Malware Analysis Report

2025-01-17 21:36

Sample ID 240603-qdj7nafd9z
Target UnprotectEnable.xlt
SHA256 1ed95a0768790ea01e30e1de07f66f36d7ef402d177ea32ce24004c80611658d
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

1ed95a0768790ea01e30e1de07f66f36d7ef402d177ea32ce24004c80611658d

Threat Level: No (potentially) malicious behavior was detected

The file UnprotectEnable.xlt was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Checks processor information in registry

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:08

Reported

2024-06-03 13:09

Platform

win10-20240404-en

Max time kernel

46s

Max time network

36s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\UnprotectEnable.xlt"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4328 wrote to memory of 4812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 3492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 3492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 2360 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 1528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 1528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4812 wrote to memory of 1528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\UnprotectEnable.xlt"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.0.1141007606\98718854" -parentBuildID 20221007134813 -prefsHandle 1712 -prefMapHandle 1704 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c78970d-cbc4-4ca8-a294-24c3bb2d5b23} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 1792 1cc1f8deb58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.1.902748310\1172220682" -parentBuildID 20221007134813 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e4fb0e7-490f-4530-86e6-c7b2a86bfddb} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 2148 1cc1f7f9b58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.2.329029068\1517647693" -childID 1 -isForBrowser -prefsHandle 2704 -prefMapHandle 2712 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1104 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75dcfe04-944b-4a41-b78d-bb24e5968c99} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 2788 1cc23adcd58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.3.1321124159\1597949353" -childID 2 -isForBrowser -prefsHandle 3324 -prefMapHandle 3320 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1104 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {033e27c0-cad7-4b6a-90f2-58228ef31d02} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 3348 1cc0d66ab58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.4.1893762328\1169764986" -childID 3 -isForBrowser -prefsHandle 4396 -prefMapHandle 4392 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1104 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45ad7d89-dd2c-42e2-b97b-349a4b7fbec6} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 4408 1cc2237b558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.5.441070390\320784120" -childID 4 -isForBrowser -prefsHandle 4868 -prefMapHandle 4860 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1104 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2aae28c-d1fd-4624-8609-ec037ce60f5c} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 2644 1cc25f6ca58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.6.1648125749\370663925" -childID 5 -isForBrowser -prefsHandle 5004 -prefMapHandle 5008 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1104 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe2bbfb9-7dd7-497c-bb60-5812ff1afb8e} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 4996 1cc25f6ee58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4812.7.955671659\729053132" -childID 6 -isForBrowser -prefsHandle 5156 -prefMapHandle 5160 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1104 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc7bf424-9598-4ef5-b82e-a8971f35319d} 4812 "\\.\pipe\gecko-crash-server-pipe.4812" 5148 1cc25f6d658 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
N/A 127.0.0.1:50011 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 44.237.98.207:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 166.188.117.34.in-addr.arpa udp
US 8.8.8.8:53 207.98.237.44.in-addr.arpa udp
N/A 127.0.0.1:50017 tcp

Files

memory/2840-0-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-1-0x00007FFF6B5F5000-0x00007FFF6B5F6000-memory.dmp

memory/2840-2-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-3-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-8-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-7-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-4-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-10-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-12-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-13-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-11-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-9-0x00007FFF27EA0000-0x00007FFF27EB0000-memory.dmp

memory/2840-14-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-15-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-16-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-17-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-18-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-20-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-21-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-22-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-19-0x00007FFF27EA0000-0x00007FFF27EB0000-memory.dmp

memory/2840-29-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-32-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-31-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-30-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-28-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-27-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-26-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-25-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-24-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-23-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-185-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-186-0x00007FFF6B5F5000-0x00007FFF6B5F6000-memory.dmp

memory/2840-227-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-226-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-225-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-224-0x00007FFF2B5E0000-0x00007FFF2B5F0000-memory.dmp

memory/2840-228-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

memory/2840-229-0x00007FFF6B550000-0x00007FFF6B72B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

MD5 4895f2b48f7436fbf57f13a9bf63db98
SHA1 be66c2b0fe57fb9b90d4bd10cdd1170fb095dd81
SHA256 37349075e7a08f6e60f773b13f4d42a9123accaf17e2ba16fbc3e884437e8c15
SHA512 9e7a0c1e24abed407e55a0173e453ed0e37d00cafffcf54832d03a9217d2c34a9d470971d2278bca046f41a0c4dc08f63a5ca40ab6dbc37a58ee13b029fa86e5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\3f585354-5da9-4f9c-9415-a25f4d6385b3

MD5 8c4fdc3f782384262f08a5119201a0d3
SHA1 e8ede8d8c1e4a6aafc7aaaabb865fca5139423f4
SHA256 faef87499af40e4a4d7066406ab4e655c6d4217d3b618017308943b256974b4e
SHA512 576560b378765bee7703d9fadff25555bcddc97d034901fa6182b85b3793ca48de8904fb4764065df38de6aeebe4ea2e358b5a50bfc78c833e316e4d6f83c6dd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\bf3ef7f9-9418-4f01-ba84-49e321a538d4

MD5 0f2daddb7cc6e6db91a015eb1439d8a0
SHA1 a7c2b31888222befc519329c645588e06997bd3b
SHA256 49ba00311169939b80e1255d6bc873a6ad7230176cfb4e69dbfe5b02119cb336
SHA512 15948c7223a10c362b60ad5a0a6fc2fc188493430911d6443037755aa9029c2d57a263bde790df8b986a3f245ab4c6f2b610994de115f779db4acd2f63357f7a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 0d0013d9708d9fef539adc917f5b87f6
SHA1 5e071e6b4d8abf007c8bb78ee948caf5bb0439e1
SHA256 f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b
SHA512 851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388