Overview

overview

8

Static

static

3

beetle-cab/7za.dll

windows10-2004-x64

3

beetle-cab/7za.dll

windows11-ltsc_2024-x64

3

beetle-cab/7za.exe

windows10-2004-x64

3

beetle-cab/7za.exe

windows11-ltsc_2024-x64

3

beetle-cab/7zxa.dll

windows10-2004-x64

3

beetle-cab/7zxa.dll

windows11-ltsc_2024-x64

3

beetle-cab/start.cmd

windows10-2004-x64

8

beetle-cab/start.cmd

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    112s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 12:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    beetle-cab/start.cmd
  • Size 86B
  • Sample260804-pfhk6swvbw
  • SHA256 030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3
  • MD5 SHA1 SHA512 TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 52 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\beetle-cab\start.cmd"
    1⤵
    • Checks computer location settings
    • Executes a command shell one-liner
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\beetle-cab\7za.exe
      7za.exe x -y -aoa -pbeetle arc.7z -oext
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx
      2⤵
      • Badlisted process makes network request
      • Checks computer location settings
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32 kernel32,Sleep
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1160
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_729.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall delete rule name="DriverPack aria2c.exe"
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:3568
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_71229.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe"
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:116
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80767.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_80767.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80767.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3960
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73368.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_73368.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73368.log"
          4⤵
          • Executes dropped EXE
          PID:3888
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44749.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_44749.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44749.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:4284
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70007.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_70007.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70007.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42164.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_42164.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42164.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:472
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64416.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64416.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64416.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25439.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_25439.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25439.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29698.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_29698.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29698.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:4820
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27592.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_27592.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27592.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2732
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3523.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3523.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3632
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3523.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:652
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7235.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7235.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1864
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7235.log"
          4⤵
          • Executes dropped EXE
          PID:2248
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70687.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_70687.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70687.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3076
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7147.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7147.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7147.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1932
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23004.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_23004.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23004.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2328
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65338.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_65338.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65338.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3064
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16752.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_16752.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16752.log"
          4⤵
          • Executes dropped EXE
          PID:3988
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9369.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_9369.txt""
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_9369.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94583.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_94583.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94583.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1628
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4120.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_4120.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_4120.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3144
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93177.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93177.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93177.log"
          4⤵
          • Executes dropped EXE
          PID:1088
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22169.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_22169.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22169.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1104
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69348.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_69348.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_69348.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1468
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40369.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_40369.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_40369.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3364
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7280.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7280.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-PROTECT-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7280.log"
          4⤵
          • Executes dropped EXE
          PID:5100
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65219.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_65219.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65219.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13533.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_13533.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_13533.log"
          4⤵
          • Executes dropped EXE
          PID:2452
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21114.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_21114.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4068
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_21114.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3844
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61348.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_61348.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4376
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_61348.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:4768
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31867.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_31867.txt""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4788
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-5.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_31867.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1660
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35161.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35161.txt""
        3⤵
        • Executes a command shell one-liner
        PID:3312
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-DIAGNOSTICS-6.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35161.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:4284
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7957.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_7957.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3928
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7957.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25170.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_25170.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4276
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25170.log"
          4⤵
          • Executes dropped EXE
          PID:4108
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55322.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_55322.txt""
        3⤵
        • Executes a command shell one-liner
        PID:3208
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-CONFIGURATOR-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_55322.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1748
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82013.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_82013.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2876
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/EXPERT-SETTINGS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_82013.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20211.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_20211.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4168
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20211.log"
          4⤵
          • Executes dropped EXE
          PID:1176
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16236.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_16236.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5072
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16236.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:5032
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17224.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_17224.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2420
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_17224.log"
          4⤵
          • Executes dropped EXE
          PID:1536
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96136.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_96136.txt""
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5064
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_96136.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2724
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_81572.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_81572.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:4220
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_81572.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:912
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92036.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_92036.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:544
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_92036.log"
          4⤵
          • Executes dropped EXE
          PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83215.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83215.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3236
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83215.log"
          4⤵
          • Executes dropped EXE
          PID:3932
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43051.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_43051.txt""
        3⤵
        • Executes a command shell one-liner
        PID:1936
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_43051.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:420
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20612.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_20612.txt""
        3⤵
        • Executes a command shell one-liner
        PID:4156
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_20612.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93340.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_93340.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5044
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_93340.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1380
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19780.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19780.txt""
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3416
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19780.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94829.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_94829.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2348
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/COMPILATION-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_94829.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1640
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34094.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_34094.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2860
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34094.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89962.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_89962.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:5040
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/SERVICE_MODE-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89962.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:4728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19340.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_19340.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2592
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_19340.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3024
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35372.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35372.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4196
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35372.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33904.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_33904.txt""
        3⤵
        • Executes a command shell one-liner
        PID:912
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_33904.log"
          4⤵
          • Executes dropped EXE
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:900
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71216.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_71216.txt""
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1708
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/ISTART_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_71216.log"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1824
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" start wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2632
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89936.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_89936.txt""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1628
        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
          "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_89936.log"
          4⤵
            PID:2940
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8834.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_8834.txt""
          3⤵
          • Executes a command shell one-liner
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2556
          • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/WAITING-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_8834.log"
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4880
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86695.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_86695.txt""
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2452
          • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_86695.log"
            4⤵
              PID:2992
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48223.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_48223.txt""
            3⤵
            • Executes a command shell one-liner
            PID:3052
            • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
              "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_48223.log"
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2864
          • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\Tools\driverpack-7za.exe
            "C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\Tools\driverpack-7za.exe" a "C:\Users\Admin\AppData\Roaming\DRPSu\snapshots\DriverPack_Snapshot_20260804_131847.zip" "C:\Users\Admin\AppData\Roaming\DRPSu\diagnostics\*"
            3⤵
              PID:4284
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24989.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24989.txt""
              3⤵
              • Executes a command shell one-liner
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2448
              • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
                "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24989.log"
                4⤵
                  PID:4812
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75162.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75162.txt""
                3⤵
                • Executes a command shell one-liner
                PID:3012
                • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
                  "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75162.log"
                  4⤵
                    PID:4900
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2164.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_2164.txt""
                  3⤵
                  • Executes a command shell one-liner
                  PID:208
                  • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
                    "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_4.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_2164.log"
                    4⤵
                      PID:2276
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75544.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75544.txt""
                    3⤵
                    • Executes a command shell one-liner
                    • System Network Configuration Discovery: Internet Connection Discovery
                    PID:472
                    • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\driverpack-wget.exe
                      "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en" "http://dl.driverpack.io/assistant/beetle/audio/en/FIREFOX_3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75544.log"
                      4⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:5020
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32 kernel32,Sleep
                    3⤵
                      PID:4684
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/ab/4/Internet-Start.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_99856.txt""
                      3⤵
                      • Executes a command shell one-liner
                      • System Time Discovery
                      PID:4184
                      • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe
                        "tools\aria2c.exe" "http://dl.driverpack.io/soft/ab/4/Internet-Start.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
                        4⤵
                        • System Time Discovery
                        PID:2576
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_91564.txt""
                      3⤵
                      • Executes a command shell one-liner
                      PID:4460
                      • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe
                        "tools\aria2c.exe" "http://dl.driverpack.io/soft/Chrone.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
                        4⤵
                          PID:4916
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaBlink64_win7.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_51088.txt""
                        3⤵
                        • Executes a command shell one-liner
                        PID:2720
                        • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe
                          "tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaBlink64_win7.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
                          4⤵
                            PID:2140
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_26753.txt""
                          3⤵
                          • Executes a command shell one-liner
                          PID:2028
                          • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe
                            "tools\aria2c.exe" "http://dl.driverpack.io/soft/OperaXP.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
                            4⤵
                              PID:520
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c ""tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120 || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_73082.txt""
                            3⤵
                            • Executes a command shell one-liner
                            PID:1956
                            • C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\tools\aria2c.exe
                              "tools\aria2c.exe" "http://dl.driverpack.io/soft/SearcherBar.exe.torrent" --dir="C:\Users\Admin\AppData\Roaming\DRPSu\PROGRAMS" --quiet --continue --min-split-size=1M --follow-torrent=true --check-integrity --seed-time=0 --bt-stop-timeout=120
                              4⤵
                                PID:2764

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Privilege Escalation

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Event Triggered Execution

                              1
                              T1546

                              Netsh Helper DLL

                              1
                              T1546.007

                              Defense Evasion

                              Impair Defenses

                              1
                              T1562

                              Disable or Modify System Firewall

                              1
                              T1562.004

                              Credential Access

                              Discovery

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              2
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              System Time Discovery

                              1
                              T1124

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              collect[1].gif
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\collect[1].gif
                              • Size 35B
                              • SHA256 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
                              • MD5 SHA1 SHA512
                              Submit Download

                              sync_cookie_image_finish[1].gif
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\sync_cookie_image_finish[1].gif
                              • Size 43B
                              • SHA256 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                              • MD5 SHA1 SHA512
                              Submit Download

                              CONTINUOUS-3[1].mp3
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JC22KH2D\CONTINUOUS-3[1].mp3
                              • Size 26KB
                              • SHA256 88d420fb6a0a847c522066698efec070203c436aa5e2ff2097bb2e5e3692150b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              WAITING-2[1].dat
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JC22KH2D\WAITING-2[1].dat
                              • Size 192KB
                              • SHA256 4bebba087f04d890c8191a8810bf7cbf714c30d590e8861fed90116952414a22
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              intro[1].mp3
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JC22KH2D\intro[1].mp3
                              • Size 27KB
                              • SHA256 8fcbf2cede0ba798aabc145593b273d3c76596ca9bce0a3138684fa7b416359f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CONTINUOUS-1[1].mp3
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6MRVMCF\CONTINUOUS-1[1].mp3
                              • Size 9KB
                              • SHA256 571aed8d5306ecfa709dc894f6fe66176bc99380ee42694328b3da237fd6b989
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DriverPackSolution.html
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\DriverPackSolution.html
                              • Size 4KB
                              • SHA256 8892e63141854bcf4bb1452abef68dd2c348c59322d697ef11a7ab7c5e3c4aea
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              driverpack-wget.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\Tools\driverpack-wget.exe
                              • Size 392KB
                              • SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ANTIVIRUS-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ANTIVIRUS-1.mp3
                              • Size 36KB
                              • SHA256 46d1565a9237f7ade1d03a2d70c084f5f688d6a0574220ecc5eb83d5cfd875ed
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ANTIVIRUS-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ANTIVIRUS-2.mp3
                              • Size 23KB
                              • SHA256 c87feb5bd45ff4ffb897f53c22e3e2f5732ad49d124724248a06627162bc40ab
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ANTIVIRUS-3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ANTIVIRUS-3.mp3
                              • Size 21KB
                              • SHA256 1d23cba7b365efc03cf981a61ad2faf55a93740e077e1ab6569a2ec2c58191fd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              COMPILATION-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\COMPILATION-1.mp3
                              • Size 17KB
                              • SHA256 ae70f1cc64550e94420d87adcaad724d1249982742c3bde5febad04eff28f988
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              COMPILATION-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\COMPILATION-2.mp3
                              • Size 22KB
                              • SHA256 d25c6a14bf6694641f0237ddeb0aef74112e1cae7acf77f753cbe20bb8bbd203
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              COMPILATION-3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\COMPILATION-3.mp3
                              • Size 17KB
                              • SHA256 0069a0aa7fe69bebf3154744535e3b52ced7362e07e0e832698629f68c02785d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CONTINUOUS-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\CONTINUOUS-2.mp3
                              • Size 26KB
                              • SHA256 a3857040e7a5e315d3fbab41ddb232465fc2b57db4aaedef2f3b74c699f01a8a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DRIVERS-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\DRIVERS-1.mp3
                              • Size 13KB
                              • SHA256 c960f5c70ef3d1a79a789c1ce2523a369b80ee05caedc2fde94a13a8f9f42c41
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DRIVERS-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\DRIVERS-2.mp3
                              • Size 36KB
                              • SHA256 f7a19341356126b54bbf079b8b99327fe00c4d272044eacd998fbb92beea5264
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-CONFIGURATOR-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-CONFIGURATOR-1.mp3
                              • Size 23KB
                              • SHA256 3aa947528d8e22c95fc3c2c189a223293746f65aa04a034ab7e51f07108b0e63
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-CONFIGURATOR-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-CONFIGURATOR-2.mp3
                              • Size 30KB
                              • SHA256 5a3e6a91181f9c87c354447d4e8c06a49cebfd06b2bb76683f44bb6a3200ee86
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-CONFIGURATOR-3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-CONFIGURATOR-3.mp3
                              • Size 21KB
                              • SHA256 78ae68bedd64b4cae4dadcf69c184b62c709756f9e2128bb178311431b4129ee
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-DIAGNOSTICS-6.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-DIAGNOSTICS-6.mp3
                              • Size 13KB
                              • SHA256 0116eef284c5228183cfd27992eda255775e5ea88b4e7739f2779967bd1b6fb8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-DRIVERS-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-DRIVERS-1.mp3
                              • Size 25KB
                              • SHA256 1f19a45b24a98014ab4821a1c80b1d2120f54e24cf2517b73f015141d6aa98ed
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-DRIVERS-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-DRIVERS-2.mp3
                              • Size 25KB
                              • SHA256 9f35f0dbff0fbd1362b8f221550bf9d63e5d30ee8487bb47c78edb1661a52b9b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-DRIVERS-3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-DRIVERS-3.mp3
                              • Size 36KB
                              • SHA256 540abfdf5e2894d09dded9dfffe2d1be207b484f32f8e0aa237aba52142eeb8a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-PROGRAMS_CHECKBOX_USED-1.mp3
                              • Size 42KB
                              • SHA256 90b0c57398a3dc95f089121e0873719e3fce5978a66bc3f8468fdb375287d37a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-PROGRAMS_CHECKBOX_USED-2.mp3
                              • Size 28KB
                              • SHA256 a5062cbc572ce18afb6e590a74a299f288c593de995841c13981c25a5cc3fcf1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-PROTECT-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-PROTECT-1.mp3
                              • Size 37KB
                              • SHA256 9545c34922b77b59a2fb172bad55f064e14761cf213b89061164cdcbdf8963a7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-PROTECT-3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-PROTECT-3.mp3
                              • Size 27KB
                              • SHA256 996744756df49ce498243a7fcd70cf5cc9c55f399b8027ed712485c6843d1ced
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              EXPERT-SETTINGS-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\EXPERT-SETTINGS-1.mp3
                              • Size 27KB
                              • SHA256 c924ba594bd39760e0939729a27a0bc201f61f8f2edc5123e4841f13cb7c5ccd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ISTART_1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ISTART_1.mp3
                              • Size 23KB
                              • SHA256 815f5cdc4f714576ff9e5b6ccab5c4cd227aa87add8237b3e5a88913867e8ce5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ISTART_2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ISTART_2.mp3
                              • Size 42KB
                              • SHA256 df1126cb3c694ba6e5fde3e2149cfa536e02072bcc52dce9cf481fe9f9575401
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ISTART_3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ISTART_3.mp3
                              • Size 14KB
                              • SHA256 23a69131f2b1ea74723a087a9e0137c202f4f9439c165c6f0784b2fde7d3e7b6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ISTART_4.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\ISTART_4.mp3
                              • Size 18KB
                              • SHA256 618eb740f1dcaf902215f7a3d77d69a1a07bcc46ee9e96156d524d1eb3ee38f2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SERVICE_MODE-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\SERVICE_MODE-1.mp3
                              • Size 43KB
                              • SHA256 74ef8c36b37524515e37100952f7a36faa0f3163d6d5388f360dce946ad4fa28
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              SERVICE_MODE-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\SERVICE_MODE-2.mp3
                              • Size 36KB
                              • SHA256 527f93a6a3159de9a01242e8a1f85c568651bd711da175e5a6c9fe1942224b97
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              START-INITIAL-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\START-INITIAL-1.mp3
                              • Size 20KB
                              • SHA256 7ce172ba3df0c381dabc6688dc584035860052b57242ec01ee3adc60ccb3bbc3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              START-LOADED-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\START-LOADED-1.mp3
                              • Size 38KB
                              • SHA256 3a2f113b271e4a4a6bc8be28f4396babf7e92331492074c29dbaa83d0c09ad57
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              START-SETUP-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\START-SETUP-1.mp3
                              • Size 24KB
                              • SHA256 f01ce28bdb7af9b93ed9e255d5f2c4b7860c97d2f0d58339dbd489828b3484ba
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TEAM-PROOF-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\TEAM-PROOF-1.mp3
                              • Size 40KB
                              • SHA256 07eca9f5ef7741062a9081a42dc70200ab38b0a48f31ac62393332ac24e97089
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TEAM-PROOF-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\TEAM-PROOF-2.mp3
                              • Size 60KB
                              • SHA256 09bd89dd7b59b6403c9fc495d8e4780840f9ade3ae9744f684e90876b250f981
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TEAM-PROOF-3.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\TEAM-PROOF-3.mp3
                              • Size 17KB
                              • SHA256 91c9b43045e05c5ea9debee09aec46356c9a286369569508181117ac98f6c487
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              WAITING-1.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\WAITING-1.mp3
                              • Size 23KB
                              • SHA256 cc85ff5e54762063c62237ff6e23c59fafe4ccc5b91333aefcc4286b6eb5c68a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              WAITING-2.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\en\WAITING-2.mp3
                              • Size 26KB
                              • SHA256 49f80e6ee7ae260d208deea397931f9fd9f6d1cd540e27d2f3e3263385830dba
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              STORIES-adout-8.mp3
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\audio\ru\STORIES-adout-8.mp3
                              • Size 17KB
                              • SHA256 c2f79a0267df7d522b13e49b406f74892cc6744b88204449387a335cf525550d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              config.js
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\config.js
                              • Size 3KB
                              • SHA256 18f86ef3fad86c97d56274e5577b178a77f40587a80451a971013248e37190a6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              custom-control.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\custom-control.css
                              • Size 10KB
                              • SHA256 7d7853e95258a7a3f8eaf41795f7124e7d2dacdeb5f1efe212b3ff7ed0da9e50
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DRPicons-webfont.eot
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\fonts\DRPicons\DRPicons-webfont.eot
                              • Size 7KB
                              • SHA256 0a04d85875091cc334f63b90c8ccfa0838f20023945d949296363369066870e3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              opensans-regular-webfont.eot
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\fonts\Open-Sans\opensans-regular-webfont.eot
                              • Size 40KB
                              • SHA256 3ae576bfa96d7cf6614c8c97290c7abe03191a8ceb0c837a21e7ffe70d66ca62
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ProximaNova-Bold.eot
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\fonts\ProximaNova\ProximaNova-Bold.eot
                              • Size 141KB
                              • SHA256 1c3a470bf710204b1dbd65679b914af4b94e7f018b1f7df3d61ff863d6f335d9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ProximaNova-Bold.woff
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\fonts\ProximaNova\ProximaNova-Bold.woff
                              • Size 57KB
                              • SHA256 2a8f208d9d8556ff58da8a420316de6d634a568a0eeb94c043430659fff7d338
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              proxima_nova_light-webfont.eot
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\fonts\ProximaNova\proxima_nova_light-webfont.eot
                              • Size 61KB
                              • SHA256 53f30a622db68cebe92dbd384cc292aef13ad7e3349a10a77c29326e10634c21
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              proxima_nova_semibold-webfont.eot
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eot
                              • Size 65KB
                              • SHA256 790579e11608136663d073bc6f99848c04b4dcd69216df7daf5be00df573a3fd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              icons-checkbox.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\icons-checkbox.css
                              • Size 444B
                              • SHA256 cb134dcb95a407795c671a512c389894d3525fba3f6a2168fc5b9b7e875e78dc
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              icons.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\icons.css
                              • Size 509B
                              • SHA256 b5f111103f7f090c246a223b1ff497b94c4dd3ac64bf5b3fb2d91555fcfd6f2c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              normalize.min.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\normalize.min.css
                              • Size 1KB
                              • SHA256 86235e2c477078adfe1188d07ca1e5d8198443aaf2436de1785a169f3e1d5463
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              open-sans.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\open-sans.css
                              • Size 1KB
                              • SHA256 b9bd51ae6ccc7df20417e0ef341295b86bf8f74f6e235ee99ddefd675806f47f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              proximanova.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\proximanova.css
                              • Size 2KB
                              • SHA256 931071422410d73d9d7d3583745e476eac23c0cac5fbe344f8436499ee40ac46
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              roboto.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\roboto.css
                              • Size 1001B
                              • SHA256 2537efe2fb974f58cddbc99abfcd7aed6e9df81992eed3e528b5f1748167b8fa
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              style.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\css\style.css
                              • Size 14KB
                              • SHA256 3f8ec31a3c08de6c1aac117347b1b83f391bb0a91c9dbdc57ba9d11d5ba372d5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              drp.css
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\drp.css
                              • Size 189KB
                              • SHA256 68f09ef8144c09433c19d0d139fde1eda7f0a9b69be828e90410bb51c49cc030
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              drp.js
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\drp.js
                              • Size 3.7MB
                              • SHA256 c0ae6134f693b80d71ece89965cde42c819e815c7218d54fcfad0372a62dec21
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              5.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\assistant-faces\start-screen\5.png
                              • Size 75KB
                              • SHA256 ad615ef1f7016826d475fe90b4363cc149b060de2b9406b4c58cb4a4f1938bef
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              wifi.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\device-class\new-ui\wifi.png
                              • Size 1KB
                              • SHA256 4da7ccf08d94f78c5e45554f8998c0e5f6d0a07b8a3a9e4b109543db6bc9ba43
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              new-header-logo.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\header\new-header-logo.png
                              • Size 4KB
                              • SHA256 98856383428042c14739159f4a62168e9394f774bf2b696d62f46d70fc2ba175
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              banner_catalog-bg-ru.jpg
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\installation\banner_catalog-bg-ru.jpg
                              • Size 74KB
                              • SHA256 1fbb1510ae2f6db083cddf7c0f16364d5f5d2938737a297556c268c039a28165
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              DP_Touchpad.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\installation\drivers\DP_Touchpad.png
                              • Size 888B
                              • SHA256 025e7e8699fd9c246452c6634d4935149baa6a6acadb91b0f9adf52d11a094f9
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              arrow-recommend.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\new-ui-assistant\arrow-recommend.png
                              • Size 1KB
                              • SHA256 fd42158b4e01b5c86360c9450e9e3db5e399e0eadb28e5420ac69f7da1dc0fc5
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              icon-footer-splite.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\new-ui-assistant\icon-footer-splite.png
                              • Size 4KB
                              • SHA256 5e45160ca10f9237661f7c76880f1fed2dc5d2e147061daeeac7080df1502774
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              arrow-top.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\screens\arrow-top.png
                              • Size 2KB
                              • SHA256 4f2785a950320440acd22fcc0274944b971d5975de008f69bf81d19d44842925
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              new-ui-logo2021.png
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\img\screens\new-ui-logo2021.png
                              • Size 5KB
                              • SHA256 a11af07103005c27c0a5f721d99482e4700c21c85afcbc8e44e4e785af5fa902
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              en.js
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\languages\en.js
                              • Size 86KB
                              • SHA256 a3df7c1b150504fb96555d8d7f7b9c4129a3225ba241da983d56a9c7a1404aec
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              run.hta
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\run.hta
                              • Size 2KB
                              • SHA256 02bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              start.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\beetle-cab\ext\start.bat
                              • Size 90B
                              • SHA256 88ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              run_command_71229.txt
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_71229.txt
                              • Size 9B
                              • SHA256 51e6af14fa1e9032300dbf76a85cb8561e523e89c363cec09cdc2128801a191d
                              • MD5 SHA1 SHA512
                              Submit Download

                              run_command_729.txt
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_729.txt
                              • Size 9B
                              • SHA256 195418a93d769a17558aa804568eff487979e62d0731aa8c63d8d0ffc1723321
                              • MD5 SHA1 SHA512
                              Submit Download

                              wget_finished_64416.txt
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_64416.txt
                              • Size 7B
                              • SHA256 9a25234ae91ada142892f61bb4a52640d8854872909068b7b1c307a8e16591ed
                              • MD5 SHA1 SHA512
                              Submit Download

                              wget_log_16752.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_16752.log
                              • Size 1KB
                              • SHA256 441c3ed3e555b88195178594e13176b279434635c8ded465a169ea23012c0f67
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_23004.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_23004.log
                              • Size 1KB
                              • SHA256 0d5ce5a3ea6f20101c1a789bfff95208547b2682631f4e732ac932c7cfeea74d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_25439.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_25439.log
                              • Size 1KB
                              • SHA256 17de2af05f04e4a7f6fb4a97c4c9b8399bf9c2362c55acc524b47dba1f55fb37
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_27592.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_27592.log
                              • Size 1KB
                              • SHA256 acd3d1cc3aae469f2992566f0785b50be187daf95d59b69b21aae9302a513c09
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_29698.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_29698.log
                              • Size 1KB
                              • SHA256 14b6dc81b9ac6e63f658dca215dbc8bbe46f7ce5b7b12b5a1500169c9758022e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_3523.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3523.log
                              • Size 1KB
                              • SHA256 4cdd1a7a3e85f26a593fc798587e97e3cc613184e76e832ddde229be733e407c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_42164.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_42164.log
                              • Size 1KB
                              • SHA256 ae9ad64f975487c7600b3acc8dabb4caa8b9301192285f06a4c56807a1698c24
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_44749.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_44749.log
                              • Size 1KB
                              • SHA256 83b74ea143d5acc69edfa5ce70b05c0733650639b41ceaba17ed73e8133d02a6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_64416.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_64416.log
                              • Size 1KB
                              • SHA256 502724231445d0843010a2e18795cb95ea0014ec024bd22ac4a16c756a82d64b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_65338.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_65338.log
                              • Size 1KB
                              • SHA256 8b15697fa6a1cbf15704cdd5c806737cc150f9a0e19e04dc32f01d655a6e7d7d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_70007.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70007.log
                              • Size 1KB
                              • SHA256 de2b00457aba6442716314f66635868d197efac0f18c8a39321602eb57741a9e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_70687.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_70687.log
                              • Size 1KB
                              • SHA256 f35b7eb6be511337b7c24fc908b413ddb06c9bceae4e27c87d8f86c005064860
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_7147.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7147.log
                              • Size 1KB
                              • SHA256 1710a6596b7c075651709ee4d44017436b25185d5a28fb134ca29c1d0447bd0a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_7235.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_7235.log
                              • Size 1KB
                              • SHA256 068ecd18d20ba5e2713aa27d4cde2f0db5a77793546b55ad350fbd6ad42da3cf
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_73368.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_73368.log
                              • Size 1KB
                              • SHA256 9d74ec7fc521a36f111d9b47bc4967cc72aa9deee4c2e0490d45451549102f5e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wget_log_80767.log
                              • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_80767.log
                              • Size 1KB
                              • SHA256 639f889bcc541b993b52137ae6a9d453e5037fa9bd98cec3681677a30dc5727a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/420-1659-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/472-1290-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/472-1325-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/472-1395-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/652-1363-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/680-1709-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/900-1748-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/900-1753-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/900-1747-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/912-1619-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/912-1636-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1088-1465-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1104-1471-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1176-1614-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1380-1678-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1468-1493-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1536-1615-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1536-1597-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1628-1444-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1628-1430-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1640-1686-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1640-1691-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1660-1525-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1748-1583-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1824-1739-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/1932-1405-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2248-1347-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2328-1416-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2328-1384-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2452-1540-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2724-1631-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2732-1353-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2864-1803-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2932-1551-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2932-1542-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2940-1770-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2968-1684-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/2992-1797-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3024-1733-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3044-1638-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3064-1423-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3076-1365-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3144-1452-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3364-1473-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3364-1500-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3436-1259-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3448-1336-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3448-1573-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3844-1530-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3844-1506-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3888-1277-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3932-1654-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3960-1238-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3960-1264-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/3988-1415-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4020-1745-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4108-1579-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4284-1556-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4284-1270-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4436-1594-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4728-1707-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4768-1532-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4820-1341-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4820-1299-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4868-1641-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4868-1658-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4880-1774-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/4900-1827-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5020-1334-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5020-1298-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5020-1326-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5032-1612-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5032-1596-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5100-1492-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download

                              memory/5116-1448-0x0000000000400000-0x00000000004EF000-memory.dmp
                              Download