f7fed754f7318566934123d6ce11b664336de3e2208b3870e8ffc7cabd609b01

Resubmissions

11/03/2024, 16:57

240311-vgpzjaah62 4

11/03/2024, 16:53

240311-vd96asgf8v 4

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

elxocmcore-windows-x64-14.2.455.10-1.exe
Size

5.9MB
MD5

893623ad7da2b0370f64003651a9d5b6
SHA1

8a51f94affad2906d8cbb2c6c7b475e264d29d21
SHA256

f7fed754f7318566934123d6ce11b664336de3e2208b3870e8ffc7cabd609b01
SHA512

34c878a1b6483b651101a9dfa7debee64973de392e8016b834296b7d52a0b627ea39d7e723e6f69528877ff161d8b94794647b8f0f229dd4dcb745689f33e22c
SSDEEP

98304:yMbeDs+aWyGqGs5WUk0sqwGl+BCYtYYT7KHmVMx+NSqTRQ8t9BVPrnTP:Hbeza9Gs1PsqOBCcxKGVMxnqFNtpD

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Emulex\Util\Common\libdfc.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Uninstall\uninstall_WinLpCfg.bat._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\regDel.bat	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\libdfc.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\RM.INI	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\OCManager\rumode.exe	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\LrmApi.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\UninstallW.exe	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\LrmApi.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\elxpegclient.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\RM.INI._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\RM.LOG	RMServer.exe
File created	C:\Program Files\Emulex\Util\OCManager\rumode.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\regDel.bat._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\OCManager\HbaCmd.exe	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\OCManager\HbaCmd.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\elxpegclient.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\elxpegclient.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\LIBDFC.ini	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\RmApi.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\ElxHBASvcMsg.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\uninstall_OCManager_Core.bat	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\uninstall_WinLpCfg.bat._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\LIBDFC.ini._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\OCManager\rumode.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\RM.INI._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\uninstall_WinLpCfg.bat	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Uninstall\regDel.bat._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\OCManager\libdfc.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\LIBDFC.ini._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\OCM14.2.455.10-1-Install-20240311.165804.log	cmd.exe
File created	C:\Program Files\Emulex\Util\Common\LrmApi.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Uninstall\uninstall_OCManager_Core.bat._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\OCManager\HbaCmd.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\UninstallW.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\elxpegcommon.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\RmApi.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\RMServer.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\RMServer.exe	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\OCManager\libdfc.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\ElxHBASvcMsg.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\OCM14.2.455.10-1-Install-20240311.165804.log	cmd.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Uninstall\uninstall_OCManager_Core.bat._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\LIBDFC.LOG	RMServer.exe
File opened for modification	C:\Program Files\Emulex\Util\OCManager\libdfc.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\libdfc.dll	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\OCM14.2.455.10-1-Install-20240311.165804.log.tmp	LogX.exe
File created	C:\Program Files\Emulex\Util\Common\elxpegcommon.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\RMServer.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\elxpegcommon.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\RmApi.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File created	C:\Program Files\Emulex\Util\Common\ElxHBASvcMsg.dll._tm	elxocmcore-windows-x64-14.2.455.10-1.exe
File opened for modification	C:\Program Files\Emulex\Util\Common\LIBDFC.LOG	RMServer.exe
File created	C:\Program Files\Emulex\Util\Uninstall\UninstallW.exe._tm	elxocmcore-windows-x64-14.2.455.10-1.exe

Executes dropped EXE 12 IoCs

pid	Process
2340	rumode.exe
2928	RMServer.exe
1920	RMServer.exe
4456	HbaHsMgr.exe
1248	HbaHsMgr.exe
404	GAx64.exe
4516	GAx64.exe
1320	GA.exe
2060	GAx64.exe
2648	GAx64.exe
4144	GA.exe
1796	LogX.exe

Loads dropped DLL 6 IoCs

pid	Process
3024	elxocmcore-windows-x64-14.2.455.10-1.exe
3024	elxocmcore-windows-x64-14.2.455.10-1.exe
3024	elxocmcore-windows-x64-14.2.455.10-1.exe
3024	elxocmcore-windows-x64-14.2.455.10-1.exe
2928	RMServer.exe
1920	RMServer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3148	tasklist.exe

Modifies registry key 1 TTPs 8 IoCs

Modify Registry

T1112

pid	Process
2648	reg.exe
2268	reg.exe
2280	reg.exe
2484	reg.exe
2552	reg.exe
2980	reg.exe
3876	reg.exe
4488	reg.exe

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	elxocmcore-windows-x64-14.2.455.10-1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2340	rumode.exe
2340	rumode.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4692	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	89
PID 3024 wrote to memory of 4692	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	89
PID 4692 wrote to memory of 3148	4692	cmd.exe	91
PID 4692 wrote to memory of 3148	4692	cmd.exe	91
PID 4692 wrote to memory of 2884	4692	cmd.exe	92
PID 4692 wrote to memory of 2884	4692	cmd.exe	92
PID 3024 wrote to memory of 3132	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	107
PID 3024 wrote to memory of 3132	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	107
PID 3024 wrote to memory of 2164	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	109
PID 3024 wrote to memory of 2164	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	109
PID 2164 wrote to memory of 2552	2164	cmd.exe	111
PID 2164 wrote to memory of 2552	2164	cmd.exe	111
PID 2164 wrote to memory of 2980	2164	cmd.exe	112
PID 2164 wrote to memory of 2980	2164	cmd.exe	112
PID 2164 wrote to memory of 3876	2164	cmd.exe	113
PID 2164 wrote to memory of 3876	2164	cmd.exe	113
PID 2164 wrote to memory of 4488	2164	cmd.exe	114
PID 2164 wrote to memory of 4488	2164	cmd.exe	114
PID 3024 wrote to memory of 4432	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	115
PID 3024 wrote to memory of 4432	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	115
PID 4432 wrote to memory of 2648	4432	cmd.exe	117
PID 4432 wrote to memory of 2648	4432	cmd.exe	117
PID 4432 wrote to memory of 2268	4432	cmd.exe	118
PID 4432 wrote to memory of 2268	4432	cmd.exe	118
PID 4432 wrote to memory of 2280	4432	cmd.exe	119
PID 4432 wrote to memory of 2280	4432	cmd.exe	119
PID 4432 wrote to memory of 2484	4432	cmd.exe	120
PID 4432 wrote to memory of 2484	4432	cmd.exe	120
PID 3024 wrote to memory of 2340	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	121
PID 3024 wrote to memory of 2340	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	121
PID 3024 wrote to memory of 2928	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	124
PID 3024 wrote to memory of 2928	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	124
PID 3024 wrote to memory of 2368	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	126
PID 3024 wrote to memory of 2368	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	126
PID 2368 wrote to memory of 4976	2368	cmd.exe	128
PID 2368 wrote to memory of 4976	2368	cmd.exe	128
PID 4976 wrote to memory of 3864	4976	net.exe	129
PID 4976 wrote to memory of 3864	4976	net.exe	129
PID 3024 wrote to memory of 4456	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	131
PID 3024 wrote to memory of 4456	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	131
PID 3024 wrote to memory of 1724	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	132
PID 3024 wrote to memory of 1724	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	132
PID 1724 wrote to memory of 3512	1724	cmd.exe	134
PID 1724 wrote to memory of 3512	1724	cmd.exe	134
PID 3512 wrote to memory of 1796	3512	net.exe	135
PID 3512 wrote to memory of 1796	3512	net.exe	135
PID 3024 wrote to memory of 4216	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	137
PID 3024 wrote to memory of 4216	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	137
PID 4216 wrote to memory of 404	4216	cmd.exe	139
PID 4216 wrote to memory of 404	4216	cmd.exe	139
PID 4216 wrote to memory of 4516	4216	cmd.exe	140
PID 4216 wrote to memory of 4516	4216	cmd.exe	140
PID 4216 wrote to memory of 1320	4216	cmd.exe	141
PID 4216 wrote to memory of 1320	4216	cmd.exe	141
PID 4216 wrote to memory of 1320	4216	cmd.exe	141
PID 4216 wrote to memory of 2060	4216	cmd.exe	142
PID 4216 wrote to memory of 2060	4216	cmd.exe	142
PID 4216 wrote to memory of 2648	4216	cmd.exe	143
PID 4216 wrote to memory of 2648	4216	cmd.exe	143
PID 4216 wrote to memory of 4144	4216	cmd.exe	144
PID 4216 wrote to memory of 4144	4216	cmd.exe	144
PID 4216 wrote to memory of 4144	4216	cmd.exe	144
PID 3024 wrote to memory of 4284	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	145
PID 3024 wrote to memory of 4284	3024	elxocmcore-windows-x64-14.2.455.10-1.exe	145

C:\Users\Admin\AppData\Local\Temp\elxocmcore-windows-x64-14.2.455.10-1.exe
"C:\Users\Admin\AppData\Local\Temp\elxocmcore-windows-x64-14.2.455.10-1.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin8B9E.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- - C:\Windows\system32\find.exe
    find /c /i "OCManager.exe"
    3⤵
    PID:2884
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinA568.bat"
  2⤵
  PID:3132
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinAE6A.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Emulex\OCManager /v SecureMgmt
    3⤵
    - Modifies registry key
    PID:2552
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Emulex\OCManager /v LocalModeOnly
    3⤵
    - Modifies registry key
    PID:2980
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Emulex\OCManager /v ProcRmReqs
    3⤵
    - Modifies registry key
    PID:3876
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Emulex\OCManager /v Appro
    3⤵
    - Modifies registry key
    PID:4488
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin9E78.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Emulex\OCManager /f /v OCManagerDir /d "C:\Program Files\Emulex\Util\\"
    3⤵
    - Modifies registry key
    PID:2648
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Emulex\OCManager\ELXSNMP\CurrentVersion /f /v pathname /d "C:\Program Files\Emulex\util\common\elxsnmp.dll"
    3⤵
    - Modifies registry key
    PID:2268
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Wow6432Node\Emulex\OCManager /f /v OCManagerDir /d "C:\Program Files (x86)\Emulex\Util\\"
    3⤵
    - Modifies registry key
    PID:2280
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Emulex\HBAnyware /f
    3⤵
    - Modifies registry key
    PID:2484
- C:\Program Files\Emulex\Util\ocmanager\rumode.exe
  "C:\Program Files\Emulex\Util\ocmanager\rumode.exe" -hbanyware -tcpmm
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2340
- C:\Program Files\Emulex\Util\Common\RMServer.exe
  "C:\Program Files\Emulex\Util\Common\RMServer.exe" /install /auto
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2928
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin7A3C.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\net.exe
    net start "Emulex HBA Management"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Emulex HBA Management"
      4⤵
      PID:3864
- C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe
  "C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe" /install /auto
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin6785.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\net.exe
    net start "Emulex SvcMgr"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Emulex SvcMgr"
      4⤵
      PID:1796
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin4B59.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\26F9C702\GAx64.exe
    GAx64.exe - ocmadmin "C:\Program Files\Emulex\Util"
    3⤵
    - Executes dropped EXE
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\26F9C702\GAx64.exe
    GAx64.exe - ocmadmin "MACHINE\SOFTWARE\Emulex\OCManager"
    3⤵
    - Executes dropped EXE
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\26F9C702\GA.exe
    GA.exe - ocmadmin "MACHINE\SOFTWARE\Emulex\OCManager"
    3⤵
    - Executes dropped EXE
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\26F9C702\GAx64.exe
    GAx64.exe - ocmlocaladmin "C:\Program Files\Emulex\Util"
    3⤵
    - Executes dropped EXE
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\26F9C702\GAx64.exe
    GAx64.exe - ocmlocaladmin "MACHINE\SOFTWARE\Emulex\OCManager"
    3⤵
    - Executes dropped EXE
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\26F9C702\GA.exe
    GA.exe - ocmlocaladmin "MACHINE\SOFTWARE\Emulex\OCManager"
    3⤵
    - Executes dropped EXE
    PID:4144
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin9D80.bat"
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin689C.bat"
  2⤵
  PID:4532
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinBFA3.bat"
  2⤵
  PID:5108
- - C:\Windows\system32\net.exe
    net start
    3⤵
    PID:432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2456
- - C:\Windows\system32\find.exe
    find /c /i "SNMP Service"
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinE662.bat"
  2⤵
  PID:2688
- - C:\Windows\system32\net.exe
    net start "SNMP Service"
    3⤵
    PID:3356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "SNMP Service"
      4⤵
      PID:1420
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinA90B.bat"
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinA25B.bat"
  2⤵
  - Drops file in Program Files directory
  PID:4632
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin0FFC.bat"
  2⤵
  PID:3468
- - C:\ProgramData\Broadcom Inc. or its subsidiaries\Uninstall\{27E8DE06-D437-481F-B079-B14F9E3D33BD}\LogX.exe
    "C:\ProgramData\Broadcom Inc. or its subsidiaries\Uninstall\{27E8DE06-D437-481F-B079-B14F9E3D33BD}\LogX" "C:\Program Files\Emulex\Util\OCM14.2.455.10-1-Install-20240311.165804.log"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:1796

C:\Program Files\Emulex\Util\Common\RMServer.exe
"C:\Program Files\Emulex\Util\Common\RMServer.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
PID:1920

C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe
"C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe"
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Emulex\Util\Common\ElxHBASvcMsg.dll

Filesize
409KB

MD5
f8bece60df4f95a805f19d54ba4101f1

SHA1
33a04c6ee84c6c81c005f1c20268b79cd2565e9a

SHA256
8b722f225a150381a8eb5f74ff5c332da7870c7045549e26fe0a58dfa38b828d

SHA512
2b7dcf06e39658258038794ecf47af11af510ad64ec9c29e91a61da676878509dde1db52ad58e8870a9fc4d1dadf5ce42f4f1341d621dd96e4f0b6e165bfbfe4

Download Submit
C:\Program Files\Emulex\Util\Common\HbaHsMgr.exe

Filesize
562KB

MD5
a65b9bec55adc1cbafa60762656f0027

SHA1
04b555fe99d302b09779699e7a377380aa0beb50

SHA256
b379cae3a13433085b546f0a589aed5dc46f0f8628143f65937931c939c28c6e

SHA512
f5ba0749728ab1a90d561ce901f7f36a973f3fc6163a22a9767d3824e58e5d372d83162154eb4b9918982c7d214f77c6f09143b80aa0806607902a04d3281698

Download Submit
C:\Program Files\Emulex\Util\Common\LIBDFC.ini

Filesize
11B

MD5
2b9aca712aa1ea30f5a64ba00f2c1a3f

SHA1
08cffbcd285437393654bdc3f53c2d0b46e686f9

SHA256
4bd18c3501a51163dbf5d748c9ce71305e07e73d20acff78b06a966a8704fd4e

SHA512
c435c468c6fcc9bb22d8ec0af990c720baf7810c724ee3d84ebce1fd8a0729f65386660b54191831870ea6a5d73cf9366d952c3fdaf8713e4d6884da4731aef4

Download Submit
C:\Program Files\Emulex\Util\Common\RM.INI

Filesize
1KB

MD5
8a5056056808db2e0de27ded67a48d8d

SHA1
1d4224d9b2790559cfd911cd4cb2f71d60b4f85a

SHA256
49a50b865e20cfd7013e5ce884c6e855168863db8afacdc7e2dcb1476f34b53b

SHA512
4492de14add74505b1dc5e2954d01c36e441317c2b9ae4f8350697e87a646ded863cda8f3db3471c6fe1982fe5d8bee86a62710a79a83b31c91262e8a400831b

Download Submit
C:\Program Files\Emulex\Util\Common\RMServer.exe

Filesize
2.3MB

MD5
aff30a6df3d9e4f257923198348cf857

SHA1
45ee9f9fe15d4a5b9593a5d827cd5a529cc7ac94

SHA256
059eacb0af8e8a92611e5f40dce36f79f43ef2f7d078c6a419e3e0376c84c3df

SHA512
d23184452284433d28c5b6375b77c1c363f7fd57dded50b01f029997a16975e74d05c6f7404f178ace3fd7bebd60ce15536704d9d51230de0c8d2a9214b7fdd8

Download Submit
C:\Program Files\Emulex\Util\Common\libdfc.dll

Filesize
344KB

MD5
0a9bd29a00f8a06dc4a38a6f0326dbb8

SHA1
92bfade03fdb8cac65122fabe4db3eeb4bdd8749

SHA256
10d09edf717c50e37f431b909abd5d1da7eca9dd94b06980b9adb6535d2eb01a

SHA512
19b22df392495db0851972d8e91b418c2cfa789f0c678d067bfed34e0981bdf1e1b7acc89f76c54d0ba66dbb90f87b54b8b9a0175d5ee2e11f729ff8e1d07a7e

Download Submit
C:\Program Files\Emulex\Util\OCM14.2.455.10-1-Install-20240311.165804.log

Filesize
235KB

MD5
5dd00f3ab6bf90e4424c9efa3e832d0b

SHA1
204cd912698f1ca76ca6f0ec9758ab7897de3156

SHA256
cb1f6542be8fbf7070a4a7f0731ddbccdce5f5b8e4a23c8a48c75f8995266be9

SHA512
a7426b4ac88b7c93945fcc530e0fadd17b8bd38f90bab86113e5e58e0c5d4a35f2730254ec03c4007b548677b4be2f330520ee29d8d9be1294fd1555348bd6e0

Download Submit
C:\Program Files\Emulex\Util\OCManager\libdfc.dll

Filesize
468KB

MD5
49a9919df831ca62038ba5beec39c5c6

SHA1
81af6c7efce338ff078c8e72e600cfe798806eb9

SHA256
b37c4cd7b0880d4d6944d15818fb87aa10d50d6175f60dbf9bcce0d58a2e4430

SHA512
a561b920eac2180492c390bd08e9c9caa84b16974930dad3c402dc1b73978cb6707f2c925e61a06b071f8504d1766bca4bda6b1c2d61bce81d056dba2ff40dac

Download Submit
C:\Program Files\Emulex\Util\OCManager\rumode.exe

Filesize
4.3MB

MD5
a85101d0610c5850491b11c77fbba92a

SHA1
b875de3a6de063367fd9c1619c786e929090e7e0

SHA256
0cadca5b9b31b656ddc2c685b31d9292b61262a1cfe503dcb0583a03da87659a

SHA512
8e6118f96b1acbef10d9865f5cd79ad6725f14baf26ced6f034bc17f2309b36bb188192a0a733c3e5aa70f1afc7c78fe8a1c4b5f4f39500260123a8ddfd18a5d

Download Submit
C:\ProgramData\Broadcom Inc. or its subsidiaries\Uninstall\{27E8DE06-D437-481F-B079-B14F9E3D33BD}\Uninstall.dat

Filesize
130KB

MD5
fd7c1563d269444f8a71cb0f90493fe3

SHA1
1ffe0a030887275f8614c2c47927059d8e8d33e1

SHA256
03da4f45effd5ad577df83dc280aeccfa83910838e4cca484a377beb5791f294

SHA512
3d19ef898ebb974d67d2c4793ffe9d6dce465533ef13e33f5dc7e1819d810f62ff118d674a732d33a7d03b4547a82698aa6b70cfee51d44fad0a5935735355ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\GA-Debug.exe

Filesize
15KB

MD5
2f92631b80bdf6d91a12d72b3230ad8a

SHA1
8e67b7196f9de87cc000fe686a08e8b1c6514c3c

SHA256
4fa21b44750b1215bd44b5dadf8fe51bc8fe6745d13049ae91c7324f30effc9e

SHA512
7a3d6cd8ccb5b045bb5d8998663b9abfa90b814d6683e8118e59631bf74ae7845403483a28b89ab2800818a47add0de5e160304280b4862a6a20b42fab7259ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\GA.exe

Filesize
9KB

MD5
f9b205fa2dd14d657e6654ee49e40545

SHA1
34f445fd51ff994fce2f9257aa00f82b52c2a6ca

SHA256
34ceffd131f028d764069361ecf92f8cb40e73c491dac6c05e9ea04c5b66807c

SHA512
1b5666b7739ffe35e363bd197c5ec3ec9f2894cc9c9259de6c4af4931257ca7cc93fbe1943b1f08152fbc8b9bc41241f9108ca96b2241b73814fc6db98fafa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\GAx64-Debug.exe

Filesize
18KB

MD5
dc02244050c478c7efc15f92dfde0eba

SHA1
8b7404de92e24a57e12fe8f101b63f40d8116a5f

SHA256
d10d1c2e52fb86bfcfe12ba488f8165d0f9792f13dc6855fe1327a69bb86d224

SHA512
d89bfacef961dd60082858189db163964dc863e67858d4f92d470bdc9696fb2d4b65b3f997463f0b2add6b1711ec14bf6a18fa6b7c737e1cd1863d177edcf37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\GAx64.exe

Filesize
10KB

MD5
0b26992def53f15a7950a89996f7f5cf

SHA1
a6c1d9b32a4b6ffe97c5d301d0b1a3f685a1de1c

SHA256
e526c9e68c4580e0b665fe19a378bf26ca505c0ec5d5bb6ffcc53d20e486dfb9

SHA512
767c212cc2f6a76d3afcb9d256a997d32960c431ea71d84c7ff1df2b9ffe5dbc1a373add76787773634ef09967ac6859286fdee3539f24277c473fbeb8a55157

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\LogX.exe

Filesize
65KB

MD5
5b74990161ee6b8bb9ac83f309af57ee

SHA1
7603d0df0acd12f7c73484a91de0c8032dbf4db5

SHA256
fcd6e8c973b51033b938104ab9579fae3721fb48e8ec03e9f9d6cd8693e63c4f

SHA512
688d5df37aeb84957b71250fa01af71714d378f50b14c0b2c8b6bab47bf0442adbbad0d644387e38bbdd38ef7416cfa8c8440a873e05c8e319cf3e6a96fe0e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\Readme.txt

Filesize
2KB

MD5
070f0f525a0024009f7efcc7f50570ff

SHA1
0af9c9550ca3e68a2838501ff1cc66f9121ebfb0

SHA256
1f625467c07d1175e49b83c4825c279df5c5730a975121d70d0fca7b4bf677f9

SHA512
5679e4054338f65ed4eab4b70528a565266a8d7adb5954683bdf05167b7e34cebdaef40c3f762073a89efaee8a1f4bb9c00675d885b41ac37d8acc082b65a739

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\SM_GiveAccess_x64.bat

Filesize
361B

MD5
893d467f3194acd1832a6a70af939b67

SHA1
28d179f6ea6966bbd5693224b390e73fe15bf048

SHA256
c14c0f9c375d81530e3e156adc28411ab06ec3d41243d7d6e8606710a87ef2c7

SHA512
4503b62e6e3525811fa4763c4c8ac4fc9afdf4cf91be9fd2b59b637d4578471110bc5fe0b3b5c9b8a5dfecedc5de4c5d386e3d23d418b96251cf1d2a7b1eae1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\SM_GiveAccess_x86.bat

Filesize
238B

MD5
9bb838d2f54a9e1d11e1d546553cc074

SHA1
112491bf76acc24743d845320d94b8f7a33383d3

SHA256
47f288a2f6a282ad9690b748e223c55ee3b53635cc0b0080bc9875e8e25b69d0

SHA512
8d04c7571b0d66d89e9ca931bcf40dce4b6b70c899f9a0fbea8183f450ec0499f0f4e3b2c1869911957d7b30a8d3f7b0be7634e9ec308d5111bd45cfb8fb4458

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\SM_RemoveAccess_x64.bat

Filesize
343B

MD5
b60992654cd92bcc5d96c62b81b4e278

SHA1
b25d8a30a80a64833970ce6b8c3b97efc44ef795

SHA256
a4e2bd5a5be1590e03038b46c867ac307ac74d6c3427de299125b35465f72ad1

SHA512
8b042cbdfc0e5de22129d95f26fe57230396e42d1bed17107a325a8beec18aceb4331405482307abedb772d2450e7dc0c34d57aaff0afcd3582e06907fc88bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\SM_RemoveAccess_x86.bat

Filesize
226B

MD5
d9c8d2fd19897c73bcd4c92849ad4706

SHA1
ce4e5848c3b84a74ec7899ef10403ba7f08c8893

SHA256
86b1310afd050505df09159ccfda7e787f6c89a26efca95ae3cd4439caabc781

SHA512
c930032bb10543b9026f8f924eb3c220c4139ececa69396086b4c5ba5dcee19c2cf1212ef89c0d535c1280aa7e9cc4069faeb4ef6871e1630a6b5c5c11aecdd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\Setup.exe

Filesize
24KB

MD5
b76a2041c635644a9f65eaa746f05822

SHA1
22870fb715cf9e27abd2b3f5a66ce82cfee866ef

SHA256
13f5a5f847ad1a79ef05184f17ef01dd336a0ea16a1113b80d35cea0cd9fd0c1

SHA512
7eda3e98467f08a4e279d461e0e83d7c5beb78dbae487697fc42840a18f780123319617aaec9c6159357358924e6cbb323b0edc449e02051b63676be44405321

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\Setup.ico

Filesize
273KB

MD5
56b8460063fe803cb3ed5b3802d505c5

SHA1
2d48fae6c07fc7b8e6cb6129122227681a6d140e

SHA256
c16ce994b477753537b889ad0a2aa2e38c3ea999f45ef25d0ab98e6283b89a1d

SHA512
9bfa78b27c89b30666e46dfbb1cc53bfe74449bc0a18494c33e4f0a129de60cb39bf39712bed93c16320e1dc1b3398a5d99e8af5dc8bf7724fa50364521e418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_Setup.dll

Filesize
568KB

MD5
4384ec4cd74288a34712b79d2ee24913

SHA1
024633d61ea2e7c734049547050910235c4fbd85

SHA256
be839b77586c7a174e9b389aa892606be85a9b6f2f514c662d03162dc7dc579d

SHA512
6d1fa4d738b7ea81feec15f3c09b8beaed1968f4b1331540f35788cb213a64cd756398c741d258eba2e9aba03eafdf42a5198bab2d80313abea5fd7106f756cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_Setupx.dll

Filesize
65KB

MD5
0633fd9030d301d6257f40486eed1110

SHA1
d7e9e2c74d0bd33212251654b91689d30f700021

SHA256
9b26d9e19fa1f55303f2ffa09e117072cf901ef588b97d04ec480007723d64f6

SHA512
af7ccbc370369967be1f857effd6c256fdddfd3b7e3bd70250f547be561a8bd20810890a31f74b24089bc94d4cbbb0c9a9715649c36fa05743acc9d7a4ebc86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin0FFC.bat

Filesize
183B

MD5
d4f40eeb8532974771c8ef2b5ac309ff

SHA1
30ba4286cf078a344d554f894b2c88e681d2aa3c

SHA256
62c9d4d870a985a7613e70e4acd9944f09b478e0506a191c858ef4f4dd9d8bf4

SHA512
8c2962e7fe1856d0c247efb38cb3306ea9445080d97b0b495ff91c3aa5b94d4c6d6e972c1c0591f0a78ebe7978dfde49c7393f13f0d07f19f32eab326349815b

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin4B59.bat

Filesize
25B

MD5
d1ca7011769fbb978fb9d49b35f96c29

SHA1
20835cfaef02f9930b5a5ad4744ce76e51c0ef64

SHA256
d5bed91148c33b4df70a889f23e1604dcff823188d767c61a9f2219e40077374

SHA512
6c80561d73711e93910159e1476cd63229166fdc006bd0a4936b7660193323dca8b13ee2f4045aa2005b5c0293d5e6bd6dc50fcd6f48178d0d38dbcfd4dc0b54

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin6785.bat

Filesize
27B

MD5
32d9b91ef7e14432c1c1d064715850c6

SHA1
91e997474cdd4dd56ffecf4f9f25c6f4ed0b7f7e

SHA256
44613aafd5cd34d44ca5b1c034ca0983570a5d3b39121d01ea43cdf40fdbaa5a

SHA512
b6e97d7e2b2eb480432d8e4d278aa9c689ee378221535f4a66ed51a702f8232a4628212298698d7b36e109830eb5af89e498f4dc82de8ce8a57dfae8973f66d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin689C.bat

Filesize
58B

MD5
124a516bd79c92eef339d671a6e1e6eb

SHA1
ea7195645ec09488fdf8a7cd5894706bd963a5c0

SHA256
d3033f2abac3e8c59ba8fed7c6696a0d665d2faf822a97f2e2bba53971016a38

SHA512
3687b98f7f115ed93860f109565719868fb8557471fe77c5e670ed312ef53d8e18f1fdb8ab30817f021ad47fa3924d55de5f426f9cbdc237bc3ca2f27ec2484e

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin7A3C.bat

Filesize
35B

MD5
8dc81162d27670544ee6a95433710784

SHA1
642bfb719a7ddb465547dec24a46c3948a297ff0

SHA256
fc48c1afe51fb509bbb7ff74a3f74795dc97675d038a6f92c383c1815608d75b

SHA512
8ce697fc0e83b8951adb3d26692cd3a7bcc0c3244aa793ec88807a1685c4e36f2b7ed0c35eb46dcd3a635a2b7611392728d2de3b0a15349a31bba44ff54a5883

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin8B9E.bat

Filesize
41B

MD5
f86b8647b175b05f1d6afebdc6643d84

SHA1
83767eba4099ed7dfd1dbe31d134172dbe04fe99

SHA256
57700cd8c8bc7b158e007a98eba98a7d8f44c80676bb2918cb132d64f004f3ab

SHA512
3f0e143df71ff00fadbef80d46f043abe28c741834469ce554f7a687b696aef23324985afceba3c184e83b4492bc6355d8142da36262d87b9a265ff6c03f3b73

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin9D80.bat

Filesize
34B

MD5
e493985936dc8c14af84648269cabd2c

SHA1
9ebdc8b782275ea567845ca0a5bf5a318235000f

SHA256
60ddf510f61d4e83c236d9219054b541645b3032cbb866609790a2e358cef85e

SHA512
f94894fed0968c8e7040cd3dd96c8fff24089f515dae200da9e61e49460980f4a4a39358790a7abadcf85e2b3b247d16985fcb95c41e81efddb8901197d2cc7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tin9E78.bat

Filesize
19B

MD5
4b5b47ec38e0db4d2c5a18098e1530ba

SHA1
d0fd2ef76da007f401eadfcc0aef3825ab96ab4e

SHA256
e2f1328ad7fd9e695d31218829a133ae232ef8288eac06b9472e1d629dddbabe

SHA512
ecd98c6dfd8e3c41dfb905789c2fad30399b48adf8dee26413202a94f4c9c95d730ad981a0bf119d0479ff860be50633556670f96815e62acecc01bafdbb85d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinA25B.bat

Filesize
160B

MD5
27d4f08188177f5e7c58969a831b5a5c

SHA1
09fbcab1854334de8518fd8924e1ba4c820a96b0

SHA256
988496b0e1afe0322d0488bc4189e8232ecafa9d0f05865357e672fd3758e523

SHA512
aab80460fc9da4d3b3a7e7b1cf711c5ec7c26caab7d39881f8b93e24757337c6420794e5d98b9bc4506a20b4bac149354ec25baf12b4715a63fbd8a875118e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinA568.bat

Filesize
20B

MD5
143e0ab574226306c28497d5778eb9d6

SHA1
f7861019349e15b2dd8f16f9991103bb3f9ceef2

SHA256
3cc906ab8f679c76057fe65809a3c3bd540c9793199e991c6538b08f1d1fc527

SHA512
6a906f9cbcb98ef592fc97f3eae08d11c5b2c9dd6a6d4753f0055d2ea35cc19aa595d695b67436bdc0567cc25c9fccf1b6828d89bcb4648a74800380d8f99b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinA90B.bat

Filesize
170B

MD5
49efdc95ef4b73e81f920fa084174c18

SHA1
a68e9e1286054ecd4ba4b3266566a9e8f0af9a20

SHA256
f28de90678bffde8c6a46b773931bd2144f9e553324af5eb9564a42f6d90edc5

SHA512
d5a10a3874112c1bd65b98feae053d1156e076f796cec5afa938bc8fb21aa04cc191fde8259f34196ea688e86af3bd9a680e99682f3ccd07ce69d07c88a11f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinAE6A.bat

Filesize
35B

MD5
44bbfa1f8fc85dc35db3478e0f57e97f

SHA1
71283346739d6f7bb249f94f3ac90187e182e6c0

SHA256
834d8fa99cb8a44aeb1b91c971851760e046e23c72e2059a69cb53faf31e807a

SHA512
147d1cf90e91abcb962b308e02ac0a249f1c13b454bb77f66a145c93c7c3fe543bdb005600729f88fce9888ea63d2c533a85bb51b3a20e07975626ca3795a7e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinBFA3.bat

Filesize
41B

MD5
bacd0a43224ab6d99ad15c4eea6c858e

SHA1
344cbde7c2ba63adfef464f83058980c215355ea

SHA256
5579698af79ad1947047c6db1e118e57906c7c3ad37ba0046c83e235338c4ea1

SHA512
c24c42ce242c5d93d2a2ab3b52cba4af216401751d4702fd1b8da5bfcb272d7c78dfc4fafb9744fdb53ccf85684b8ea485c98b5b1a1fd8f49531accb0fea1a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\_tinE662.bat

Filesize
26B

MD5
4d3c26102d52531db61e95603d0795c2

SHA1
533ce15ed15b202023e6370535959eb8dfd5bf0f

SHA256
a208096537091cdd5ae8918fb122842eb6dd4962b6bdd1cf32883e03a54a382b

SHA512
ef242a22c375cbc593f35ada552bdbff86420dcc717913295a1b1edd812478fd4f7490157c42cf0b36dedf17e5fe4110a5ad2d3cb251ad0cf1cb5b03acadf0f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\copylibdfc.bat

Filesize
159B

MD5
0534757810dac1287f8724ef646338de

SHA1
dd59b63d75b30390a22f2a624e76d3940a706e59

SHA256
9adf4eea15f8db741987ca0145c5de60492ba7f2624eb151d461244a5ded60bf

SHA512
7e661c1600ba260a2b057d38a4e6f1f78f32d672da4d87c88d20dbb407825daad7b2f706428af014307f753ca25d42fa888a954e2b1017d1ab28a5e38c2edb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\moveAddonToX86.bat

Filesize
273B

MD5
378181f645fcdcee3d2b7b8d31a11696

SHA1
4eef36ae98faef903cc103ddf02f02d255570321

SHA256
b15614c7d4ef2308a611a58164124fea676f57ffdf391a2b03fce1cd267e8a1c

SHA512
b0a02bdf510bdf9b33b7dd79dd982460f92cca0a33b0f5e6fa6e062c18e2ed187a6d2e91c5b7bc5af7cca32cf3a666b3518469aa22f01a5f4c9668d59116c93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_Core.bat

Filesize
378B

MD5
367c6e6532a207bea589a6719da063d9

SHA1
b3c0082d984fbf12859fad711dac02a46c603b74

SHA256
51c1ad83255193b946e9fe6c697797967da22e99dda9c3acc8600aad70431165

SHA512
5eaa03a94f80d90be5c301f43c21df8711d1d167371ed4693d361c14595498eba1b49842ad222d15b6f72bd98773157e3a80d165904ac893963c475f9b507982

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_Core_x86.bat

Filesize
268B

MD5
b5376ccd99d534fae4e2f223e2779766

SHA1
82683ab96f0dfc03c231bc55e36b4bf5a794bebb

SHA256
93ba327ae268f3b73cb187d03f8d3109a5ea1c83b9a540ecfeec3418839613a6

SHA512
2e159f7deacb9bf6cf0c42c1ea43c80e6d3e29ad10295b7120406fa6d874a306d0308e8659f6b24a76af1892de14162d9b43d4850ff80e5f79a44c73afb26415

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_SecureMgmt0.bat

Filesize
75B

MD5
1687fa3a3cf946a78476ed77852d884f

SHA1
d4e888f256adf0e775529fd12c47e78d2b78012f

SHA256
0b4ee0b16baf595a2d101c37295737ce648139b81baaceadddf63a495a6a6d4f

SHA512
466d01b5830db0ac3198b5caaa36db6e48840f9f846f2dbb9749f5b2e4089570ae5dc20f58c68b7cec32f17491a68e933db5b24cff3943929377387215fe04be

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_SecureMgmt0_defMmode.bat

Filesize
872B

MD5
86ab6fee746dbaa9bb9aafe2fe3f2c47

SHA1
5f2d3e06be4f3b49a3a94db64cdbb405f0f142c0

SHA256
541cd3567f4215f073215b84555c3b89897806e6d28a83577c79ae69f4af24fb

SHA512
52b222d2b5147db083e43c0581b681c6f2f547dcf6524c681b74e4fd566483b91ae6046cac4894a9cef4b0a29faeb1fceff3cad6cd3a6f2779739b3c3acd2859

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_SecureMgmt1.bat

Filesize
296B

MD5
ec378f03f91f1ad5392e2addbbf16eed

SHA1
ff0fb2f6ffe4b748d7da9387e767ce90decdf21c

SHA256
34c6da30257f43300569468632f5cb9c19b36ffb05da131c2a1de4204d1dc55f

SHA512
fea3f05a3b872bed4eb29d26540fa0a911a51051c2688a1834ab8541afdf3990567fc6ddc87c6118754445940f8aec5e934f32659e45d29e009a4efdd0856f50

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_achange0.bat

Filesize
69B

MD5
5853e9faf0244f1d5bfc59fcb86f4f53

SHA1
45bfafe505f6ab0f1068754d32979e1f1a5f0a5b

SHA256
5e24beeefd4b6bccaf1c0b52f3cc3656939ee0f6bf01781097d64beab8f1ecd8

SHA512
b73e3e0ffdf0caeb46bd106cbe912cc5670aaa838f26bca6d2df2bf772883ddc1d9997aa638b222026aa73ebffb3f4da3d60e3714fde330145562ef374b9e7bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_achange1.bat

Filesize
69B

MD5
fc9ecbf3e4ccfc67d12e617ed42e6941

SHA1
fd327bafe0c0497db8488acd7b9c978aeeca33fe

SHA256
dbb855e676055c7d717923c6c4660ef9023a78c2e13ae3df144c5c8ee628450b

SHA512
534bcd39db2dd4161601576d177cf49e70f97160c84b09bbb0105ced6e355baf10eecb9d68dabd68b1d849a8e61a5bc5db1f9bd69c4a9c4d532330edb644ac03

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_mmode1.bat

Filesize
296B

MD5
8524bbcda365d396423b54d0a5c7b229

SHA1
4b15d8353bf2de6d4b7c2c6fd601ee8ba142f562

SHA256
af0e7cc6d5e81e8d61b4e6249513c14d31ce5e36ade051c89b71202328769131

SHA512
0e875f5f69bcdebff96490c3c95f83307f7e95b756347ab246fb8c89668fadd19f0eb8a1cb0cea7b92ab25665828e7d8215862ec7eb18c6be9ccd6d12e744b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_mmode2.bat

Filesize
296B

MD5
b17f4c0ea42509776c8722c4cbc3c89d

SHA1
164c4a486c8f978e615425b384e6342a07528672

SHA256
58d0375354aaab0952a1849fb214d8ac3d286e5a8e40832ec1f8f7de8900f90f

SHA512
e17264f13f8266e2a5ff7c16af441d0e2586133cf7f4b81e92e9edf2a32f0ed32bbceee644794154c1049fdb9ff80a88af9e7370e3166f941ab6c34a979eda01

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_mmode3.bat

Filesize
296B

MD5
a08ae9f952fe9df588e31a74758b70bb

SHA1
1aed776b02f2508aa1bc95ffa34c6d20aba5071f

SHA256
afb002b8f6bcc38a41d689e131737ef0e797445d9b431afc7f7899a4910ea583

SHA512
0e804b33fe9e02a74332677703df01f80cae85fcf6b9c95a06a5142666c91d283e78703aa5f9dfc68481fb0c03d3c10fbb350aabd1e655ba86d9aa0a4de111de

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_mmode4.bat

Filesize
296B

MD5
47fed612b1e085c6bf9760a600605b58

SHA1
dde7b10e4ce6ac2a27c557748271493ae59d9b6b

SHA256
cf9beff54c220834853498208e68e37d2dd77f1faa72bc8c63128eced1e13af8

SHA512
abba7f76939faa1d521e6b775bc3522e3e2da2f36968ebc30f076b3639884472b68cfdf9756da9cd233c8682e3a569af799a63fa6bda6cb982ac3d61c648381c

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_mmode5.bat

Filesize
296B

MD5
498f6f3725e2022f37aaffe630faf352

SHA1
7a4d74f297abe443f522fe34966e4ca6d5205ea0

SHA256
63d0cf75881a3bd846030e7f81765e96cae1ac1e94e3bcd04ec8883f4f81fb2f

SHA512
93d7cb60cb9b54def2eb4bbc4bc236c7396ff0684bd63d3ce3201ae43cfe46a6a2d72deb520805dd960ba2a1a4ae1414042b82b8c90505f95cb1bd028d17a03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\26F9C702\regWrite_mmode6.bat

Filesize
296B

MD5
3e0443b047175e68ba8dd929febaa130

SHA1
44124f470a2ef1be27298340bbe445b132625a5e

SHA256
5fbc205c06ebb8828eb5252db526531c758bdd08107b01a1def9bc4d696e168b

SHA512
76e67ab8c100798907f5f24e84aecc86c8e80cbc0f292a8a2617721032613ed48cfc95016ea401e4ef112bb96555f9f4b88417ce5cd1482fef73e8d61b19aa90

Download Submit
C:\Users\Admin\AppData\Local\Temp\TsuB8FE3728.dll

Filesize
566KB

MD5
1282c7c4e3c8b6d54b99b17e0d668612

SHA1
4070d8fe3089bc053a5669d6dbb668039e061ee1

SHA256
06aea36c7076068bc89bf2199034d13e965754f92c0957fed16dfbd1bfbcca18

SHA512
11556401dde10604f40897191c28e4c9f98f759a1f2dff9b3f84094ec30058adaf2b3d35360b41ca9a52d16988b67a898ce0c3fe31d5b3d75ea17591517c9450

Download Submit
C:\Users\Admin\AppData\Local\Temp\elxocmcore-windows-x64-14.2.455.10-1A95218C1.log

Filesize
235KB

MD5
45aeb3112c96e5c63ae9c5df03e94da6

SHA1
f016a5964b993e33299a9b8e3e6bcc5ccd4fbecc

SHA256
799ef147e338e80d7a15815e675e8178c3cfc20e6b67f17c0244946e32326e28

SHA512
86c998b10860ec2591bd93c1707227831fb5b5afc3f8f35cb55ab844a8ba07d44e8b4a47d5a78a436d1089b8807195b33b8bc41ad507a78c73c9ff2346b6405a

Download Submit