Malware Analysis Report

2024-07-11 07:25

Sample ID 240212-e6qpcsab5v
Target diamondfox_2.exe
SHA256 06e55f0700b583a63f0778201bf4f1ac352966f9c4fa47b5bbd7f39c08b68b79
Tags
diamondfox botnet infostealer stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

06e55f0700b583a63f0778201bf4f1ac352966f9c4fa47b5bbd7f39c08b68b79

Threat Level: Known bad

The file diamondfox_2.exe was found to be: Known bad.

Malicious Activity Summary

diamondfox botnet infostealer stealer

Diamondfox family

DiamondFox payload

DiamondFox

DiamondFox payload

Executes dropped EXE

Deletes itself

Loads dropped DLL

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-02-12 04:33

Signatures

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Diamondfox family

diamondfox

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-12 04:33

Reported

2024-02-12 04:35

Platform

win7-20231215-en

Max time kernel

53s

Max time network

61s

Command Line

"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"

Signatures

DiamondFox

botnet stealer diamondfox

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2984 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2984 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2984 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2984 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2908 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2984 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2984 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2984 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2984 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe

"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe' -Force -Recurse

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 diamond.serivice.com udp
DE 185.53.179.172:80 diamond.serivice.com tcp

Files

\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5 edcbd21bcf32c01e132b51ab1c92a532
SHA1 205e23b68a25e20651b459523b2c8a2ebaac022f
SHA256 06e55f0700b583a63f0778201bf4f1ac352966f9c4fa47b5bbd7f39c08b68b79
SHA512 35c767a8022bab81879d51b0d6731176555fbd6a3ce00d69826a059d15131fa1a9230b706f866f7759a3b646fb1a404fa2197ff7dba5dc35a898216cb5f6a9c3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 68a188eb97d37795b02a48380c57f79a
SHA1 9b60b053cc753fc8f0edd2b7d1e4bd9a0c2659d5
SHA256 0ad57ad8875eb548cc32777b0ac32412bd35c5183b00afe35d6d27d57256b61a
SHA512 40efaee5bf0aa74bc39470e8f3032cd068f0fa2ffabd9cb00e1502cb6551917bab2f201cb223b751131c022a291cf8ec2a05341583789bfa7d28aea1652c8b10

memory/2052-16-0x00000000738D0000-0x0000000073E7B000-memory.dmp

memory/2052-17-0x0000000002680000-0x00000000026C0000-memory.dmp

memory/3056-18-0x0000000002100000-0x0000000002140000-memory.dmp

memory/3056-19-0x00000000738D0000-0x0000000073E7B000-memory.dmp

memory/2052-20-0x00000000738D0000-0x0000000073E7B000-memory.dmp

memory/3056-21-0x0000000002100000-0x0000000002140000-memory.dmp

memory/3056-22-0x00000000738D0000-0x0000000073E7B000-memory.dmp

memory/2052-23-0x00000000738D0000-0x0000000073E7B000-memory.dmp

memory/3056-24-0x00000000738D0000-0x0000000073E7B000-memory.dmp

memory/3056-25-0x0000000002100000-0x0000000002140000-memory.dmp

memory/3056-26-0x00000000738D0000-0x0000000073E7B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-12 04:33

Reported

2024-02-12 04:35

Platform

win10v2004-20231215-en

Max time kernel

84s

Max time network

90s

Command Line

"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"

Signatures

DiamondFox

botnet stealer diamondfox

DiamondFox payload

infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2600 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2600 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2600 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 2600 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4516 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4516 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4516 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1408 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 1408 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 1408 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
PID 1408 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1408 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1408 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe

"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe' -Force -Recurse

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1

C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe

"C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Start-Sleep -s 10; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\diamondfox_2.exe' -Force -Recurse

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 diamond.serivice.com udp
DE 185.53.179.172:80 diamond.serivice.com tcp
US 8.8.8.8:53 172.179.53.185.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe

MD5 edcbd21bcf32c01e132b51ab1c92a532
SHA1 205e23b68a25e20651b459523b2c8a2ebaac022f
SHA256 06e55f0700b583a63f0778201bf4f1ac352966f9c4fa47b5bbd7f39c08b68b79
SHA512 35c767a8022bab81879d51b0d6731176555fbd6a3ce00d69826a059d15131fa1a9230b706f866f7759a3b646fb1a404fa2197ff7dba5dc35a898216cb5f6a9c3

memory/4420-5-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/1160-6-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/1160-7-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

memory/4420-8-0x0000000004570000-0x00000000045A6000-memory.dmp

memory/1160-9-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

memory/4420-10-0x0000000004630000-0x0000000004640000-memory.dmp

memory/4420-11-0x0000000004C70000-0x0000000005298000-memory.dmp

memory/1160-12-0x00000000052A0000-0x00000000052C2000-memory.dmp

memory/1160-13-0x0000000005BC0000-0x0000000005C26000-memory.dmp

memory/4420-14-0x00000000054C0000-0x0000000005526000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hp5i5lr3.1yc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4420-33-0x0000000005530000-0x0000000005884000-memory.dmp

memory/2268-35-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/3244-36-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/3244-37-0x0000000002880000-0x0000000002890000-memory.dmp

memory/2268-38-0x00000000023A0000-0x00000000023B0000-memory.dmp

memory/2268-39-0x00000000023A0000-0x00000000023B0000-memory.dmp

memory/1160-58-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

memory/4420-59-0x0000000006080000-0x00000000060CC000-memory.dmp

memory/4420-60-0x0000000004630000-0x0000000004640000-memory.dmp

memory/1160-61-0x00000000078F0000-0x0000000007F6A000-memory.dmp

memory/1160-62-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/3244-63-0x0000000002880000-0x0000000002890000-memory.dmp

memory/2268-66-0x00000000023A0000-0x00000000023B0000-memory.dmp

memory/4420-68-0x000000007EF80000-0x000000007EF90000-memory.dmp

memory/4420-67-0x0000000006110000-0x0000000006142000-memory.dmp

memory/4420-69-0x000000006FA60000-0x000000006FAAC000-memory.dmp

memory/1160-65-0x0000000006710000-0x000000000672A000-memory.dmp

memory/4420-64-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/4420-79-0x00000000060F0000-0x000000000610E000-memory.dmp

memory/4420-80-0x0000000004630000-0x0000000004640000-memory.dmp

memory/3244-81-0x000000006FA60000-0x000000006FAAC000-memory.dmp

memory/4420-91-0x0000000006B00000-0x0000000006BA3000-memory.dmp

memory/4420-92-0x0000000006EC0000-0x0000000006ECA000-memory.dmp

memory/4420-93-0x00000000070D0000-0x0000000007166000-memory.dmp

memory/4420-94-0x0000000007050000-0x0000000007061000-memory.dmp

memory/4420-96-0x0000000004630000-0x0000000004640000-memory.dmp

memory/1160-95-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

memory/4420-97-0x0000000007080000-0x000000000708E000-memory.dmp

memory/3244-98-0x0000000007740000-0x0000000007754000-memory.dmp

memory/4420-99-0x0000000007190000-0x00000000071AA000-memory.dmp

memory/4420-100-0x0000000007170000-0x0000000007178000-memory.dmp

memory/3244-103-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/4420-104-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/2268-105-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/1160-107-0x0000000006880000-0x00000000068A2000-memory.dmp

memory/1160-108-0x0000000008520000-0x0000000008AC4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5cec7c96eb5eeda3b047b54ef1218644
SHA1 14bac4bd4805f2be07fbec264e8185afba4a92c5
SHA256 cb3d312b18b8e0ea89cbedaab5e0f98c39a8615baf928323b1bdcfcaa6ae3ad9
SHA512 5433b719414fdb981615b17b0863e99bf87538d061c09e2ed4e2c45f3f75d29eec2d11028e6eb38b30143c72fa3a0b230d1cb4dfeb0be63457623a34eaf67798

memory/1160-112-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/2268-116-0x00000000023A0000-0x00000000023B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1cc1c17311c242ecc008772d3874b8f1
SHA1 3339d8c65fa28ccc69c6f1cd9fee4f90948f235a
SHA256 d20fb206886edc53b4865460246cbebb0dc5398fed0e21d753ac2932997235fe
SHA512 a789886e82b3a4d1598cce707a0ed76f56c1ce1775d879edacb9610ae63b5153b464f791b4aed61d458fbb02988c73fb429f19ab00b9c0a5d53c3056b48c8043

memory/2268-113-0x00000000023A0000-0x00000000023B0000-memory.dmp

memory/2268-117-0x0000000073480000-0x0000000073C30000-memory.dmp

memory/3436-118-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-120-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-119-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-125-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-124-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-127-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-126-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-129-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-128-0x0000028EB9710000-0x0000028EB9711000-memory.dmp

memory/3436-130-0x0000028EB9710000-0x0000028EB9711000-memory.dmp