dbcf0ec08edb25ba62768afdbbae7f7d5259f7699db538d2e267e5615f15b0bf

Resubmissions

02/06/2024, 16:51

240602-vc1kgahg76 7

02/06/2024, 16:50

240602-vcjlyshg64 7

02/06/2024, 16:49

240602-vbt2ashg39 5

02/06/2024, 16:45

240602-t9mjfagh5y 7

Analysis

max time kernel
145s
max time network
157s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/06/2024, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MCC-Loader-Premium-main.zip
Size

46.7MB
MD5

343ac8939ff1f2d87e28326856293242
SHA1

d9320eb9f2a07a9ba4f26b56d9eb231bab29713a
SHA256

dbcf0ec08edb25ba62768afdbbae7f7d5259f7699db538d2e267e5615f15b0bf
SHA512

055c4501ca7b664a17e223e775147fc90324e7270e7b6cab28e0be43eb744735cf6ecba1108c8433d8cde6f00cc24ca076595ad545970f472f9836cc7ea8d5c3
SSDEEP

786432:zwCdjQLpL7NAJ2Rt00kRmSVv1n5xdJ2Rt00kRmSVv1n5xtJ2Rt00kRmSVv1n5xMU:zZKpL7Iaq0k5TnT7aq0k5TnTLaq0k5T5

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
100	camo.githubusercontent.com
105	camo.githubusercontent.com
109	camo.githubusercontent.com
111	camo.githubusercontent.com
112	camo.githubusercontent.com
113	camo.githubusercontent.com
102	camo.githubusercontent.com
110	camo.githubusercontent.com
114	camo.githubusercontent.com

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MCC-Loader-Premium-main.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	firefox.exe
Token: SeDebugPrivilege	1352	firefox.exe
Token: SeDebugPrivilege	1352	firefox.exe
Token: SeRestorePrivilege	5396	7zG.exe
Token: 35	5396	7zG.exe
Token: SeSecurityPrivilege	5396	7zG.exe
Token: SeSecurityPrivilege	5396	7zG.exe
Token: SeDebugPrivilege	1352	firefox.exe
Token: SeDebugPrivilege	1352	firefox.exe
Token: SeDebugPrivilege	1352	firefox.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
5396	7zG.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 4504 wrote to memory of 1352	4504	firefox.exe	81
PID 1352 wrote to memory of 1104	1352	firefox.exe	82
PID 1352 wrote to memory of 1104	1352	firefox.exe	82
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4640	1352	firefox.exe	83
PID 1352 wrote to memory of 4076	1352	firefox.exe	84
PID 1352 wrote to memory of 4076	1352	firefox.exe	84
PID 1352 wrote to memory of 4076	1352	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MCC-Loader-Premium-main.zip
1⤵
PID:1012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.0.1168819067\1727640033" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77f70dcc-ecf0-4ef9-80e4-afdda2475a87} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 1796 259b7bf4e58 gpu
    3⤵
    PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.1.1260593751\1881015826" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57b5d80c-693d-4872-a475-f00ee31b6e63} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 2152 259b7731d58 socket
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.2.503397838\1417253235" -childID 1 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82402edc-2490-4590-a98f-027b8169dabc} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 2856 259b7b5b658 tab
    3⤵
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.3.171850163\1915514527" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdbf8bd6-dc2c-4d81-89fb-fcbae76e654a} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 3432 259ba2e7058 tab
    3⤵
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.4.1118283896\1003925992" -childID 3 -isForBrowser -prefsHandle 3840 -prefMapHandle 3852 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f3e4a22-26d9-48f7-8e3b-935c5c806ed7} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 3912 259bcec0858 tab
    3⤵
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.5.1335160539\2014486570" -childID 4 -isForBrowser -prefsHandle 4720 -prefMapHandle 4740 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7deac2a0-9cb4-4f69-9ab5-3bcdd1fe67be} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 4728 259bcebe758 tab
    3⤵
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.6.590787233\742566381" -childID 5 -isForBrowser -prefsHandle 4860 -prefMapHandle 4864 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {096eef5e-1c39-4944-bbd3-4928f2d36beb} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 4944 259be0f7858 tab
    3⤵
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.7.772259404\774702064" -childID 6 -isForBrowser -prefsHandle 5080 -prefMapHandle 5084 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2d08956-da16-490e-8109-d08efbc391a7} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 5068 259be0f8d58 tab
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.8.846378790\1568726859" -childID 7 -isForBrowser -prefsHandle 4040 -prefMapHandle 5516 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68f700c3-355d-4242-9420-2f23ea958b38} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 3296 259ba3b1058 tab
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.9.1501427755\1779862836" -childID 8 -isForBrowser -prefsHandle 6080 -prefMapHandle 6124 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef6d4646-9210-4a5a-bb12-b08aea0ab884} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 6140 259bf8cb658 tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1352.10.564126914\1499621551" -childID 9 -isForBrowser -prefsHandle 4584 -prefMapHandle 6368 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {847c00c4-d050-40d2-b070-822059d9dc36} 1352 "\\.\pipe\gecko-crash-server-pipe.1352" 5840 259c2392558 tab
    3⤵
    PID:5552

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MCC-Loader-Premium-main\" -spe -an -ai#7zMap7756:108:7zEvent19692
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
ea65cd3511698e248406a8fee0463745

SHA1
41c33e49e805512a4897549b927a7e0ac6d54e32

SHA256
271fb64129f1764babf8c9cf51bcc2e7f9794f1d8f65a83d7c1646e4cef86ec0

SHA512
f3dd5bdb561f7d390c4837c8ae6fddb0bf4427510e6fa485c9323a73dde45ae94384d63b6185750b558a5c7405e44c96f819d8d5b5ac72b1191b85126806c7b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
8b7ea0fc8a79bcbb90e7f4ae8400af2f

SHA1
6770f8b6e685f67f3a4efc8a9ebeb6c217928304

SHA256
0bfc773791f2fb06c5793a4f5feea5026d20aceac8ac6068897c1d727c6a5c60

SHA512
a8a090f41afd55c783ad9ac039205da75a48d33573c897a32a644e4cc9a8abc00c913b4168cac26d65abe668b532342ee36f9098848c92ba9dd71aa300509cd9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
8f9d13fff087c06c31d94ffc521cdb84

SHA1
3b57f15ffd9ad860c6dc28123af55967e856387f

SHA256
28e8b46363d3d5140c1c87d1357c43a04550674341bdf2ac51d9f2a2fc626038

SHA512
84001ac7be2d122d7d4f7fdcec754c410ad22f31aadc153c5e933bec2a60e9ddbe5983ab7e1937142a547a883f8a9b1bcbce25b277475b0416eb6c21882905d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\f7539982-9e0f-48b4-b899-8b44025ebbd9

Filesize
10KB

MD5
9d679722cef28ee03e6892b175376418

SHA1
1495b8b6c4303fb808a25c7a251f8fd5874f54e3

SHA256
e5b7724572062adb1d15e13b0aa22d4a389a78a9d135d94f640772b36f402d23

SHA512
50856291505b94b1af1f21b75010a0fce236d3af64f8bd54305f091505f57b0a70c7078baa6bce6e35308d52f6d3fce366b96401c064b2c3185e9a05ac196c22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\fe8e9376-5577-4d84-9ef8-adf4a1871c36

Filesize
746B

MD5
7f52b6a9fc23f0809c8f225151198af1

SHA1
350cb817680aead7ec4613e2b67dcc6444dcea95

SHA256
fa845a816f39c1ff6827eda37886a0b78bbb7df942db23ffdb2a3814572fc261

SHA512
473d965cca0d005c108df72c5eee7431a7ea4ad603d05e33d2cc1810c1777feffa062db1e354d670a9e1ef94f9812ae5f3653413e4f26185538fe62081d65c40

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
df4f91c3040c9464298615f3becaa72f

SHA1
b41955031ada3c2a38a149f664df8e79032485fc

SHA256
30157e10b8b8d77d956e8608f26760c6c90d8695bfcb641ab1e1e655a91a3870

SHA512
83b5514f5bfe62921d482137cec02af96d32c5fc5371465e37c5217ee33a91ec1f44e6a2dc8fb31c81917b0149b478fb97d0b14127e3826cd7be441d344c51e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
7KB

MD5
a4c4c7d39eaae43cfb65e8ea406b8e79

SHA1
be726fdfe8f1bbe32a89cc4daa9bfc86ccb17b56

SHA256
943d0cb8d7afe73cf71f2c5934cb753546cf123f8a98b9732ef036dafba122ba

SHA512
273b05fd42de1cb9831910ed759f0e396a674176ef0886b58c5ab99e31e8ef61dbbb20e2dd9f95a714d20fc12f744b970cd331b91371d2103fb894c07c27c52b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
511f53064d12c303528dcf671873f579

SHA1
e14c413f6dd4af0f8991aceb842076978c4aa893

SHA256
8640ed08459d8b3bbf26902d25062054fbca4f9c7909c938f78a23863bfe1b13

SHA512
160e53168cc36a27324cc42c09acffefad4b1b0658bd8d56cb6a7b8f82db2d170b1671da115b928b00761cdc4c5db16d017243068193e3f157e6ab8afe5a0011

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
7KB

MD5
423be743f9e99c0572459f6d90fefabc

SHA1
11141285d0f73deab1c5315ea7e00aed4204bb6f

SHA256
d0644a57765c205f50714585a5a5b3d08b0a457791b9e7632de9c28fcf8f12aa

SHA512
065be39eb9153f61dd3a766f063dd983b611fecfc0f4e3977fd797b5fc4dfb6c09da0ae1be1e7d75ba799a1b0415bae61ab844370439418e7750194d7b0052c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
88f58f11dffabc706d2e2090b1b5a26f

SHA1
bf64d2e118aaffa5f303255958cfcaefc3e68c0d

SHA256
97b0dac44418db383bbedbba5008314a93d1832df99576078d9326d6fcc66f88

SHA512
d7bb0a10da080a383c214807b639b527a4d29a840cac460eb76e3ce52481c87eb3af049068ac5f114ba8d5198163e94a3dccfdc8e6c42c353a2f1784156f1c1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e3c2c5c1957da58c54185e17c522fa11

SHA1
ca5a770ff050eac605ba857d5cae63de333cb2e3

SHA256
3e22a804d72da2555c1aa12042ad16ae1167ae186ef5fff713caa270c6205e75

SHA512
1d21c889ce9fe02c6637ee9663078dc570013845e1bcbfa14e477e0fd5c516cf8b75bb60803f932bc51259c7a512c88cb57f00fc8c7247d49a5c05cebd7479fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
7366509b00fcf3a91ce546932b145fcd

SHA1
3c7ea4e32c6e8ccabadbf79c4eed5ce6c6ed7eaf

SHA256
f2b8b798abaa659e59e4bce0877cd9dce37b4397006fe5de9c80cbc5f0a6c39c

SHA512
b2e126cf26c1e22e24d3f911e2c183c30d7b2e9815dce319aae8d534a512d80c68507d22808af1f6b9b0cbe0a8ca780631a28a7aece2360758288d2aee0ed75e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
90677d344bf997e63f21340256fedf5c

SHA1
61a2bf15a888969a7980eb04a4e8df6bec1bfc25

SHA256
e84c0724aff010f04ce6ed13028590b7a5236673aff166a5fff7380f4c3d017a

SHA512
6c3ea60547275635bfdcc5ce56ff3fff23c2f04aa1430e09d791ede1fc5e897d84482a5aedc84f4e32451a29e247918e726a7d0d24be367c06bcbda3f4b10b68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
7cf5edaabc0bc132258ed770097e83e5

SHA1
03ee3fecfe1f95174460cb56b7218935ec6f7663

SHA256
1c4da8ed49a3502f9008dedb209b9d8b30e48f4715b44d8eeebe4776990630e0

SHA512
00db9a32d5711d475d516d518a7768d6cd61a969cabf599d9d2425fda890ba01480712894a43f7fcccb8323c94391a9c758007fb96d5ff9151bc007d054ff18f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
70dd1a98a4e3d63ccceed9d05b03b7f0

SHA1
a50326f319fb5178e16f295d19178648bbb01b63

SHA256
fbe0b44c4268e96eff63b0870491c4c62084efb85d06c896b93043abac176695

SHA512
365ed0d672c0562e2240529fa3a91bf5346e8b9f6b3f07e2163961b521e3261f84ea54650760bb304b0888dbf8ce786d53565dacfe54eb823cc4ef50289dd0be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
902daaf332922ef8a353c05e0046bb4a

SHA1
eb814c1015e741bca62c09f0dea69081362e0379

SHA256
20d0fd2b93113e082dab22a0e3bbc982cb2eabc991a4d4276a7953e1ff4f6c7b

SHA512
49552e2c8488f3be9258afc17eb41ef41830cafdf73a3e8c77ee71a9cf16f067dd65a3de78a1b1bec8316b6e60f413bee485e3e7eaa78568cafc75a6208a039c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
84a54b1cfc6ef1066a6209f5b3741ae9

SHA1
a80245862a5f0dc2091ebdbe0824364bf5cfa3b5

SHA256
0691d9ef9c231a11e233025d6a06776398601a8e3093ed526703e5ee944007a2

SHA512
22e48203402134b0174012ccc955ae016a87d306330f3c52fb6df31f015d0acf54f79dc73a09f37b1db04fb8a133db0d72f2667e31c19ad0491c5449d2e7acf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
e7d901ad03d22078f4c42ecc83c3bd45

SHA1
13ffe2ced2026e6b99c39a96d006c7832a72ba17

SHA256
fddee54013f830a84e74dce5679f6e4c3c71b4c5c51ecdf58bcef7e27eba4f17

SHA512
8e7373116183db845f03c74e28effbe85b53c6c109f0a1a867fc4daa2944c099846644c5b6ecfa6408091d097a08b3f1b8cedcbeffbdcfaa14147f6b76663ec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\weave\toFetch\tabs.json.tmp

Filesize
10B

MD5
f20674a0751f58bbd67ada26a34ad922

SHA1
72a8da9e69d207c3b03adcd315cab704d55d5d5f

SHA256
8f05bafd61f29998ca102b333f853628502d4e45d53cff41148d6dd15f011792

SHA512
2bce112a766304daa2725740622d2afb6fe2221b242e4cb0276a8665d631109fbd498a57ca43f9ca67b14e52402abe900f5bac9502eac819a6617d133c1ba6a3

Download Submit
C:\Users\Admin\Downloads\MCC-Loader-Premium-main.fLDc3IXK.zip.part

Filesize
46.7MB

MD5
343ac8939ff1f2d87e28326856293242

SHA1
d9320eb9f2a07a9ba4f26b56d9eb231bab29713a

SHA256
dbcf0ec08edb25ba62768afdbbae7f7d5259f7699db538d2e267e5615f15b0bf

SHA512
055c4501ca7b664a17e223e775147fc90324e7270e7b6cab28e0be43eb744735cf6ecba1108c8433d8cde6f00cc24ca076595ad545970f472f9836cc7ea8d5c3

Download Submit