PUP.DriverPack

The detection of PUP.DriverPack on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent any potential harm.

What Is PUP.DriverPack?

PUP.DriverPack is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often bundled with other software or downloaded from the internet, and they can be difficult to remove without the proper tools and techniques.

How PUP.DriverPack Operates

PUP.DriverPack operates by installing itself on your system and then proceeding to perform various unwanted actions. This can include displaying advertisements, collecting your personal data, and modifying your system settings. In some cases, PUPs can also install additional malware or unwanted software, which can further compromise your system's security. It is crucial to remove PUP.DriverPack as soon as possible to prevent any potential harm to your system and your personal data.

Symptoms of Infection

The symptoms of a PUP.DriverPack infection can vary, but common signs include slow system performance, unwanted advertisements, and unexpected changes to your system settings. You may also notice that your browser is being redirected to unfamiliar websites or that your search results are being manipulated. In some cases, you may receive pop-ups or alerts that are trying to sell you unwanted software or services. If you are experiencing any of these symptoms, it is likely that your system is infected with PUP.DriverPack or another type of malware.

• Slow system performance
• Unwanted advertisements
• Unexpected changes to system settings
• Browser redirection
• Manipulated search results
• Pop-ups or alerts trying to sell unwanted software or services

How to Remove PUP.DriverPack

1. Boot your system in Safe Mode with Networking to prevent PUP.DriverPack from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.DriverPack and any other malware that may be present.
3. Uninstall any suspicious programs that may be related to PUP.DriverPack, as they may be contributing to the problem.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or add-ons that may be associated with PUP.DriverPack.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that PUP.DriverPack has been completely removed.

Conclusion

Removing PUP.DriverPack from your system is crucial to preventing any potential harm to your computer and your personal data. By following the steps outlined above, you can effectively remove this unwanted program and restore your system to its normal state. It is also essential to take steps to prevent future infections, such as being cautious when downloading software, avoiding suspicious websites, and keeping your operating system and anti-malware tools up to date. By being proactive and taking the necessary precautions, you can help protect your system and your personal data from the threats posed by PUP.DriverPack and other types of malware.

Analysis Report

General information

Family Name:	PUP.DriverPack
Signature status:	Hash Mismatch

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: ae3f2a529228ec114ca47d969fdf851f SHA1: 47eb3e1ebc3e93f70d1b25a180968be84fbe0ae9 SHA256: 00FB319157301BB7BFAD27F1A5191807839D61DC02A6D607C1EA6E167C03B2E4 File Size: 8.31 MB, 8312088 bytes

MD5: 8f045e67a86857353f6bae46db302deb SHA1: cce946e2106ac629656f0d12faec6aa313a9158c SHA256: A41FA0BFCAD944B9CB979212D7328838B168425EB63F0D6892194614DE0E3568 File Size: 8.39 MB, 8390367 bytes

MD5: 4deb4d6e2909377d388f413f34bb8f9b SHA1: 2978fb00e9205244e6db83e758889ba34c87a59e SHA256: BA1BD9027185D0289DDAD1DB49155A80A515C2B4900824D926E108612A683F0A File Size: 8.32 MB, 8321879 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Kuzyakov Artur Vyacheslavovich	USERTrust RSA Certification Authority	Hash Mismatch
Kuzyakov Artur Vyacheslavovich	USERTrust RSA Certification Authority	Hash Mismatch

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\program files\common files\system\symsrv.dll	Generic Write,Read Attributes
c:\program files\common files\system\symsrv.dll.000	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\a1d26e2\a8bd1f7080c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\config.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\blank.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\custom-control.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpcheckbox\drpcheckbox.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpcheckbox\drpcheckbox.svg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpcheckbox\drpcheckbox.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpcheckbox\drpcheckbox.woff	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpicons\drpicons-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpicons\drpicons-webfont.svg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpicons\drpicons-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\drpicons\drpicons-webfont.woff	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\generator_config.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-bold-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-bold-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-italic-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-italic-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-regular-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-regular-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-semibold-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\open-sans\opensans-semibold-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_light-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_light-webfont.svg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_light-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_light-webfont.woff	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_regular-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_regular-webfont.svg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_regular-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_regular-webfont.woff	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_semibold-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_semibold-webfont.svg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_semibold-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proxima_nova_semibold-webfont.woff	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proximanova-bold.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proximanova-bold.svg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proximanova-bold.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\proximanova\proximanova-bold.woff	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\roboto\roboto-light-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\roboto\roboto-light-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\roboto\roboto-regular-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\roboto\roboto-regular-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\roboto\roboto-thin-webfont.eot	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\fonts\roboto\roboto-thin-webfont.ttf	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\icons-checkbox.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\icons.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\ie6.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\ie7.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\lte-ie8.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\lte-ie9.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\normalize.min.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\open-sans.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\proximanova.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\roboto.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\css\style.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\driverpacksolution.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\drp.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\drp.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\assistant-animation-img.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\assistant-icons-sprite.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\chat-icon.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\directx.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\netframework.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\new-chat-off.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\no-sound-hover.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\no-sound.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\ny-chat-icon.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\sound.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\start-assistant.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\start-chat-img.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\systemlib.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-chat\visualc.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-faces\chat\1.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-faces\chat\5.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-faces\start-screen\1.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\assistant-faces\start-screen\5.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\blank.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\btn-icon-admin-mode.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\bugreport\bugreport_icon_alert.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\bugreport\bugreport_icon_ie.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\bugreport\bugreport_icon_previous.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\bugreport\bugreport_icon_skip.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\bugreport\bugreport_loader.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\burger\auto_installation.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\cam.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\apps.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\arrow.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\computer.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\download.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\download.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\gears.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\help.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\info.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\line.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\pc.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\programms.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\reload-sm.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\setup.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\setup.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\store.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\charms\toolkit.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\bluetooth.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\cardreader.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\chipset.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\default.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\inputdev.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\lan.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\massstorage.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\modem.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\monitor.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\bluetooth.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\cardreader.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\chipset.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\default.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\inputdev.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\lan.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\massstorage.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\modem.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\monitor.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\other.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\phone.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\printer.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\sound.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\tvtuner.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\undefined-device.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\video.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\webcamera.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\new-ui\wifi.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\other.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\phone.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\printer.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\sound.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\tvtuner.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\undefined-device.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\video.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\webcamera.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-class\wifi.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\device-generic.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\driver-row-arrow.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\fake-installation\browser.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\fake-installation\connect.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\fake-installation\firewall.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\fake-installation\torrent.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\fake-installation\vpn.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\final\final_aside-failure$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\final\final_button-warning$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\final\final_failure$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\final\final_main-cta-arrow$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\final\final_partial-success$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\final\final_success$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-bottom-logo.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-button-icon-green.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-button-icon-white.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-cloud-big.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-cloud.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-civilization.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-doom-large.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-doom.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-gta.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-hitman.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-mafia.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-overwatch.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-resident-evil.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-witcher-large.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\games\games-top-witcher.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\header\header-bell.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\header\header-logo$2x.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\header\header-logo.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\header\new-header-logo.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\heart.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\info.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation-loader.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner-arrow-left.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner-arrow-right.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_auth-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_avast-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_browsers-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_bullit-active.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_bullit-empty.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_catalog-bg-en.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_catalog-bg-pt-br.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_catalog-bg-ru.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_catalog-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_cloud-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_driverpack-for-all-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_how-it-works-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_istart-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_opera-bg.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg-de.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg-en.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg-es.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg-fr.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg-pt-br.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg-ru.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_protect-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_restore-bg.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_social-bg-en.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_social-bg-ru.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\driverpack-20260314175619\img\installation\banner_social-fb.png	Generic Write,Read Attributes

819 additional files are not displayed above.

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\microsoft\windows nt\currentversion\windows::appinit_dlls	C:\PROGRA~1\COMMON~1\System\symsrv.dll	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows nt\currentversion\windows::loadappinit_dlls		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows nt\currentversion\windows::requiresignedappinit_dlls		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Show More

HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	押謷됖ǜ	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352*1\??\C:\P	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	标⁄ǜ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	2m �8�1� �� �6 �v xy ����T������1��dc�% ���5����3bBx�< ���R �7#�#�� $kF %`�%� &� &�-'�(�(X�(� )A )�`*9 *�" *�h+��,��0P% 1`1�1HO1�D5,]9ߔ=�@V�B��F?H[uH��J��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	3m �8�1� �� �6 �v xy ����T������1��dc�% ���5����3bBx�< ���R �7#�#�� $kF %`�%� &� &�-'�(�(X�(� )A )�`*9 *�" *�h+��,��0P% 1`1�1HO1�D5,]9ߔ=�@V�B��F?H[uH��J��	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	4m �8�1� �� �6 �v xy ����T������1��dc�% ���5����3bBx�< ���R �7#�#�� $kF %`�%� &� &�-'�(�(X�(� )A )�`*9 *�" *�h+��,=�,��0P% 1`1�1HO1�D5,]9ߔ=�@V�B��F?H[uH��	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap\domains\drp.su\update::http		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap\domains\drp.su\update::https		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKCU\software\microsoft\internet explorer\styles::maxscriptstatements	￿￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\internet explorer\styles::maxscriptstatements	￿￿	RegNtPreCreateKey
HKLM\software\classes\typelib\{1ea4dbf0-3c3b-11cf-810c-00aa00389b71}\1.1\0\win32::	C:\WINDOWS\SysWow64\Oleacc.dll	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::version	1.1	RegNtPreCreateKey
HKLM\software\classes\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\interface\{618736e0-3c3d-11cf-810c-00aa00389b71}\typelib::version	1.1	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\wow6432node\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::version	1.1	RegNtPreCreateKey
HKLM\software\classes\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\proxystubclsid32::	{00020424-0000-0000-C000-000000000046}	RegNtPreCreateKey
HKLM\software\classes\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::	{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}	RegNtPreCreateKey
HKLM\software\classes\interface\{03022430-abc4-11d0-bde2-00aa001a1953}\typelib::version	1.1	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection ZwMapViewOfSection
Process Shell Execute	CreateProcess WriteConsole
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcAcceptConnectPort ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcCreatePort ntdll.dll!NtAlpcOpenSenderProcess ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl Show More ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateThreadEx ntdll.dll!NtDeleteValueKey ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFindAtom ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenMutant ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtResumeThread ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Terminate	TerminateProcess
Keyboard Access	GetKeyState

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\WINDOWS\system32\reg.exe import "C:\Users\Cwogofay\AppData\Local\Temp\DriverPack-20260314175619\Tools\patch.reg"

C:\WINDOWS\system32\mshta.exe "C:\Users\Cwogofay\AppData\Local\Temp\DriverPack-20260314175619\run.hta" --sfx "cce946e2106ac629656f0d12faec6aa313a9158c_0008390367"

C:\WINDOWS\system32\reg.exe import "C:\Users\Miwwdawl\AppData\Local\Temp\DriverPack-20260524203940\Tools\patch.reg"

C:\WINDOWS\system32\mshta.exe "C:\Users\Miwwdawl\AppData\Local\Temp\DriverPack-20260524203940\run.hta" --sfx "2978fb00e9205244e6db83e758889ba34c87a59e_0008321879"

WriteConsole: The operation co