hxxp://hianime[.]to

Resubmissions

13/07/2024, 00:41

240713-a17y8szhqd 1

13/07/2024, 00:41

240713-a14ltazhph 1

13/07/2024, 00:41

240713-a1r8sazhng 1

13/07/2024, 00:38

240713-ay379szgrb 4

Analysis

max time kernel
156s
max time network
157s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://hianime.to

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	firefox.exe
Token: SeDebugPrivilege	1436	firefox.exe
Token: 33	3640	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3640	AUDIODG.EXE
Token: 33	3640	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3640	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1436	firefox.exe
1436	firefox.exe
1436	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1956 wrote to memory of 1436	1956	firefox.exe	30
PID 1436 wrote to memory of 2860	1436	firefox.exe	31
PID 1436 wrote to memory of 2860	1436	firefox.exe	31
PID 1436 wrote to memory of 2860	1436	firefox.exe	31
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 2748	1436	firefox.exe	32
PID 1436 wrote to memory of 1268	1436	firefox.exe	33
PID 1436 wrote to memory of 1268	1436	firefox.exe	33
PID 1436 wrote to memory of 1268	1436	firefox.exe	33
PID 1436 wrote to memory of 1268	1436	firefox.exe	33
PID 1436 wrote to memory of 1268	1436	firefox.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://hianime.to"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://hianime.to
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.0.334567327\1612540544" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64b7fd46-ecc8-412f-8360-2f8748e5352c} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 1292 11ff3558 gpu
    3⤵
    PID:2860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.1.1410007096\1476951434" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cc2233d-4e48-4bf7-acee-3c0b4b2e4092} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 1492 f70758 socket
    3⤵
    PID:2748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.2.1394099483\260297380" -childID 1 -isForBrowser -prefsHandle 1068 -prefMapHandle 1672 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ec0d407-671a-4727-9df8-09cbdaa23af8} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 2128 1a3c3358 tab
    3⤵
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.3.1630016805\237213595" -childID 2 -isForBrowser -prefsHandle 2784 -prefMapHandle 2780 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22cb6b79-fe27-4569-b624-9d47fa60b9c9} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 2796 f2d858 tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.4.1708325706\1960199268" -childID 3 -isForBrowser -prefsHandle 3680 -prefMapHandle 2732 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a39a4920-89be-4e82-a377-1b1df06082b7} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 3684 1a33b258 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.5.408932607\1483666457" -childID 4 -isForBrowser -prefsHandle 2092 -prefMapHandle 2408 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba3e2133-507b-4521-97c5-aa159375fd80} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 2172 1f251258 tab
    3⤵
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.6.1614917657\1048725963" -childID 5 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1e58714-6bd0-4783-9c72-7e481949caf8} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 3988 2063f758 tab
    3⤵
    PID:1940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.7.1134614909\823319324" -childID 6 -isForBrowser -prefsHandle 4168 -prefMapHandle 4172 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aae0249-0cf4-4e0b-885d-ef4d417d3308} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 4156 2063fd58 tab
    3⤵
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.8.359543162\393591731" -childID 7 -isForBrowser -prefsHandle 8328 -prefMapHandle 8320 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c614764-757e-4601-a3c6-9bd353331315} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 8340 22378758 tab
    3⤵
    PID:2720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.9.92137358\486208055" -childID 8 -isForBrowser -prefsHandle 8200 -prefMapHandle 8196 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63ed2b5c-1261-408b-941f-a366cb5b2cbd} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 8208 22db1358 tab
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.10.1942447284\337121203" -childID 9 -isForBrowser -prefsHandle 3248 -prefMapHandle 3252 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf636c66-1bf2-48fa-a492-4f004285e326} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 2772 223fb658 tab
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.11.448789026\657674211" -childID 10 -isForBrowser -prefsHandle 4140 -prefMapHandle 8436 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16123e2e-d859-4f96-9779-f0883bca75da} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 2760 1e6fa858 tab
    3⤵
    PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.12.1290733462\1981959811" -childID 11 -isForBrowser -prefsHandle 4304 -prefMapHandle 4328 -prefsLen 26872 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aec6ebaa-a4f3-4314-8dc8-79077185c360} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 4292 191f5e58 tab
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.13.63709576\43864972" -parentBuildID 20221007134813 -prefsHandle 8252 -prefMapHandle 8240 -prefsLen 26872 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be381978-e771-492e-9186-f6e7a1a156da} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 8304 118c6b58 rdd
    3⤵
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.14.750015868\324455324" -childID 12 -isForBrowser -prefsHandle 4104 -prefMapHandle 1668 -prefsLen 26872 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45d2fb79-7150-46da-a419-262add64605c} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 7968 21e19958 tab
    3⤵
    PID:3088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.15.348519986\273249369" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 7828 -prefMapHandle 8312 -prefsLen 26872 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fe11b96-e764-4c2f-a929-d5df118946d5} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 7840 1189de58 utility
    3⤵
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.16.297093125\557350573" -childID 13 -isForBrowser -prefsHandle 1816 -prefMapHandle 2336 -prefsLen 26872 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {674070db-c7ac-41b4-81e2-3af1c5b92c3f} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 4008 191f3d58 tab
    3⤵
    PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1436.17.557571346\70334046" -childID 14 -isForBrowser -prefsHandle 4108 -prefMapHandle 1816 -prefsLen 26872 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cb98cf8-5250-4121-8199-d93ea64894be} 1436 "\\.\pipe\gecko-crash-server-pipe.1436" 3244 1e8d6858 tab
    3⤵
    PID:2564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i7f18jmm.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
d4e6d634d86af698d006d2ffaeee4408

SHA1
5970aa141b3f7194a32f208ad5aaddde7e01f8a6

SHA256
ed39b8dacb9539043829e8260ea4b90dcb2e231891b9d20b188f76374117da1b

SHA512
d8a11814d78c9d3de36ae64e50d4e471c9a3a1fa477eb4510da646fecd17eaf388897e4547487d5d89ced9757d51a4121e2de8e7e3ef853b969d9a7f0c70bfb4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i7f18jmm.default-release\cache2\entries\1F1BBBAB1CEDF80D401E6645617D2EED1D114FA1

Filesize
188KB

MD5
f1fceb88e29c0e17c0c4d557c4f19916

SHA1
dd672b833c4d119094ea1967a89352490a2e4af3

SHA256
03952877fbcb3e4f4d6228beac35adb4e338466bf5bc0b1976f3737365a9ab02

SHA512
70f674f6d912efc5d1478f041ef7615034c361284743e3e0d36682ae5bfd6a32fdbfb862a3a030072995ddd72093ca44d3c20387fc39c86be39b48143e3d2f82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i7f18jmm.default-release\cache2\entries\52D11129AA099DB07364CABBE4176EE96467742C

Filesize
53KB

MD5
a47801fbbc6710a10392a7258fec2ad1

SHA1
191b8a09b1f3a2fe0456e4029fb07c982dcf47e7

SHA256
e89cf0294c3dc179597e6728d145733c4750e988bd0b71d5d4cc7a54ce5d8b2d

SHA512
3fa9e79dbbd38c6f66f6513ffca4d46bea15ed3e7132ea2ca826d30665200d746d134d9cb9a0443856530d3e829d5df24eae16cf52471a1aa14b221e41cd83d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i7f18jmm.default-release\cache2\entries\BE180CC24D94DAE8C6AAB72806F77D0D32E0861E

Filesize
1.5MB

MD5
d59f8f84132e56c69a33a86ff13c6ff9

SHA1
1a62c533bc4d0bb472eba68d34429a95edd3a024

SHA256
370687610caa7e40e64b03c980324c016b9365db220417fa27afae9442295da8

SHA512
ed4a1909ed25fbe4641276d4560f738e5039888aece8e9230bad53299d3a6a7dac7efa730b28ca1543d96dc9287502529442e30e2a20bbda1e78f388cb7f8064

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
e7fa58affb49ef9cab27d16dbd239743

SHA1
e2a6b5b69a89b4d2ca82aec1f657652ee6573604

SHA256
f50f6cad8cf96e26368ccb4e1128a00332b438dcd1e41048a1172180f28d874a

SHA512
57b5efd9ed462c6d4b520c344c041f66a13de85ba53d0995b6978bf81153f7b5fa8283ebab73adcbc8c730453b7376b2301a99ec7ae89a2a12fdec9fa931d311

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\pending_pings\c9e22eb5-11c0-42bb-ab21-3e09dd400dd7

Filesize
733B

MD5
e8eafe123e0280f2a4593608491c7e5a

SHA1
af16caa86c47b35f0d9e0b4bc3253ed1b72d09a1

SHA256
9d00933c0385e06ea9f8c2efad625ddf49b69933b4a2b3720bf998ae8356ea0e

SHA512
c7ae32380e3a5ac6c9624f31708ec54551e84ce9671386d29cb236830033baa0741d35aec7ed7fd52f9ade499b9119bc761a52bf8ea43640d21e51a615c0cd99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs-1.js

Filesize
6KB

MD5
ab4486aa069af50470d2e3c86781a62f

SHA1
f5d10bf865af7b9e5a22cc7152aedfd3ff05f515

SHA256
98042d80e68189ea507b619361d54fd02b05876d4d199d029189b5ced54fbd5d

SHA512
18a6b07f61685259cb18c554d03ea124da1a05e71b8340b6d6c833f56f73c9d76be8e03a4ddb343e9a82aa5d3aaf03b0426fdae41fcec4f780d1e2e9cbc23c14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs.js

Filesize
6KB

MD5
5cbb3a5e52c040f10df845df426a4e57

SHA1
a6096bda8814f0332d941c3ed394de5b29dd05a6

SHA256
3fa06c7fa32d8a73091b4a9ddba5686e09caee5f33819a4807485c7d167f9f1f

SHA512
3e94c5786aee173c796dfb2ee36d1fe276d7b7e385e145f261f795974459ad25d99d6d987aab6eb71238468f8cda6fe697e604df93339cfdd29cb9a81c1c131c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs.js

Filesize
6KB

MD5
6ae3c4fed6b0022eb9ebf5217d2c5c19

SHA1
a0562f9b16ed377bff48bf7d2a00b70c7afb6455

SHA256
8b552455c79a895f5ff705ac291755e1c97302cec330b5d180c97ebe79b1afef

SHA512
90d84124989cf986fd49bd4333a24ea3711c72f2247a00b027c102f719a487a56527354ce336c762aa3635e7123cc662c945bbe42b9ea012629bf429b831aa60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
e6452427fb44bc1970aaa2a6d8d3c1c1

SHA1
8efb7df00bf0197201cec653f155ca10cadf21db

SHA256
c758b973a28eaab6e3d7cc7b256098a597f5717259dc45b5d0c986576a0d389d

SHA512
d8026bc1c67385339ddb7c879f8ef847a82e858d35d50ecaab6e28ab88b855ca4e87150e6f09969a78e4db6162fae32e31c65726b2f04cfa84847cff158a5472

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
f7654505b15067662da1dfb53e5d46b7

SHA1
c0417b36cd9f29b05f1eff88bdf78682051c2d75

SHA256
4aed3bb82054f57d53cbca0684a5ed54657bc69e876ce8ee45af8c282ac79727

SHA512
32678ae5e09eb19f7f44e661b950057091e62b1f5c0eaabae301cfdc7485863c23840541374d7f2d58e211897c0031f76d988df64996c681d1dd62f68b99b490

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
c063ed63c3d29f50c4e45051df8bc55d

SHA1
5c99e3ccb70279aa3045a47fce89b1a4c26ecb36

SHA256
996e0060207122a52d47df2a429f08d4455121d081ab5988d58e921fe96bad5e

SHA512
7c7f5c6be261c3ec89240ab901d9031f2f199379603c01c05ee7beb835d89cf69b8a626348a4956e28267697587a40262fd313d5e046c01d40b6ebe4de21a458

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
67847565a9207d9e7770523e50915687

SHA1
84364d6eb3f251a176c21dfd76e428b0b62679cb

SHA256
a9fc8332940dd10c6cfc967ad191275db24a6f03fa942c3d0b00d4ddca461792

SHA512
031c8cb8430a241878878db3b01e75a65430e5e718ec49b7dd2d952f44fb97cfdd158918cd95293b8287835c536d54750abbf69fc8f2d5e7d8d563d25a54abb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
93aaae131f22626ade31cba924451d42

SHA1
df4caeb267e4e1495fce41ee94ef7502f098e3ac

SHA256
07d57406c1fef31dd3d6c58a2ed088aabdde1114c52b87248cbf20827561ebde

SHA512
c06f9abb4f26d54e4e5f0dfb0f132163442f6deecdb668545b479071656ee21960f3e976b1d417e703e34af85e965be6bfeee9caee9ce941b25136eb58a4d4d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
79c13606bc6c7fbd795d6068eabf0e47

SHA1
8aba5bed34ad95a0c291aca63182e63331d330ad

SHA256
cce791aed7273f7aa6e49b855eed4d684a0a7672d90b52757603b1c5a3c28368

SHA512
e584b2a5474ce670fb7cf15b410deacde8bfb978c8393fdd5f5e815a29d3ce1721ad603073eb0de5a808ec3cb76c6131584ea00934004d952342142a5148efa6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
dd74108d4cf77b0180f9b269be139a71

SHA1
36e3c1c9c7cb2b45a9969d223af37f0bada636b2

SHA256
ecb89bd4b1abc8e6bbca563c6092c2e742b6ed1ef2cfc6e04a8c9d419e587519

SHA512
c06e9a1ce8ece49db4659a6dff57fca014c162fd440e11120539124efebd7152eb26fe2b55b80fef76894fb6758936e48fe23bd5dfde76391cd15e4e3184c4ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
9671154d39b64ac1a05e1661d43f444c

SHA1
c3d656dcb1755ca99695b2aa5fb186c53c50ca49

SHA256
83371ec0b79db0ff3f2a3de8c3ae45ccb0fe66ab265c55b233dc46b766c38969

SHA512
c46b6048ba56c777550a4053aa6c18e5ca52045211ef635789782158e06a9200c9f0a1f9801fbd792849c3c00c05cf550b0db186f57df4452cf343830bbb1678

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\storage\default\https+++hianime.to\cache\morgue\53\{4b2321d4-8c97-4afd-afa7-c21bc0dab135}.final

Filesize
437B

MD5
9bb6bdf8cc0356806d16ee9197cfc012

SHA1
cbdc7451b9ccf92627de2e64edf1be53594a6822

SHA256
b2386b5b38ce2b22fadacb1cf83b7ef4108cfa63170c801ae0bae7212fdb9e66

SHA512
06165a07d5a4c976fed17bd8299ded055b89da4bd5a85893b775a6592d54f8eddaeb3687a6084633c00862b59159a09a9dc21bf31592a782461a1e45eba5fd5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\storage\default\https+++megacloud.tv^partitionKey=%28https%2Chianime.to%29\ls\usage

Filesize
12B

MD5
16c6e9750eaef7c0b475a4db57991261

SHA1
b0648df1c93f49e4abafe3d7a84f641cedfbba64

SHA256
7bffba513a5d38dc30e40eee47cab3169c28f953dce74fcc7ebfe2a87b513338

SHA512
c0dd6b540fe162f2185a1cfa034d41282b37507a21e89080566310a49955936a499485e1fdd00ddc3fbfaf62227f9dc8649aa56166da64851ee048b8cddbe747

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\storage\default\https+++megacloud.tv^partitionKey=%28https%2Chianime.to%29\ls\usage

Filesize
12B

MD5
5a053c497ad09ce5090413a0b5fc0434

SHA1
849ba19d850408363554ae8ab5f061663abd6302

SHA256
ac670d97ab4348c21cda6f98c694049b678b029679433dbdbb25a6eead1538b8

SHA512
cdeccbd694db251860acf4728eb75c1b96d6654feb7fafbca149ad794a1cc5b69ea9ee56e164ba810339e944b0b23d4f537fc1dbabc2104c9af52067d9b8af98

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads