

Download

memory/4644-1883-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4768-1550-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4816-1647-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4816-1634-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4872-1510-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4872-1552-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4916-1270-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4920-1326-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4920-1353-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4972-1602-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4972-1607-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4980-1672-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4992-1472-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5004-1867-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5020-1337-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5040-1555-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5076-1596-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5096-1708-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads