a9206417bf18fbe241927419daaf2ba6bdec71d4c130256a59ca6f2e8f89cf8e

Resubmissions

03-09-2024 08:38

240903-kj4klascln 10

03-09-2024 08:36

240903-kh1gjsscjm 10

03-09-2024 06:55

240903-hp2l3s1gkh 10

Analysis

max time kernel
74s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PenlExecutorV5.exe
Size

21.7MB
MD5

2ab204ea193000dade28d306de97a101
SHA1

b465e38921a355bd93e3224dacbf330665bc69ab
SHA256

a9206417bf18fbe241927419daaf2ba6bdec71d4c130256a59ca6f2e8f89cf8e
SHA512

57a3b37e3f42a33e98b33afc10fdc28bd3247d2ace85772859a63a80fc71676732320e0bda1b6b77565ad8150f6c38ada7800fab76547ec9ced0363ceda1d5dd
SSDEEP

393216:nLct7WGlx0P7z8P/NR5q+5DbqCrqDlJVy2zOeLM+AA+k6zYVz4TUi2I8:ngtpgYP/N/qUDbqgqDjVy2LhhZzEEI

Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation pyinstaller ransomware spyware stealer

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Renames multiple (212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4336	powershell.exe
1528	powershell.exe
1756	powershell.exe
3792	powershell.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PanelExecutorsV8.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
952	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	PenlExecutorV5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	PenlExecutorV4.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyScript.lnk	PanelExecutorsV8.exe

Executes dropped EXE 4 IoCs

pid	Process
3412	PenlExecutorV4.exe
1040	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4036	PenlExecutorV4.exe

Loads dropped DLL 32 IoCs

pid	Process
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe
4516	PanelExecutorsV8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	discord.com
29	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com
26	ipinfo.io
27	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5004	sc.exe
1796	sc.exe
2832	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000b000000023422-87.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PanelExecutorsV8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PanelExecutorsV8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1760	taskkill.exe
3980	taskkill.exe
4412	taskkill.exe
3604	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3940	notepad.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4172	powershell.exe
1164	powershell.exe
4172	powershell.exe
1164	powershell.exe
3792	powershell.exe
3792	powershell.exe
1528	powershell.exe
1528	powershell.exe
1756	powershell.exe
1756	powershell.exe
5040	powershell.exe
5040	powershell.exe
4336	powershell.exe
4336	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	3412	PenlExecutorV4.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4516	PanelExecutorsV8.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	3604	taskkill.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4036	PenlExecutorV4.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3940	notepad.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4172	4152	PenlExecutorV5.exe	85
PID 4152 wrote to memory of 4172	4152	PenlExecutorV5.exe	85
PID 4152 wrote to memory of 1164	4152	PenlExecutorV5.exe	87
PID 4152 wrote to memory of 1164	4152	PenlExecutorV5.exe	87
PID 4152 wrote to memory of 3412	4152	PenlExecutorV5.exe	89
PID 4152 wrote to memory of 3412	4152	PenlExecutorV5.exe	89
PID 3412 wrote to memory of 3792	3412	PenlExecutorV4.exe	95
PID 3412 wrote to memory of 3792	3412	PenlExecutorV4.exe	95
PID 3412 wrote to memory of 1528	3412	PenlExecutorV4.exe	97
PID 3412 wrote to memory of 1528	3412	PenlExecutorV4.exe	97
PID 3412 wrote to memory of 1756	3412	PenlExecutorV4.exe	99
PID 3412 wrote to memory of 1756	3412	PenlExecutorV4.exe	99
PID 3412 wrote to memory of 2660	3412	PenlExecutorV4.exe	101
PID 3412 wrote to memory of 2660	3412	PenlExecutorV4.exe	101
PID 3412 wrote to memory of 3308	3412	PenlExecutorV4.exe	104
PID 3412 wrote to memory of 3308	3412	PenlExecutorV4.exe	104
PID 3412 wrote to memory of 5040	3412	PenlExecutorV4.exe	106
PID 3412 wrote to memory of 5040	3412	PenlExecutorV4.exe	106
PID 3412 wrote to memory of 1040	3412	PenlExecutorV4.exe	108
PID 3412 wrote to memory of 1040	3412	PenlExecutorV4.exe	108
PID 3412 wrote to memory of 1040	3412	PenlExecutorV4.exe	108
PID 1040 wrote to memory of 4516	1040	PanelExecutorsV8.exe	112
PID 1040 wrote to memory of 4516	1040	PanelExecutorsV8.exe	112
PID 1040 wrote to memory of 4516	1040	PanelExecutorsV8.exe	112
PID 4516 wrote to memory of 1760	4516	PanelExecutorsV8.exe	113
PID 4516 wrote to memory of 1760	4516	PanelExecutorsV8.exe	113
PID 4516 wrote to memory of 1760	4516	PanelExecutorsV8.exe	113
PID 4516 wrote to memory of 3980	4516	PanelExecutorsV8.exe	114
PID 4516 wrote to memory of 3980	4516	PanelExecutorsV8.exe	114
PID 4516 wrote to memory of 3980	4516	PanelExecutorsV8.exe	114
PID 4516 wrote to memory of 4412	4516	PanelExecutorsV8.exe	115
PID 4516 wrote to memory of 4412	4516	PanelExecutorsV8.exe	115
PID 4516 wrote to memory of 4412	4516	PanelExecutorsV8.exe	115
PID 4516 wrote to memory of 3604	4516	PanelExecutorsV8.exe	116
PID 4516 wrote to memory of 3604	4516	PanelExecutorsV8.exe	116
PID 4516 wrote to memory of 3604	4516	PanelExecutorsV8.exe	116
PID 4516 wrote to memory of 3940	4516	PanelExecutorsV8.exe	117
PID 4516 wrote to memory of 3940	4516	PanelExecutorsV8.exe	117
PID 4516 wrote to memory of 3940	4516	PanelExecutorsV8.exe	117
PID 4516 wrote to memory of 4336	4516	PanelExecutorsV8.exe	118
PID 4516 wrote to memory of 4336	4516	PanelExecutorsV8.exe	118
PID 4516 wrote to memory of 4336	4516	PanelExecutorsV8.exe	118
PID 4516 wrote to memory of 5004	4516	PanelExecutorsV8.exe	121
PID 4516 wrote to memory of 5004	4516	PanelExecutorsV8.exe	121
PID 4516 wrote to memory of 5004	4516	PanelExecutorsV8.exe	121
PID 4516 wrote to memory of 1796	4516	PanelExecutorsV8.exe	122
PID 4516 wrote to memory of 1796	4516	PanelExecutorsV8.exe	122
PID 4516 wrote to memory of 1796	4516	PanelExecutorsV8.exe	122
PID 4516 wrote to memory of 952	4516	PanelExecutorsV8.exe	123
PID 4516 wrote to memory of 952	4516	PanelExecutorsV8.exe	123
PID 4516 wrote to memory of 952	4516	PanelExecutorsV8.exe	123
PID 4516 wrote to memory of 2832	4516	PanelExecutorsV8.exe	124
PID 4516 wrote to memory of 2832	4516	PanelExecutorsV8.exe	124
PID 4516 wrote to memory of 2832	4516	PanelExecutorsV8.exe	124

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableResetOption = "1"	PanelExecutorsV8.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PenlExecutorV5.exe
"C:\Users\Admin\AppData\Local\Temp\PenlExecutorV5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAegByACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGQAbQBrACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBvAHIAawBpAG4AZwAgAGoAdQBzAHQAIABjAGwAaQBjAGsAIABvAGsAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHcAaQBzACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAZgBpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAdwBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAdABkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcgBqACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe
  "C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'PenlExecutorV4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\PenlExecutorV4.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "PenlExecutorV4" /tr "C:\ProgramData\PenlExecutorV4.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbAB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHcAZgBzACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBvAHIAawBpAG4AZwAgAGoAdQBzAHQAIABjAGwAaQBjAGsAIABvAGsAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAGQAeAB5ACMAPgA="
    3⤵
    PID:3308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAcQB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAawB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGwAZABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAYgB5ACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe
    "C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe
      "C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe"
      4⤵
      Drops file in Drivers directory
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4516
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad.exe C:\Temp\ransom_message.txt
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        Suspicious use of FindShellTrayWindow
        
        PID:3940
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4336
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1796
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:952
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wscsvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2832

C:\ProgramData\PenlExecutorV4.exe
C:\ProgramData\PenlExecutorV4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\end_time.pkl

Filesize
53B

MD5
e1f3b3a6779736206ff4a89b30aba910

SHA1
6740bfe1e53ae704ad367c6ede42b9812dddaf3e

SHA256
83c1af562a30e9481475c99bb63a18bd6cd02c7c5c9ada4a193d6b1721acc9b9

SHA512
37bed0bc64429885ae2594c7656470fcc4159b1d0b97aa9d3269976777317015db7366f7735e304cec2da0e1976f2dcd72cd8d4a03c13c9ba3d2a3809c9df809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96e3b86880fedd5afc001d108732a3e5

SHA1
8fc17b39d744a9590a6d5897012da5e6757439a3

SHA256
c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

SHA512
909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d4c4d1dca8db6525ebf0f76e0a17dff8

SHA1
c66f537cd817b1b4d4a745ae5bc95a2b340a2faf

SHA256
3b760f2aaf2d8ea3bf7f40daafe99bb4de9edc0c42f68a7dfbd9f26c5d75fdc4

SHA512
29cffc712cd1aa365a2acbf316271dbbaa677bc443f442be918eabaa8a8a506153a3303a63e28088c328a8c933a1d0313a833154538995976a93a2fd311bf288

Download Submit
C:\Users\Admin\AppData\Local\Temp\PanelExecutorsV8.exe

Filesize
21.6MB

MD5
eeb609c203c96953017ce60c6c837c50

SHA1
cc7d00abeb70ba3c83e4fc169a133cb61794c43c

SHA256
94062fbf362116f6a73b00900baaee497c264f47184d527b7a5026bcef6332c1

SHA512
01ec0c74b166fe71788eec13426b43bf1016eea37656a2b3cfd8e57e25a19d3efb585d7481857fbd7eccfe31bbad3087bc7b2bfffc97d52b94b9c666237bf425

Download Submit
C:\Users\Admin\AppData\Local\Temp\PenlExecutorV4.exe

Filesize
21.6MB

MD5
41a303702620b554aa697cadcd937f80

SHA1
861eb3f46b826678d2dea7710413a4973bf664ec

SHA256
ed3ddc8dd5074454b681f10cc1ba5deb82fe8fe981cede1465bbbf1818052960

SHA512
92d22aafa18c0738d64a0fa3ab9fd964bec4447a093983cf0ed4de89a8dcf6d29f2e7e6e36c9a1bf4b52d2cb435548a5629f5eb3b4615a4e51c0dac173cf7ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\MSVCP140.dll

Filesize
436KB

MD5
c766ca0482dfe588576074b9ed467e38

SHA1
5ac975ccce81399218ab0dd27a3effc5b702005e

SHA256
85aa8c8ab4cbf1ff9ae5c7bde1bf6da2e18a570e36e2d870b88536b8658c5ba8

SHA512
ee36bc949d627b06f11725117d568f9cf1a4d345a939d9b4c46040e96c84159fa741637ef3d73ed2d01df988de59a573c3574308731402eb52bae2329d7bddac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\VCRUNTIME140.dll

Filesize
81KB

MD5
55c8e69dab59e56951d31350d7a94011

SHA1
b6af2d245ae4d67c38eb1cd31e0c1cffb29b9b2c

SHA256
9d8d21022ff9d3f6b81a45209662a4f3481edc2befae0c73b83cf942eab8be25

SHA512
efb2ac1891724df16268480628eb230b6ee37ed47b56d2e02a260559865cdd48ee340ce445e58f625e0f4d6dbdc5bfb7ce2eeedf564b837cff255ef7d1dc58cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_asyncio.pyd

Filesize
56KB

MD5
87ec92f3a05fe07a087d5137d218386f

SHA1
840b88107ac72c5752c6db422a54fa3459f5a3b6

SHA256
c60416af400ee4a75b957de9c19f1e50af7287c89bbe0b3d6a3f0c0829daaf4a

SHA512
a0c1501bd19759ffd471edc5b92f48a7d3b69ec9e257e03f74f5ce574776c6d927c58a1f6460455ed096c0e538a673528a16723dfda6303fe831e2ca672bb1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_bz2.pyd

Filesize
75KB

MD5
387725bc6de235719ae355dfaa81e67c

SHA1
428b74b0bf8acd04eb20dc5a016352042c812c7a

SHA256
a9de8848c95518434cb5c2a9cb9d648cba140021e49f2e5212becf13a329b5d0

SHA512
bed2d6902f2ddd7dc7c2043c210ce682df75616ca63d163b756559dc7d33e926733f96d5407dc856061fba711ce41de9b01bb7b9db3940fa359c32c40d9f8233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_cffi_backend.cp39-win32.pyd

Filesize
147KB

MD5
296843bbbd173d0880fe441c88ad0f95

SHA1
f9e9323edb85f58ae1f75f1d83781de02889c4e6

SHA256
c08f2ba9bdbb6c958de74d05682a1d6eb513ed129cc795100b22a0cb7d815a8b

SHA512
c79b45e387539145b964af06cae27aa1087bf7c99ec82466b38daa02f5155c5d9d156c7dc0502f9c7b45441e8ca32d42956ed19e70e60393bbdd4b128ea4c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_ctypes.pyd

Filesize
112KB

MD5
aff88d04f5d45e739902084fce6da88a

SHA1
6ce6a89611069deaa7c74fa4fa86882dc21b5801

SHA256
34371eb9b24ba67ce6803d965cf5f0fe88ef4762af648ec2183e5bf21835d876

SHA512
8dd8f90ae1cc0fbc76f0039bc12e1aee7b2718017f4f9b09361001bed7b278b84f20d0fffceda4d5edd8744140cfdf1ca52497645d0480f5d42934f7df9808ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_decimal.pyd

Filesize
224KB

MD5
680d0a29b8ad9cdb2ddd8d6b59e2fecd

SHA1
8ec37f37622d29d3025bc6007dfb11ff3ec31a07

SHA256
21034f441ffdea24ad10dbbce5ba440c2135bb809695dfbeb2d860325135bc61

SHA512
f2a96fb98f2c4ec544b3bc0d289139ecc08b8e53140380d8cfda335d367f6465a7557161a8ca18944d11b2b1fd3a1d1eaaa27ed8c003b0b0b57c5c960846b47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_hashlib.pyd

Filesize
50KB

MD5
fdfa235f58a04d19e1ce923ca0d8ae19

SHA1
4a1178ba7e9a56f8c68dc3391a169222c67237e9

SHA256
7ad484e99ea33e4eea2cbf09203fb9dbd0c2c325b96e6cf2ffd146156c93bf7a

SHA512
0fe187e1019c159c0ee90fbc8eea20e40a28ff05223321d04784e577b60a2c0a3a476fabc71bd81dd08e7a127bb6cb03edf5d604bfdda38516fb2c90148dd118

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_lzma.pyd

Filesize
157KB

MD5
f6b74ac19fb0601a4e612a8dc0c916e3

SHA1
d4a77386caf7f70e66d5ec4543c8d9de0e4bc39f

SHA256
ce2ea2c96afd8c0cf97fc55130f835b6625a0772d86b259ea82bbc0b3def75e6

SHA512
0b60c51f76eb6872000d92bbec7fdabf687f5096fd12f1456cf26ad6033c22b998aee94842fda800288bef94790608204f97a7ed034544a1377cbf9722c6a826

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_multiprocessing.pyd

Filesize
25KB

MD5
d165a01fe4f19ba9cb74b9aff5c79d80

SHA1
f78083226d6b37c7c3ecca55a0ab8f2227b5f6ef

SHA256
f87547427b693640e45b8fc51a2efbaca75e6f915e5516f8ea81ebe010e0f89d

SHA512
efa96cee1721ba2f374d31766d720f8bccd34fdec206849cb9ddcf1b149f0a6068ef23aecfa8e2a092d08f3b7db46c0e3e1cf2d891a999265110404f934ce226

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_overlapped.pyd

Filesize
37KB

MD5
6ad0656b55a9a4d0544d295b8b54a5e5

SHA1
5b0ba4d95bb325aef33971ebceee0d86fee80df0

SHA256
dcf4ebaacf2fa99d9310bf21e1f18eb7fb6f4d02f7731b3542403ecab9748ac6

SHA512
86ad66151556a9ff882befb8c2fd2e51e846078b3e3b34b1e7bf5e5e43f74bee62e111b0c79f6a0580dc6e27b37d7f26aec91bc6240687e7fd8a70b9601f8b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_queue.pyd

Filesize
24KB

MD5
9cddd43f5b53ab8993e46b24b68d8424

SHA1
7327ed8baf41f86d122137c511656f98d99ff990

SHA256
fa262ab8fb1caf23abf125e1b9d69c78727be3d8274e13ebe83e71f1058406d3

SHA512
9661968a986af5495bb3632e0a658885933ed733d64785627597456a5cef9521359a078f64af78464675698aff8f4b3cf844a56a8adbe4d69d4abe8fba3ca542

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_socket.pyd

Filesize
68KB

MD5
a9450642d8832893998bd213d98d509b

SHA1
3ef416ffaa438a2809cdffddd1b2717461ead7d4

SHA256
5407750d69d74318ec66bd1464558c07c06c6aa9edbc0641cd2dd7533378772b

SHA512
93027a694800d2d92ba773e8232ee016946ee9b36ba211537619df0508e9f50660b9a292d29dd4e90c2406b29bd3b1f8e4eb2226945b7163b2bd3227d4482323

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_ssl.pyd

Filesize
138KB

MD5
620f8f46eed249f7a7881656ad22062d

SHA1
709c772808ff2e894cdf1066c28287e92fc643c5

SHA256
dbceda1c97bfc8f6a0d1d17df6a2d7e1d44c59718cd652e0a5975052b218c590

SHA512
2bc2674603db7e29005b84b5de9cefa98737ebbdab5f5a034856c26099872e6886c8b6a41f2cdb2bb52a84ae1a15ae21b6394e1fe6820ba4fe0c7d88f3b1511a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_tkinter.pyd

Filesize
58KB

MD5
a475634789bb1284d75e55870462a74a

SHA1
af7bfe3ffeef7479549831c5cd0de487151a6c5f

SHA256
725a13950969db01ad20af1f36eb28d6011a2feb31bd8c112b6bed2d025bc761

SHA512
9ca2f331d9ca22732ab0cf12a42d1b221f5daf01b5a83c43a4ba0b48798289d52428ab17cdedfde9eb2daf5f12304fe28e2c4d2306399b7fa562acdc74487a19

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\_uuid.pyd

Filesize
19KB

MD5
8f3020f3fc4ab65c2cf9191f38749d26

SHA1
61838e10f152fa7d1632fddf7646de4c669e9036

SHA256
f12a7102bcbb9ca5f57d13474f8da916ad42a9a4d8c8b22be24ee3b6916f54e3

SHA512
8113095d7e344bb163a7759e059db97671636a57fe008d2eb64aded4fe3d7c44403941ac36a520c17bf8cd9a8aab8d8324e138014249b23fad03b10140d7b8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\base_library.zip

Filesize
822KB

MD5
c1b3b5cf32b9a0505be9af7bd59f410b

SHA1
2774e124e9dfe88597ecd98b64d5a905a44fda56

SHA256
15c4c5b53589aee564d00496ed3a88d21d5cd82f16324b258e9caaa34e3056e5

SHA512
5f36d50c5eb378cf53f1662bd552e5609459463cd90a1733bace113cd14c3b5bddb76f111e84d4c2a101f730add6bed0071cd375d6b094d3024d2feaa255db64

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\libcrypto-1_1.dll

Filesize
2.1MB

MD5
aad424a6a0ae6d6e7d4c50a1d96a17fc

SHA1
4336017ae32a48315afe1b10ff14d6159c7923bc

SHA256
3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377

SHA512
aa4b74b7971cb774e4ae847a226cae9d125fadc7cde4f997b7564dff4d71b590dcbc06a7103451b72b2afe3517ab46d3be099c3620c3d591ccbd1839f0e8f94a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\libffi-7.dll

Filesize
28KB

MD5
bc20614744ebf4c2b8acd28d1fe54174

SHA1
665c0acc404e13a69800fae94efd69a41bdda901

SHA256
0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57

SHA512
0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\libssl-1_1.dll

Filesize
525KB

MD5
697766aba55f44bbd896cbd091a72b55

SHA1
d36492be46ea63ce784e4c1b0103ba21214a76fb

SHA256
44a228b3646eb3575abd5cbcb079e018de11ca6b838a29e4391893de69e0cf4b

SHA512
206957347540f1356d805bf4a2d062927e190481aadc105c3012e69623149850a846503fca30fc38298f74d7f8f69761fddd0aa7f5e31fedb1fa5e5c9de56e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\psutil\_psutil_windows.pyd

Filesize
57KB

MD5
876371b620e310c22df0f7cb1cb28bf3

SHA1
86058ee41d3146610683829a9965fd82d000cf84

SHA256
5ce763af03f2d20859415f1af5f0bc489087e396a196caf0bacef36ceecf529a

SHA512
69b51090bfee360b3af027b4e98c6ac5b4454dbcc189d47f6b9c08938c5a54ee100c8988886fe3505fc809415e23a901937e5f678f73f775ecfc69e9950ce8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\pyexpat.pyd

Filesize
164KB

MD5
3e43bcc2897f193512990e9e9024111b

SHA1
11dec8c9a1c4b45de9c980125eaef462038c1f2a

SHA256
0d8ac2a2b81176a06b0fb8663702428d2cdd5bedeab68b04210bf5cb6b49a475

SHA512
e629f23a9ad1274b57a47b170e598e47f28984dc2aaf4985ded9b217f4288222190eabe5a9fd4b11fa3eadb42040d8a532090544bf46be288b7310966d126aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\python3.DLL

Filesize
57KB

MD5
dd07013785e2bb606293fc3ec6467fcf

SHA1
400a7f393708ccccc44e6348e88af0689afabb45

SHA256
34da45b57baec57d1193901d24e9dc9dd23eeccd0776b016072b311df1ff8379

SHA512
c06a280f89b172f91973954bb461fca1cfb6b0d0c654afe94ae1f801ff18abde36a436959979e98f41ca9dcaec2846f81279aab8701b7941f141367c2a080268

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\python39.dll

Filesize
4.2MB

MD5
2a9c5db70c6906571f2ca3a07521baa2

SHA1
765fa27bbee6a02b20b14b2b78c92a880e6627e5

SHA256
c69ce89b0487d86a63b64951207781f8051282afde67b20d3b8374c1a067f611

SHA512
fa4a677eaae2d258ac4f083a4e7009d985523b964ada93f53dc399a88c14970c7be2d2f39a7b38a922b58d134df2ede954554dcd00a4895e4273161867acac53

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\pywin32_system32\pythoncom39.dll

Filesize
526KB

MD5
266bf47153d9ae3f8fccec73352469c0

SHA1
eaec57989150d326371a178bad5ca67f61c8d15f

SHA256
427eb21b7100e453d19f6c9a557beeba7f06097d0d33da78cdb2f970b2f16a96

SHA512
f110f827c7dac1a1cdcded7ddef804e4ff06768fdbe74e2da1aa7200a63ba9f53040b89094242b6635df37dcdc50768954601d04f9659bf0452833e5b2176d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\pywin32_system32\pywintypes39.dll

Filesize
106KB

MD5
50e4d0a4043f786f19d917f67c112d83

SHA1
cc88626016bd4facee38ed9adcd7cf1148cb0407

SHA256
98318db0bfaf550d99c9c122b47a97b1dcd2f6cb6eb59730cba0efb49f34af9c

SHA512
c340299da911a2e8d7401853c2442b6380590b7f9f02c31debd666af35797872eab4bfbfa77cfdd1f1c491c3419bc21ccad5dceabfd6600cf4a72e23e28893d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\select.pyd

Filesize
23KB

MD5
1559cf3605d62c03d6ff2440ea3e175f

SHA1
26faec2bafd8523d1705021d06c56947b58cda1c

SHA256
b8da64fa424e5fb2bc8de93d2c0dcb55076cd9345452d3c624b3fcbbbe15644b

SHA512
1891a356ae98a09a7476697b6e7dd0de6b940043910a9aa414e17a523118d76dd0c55ea786d9bd2a77d792bdf95a75b272352eb813d928c429a707a78c09f05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\tcl86t.dll

Filesize
1.3MB

MD5
30195aa599dd12ac2567de0815ade5e6

SHA1
aa2597d43c64554156ae7cdb362c284ec19668a7

SHA256
e79443e9413ba9a4442ca7db8ee91a920e61ac2fb55be10a6ab9a9c81f646dbb

SHA512
2373b31d15b39ba950c5dea4505c3eaa2952363d3a9bd7ae84e5ea38245320be8f862dba9e9ad32f6b5a1436b353b3fb07e684b7695724a01b30f5ac7ba56e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
5900f51fd8b5ff75e65594eb7dd50533

SHA1
2e21300e0bc8a847d0423671b08d3c65761ee172

SHA256
14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

SHA512
ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\tk86t.dll

Filesize
1.1MB

MD5
6cadec733f5be72697d7112860a0905b

SHA1
6a6beeef3b1bb7c85c63f4a3410e673fce73f50d

SHA256
19f70dc79994e46d3e1ef6be352f5933866de5736d761faa8839204136916b3f

SHA512
e6b3e52968c79d4bd700652c1f2ebd0366b492fcda4e05fc8b198791d1169b20f89b85ec69cefa7e099d06a78bf77ff9c3274905667f0c94071f47bafad46d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\unicodedata.pyd

Filesize
1.1MB

MD5
bd51c8fbb9bfc437e19cb19042bfeae8

SHA1
8e537acb5a5f421ae4290681ed7d295ac8e86ca2

SHA256
1ccf9fa395e963daf8aba5a2acd68c5b13ee04b6b689a601652bcf04e7f25f8a

SHA512
6dd7041ee42dc2f67eef5efb0eb519dfc79cb19293693d9fb6e60e4cff374e3f955f7e09c8d9526fb5e1a3014875bd09a712d397a7068ac0900c6f8b754d8e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10402\win32\win32api.pyd

Filesize
101KB

MD5
9bd844254690f978884d24a4f2163184

SHA1
f41c8756f38becd7712bd7f5a4b956d1c682b2b1

SHA256
d18aac0acc64a5bb670d3dc4d82033a84d1411e0d32ed0c7f1819760f7b25425

SHA512
1453d6d233c8390edfcd4e4ccbdcb1c34a153555d0f8cc00d75c98e8e51791213c068227dc545ab7bc8046e3a5fa9df6ca83900ea50b042824286a683826450b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g5anlyqi.wj4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1164-39-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/1164-37-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/1164-23-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/1164-43-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/3412-82-0x000000001D3D0000-0x000000001E974000-memory.dmp

Filesize
21.6MB

Download
memory/3412-40-0x00000000001E0000-0x000000000178A000-memory.dmp

Filesize
21.7MB

Download
memory/4152-0-0x00007FFC0AC83000-0x00007FFC0AC85000-memory.dmp

Filesize
8KB

Download
memory/4152-38-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/4152-2-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/4152-1-0x0000000000220000-0x00000000017CE000-memory.dmp

Filesize
21.7MB

Download
memory/4172-81-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/4172-11-0x000001AB55DE0000-0x000001AB55E02000-memory.dmp

Filesize
136KB

Download
memory/4172-4-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/4172-3-0x00007FFC0AC80000-0x00007FFC0B741000-memory.dmp

Filesize
10.8MB

Download
memory/4336-1183-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/4336-1200-0x0000000007290000-0x00000000072AA000-memory.dmp

Filesize
104KB

Download
memory/4336-1171-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/4336-1172-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/4336-1178-0x00000000059D0000-0x0000000005D24000-memory.dmp

Filesize
3.3MB

Download
memory/4336-1169-0x00000000051E0000-0x0000000005808000-memory.dmp

Filesize
6.2MB

Download
memory/4336-1184-0x0000000006000000-0x000000000604C000-memory.dmp

Filesize
304KB

Download
memory/4336-1186-0x0000000006530000-0x0000000006562000-memory.dmp

Filesize
200KB

Download
memory/4336-1187-0x000000006E810000-0x000000006E85C000-memory.dmp

Filesize
304KB

Download
memory/4336-1197-0x0000000006510000-0x000000000652E000-memory.dmp

Filesize
120KB

Download
memory/4336-1198-0x0000000007150000-0x00000000071F3000-memory.dmp

Filesize
652KB

Download
memory/4336-1170-0x00000000050A0000-0x00000000050C2000-memory.dmp

Filesize
136KB

Download
memory/4336-1199-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Filesize
6.5MB

Download
memory/4336-1201-0x0000000007300000-0x000000000730A000-memory.dmp

Filesize
40KB

Download
memory/4336-1202-0x0000000007510000-0x00000000075A6000-memory.dmp

Filesize
600KB

Download
memory/4336-1203-0x0000000007490000-0x00000000074A1000-memory.dmp

Filesize
68KB

Download
memory/4336-1204-0x00000000074C0000-0x00000000074CE000-memory.dmp

Filesize
56KB

Download
memory/4336-1205-0x00000000074D0000-0x00000000074E4000-memory.dmp

Filesize
80KB

Download
memory/4336-1207-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download
memory/4336-1206-0x00000000075D0000-0x00000000075EA000-memory.dmp

Filesize
104KB

Download
memory/4336-1168-0x0000000000EA0000-0x0000000000ED6000-memory.dmp

Filesize
216KB

Download