Overview

overview

8

Static

static

5

DriverPack...ne.exe

windows11-ltsc_2024-x64

8

run.hta

windows11-ltsc_2024-x64

8

start.bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    170s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 23:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DriverPack-17-Online.exe
  • Size 8.4MB
  • Sample261029-232nsagy7j
  • SHA256 2f37dfcda358f501cdbb57409b27e30db48ba9cba7bbbeab5e3b0c16c8e95c76
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Badlisted process makes network request 39 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 19 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 34 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 33 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe
    "C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\DriverPack\start.bat" "DriverPack-17-Online.exe""
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DriverPack\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} --sfx "DriverPack-17-Online.exe"
        3⤵
        • Badlisted process makes network request
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 kernel32,Sleep
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3796
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall delete rule name="DriverPack aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_90320.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3356
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall delete rule name="DriverPack aria2c.exe"
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3112
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe" || echo Done & call echo Done %^errorLevel% > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_79613.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5428
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="DriverPack aria2c.exe" dir=in action=allow program="C:\Program Files (x86)\DriverPack\tools\aria2c.exe"
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5904
        • C:\Windows\SysWOW64\wscript.exe
          "C:\Windows\System32\wscript.exe" //B prepare.js binaries
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5300
        • C:\Windows\SysWOW64\wscript.exe
          "C:\Windows\System32\wscript.exe" //B prepare.js binaries
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4100
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11436.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_11436.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:424
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/intro.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11436.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5792
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75454.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75454.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/START-INITIAL-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75454.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2716
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47084.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_47084.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:252
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/START-LOADED-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47084.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2768
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24474.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_24474.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:1176
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/START-SETUP-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24474.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:6120
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34151.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_34151.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_34151.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3092
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22273.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_22273.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4608
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_22273.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4516
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35808.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_35808.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2504
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/EXPERT-DRIVERS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_35808.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2832
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51305.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_51305.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:5144
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_51305.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4220
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_45061.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_45061.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_45061.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5500
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49950.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_49950.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3496
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/TEAM-PROOF-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_49950.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:8
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52177.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_52177.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_52177.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2912
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18931.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_18931.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4144
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_18931.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:724
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99663.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_99663.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_99663.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3584
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58617.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_58617.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4724
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-2.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_58617.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4316
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3009.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_3009.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:5032
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/ANTIVIRUS-1.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_3009.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5076
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ""tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83047.log" & echo DONE > "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_83047.txt""
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2568
          • C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            "tools\driverpack-wget.exe" --tries=3 --timeout 5 --retry-connrefused --wait=5 --timestamping --directory-prefix="C:\Program Files (x86)\DriverPack\audio\en" "http://download.driverpack.io/assistant/beetle/audio/en/CONTINUOUS-3.mp3" -o "C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_83047.log"
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4204
        • C:\Windows\SysWOW64\PING.EXE
          "C:\Windows\System32\PING.EXE" -n 3 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4008
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4848
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4040
      • C:\Program Files (x86)\DriverPack\Uninstall.exe
        "C:\Program Files (x86)\DriverPack\Uninstall.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
          "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Program Files (x86)\DriverPack\
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:2088
      • C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe
        "C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe"
        1⤵
        • Executes dropped EXE
        PID:5100
      • C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe
        "C:\Program Files (x86)\DriverPack\Tools\driverpack-wget.exe"
        1⤵
        • Executes dropped EXE
        PID:2396
      • C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe
        "C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"
        1⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4516
      • C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
        "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Users\Admin\AppData\Local\Temp\~nsu2.tmp\Un.exe
          "C:\Users\Admin\AppData\Local\Temp\~nsu2.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2944
      • C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe
        "C:\Users\Admin\AppData\Local\Temp\DriverPack-17-Online.exe"
        1⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:4464

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            JavaScript

            1
            T1059.007

            Windows Command Shell

            1
            T1059.003

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            1
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            DriverPackSolution.html
            • Path C:\Program Files (x86)\DriverPack\DriverPackSolution.html
            • Size 4KB
            • SHA256 8892e63141854bcf4bb1452abef68dd2c348c59322d697ef11a7ab7c5e3c4aea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files (x86)\DriverPack\Uninstall.exe
            • Size 101KB
            • SHA256 a9b2035ba1e109b8cc8fe40e7f237a5a04811359e67d4981c0d4be5ed18cf776
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.js
            • Path C:\Program Files (x86)\DriverPack\config.js
            • Size 3KB
            • SHA256 18f86ef3fad86c97d56274e5577b178a77f40587a80451a971013248e37190a6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            blank.gif
            • Path C:\Program Files (x86)\DriverPack\css\blank.gif
            • Size 49B
            • SHA256 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
            • MD5 SHA1 SHA512
            Submit Download

            custom-control.css
            • Path C:\Program Files (x86)\DriverPack\css\custom-control.css
            • Size 10KB
            • SHA256 7d7853e95258a7a3f8eaf41795f7124e7d2dacdeb5f1efe212b3ff7ed0da9e50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DRPcheckbox.eot
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPcheckbox\DRPcheckbox.eot
            • Size 1KB
            • SHA256 c0c660ec085e958acdb6dab93f7df3b8c2375df26399ba9c62c79a14f4a23c58
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DRPcheckbox.svg
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPcheckbox\DRPcheckbox.svg
            • Size 617B
            • SHA256 a6e2003e977a3b8d1bab342c7fbdebb2de22ca39cfc69b5301d8284cc7af80a4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DRPcheckbox.ttf
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPcheckbox\DRPcheckbox.ttf
            • Size 1KB
            • SHA256 85e0bf0d78bd5363e43c4e51632f4b1c864dcf8bc8a910e3d7b077b5bfa0539b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DRPcheckbox.woff
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPcheckbox\DRPcheckbox.woff
            • Size 1KB
            • SHA256 55403b6443719753aff7787d85613ccc45b320215349be6e2cc6e48361626926
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DRPicons-webfont.eot
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.eot
            • Size 7KB
            • SHA256 0a04d85875091cc334f63b90c8ccfa0838f20023945d949296363369066870e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DRPicons-webfont.svg
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.svg
            • Size 29KB
            • SHA256 e69b080b44b611bc292e6f33c24cbf310935d3465903af93fe0bb508071ce755
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DRPicons-webfont.ttf
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.ttf
            • Size 7KB
            • SHA256 0f03fecf36a857c641ad780dec1dfdb556ecdf4731de16679889ca05f26ed33f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DRPicons-webfont.woff
            • Path C:\Program Files (x86)\DriverPack\css\fonts\DRPicons\DRPicons-webfont.woff
            • Size 7KB
            • SHA256 bdee6c77d576b1d66ef8f34830ff4c52ef86f7b965d418af53db0f888ead21c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            opensans-regular-webfont.eot
            • Path C:\Program Files (x86)\DriverPack\css\fonts\Open-Sans\opensans-regular-webfont.eot
            • Size 40KB
            • SHA256 3ae576bfa96d7cf6614c8c97290c7abe03191a8ceb0c837a21e7ffe70d66ca62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProximaNova-Bold.eot
            • Path C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.eot
            • Size 141KB
            • SHA256 1c3a470bf710204b1dbd65679b914af4b94e7f018b1f7df3d61ff863d6f335d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProximaNova-Bold.woff
            • Path C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\ProximaNova-Bold.woff
            • Size 57KB
            • SHA256 2a8f208d9d8556ff58da8a420316de6d634a568a0eeb94c043430659fff7d338
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            proxima_nova_light-webfont.eot
            • Path C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_light-webfont.eot
            • Size 61KB
            • SHA256 53f30a622db68cebe92dbd384cc292aef13ad7e3349a10a77c29326e10634c21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            proxima_nova_semibold-webfont.eot
            • Path C:\Program Files (x86)\DriverPack\css\fonts\ProximaNova\proxima_nova_semibold-webfont.eot
            • Size 65KB
            • SHA256 790579e11608136663d073bc6f99848c04b4dcd69216df7daf5be00df573a3fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icons-checkbox.css
            • Path C:\Program Files (x86)\DriverPack\css\icons-checkbox.css
            • Size 444B
            • SHA256 cb134dcb95a407795c671a512c389894d3525fba3f6a2168fc5b9b7e875e78dc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            icons.css
            • Path C:\Program Files (x86)\DriverPack\css\icons.css
            • Size 509B
            • SHA256 b5f111103f7f090c246a223b1ff497b94c4dd3ac64bf5b3fb2d91555fcfd6f2c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            normalize.min.css
            • Path C:\Program Files (x86)\DriverPack\css\normalize.min.css
            • Size 1KB
            • SHA256 86235e2c477078adfe1188d07ca1e5d8198443aaf2436de1785a169f3e1d5463
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            open-sans.css
            • Path C:\Program Files (x86)\DriverPack\css\open-sans.css
            • Size 1KB
            • SHA256 b9bd51ae6ccc7df20417e0ef341295b86bf8f74f6e235ee99ddefd675806f47f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            proximanova.css
            • Path C:\Program Files (x86)\DriverPack\css\proximanova.css
            • Size 2KB
            • SHA256 931071422410d73d9d7d3583745e476eac23c0cac5fbe344f8436499ee40ac46
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            roboto.css
            • Path C:\Program Files (x86)\DriverPack\css\roboto.css
            • Size 1001B
            • SHA256 2537efe2fb974f58cddbc99abfcd7aed6e9df81992eed3e528b5f1748167b8fa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            style.css
            • Path C:\Program Files (x86)\DriverPack\css\style.css
            • Size 14KB
            • SHA256 3f8ec31a3c08de6c1aac117347b1b83f391bb0a91c9dbdc57ba9d11d5ba372d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            drp.css
            • Path C:\Program Files (x86)\DriverPack\drp.css
            • Size 190KB
            • SHA256 439bfd8bf9f9176c1757ba277850525f0abec59bb3ef7cd8a974a5ad1d2b3004
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            drp.js
            • Path C:\Program Files (x86)\DriverPack\drp.js
            • Size 3.7MB
            • SHA256 d785af26524d6c3b118c2e7ba1dd8fd90efd305e10ac77caaa0d3c618f6eaf03
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5.png
            • Path C:\Program Files (x86)\DriverPack\img\assistant-faces\start-screen\5.png
            • Size 75KB
            • SHA256 ad615ef1f7016826d475fe90b4363cc149b060de2b9406b4c58cb4a4f1938bef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            info.png
            • Path C:\Program Files (x86)\DriverPack\img\charms\info.png
            • Size 584B
            • SHA256 637445a1b0bf68b08f325cb09221b340004e1a0b82e6e0d13a428c34118aabda
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            lan.png
            • Path C:\Program Files (x86)\DriverPack\img\device-class\new-ui\lan.png
            • Size 1KB
            • SHA256 4da7ccf08d94f78c5e45554f8998c0e5f6d0a07b8a3a9e4b109543db6bc9ba43
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            new-header-logo.png
            • Path C:\Program Files (x86)\DriverPack\img\header\new-header-logo.png
            • Size 4KB
            • SHA256 98856383428042c14739159f4a62168e9394f774bf2b696d62f46d70fc2ba175
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            banner_catalog-bg-en.jpg
            • Path C:\Program Files (x86)\DriverPack\img\installation\banner_catalog-bg-en.jpg
            • Size 74KB
            • SHA256 c5ec14fe3f769da7e4b673ae5fec021c8b74a9ae424aea822976cfa199cde92e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DP_xUSB.png
            • Path C:\Program Files (x86)\DriverPack\img\installation\drivers\DP_xUSB.png
            • Size 888B
            • SHA256 025e7e8699fd9c246452c6634d4935149baa6a6acadb91b0f9adf52d11a094f9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tvtuner.png
            • Path C:\Program Files (x86)\DriverPack\img\installation\drivers\tvtuner.png
            • Size 584B
            • SHA256 3f79ad6eb7576a2e61c9745940ead841ba86cbe75d756786e424c11315ebddbf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            arrow-recommend.png
            • Path C:\Program Files (x86)\DriverPack\img\new-ui-assistant\arrow-recommend.png
            • Size 1KB
            • SHA256 fd42158b4e01b5c86360c9450e9e3db5e399e0eadb28e5420ac69f7da1dc0fc5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            file-system.png
            • Path C:\Program Files (x86)\DriverPack\img\new-ui-assistant\drivers-icon\file-system.png
            • Size 1KB
            • SHA256 4994c04ad58bed21b0a2dc6d652d1ada7e99bdf11676af6f6ea74e6865066d16
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tire.png
            • Path C:\Program Files (x86)\DriverPack\img\new-ui-assistant\drivers-icon\tire.png
            • Size 1KB
            • SHA256 80cba1dfe3f447a57f3030e35eed0bc2209024973f7fe431541008eab093d9d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            icon-footer-splite.png
            • Path C:\Program Files (x86)\DriverPack\img\new-ui-assistant\icon-footer-splite.png
            • Size 4KB
            • SHA256 5e45160ca10f9237661f7c76880f1fed2dc5d2e147061daeeac7080df1502774
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            arrow-top.png
            • Path C:\Program Files (x86)\DriverPack\img\screens\arrow-top.png
            • Size 2KB
            • SHA256 4f2785a950320440acd22fcc0274944b971d5975de008f69bf81d19d44842925
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            new-ui-logo2021.png
            • Path C:\Program Files (x86)\DriverPack\img\screens\new-ui-logo2021.png
            • Size 5KB
            • SHA256 a11af07103005c27c0a5f721d99482e4700c21c85afcbc8e44e4e785af5fa902
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            browser.png
            • Path C:\Program Files (x86)\DriverPack\img\server_err_no_internet\browser.png
            • Size 376B
            • SHA256 d910167b4a9eb25740afff7614b83939de867db50f59a6b2d418fef9e2fdc40b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            connect.png
            • Path C:\Program Files (x86)\DriverPack\img\server_err_no_internet\connect.png
            • Size 726B
            • SHA256 ffb3f935f6c8abe28f629c1e6cd1b616b19706652fa428d4e20bcae2ab422f11
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            firewall.png
            • Path C:\Program Files (x86)\DriverPack\img\server_err_no_internet\firewall.png
            • Size 833B
            • SHA256 a386fe95ad0b4fcfc28cddc32bb592b3a9ea9d6cce05f88184c1540095aff094
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            torrent.png
            • Path C:\Program Files (x86)\DriverPack\img\server_err_no_internet\torrent.png
            • Size 979B
            • SHA256 af15c32fe45b16dab0ed27248901f0111f0ca615a12c472cdf03327f2a4fcd5c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            vpn.png
            • Path C:\Program Files (x86)\DriverPack\img\server_err_no_internet\vpn.png
            • Size 1KB
            • SHA256 7de42129a1c601264ac8632602e4d4bc7cc285f24d6fa58b1db1cb78e54ef085
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            en.js
            • Path C:\Program Files (x86)\DriverPack\languages\en.js
            • Size 86KB
            • SHA256 a3df7c1b150504fb96555d8d7f7b9c4129a3225ba241da983d56a9c7a1404aec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            downloader_browser.exe
            • Path C:\Program Files (x86)\DriverPack\programs\downloader_browser.exe
            • Size 183KB
            • SHA256 8e553e9aa721db167bdeaf7748bb09d4f497e3a469fd09b6a995ea25d378f1fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            run.hta
            • Path C:\Program Files (x86)\DriverPack\run.hta
            • Size 2KB
            • SHA256 02bd627d6825599ed039f053fecbe7f15000b5d5071e9b6baab488befa4f02dd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            start.bat
            • Path C:\Program Files (x86)\DriverPack\start.bat
            • Size 90B
            • SHA256 88ebe6fc9f45e734243dd674a3cdd9222be692bde089d0bc06726dd32156b892
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            driverpack-wget.exe
            • Path C:\Program Files (x86)\DriverPack\tools\driverpack-wget.exe
            • Size 392KB
            • SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es[1].dat
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AQUMYOH4\es[1].dat
            • Size 448KB
            • SHA256 6d81fdc9f09438ff1d983dc594420a4568c54b65477e37f497246ca40b523439
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            es[1].htm
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AQUMYOH4\es[1].htm
            • Size 271KB
            • SHA256 74dfb1643c31aba62f0decf918603f06f14c7bbfd30f13a831f62e2f301c97f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sync_cookie_image_finish[1].gif
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1BCA2PC\sync_cookie_image_finish[1].gif
            • Size 43B
            • SHA256 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
            • MD5 SHA1 SHA512
            Submit Download

            collect[1].gif
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K2UU5U9F\collect[1].gif
            • Size 35B
            • SHA256 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
            • MD5 SHA1 SHA512
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsp703D.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 e87c5e308de62cd018a8e96edde226c57d7f7166a2e7a6a0258d8b4dcbff89f0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsp703D.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 c24e63b05a9df95f0b71924847727b60b960009229e02a11f1f88448be993a65
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsp703D.tmp\ioSpecial.ini
            • Size 582B
            • SHA256 029275cc4c6d3de13cd3d0ba71efb9db19c8cf829723bf58048add1ce87d9033
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            modern-header.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsq9A8E.tmp\modern-header.bmp
            • Size 25KB
            • SHA256 1240717fec5b759d435c9a937ee499265abfc0df87f2962685f47b8e753a4254
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nss50DD.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\nss50DD.tmp
            • Size 187KB
            • SHA256 071127647f1f7d0da4a62f343a7b7f9a1ec23d2deee8dee25aefbf2a288a3c23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstallOptions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsu35FC.tmp\InstallOptions.dll
            • Size 15KB
            • SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsu35FC.tmp\System.dll
            • Size 12KB
            • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsu35FC.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 9b3db0079fad478a6d212f5a28395fd7dfb5ed82208631f5179d67aeffd81695
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsu35FC.tmp\ioSpecial.ini
            • Size 1KB
            • SHA256 c83fc147531be33976a7cf73217a745cdb282a0d8de938662f5c6fd7706896d4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsz49C9.tmp\modern-wizard.bmp
            • Size 150KB
            • SHA256 65844f7b35d63c3f805324fca880831ba7086b6bbea00ce1e29c38d46b67f7e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            run_command_79613.txt
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_79613.txt
            • Size 9B
            • SHA256 51e6af14fa1e9032300dbf76a85cb8561e523e89c363cec09cdc2128801a191d
            • MD5 SHA1 SHA512
            Submit Download

            run_command_90320.txt
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\run_command_90320.txt
            • Size 9B
            • SHA256 195418a93d769a17558aa804568eff487979e62d0731aa8c63d8d0ffc1723321
            • MD5 SHA1 SHA512
            Submit Download

            wget_finished_75454.txt
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_finished_75454.txt
            • Size 7B
            • SHA256 9a25234ae91ada142892f61bb4a52640d8854872909068b7b1c307a8e16591ed
            • MD5 SHA1 SHA512
            Submit Download

            wget_log_11436.log
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_11436.log
            • Size 527B
            • SHA256 34559f105ce86a6b834c5d6dd4ac1dead882c2fa32c9487e066955930c65d8a6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wget_log_24474.log
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_24474.log
            • Size 535B
            • SHA256 1113a426c23354d3950279816bb9648aab9d72028ad6cc0b8e338fae7dcabf42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wget_log_47084.log
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_47084.log
            • Size 536B
            • SHA256 1b1692d99ce2b5639e22e04e1ca7e28fd6519485a5709ced6d5dc7acb5369fc2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wget_log_75454.log
            • Path C:\Users\Admin\AppData\Roaming\DRPSu\temp\wget_log_75454.log
            • Size 537B
            • SHA256 d0d6c32893300cb74a53bdafb273d32be48b66f55491aaf7bbb39685744fcc4d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/8-843-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/8-818-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/724-817-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/724-850-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2396-895-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2716-754-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2716-738-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2768-721-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2768-753-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2768-737-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2832-804-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2832-839-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2832-825-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2912-848-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/2912-831-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/3092-823-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/3092-793-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/3584-899-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/3584-907-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4204-900-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4204-908-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4220-846-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4220-826-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4220-813-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4316-896-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4316-905-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4516-803-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/4516-821-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5076-898-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5076-909-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5100-868-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5500-841-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5500-814-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5792-736-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5792-752-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/5792-720-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/6120-743-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download

            memory/6120-755-0x0000000000400000-0x00000000004EF000-memory.dmp
            Download