latentbot | d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f

Resubmissions

09/12/2025, 07:26

251209-h9p4saen9w10

09/12/2025, 02:46

251209-c9l48stphk10

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
09/12/2025, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
Size 477KB
Sample251209-c9l48stphk
SHA256 d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f
MD5 a80e4f4d318805db0a195e43b3d8c2da
SHA1 40b9c76cc9434fce19022a867bd566697a789d19
SHA512 a979bfb3ef4114f4b7881656c5647d4a1a3b3777438c7fb5b2b2d4fa29f51b875592e72dd361a0b09755636b7543a9eee0ea8eb0d5aefcf3ee04e2ea9b73b656
SSDEEP 12288:Mpu0rlYENKMi5uUUsF0mAYic3EWp0ehbbD+dJS:ErlYKtouUipYtnbb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution latentbot xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

158.94.209.169:6077
johnsmith77770444.zapto.org:6078

Mutex

AX4zgihJB7HHK7jW

Attributes

install_file
pc1.exe

aes.plain

Extracted

Family

latentbot

johnsmith77770444.zapto.org

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4832-79-0x00000000061B0000-0x00000000061BE000-memory.dmp	disable_win_def

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4832-35-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral2/files/0x001b00000002b1a0-93.dat	family_xworm
behavioral2/memory/6008-100-0x00000000005D0000-0x00000000005DE000-memory.dmp	family_xworm

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3044	powershell.exe
2044	powershell.exe
5348	powershell.exe
1504	powershell.exe
3368	powershell.exe
768	powershell.exe
2000	powershell.exe
2696	powershell.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pc1.lnk	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pc1.lnk	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	vvuand.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	vvuand.exe

Executes dropped EXE 10 IoCs

pid	Process
2080	wxhPbckf.exe
4344	pc1.exe
4352	pc1.exe
6008	vvuand.exe
6080	XWormClient.exe
5952	XWormClient.exe
2216	wxhPbckf.exe
5176	wxhPbckf.exe
5464	pc1.exe
240	pc1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Windows\CurrentVersion\Run\pc1 = "\\pc1.exe"	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "\\XWormClient.exe"	vvuand.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 4832	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	84
PID 2080 set thread context of 2216	2080	wxhPbckf.exe	104
PID 4344 set thread context of 5464	4344	pc1.exe	111
PID 4352 set thread context of 240	4352	pc1.exe	118

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxhPbckf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxhPbckf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4208	schtasks.exe
1400	schtasks.exe
1792	schtasks.exe
1608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1504	powershell.exe
3368	powershell.exe
1504	powershell.exe
3368	powershell.exe
4832	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
768	powershell.exe
2080	wxhPbckf.exe
2080	wxhPbckf.exe
2000	powershell.exe
768	powershell.exe
2000	powershell.exe
3044	powershell.exe
2696	powershell.exe
3044	powershell.exe
2696	powershell.exe
2044	powershell.exe
5348	powershell.exe
5348	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	4832	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
Token: SeDebugPrivilege	6008	vvuand.exe
Token: SeDebugPrivilege	6080	XWormClient.exe
Token: SeDebugPrivilege	5952	XWormClient.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	2080	wxhPbckf.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2216	wxhPbckf.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	5464	pc1.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	5348	powershell.exe
Token: SeDebugPrivilege	240	pc1.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1504	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	78
PID 784 wrote to memory of 3368	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	80
PID 784 wrote to memory of 4208	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	82
PID 784 wrote to memory of 4832	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	84
PID 784 wrote to memory of 4832	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	84
PID 784 wrote to memory of 4832	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	84
PID 784 wrote to memory of 4832	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	84
PID 784 wrote to memory of 4832	784	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	84
PID 4832 wrote to memory of 6008	4832	_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe	92
PID 2080 wrote to memory of 768	2080	wxhPbckf.exe	97
PID 2080 wrote to memory of 2000	2080	wxhPbckf.exe	99
PID 2080 wrote to memory of 1400	2080	wxhPbckf.exe	100
PID 2080 wrote to memory of 5176	2080	wxhPbckf.exe	103
PID 2080 wrote to memory of 2216	2080	wxhPbckf.exe	104
PID 2080 wrote to memory of 2216	2080	wxhPbckf.exe	104
PID 2080 wrote to memory of 2216	2080	wxhPbckf.exe	104
PID 2080 wrote to memory of 2216	2080	wxhPbckf.exe	104
PID 2080 wrote to memory of 2216	2080	wxhPbckf.exe	104
PID 4344 wrote to memory of 2696	4344	pc1.exe	105
PID 4344 wrote to memory of 3044	4344	pc1.exe	107
PID 4344 wrote to memory of 1792	4344	pc1.exe	108
PID 4344 wrote to memory of 5464	4344	pc1.exe	111
PID 4344 wrote to memory of 5464	4344	pc1.exe	111
PID 4344 wrote to memory of 5464	4344	pc1.exe	111
PID 4344 wrote to memory of 5464	4344	pc1.exe	111
PID 4344 wrote to memory of 5464	4344	pc1.exe	111
PID 4352 wrote to memory of 2044	4352	pc1.exe	112
PID 4352 wrote to memory of 5348	4352	pc1.exe	113
PID 4352 wrote to memory of 1608	4352	pc1.exe	116
PID 4352 wrote to memory of 240	4352	pc1.exe	118
PID 4352 wrote to memory of 240	4352	pc1.exe	118
PID 4352 wrote to memory of 240	4352	pc1.exe	118
PID 4352 wrote to memory of 240	4352	pc1.exe	118
PID 4352 wrote to memory of 240	4352	pc1.exe	118

C:\Users\Admin\AppData\Local\Temp\_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
"C:\Users\Admin\AppData\Local\Temp\_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxhPbckf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB19D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4208
- C:\Users\Admin\AppData\Local\Temp\_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe
  "C:\Users\Admin\AppData\Local\Temp\_d28d2788b9d5b476e71fb63b71e36b3eb36fed4ca0152f36fa6f00aab857543f.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\vvuand.exe
    "C:\Users\Admin\AppData\Local\Temp\vvuand.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:6008

C:\Users\Admin\AppData\Roaming\wxhPbckf.exe
C:\Users\Admin\AppData\Roaming\wxhPbckf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxhPbckf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFA3E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1400
- C:\Users\Admin\AppData\Roaming\wxhPbckf.exe
  "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Users\Admin\AppData\Roaming\wxhPbckf.exe
  "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2216

C:\pc1.exe
\pc1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\pc1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxhPbckf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1792
- C:\pc1.exe
  "C:\pc1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5464

C:\pc1.exe
C:\pc1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\pc1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxhPbckf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5348
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxhPbckf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp402.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1608
- C:\pc1.exe
  "C:\pc1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:240

C:\XWormClient.exe
C:\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\XWormClient.exe
\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XWormClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWormClient.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

wxhPbckf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wxhPbckf.exe.log
Size 1KB
SHA256 4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
MD5 7e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1 765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA512 de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
MD5 SHA1 SHA512

Submit Download