Analysis Overview
SHA256
70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064
Threat Level: Known bad
The file 70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe was found to be: Known bad.
Malicious Activity Summary
Modifies visiblity of hidden/system files in Explorer
Modifies WinLogon for persistence
Reads user/profile data of web browsers
Deletes itself
Checks computer location settings
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious behavior: EnumeratesProcesses
Uses Task Scheduler COM API
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-11-17 08:26
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-17 08:26
Reported
2024-11-17 08:28
Platform
win7-20241023-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\logagent32.exe" | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
Modifies visiblity of hidden/system files in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*logagent32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" | C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\logagent32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" | C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*QWRtaW4= = "C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\logagent32.exe" | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2308 set thread context of 2460 | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe
"C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe.config"
C:\Windows\system32\timeout.exe
timeout /t 5
\??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
"c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe\" arguments" /sc MINUTE /mo 1
C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\taskeng.exe
taskeng.exe {872E121F-B80E-4E74-9089-9DCA5ECAFD84} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe arguments
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe arguments
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:80 | pastebin.com | tcp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | paste.ee | udp |
| US | 172.67.187.200:80 | paste.ee | tcp |
| RU | 213.183.58.4:5558 | tcp | |
| RU | 213.183.58.4:5558 | tcp | |
| RU | 213.183.58.4:5558 | tcp | |
| RU | 213.183.58.4:5558 | tcp | |
| RU | 213.183.58.4:5558 | tcp |
Files
memory/1776-0-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp
memory/1776-1-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/1776-2-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/1776-4-0x000000001ACE0000-0x000000001AD02000-memory.dmp
memory/1776-6-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/1776-5-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/1776-7-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/1776-3-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/1776-16-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/2308-19-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/2308-18-0x0000000000D90000-0x0000000000DB2000-memory.dmp
memory/2308-20-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/2308-17-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
| MD5 | 13368347ebf33d72487458d752f3a3f6 |
| SHA1 | a5673f20c30e076c39f5e23247b5d5429c24ed4d |
| SHA256 | 60d6beb2cf8a84a73543c7f9b2a94f155fdd7c896837795375928d3537384c9a |
| SHA512 | 5741914e29e1224c0cbaf23563f572baaaf6b3379f30f335ee029317b296aa6d954e492967f3dc22cc977a19dbf19f22ab34c8273127fa575c491db852497c6c |
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe.config
| MD5 | dd3d04c365984b4ec57a80503f81fddf |
| SHA1 | c55fbcb61818e47dac9aae465faff91f0805bd7c |
| SHA256 | 40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c |
| SHA512 | 0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785 |
memory/2460-32-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-30-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2460-27-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-25-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-23-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-21-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2308-33-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
memory/2308-34-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-17 08:26
Reported
2024-11-17 08:28
Platform
win10v2004-20241007-en
Max time kernel
120s
Max time network
126s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\PhoneOm32.exe" | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
Modifies visiblity of hidden/system files in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*PhoneOm32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" | C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PhoneOm32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" | C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*QWRtaW4= = "C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\PhoneOm32.exe" | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4408 set thread context of 3684 | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe
"C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe.config"
C:\Windows\system32\timeout.exe
timeout /t 5
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe\" arguments" /sc MINUTE /mo 1
\??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
"c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe arguments
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe arguments
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:80 | pastebin.com | tcp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 235.3.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | paste.ee | udp |
| US | 172.67.187.200:80 | paste.ee | tcp |
| US | 8.8.8.8:53 | 200.187.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| RU | 213.183.58.4:5558 | tcp | |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.12.20.2.in-addr.arpa | udp |
| RU | 213.183.58.4:5558 | tcp | |
| RU | 213.183.58.4:5558 | tcp | |
| RU | 213.183.58.4:5558 | tcp | |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| RU | 213.183.58.4:5558 | tcp |
Files
memory/5044-0-0x00007FFC5AD55000-0x00007FFC5AD56000-memory.dmp
memory/5044-2-0x000000001C240000-0x000000001C70E000-memory.dmp
memory/5044-1-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/5044-3-0x000000001BC20000-0x000000001BCBC000-memory.dmp
memory/5044-4-0x0000000001830000-0x0000000001838000-memory.dmp
memory/5044-5-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/5044-6-0x000000001C7F0000-0x000000001C856000-memory.dmp
memory/5044-7-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/5044-8-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/5044-9-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/5044-10-0x000000001D820000-0x000000001D842000-memory.dmp
memory/5044-11-0x000000001EEB0000-0x000000001EF56000-memory.dmp
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
| MD5 | dcece638898e47573d0f735f928c528d |
| SHA1 | f032007cb4547870962c32eaf59c880bd5de1d2e |
| SHA256 | 743f10df48eb0b23191ae94bce753d8f99dcfae6b09baa8c17e4527df0ddd29e |
| SHA512 | 221448a4ca5fe2c851f110266c3c6c688baa2d0d0164e005e226413e0daeb846ec2fed08e1188aa063a81ca99680d05d5cac1276fca9796b913028800394e277 |
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe.config
| MD5 | dd3d04c365984b4ec57a80503f81fddf |
| SHA1 | c55fbcb61818e47dac9aae465faff91f0805bd7c |
| SHA256 | 40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c |
| SHA512 | 0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785 |
memory/4408-26-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/4408-28-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/5044-29-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/4408-30-0x000000001C4A0000-0x000000001C4C2000-memory.dmp
memory/3684-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4408-32-0x00000000204E0000-0x0000000020542000-memory.dmp
memory/4408-33-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/4408-34-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/4408-35-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp
memory/1196-37-0x0000000000A90000-0x0000000000AB2000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\PhoneOm32.exe.log
| MD5 | 5446caf843683ea0aab610c729c40ab1 |
| SHA1 | 6df96e9c6c90843766b0fde8cec5e3a955291e74 |
| SHA256 | f7dbd089564c22c13483b867392a7bd1f9b49f8e0b089e2cc7bd7bfbf62c6329 |
| SHA512 | 488e2b8750ff820e3fbdcbb9201abddfc6c8ccc3e7cc29962a05c2313ea862eddbf4e0a49ab6a5029aa4d9c137daf2623f1b34e4dcb896269e6edae8276148ff |
memory/4036-42-0x000000001BEA0000-0x000000001BEC2000-memory.dmp