1f1660d24e972308e913eb370633bfb83c2738237f193f501b0d05b09d065878

Analysis

max time kernel
294s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
18/04/2023, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mmc-cracked-win32.zip
Size

13.5MB
MD5

44a178cff729c0416dde1cab2cd60fa1
SHA1

aa56eb685443d992aca4d830b039a8963fad20ba
SHA256

1f1660d24e972308e913eb370633bfb83c2738237f193f501b0d05b09d065878
SHA512

99f5fee63264a3c567bca3b06480ce412d87fe55320981d8e62b38cc92245056423c8513771a952fa8a98133b2571aef55e5fd8945fa4e65a690578a50fd7fad
SSDEEP

393216:G56gzFRQ3Nm3b/EUT4mlnftABcD4w1lPfm7f8:fsRQ9wbjtuM4cpm7f8

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\mmc-cracked-win32.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4228	UltimMC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4228	UltimMC.exe
4228	UltimMC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4228	UltimMC.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	firefox.exe
Token: SeDebugPrivilege	3464	firefox.exe
Token: SeDebugPrivilege	3464	firefox.exe
Token: 33	1488	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1488	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
4228	UltimMC.exe
4228	UltimMC.exe
4228	UltimMC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3612 wrote to memory of 3464	3612	firefox.exe	91
PID 3464 wrote to memory of 3572	3464	firefox.exe	92
PID 3464 wrote to memory of 3572	3464	firefox.exe	92
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 1628	3464	firefox.exe	93
PID 3464 wrote to memory of 4708	3464	firefox.exe	94
PID 3464 wrote to memory of 4708	3464	firefox.exe	94
PID 3464 wrote to memory of 4708	3464	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\mmc-cracked-win32.zip
1⤵
PID:3252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.0.1167171070\569381609" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80a28746-e1dc-403f-9a9f-05a0f7e56562} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 1884 2e091719558 gpu
    3⤵
    PID:3572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.1.1800308195\1336779318" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0c5a3a0-dceb-49d2-90f3-ec5e134429f5} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 2316 2e083671358 socket
    3⤵
    - Checks processor information in registry
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.2.1235684528\1492505543" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2940 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cfb51db-a233-4903-a303-7ef193281a8a} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 2848 2e0942fc558 tab
    3⤵
    PID:4708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.3.1941305658\1089107478" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {967bd0d4-d6c7-4945-8f6b-1bf5c04849c7} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 3600 2e083672e58 tab
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.4.951952377\1521079058" -childID 3 -isForBrowser -prefsHandle 3872 -prefMapHandle 3876 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ca3b24f-9b18-48fa-b49b-cb45f89330de} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 3860 2e09567fb58 tab
    3⤵
    PID:1080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.7.248101720\1776440344" -childID 6 -isForBrowser -prefsHandle 5112 -prefMapHandle 2680 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46605577-1964-4e99-a5eb-a7730aa0cc23} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 5220 2e096bd7758 tab
    3⤵
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.6.936711794\1274861759" -childID 5 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfeb4848-34c8-45d7-808d-e1cdedae55f7} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 5116 2e096bd7158 tab
    3⤵
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.5.1784191050\124925283" -childID 4 -isForBrowser -prefsHandle 4948 -prefMapHandle 2872 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f14a7804-2ceb-4c7d-8508-78c5ec67e45f} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 2700 2e0944b1f58 tab
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.8.590491886\145759591" -childID 7 -isForBrowser -prefsHandle 5148 -prefMapHandle 5604 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d0cde7f-5a48-4eed-bb4a-6084fe32c340} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 5688 2e098bee858 tab
    3⤵
    PID:900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.9.352216265\353468058" -parentBuildID 20221007134813 -prefsHandle 5852 -prefMapHandle 5924 -prefsLen 26930 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9524e9fa-a803-4089-b5a3-b99eb23f64fe} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 5952 2e098537958 rdd
    3⤵
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.10.575292827\832936553" -childID 8 -isForBrowser -prefsHandle 5940 -prefMapHandle 5980 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ee84ca7-d972-4567-be2e-88c310f73cbc} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 6072 2e098536158 tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3464.11.131703358\570993848" -childID 9 -isForBrowser -prefsHandle 6460 -prefMapHandle 6456 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa51fc9d-9ab7-457e-a630-87da143744e2} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" 6436 2e098fd2358 tab
    3⤵
    PID:3316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1324

C:\Users\Admin\Desktop\UltimMC\UltimMC.exe
"C:\Users\Admin\Desktop\UltimMC\UltimMC.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4228
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:/Users/Admin/Desktop/UltimMC/jars/JavaCheck.jar
  2⤵
  PID:2624
- C:\ProgramData\Oracle\Java\javapath\javaw.exe
  javaw -jar C:/Users/Admin/Desktop/UltimMC/jars/JavaCheck.jar
  2⤵
  PID:4912
- C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe" -jar C:/Users/Admin/Desktop/UltimMC/jars/JavaCheck.jar
  2⤵
  PID:3788

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
154KB

MD5
1b86417df6bb01c902e07f6171f1ed5d

SHA1
13ffb66ff2cf7ec64d034e16ae3df9421b147f63

SHA256
aff862d02bdd468edd700d03bc4e312bf9629f7c5bcd8c6c2ad6b0e0beb90c95

SHA512
1e64831298ae662b8c5ff44dd7489d91ff7b2c5bc41dc6af99b9ce8ea6c8799b551f1e10ac746963fe65244be4a780a93897e4c6faea3dc3fd3b08edf5eba25f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
58159720cd8c13e11e2394a987523166

SHA1
0ebda56602dc4896441143e4e2b49d6b9b733428

SHA256
7d16663c80a899a3ff1f969167d5901d49b276a422b83fbed3961003c18c19f8

SHA512
afcf71ad8b777420fa14cd0f3f8095651339a9e75a6edbb499e2aba3c1db801c11bcc991432c36a950bc6435ed43da03ec3b1651b0b40d2a90b09197d7defca2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
b7ab3c275204c61d115ed374a10d1a9f

SHA1
f8a2eca2825585f464b3b23e1ec8a93b1207c8e8

SHA256
b59dcaae43dce5308caad577fa62b894e0f513a81b2cb7052be27236752b170a

SHA512
154f00c755a43d5a18e63e5586c6fde1c69f520dbf5f55ef36ba8345e90211ede8d2063c08427ec7116189e7e44e8ea1cc612fcb48948b560fdade59593a5f87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
a5b16db61113fdce98bf41a09681b94b

SHA1
a233abf8b23592618afb06c1939671b066400824

SHA256
9a3ca4f5399ba74db2729016332595bcef04f1b70d8bb7e4d7fc03cb2db119c1

SHA512
c1977be1434d3d95eeacaea9b8225d348d24c665690813b28ba1cdb4ea9cbad864996b27dff8fc7360df483ba959a6a47044516e847e68e378c7c4d0999a1cd4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
6KB

MD5
9edcfa78c52c469c64e7b6306a489b40

SHA1
327af5ba7d2eb4395184b15f2fe7573fba1d7cf6

SHA256
d0586145c2bdb4cc064351728e963d4a4553a20e8e8b8f0a630daa0bb77aa216

SHA512
332633ce69aa1208169283b72e3ef3b6257f506206a7a7c5afe3578afa069f18aa5f2b681e4a99ad075c779d2492fb5d881dba7810957e3b30db541c43911aa4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
6KB

MD5
29dcab2178f93a26db2af229da58011b

SHA1
719f255c0a7c703e7ed859db82a6c1d49d3e412b

SHA256
f101cbc16d1a7102c7d4b14eb7e039394828b16111bb70d36c496d20f1bdf97f

SHA512
c5d05deb8492c1afc50684544ef7df9c88169c591b74285104dcadfc32feda2f7ab2b565cb347ca2dfd296fb5a6539e682c13dddc706b949db7ab50a5f9567cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js

Filesize
6KB

MD5
207077fed406e49d74fa19116d2712aa

SHA1
3ce60cb9b4fbd6b00a9ae26c599b9fdbe2b6c5ee

SHA256
b02701ad3c4478f891a550eac65f0a8c183999aa22a1dd171bd698b990124c58

SHA512
0c6398230b3eb103a0ce280f127515d998a6c9ea8908b8b248b132782f8166141ba8e1faabc7ace4b80e9c925bc5d7885f0fba8c16cb2e7798055727dc66190e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d22c25b8e803d9c5f3277ae48e6562ea

SHA1
92e0f72f3e7c9d9ce757879e38cbf0364f014151

SHA256
a0932ec9e225916043b4568820006044523250574435f782635eb578385b4c44

SHA512
486d981cd283c68f578c2b9cfc5213e1f5b3de732f3af9600da6dd88b4469c28eb81b6b7538aab894a767716dff5a32e5df73f52c53c07a46fbc84c5cae02f0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
bf014543f6411a769cb81be3ec195841

SHA1
07881ab9dac3288558ab6e87e3a03398f60144a5

SHA256
75f34bd7d1baf637fd1b2c60974eab9970521b8ff0f5647e534a61b144acb53f

SHA512
0a6869eb2a3c1a7da02a9dfa34187209ad44eef4b99dc0f8b26b41c7e5d2bd4a5ebdbafec7c7cd530ba7828cdb3f44a634bf2297c294c5e00eebf48ecde3bbaa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
84f41ce8282a53dad679256d2d82f6ed

SHA1
25970d996b3e6a78a6bc5ac1f4bbbceed3286952

SHA256
2a82d4544945479a80b59b80405bc906d798037f1d1b1a0a08f1df5579872d8a

SHA512
3304242be13b8b8ce36d1c976a873ffe6044c721a44111e101117182608c57c4b101c077a1b04c762cbe408140abbec6a1b5ca7b11fafe06df9962f3ba5a2df9

Download Submit
C:\Users\Admin\Desktop\UltimMC\translations\index_v2.json

Filesize
15KB

MD5
4d18ce01732ff1fe8305af3d74e6cb41

SHA1
43437da4cbc9e0e6adbc88a76e75721963c07d3b

SHA256
284159c2183faff37ff5659330ea42e31acc1ab105f68f9efb5faffc83ca98fe

SHA512
d2e9466bfeb76eb46d9d1cd144ef04c3f51512bf92b2f15d3d62344e90beeabc5b117a5afbcac860cfd4910e66f8716f59a68837bcd125851a15d548bff122af

Download Submit
C:\Users\Admin\Downloads\mmc-cracked-win32.EadqaTgE.zip.part

Filesize
13.5MB

MD5
44a178cff729c0416dde1cab2cd60fa1

SHA1
aa56eb685443d992aca4d830b039a8963fad20ba

SHA256
1f1660d24e972308e913eb370633bfb83c2738237f193f501b0d05b09d065878

SHA512
99f5fee63264a3c567bca3b06480ce412d87fe55320981d8e62b38cc92245056423c8513771a952fa8a98133b2571aef55e5fd8945fa4e65a690578a50fd7fad

Download Submit
memory/4228-1348-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/4228-1358-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/4228-1318-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/4228-1319-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/4228-1320-0x0000000000400000-0x0000000000A23000-memory.dmp

Filesize
6.1MB

Download
memory/4228-1330-0x0000000005460000-0x0000000005672000-memory.dmp

Filesize
2.1MB

Download
memory/4228-1316-0x0000000001400000-0x0000000001975000-memory.dmp

Filesize
5.5MB

Download
memory/4228-1340-0x0000000000400000-0x0000000000A23000-memory.dmp

Filesize
6.1MB

Download
memory/4228-1341-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/4228-1342-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/4228-1343-0x0000000063400000-0x0000000063415000-memory.dmp

Filesize
84KB

Download
memory/4228-1344-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/4228-1345-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/4228-1347-0x0000000069700000-0x0000000069894000-memory.dmp

Filesize
1.6MB

Download
memory/4228-1314-0x0000000001400000-0x0000000001975000-memory.dmp

Filesize
5.5MB

Download
memory/4228-1346-0x0000000061B80000-0x0000000061B98000-memory.dmp

Filesize
96KB

Download
memory/4228-1349-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/4228-1350-0x0000000066C00000-0x0000000066C3E000-memory.dmp

Filesize
248KB

Download
memory/4228-1351-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/4228-1355-0x0000000061DC0000-0x0000000062404000-memory.dmp

Filesize
6.3MB

Download
memory/4228-1356-0x0000000001400000-0x0000000001975000-memory.dmp

Filesize
5.5MB

Download
memory/4228-1317-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/4228-1359-0x000000006A880000-0x000000006A9F6000-memory.dmp

Filesize
1.5MB

Download
memory/4228-1364-0x000000006E600000-0x000000006E674000-memory.dmp

Filesize
464KB

Download
memory/4228-1367-0x0000000005460000-0x0000000005672000-memory.dmp

Filesize
2.1MB

Download
memory/4228-1362-0x0000000006860000-0x0000000006871000-memory.dmp

Filesize
68KB

Download
memory/4228-1396-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/4228-1404-0x0000000069700000-0x0000000069894000-memory.dmp

Filesize
1.6MB

Download
memory/4228-1405-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/4228-1409-0x0000000061DC0000-0x0000000062404000-memory.dmp

Filesize
6.3MB

Download
memory/4228-1410-0x0000000001400000-0x0000000001975000-memory.dmp

Filesize
5.5MB

Download
memory/4228-1414-0x0000000005460000-0x0000000005672000-memory.dmp

Filesize
2.1MB

Download
memory/4228-1415-0x0000000006860000-0x0000000006871000-memory.dmp

Filesize
68KB

Download
memory/4228-1418-0x00000000626C0000-0x0000000062706000-memory.dmp

Filesize
280KB

Download
memory/4228-1419-0x0000000061B00000-0x0000000061B10000-memory.dmp

Filesize
64KB

Download
memory/4228-1421-0x0000000066AC0000-0x0000000066AD0000-memory.dmp

Filesize
64KB

Download
memory/4228-1420-0x0000000067740000-0x000000006779F000-memory.dmp

Filesize
380KB

Download
memory/4228-1417-0x000000006E840000-0x000000006E852000-memory.dmp

Filesize
72KB

Download
memory/4228-1416-0x000000006C600000-0x000000006C615000-memory.dmp

Filesize
84KB

Download
memory/4228-1422-0x0000000000400000-0x0000000000A23000-memory.dmp

Filesize
6.1MB

Download
memory/4228-1423-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/4228-1427-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download