Malware Analysis Report

2025-08-10 23:21

Sample ID 241117-kb4kmavmdz
Target 70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe
SHA256 70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064
Tags
discovery evasion persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064

Threat Level: Known bad

The file 70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence spyware stealer

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Reads user/profile data of web browsers

Deletes itself

Checks computer location settings

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-17 08:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-17 08:26

Reported

2024-11-17 08:28

Platform

win7-20241023-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\logagent32.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*logagent32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\logagent32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*QWRtaW4= = "C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\logagent32.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2308 set thread context of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1776 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 1776 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 1776 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 1776 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 2428 wrote to memory of 2816 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2428 wrote to memory of 2816 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2428 wrote to memory of 2816 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 2308 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe C:\Windows\System32\schtasks.exe
PID 2308 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe C:\Windows\System32\schtasks.exe
PID 2308 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe C:\Windows\System32\schtasks.exe
PID 2580 wrote to memory of 616 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 2580 wrote to memory of 616 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 2580 wrote to memory of 616 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 2580 wrote to memory of 2148 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 2580 wrote to memory of 2148 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
PID 2580 wrote to memory of 2148 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe

"C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe.config"

C:\Windows\system32\timeout.exe

timeout /t 5

\??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe

"c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe\" arguments" /sc MINUTE /mo 1

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {872E121F-B80E-4E74-9089-9DCA5ECAFD84} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe arguments

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe arguments

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:80 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 paste.ee udp
US 172.67.187.200:80 paste.ee tcp
RU 213.183.58.4:5558 tcp
RU 213.183.58.4:5558 tcp
RU 213.183.58.4:5558 tcp
RU 213.183.58.4:5558 tcp
RU 213.183.58.4:5558 tcp

Files

memory/1776-0-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

memory/1776-1-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/1776-2-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/1776-4-0x000000001ACE0000-0x000000001AD02000-memory.dmp

memory/1776-6-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/1776-5-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/1776-7-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/1776-3-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/1776-16-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/2308-19-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/2308-18-0x0000000000D90000-0x0000000000DB2000-memory.dmp

memory/2308-20-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/2308-17-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

MD5 13368347ebf33d72487458d752f3a3f6
SHA1 a5673f20c30e076c39f5e23247b5d5429c24ed4d
SHA256 60d6beb2cf8a84a73543c7f9b2a94f155fdd7c896837795375928d3537384c9a
SHA512 5741914e29e1224c0cbaf23563f572baaaf6b3379f30f335ee029317b296aa6d954e492967f3dc22cc977a19dbf19f22ab34c8273127fa575c491db852497c6c

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe.config

MD5 dd3d04c365984b4ec57a80503f81fddf
SHA1 c55fbcb61818e47dac9aae465faff91f0805bd7c
SHA256 40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c
SHA512 0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785

memory/2460-32-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2460-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2460-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2460-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2460-27-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2460-25-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2460-23-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2460-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2308-33-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

memory/2308-34-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-17 08:26

Reported

2024-11-17 08:28

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\PhoneOm32.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*PhoneOm32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PhoneOm32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*QWRtaW4= = "C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\PhoneOm32.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4408 set thread context of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5044 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
PID 5044 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
PID 5044 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 5044 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 5044 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 5044 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe C:\Windows\System32\cmd.exe
PID 3956 wrote to memory of 2040 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 3956 wrote to memory of 2040 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 4408 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe C:\Windows\System32\schtasks.exe
PID 4408 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe C:\Windows\System32\schtasks.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
PID 4408 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe

"C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe

"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe.config"

C:\Windows\system32\timeout.exe

timeout /t 5

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe\" arguments" /sc MINUTE /mo 1

\??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe

"c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe arguments

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe arguments

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:80 pastebin.com tcp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 paste.ee udp
US 172.67.187.200:80 paste.ee tcp
US 8.8.8.8:53 200.187.67.172.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
RU 213.183.58.4:5558 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
RU 213.183.58.4:5558 tcp
RU 213.183.58.4:5558 tcp
RU 213.183.58.4:5558 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 213.183.58.4:5558 tcp

Files

memory/5044-0-0x00007FFC5AD55000-0x00007FFC5AD56000-memory.dmp

memory/5044-2-0x000000001C240000-0x000000001C70E000-memory.dmp

memory/5044-1-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/5044-3-0x000000001BC20000-0x000000001BCBC000-memory.dmp

memory/5044-4-0x0000000001830000-0x0000000001838000-memory.dmp

memory/5044-5-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/5044-6-0x000000001C7F0000-0x000000001C856000-memory.dmp

memory/5044-7-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/5044-8-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/5044-9-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/5044-10-0x000000001D820000-0x000000001D842000-memory.dmp

memory/5044-11-0x000000001EEB0000-0x000000001EF56000-memory.dmp

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe

MD5 dcece638898e47573d0f735f928c528d
SHA1 f032007cb4547870962c32eaf59c880bd5de1d2e
SHA256 743f10df48eb0b23191ae94bce753d8f99dcfae6b09baa8c17e4527df0ddd29e
SHA512 221448a4ca5fe2c851f110266c3c6c688baa2d0d0164e005e226413e0daeb846ec2fed08e1188aa063a81ca99680d05d5cac1276fca9796b913028800394e277

C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe.config

MD5 dd3d04c365984b4ec57a80503f81fddf
SHA1 c55fbcb61818e47dac9aae465faff91f0805bd7c
SHA256 40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c
SHA512 0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785

memory/4408-26-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/4408-28-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/5044-29-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/4408-30-0x000000001C4A0000-0x000000001C4C2000-memory.dmp

memory/3684-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4408-32-0x00000000204E0000-0x0000000020542000-memory.dmp

memory/4408-33-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/4408-34-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/4408-35-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

memory/1196-37-0x0000000000A90000-0x0000000000AB2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\PhoneOm32.exe.log

MD5 5446caf843683ea0aab610c729c40ab1
SHA1 6df96e9c6c90843766b0fde8cec5e3a955291e74
SHA256 f7dbd089564c22c13483b867392a7bd1f9b49f8e0b089e2cc7bd7bfbf62c6329
SHA512 488e2b8750ff820e3fbdcbb9201abddfc6c8ccc3e7cc29962a05c2313ea862eddbf4e0a49ab6a5029aa4d9c137daf2623f1b34e4dcb896269e6edae8276148ff

memory/4036-42-0x000000001BEA0000-0x000000001BEC2000-memory.dmp