Edit tour

Windows Analysis Report
mozglue.dll.dll

Overview

General Information

Sample name:	mozglue.dll.dll (renamed file extension from exe to dll)
Original sample name:	mozglue.dll.exe
Analysis ID:	1448265
MD5:	805c3d7c57adfa1b6da148b1330fe00e
SHA1:	b732a4b1b914647034041d4c6465071e06d127cb
SHA256:	bbc93694f969ff53e2a99b46935b116ca2b241083a9df3eea953dd02ab344a67
Tags:	exe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

One or more processes crash

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6412 cmdline: loaddll64.exe "C:\Users\user\Desktop\mozglue.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4428 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7192 cmdline: rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7316 cmdline: C:\Windows\system32\WerFault.exe -u -p 7192 -s 292 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7176 cmdline: rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapAlloc MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7296 cmdline: C:\Windows\system32\WerFault.exe -u -p 7176 -s 296 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7468 cmdline: rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapFree MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7512 cmdline: C:\Windows\system32\WerFault.exe -u -p 7468 -s 284 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7668 cmdline: rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapReAlloc MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7704 cmdline: C:\Windows\system32\WerFault.exe -u -p 7668 -s 236 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mozglue.dll.dll	ReversingLabs: Detection: 44%
Source: mozglue.dll.dll	Virustotal: Detection: 55%			Perma Link

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF1B2EF0 CryptQueryObject,WinVerifyTrust,WinVerifyTrust,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,CreateFileW,GetLastError,memset,GetLastError,memset,memset,CryptQueryObject,memset,CryptBinaryToStringW,_wcsupr_s,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,WinVerifyTrust,WinVerifyTrust,CloseHandle,CryptMsgGetParam,memset,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,CryptMsgClose,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00007FFDFF1B2EF0

Source: mozglue.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: /var/tmp/build/firefox-cc4c8eaff833/obj-mingw/mozglue/build/mozglue.pdb source: loaddll64.exe, loaddll64.exe, 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1818819333.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1819311882.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1774290881.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1788028454.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, mozglue.dll.dll

Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: loaddll64.exe, loaddll64.exe, 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1818819333.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1819311882.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1774290881.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1788028454.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, mozglue.dll.dll	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1AE840 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_00007FFDFF1AE840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1AE030 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_00007FFDFF1AE030
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B14C0 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,GetLastError,GetSystemInfo,	0_2_00007FFDFF1B14C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B2D10 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_00007FFDFF1B2D10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B0550 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetSystemInfo,	0_2_00007FFDFF1B0550

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B8BC0	0_2_00007FFDFF1B8BC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B3FC0	0_2_00007FFDFF1B3FC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A2FC0	0_2_00007FFDFF1A2FC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1E5BC0	0_2_00007FFDFF1E5BC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A73A0	0_2_00007FFDFF1A73A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1E5FA0	0_2_00007FFDFF1E5FA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1D5000	0_2_00007FFDFF1D5000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1E33E0	0_2_00007FFDFF1E33E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1BD430	0_2_00007FFDFF1BD430
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1BC830	0_2_00007FFDFF1BC830
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1AD830	0_2_00007FFDFF1AD830
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1BE280	0_2_00007FFDFF1BE280
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1ABE80	0_2_00007FFDFF1ABE80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF28C290	0_2_00007FFDFF28C290
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A7A90	0_2_00007FFDFF1A7A90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1AEA70	0_2_00007FFDFF1AEA70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A76D0	0_2_00007FFDFF1A76D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1D5AD0	0_2_00007FFDFF1D5AD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF288700	0_2_00007FFDFF288700
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A3EEA	0_2_00007FFDFF1A3EEA
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B2EF0	0_2_00007FFDFF1B2EF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A3720	0_2_00007FFDFF1A3720
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1AE170	0_2_00007FFDFF1AE170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B1A10	0_2_00007FFDFF1B1A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1D3A10	0_2_00007FFDFF1D3A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A5DF0	0_2_00007FFDFF1A5DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A2240	0_2_00007FFDFF1A2240
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1D1080	0_2_00007FFDFF1D1080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1BD090	0_2_00007FFDFF1BD090
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1BA8C0	0_2_00007FFDFF1BA8C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A80A0	0_2_00007FFDFF1A80A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1F30A0	0_2_00007FFDFF1F30A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B6110	0_2_00007FFDFF1B6110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1A2910	0_2_00007FFDFF1A2910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1E3110	0_2_00007FFDFF1E3110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B9D40	0_2_00007FFDFF1B9D40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1B5940	0_2_00007FFDFF1B5940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF1ADD20	0_2_00007FFDFF1ADD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF28C530	0_2_00007FFDFF28C530

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7176 -s 296

Source: mozglue.dll.dll

Binary or memory string: OriginalFilenamemozglue.dll8 vs mozglue.dll.dll

Source: classification engine

Classification label: mal48.winDLL@16/17@0/0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF1F30A0 SymGetModuleInfo64,EnumerateLoadedModules64,SymGetModuleInfo64,SymGetLineFromAddr64,GetCurrentProcess,SymLoadModule64,GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,InitializeCriticalSection,SymSetOptions,GetCurrentProcess,SymInitialize,GetCurrentProcess,EnterCriticalSection,strncpy,strncpy,SymFromAddr,strncpy,LeaveCriticalSection,GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,__acrt_iob_func,

0_2_00007FFDFF1F30A0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7176
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7192
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5300:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7468
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7668

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2e6e6fee-a70f-4c4f-9157-921f696eaa71

Jump to behavior

Source: mozglue.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapAlloc

Source: mozglue.dll.dll	ReversingLabs: Detection: 44%
Source: mozglue.dll.dll	Virustotal: Detection: 55%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\mozglue.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapAlloc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7176 -s 296
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7192 -s 292
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapFree
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7468 -s 284
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapReAlloc
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7668 -s 236
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapAlloc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapFree	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapReAlloc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msasn1.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: mozglue.dll.dll

Static PE information: More than 335 > 100 exports found

Source: mozglue.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: mozglue.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: mozglue.dll.dll

Static file information: File size 1420288 > 1048576

Source: mozglue.dll.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x118e00

Source: mozglue.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: mozglue.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF1F56A0 GetCurrentProcess,LoadLibraryW,GetProcAddress,FreeLibrary,GetCurrentProcess,LoadLibraryW,GetProcAddress,FreeLibrary,GetCurrentProcess,LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00007FFDFF1F56A0

Source: mozglue.dll.dll

Static PE information: section name: .buildid

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF1A3604 push rsp; ret

0_2_00007FFDFF1A3605

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF1B0810 abort,GetSystemInfo,GetSystemInfo,

0_2_00007FFDFF1B0810

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe

0_2_00007FFDFF1F56A0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF1F4870 QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,GetTickCount64,GetCurrentProcess,GetProcessTimes,GetSystemTimeAsFileTime,

0_2_00007FFDFF1F4870

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mozglue.dll.dll	45%	ReversingLabs	Win64.Trojan.Generic
mozglue.dll.dll	55%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	loaddll64.exe, loaddll64.exe, 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1818819333.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1819311882.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1774290881.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1788028454.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, mozglue.dll.dll	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448265
Start date and time:	2024-05-28 07:27:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mozglue.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	mozglue.dll.exe
Detection:	MAL
Classification:	mal48.winDLL@16/17@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 133

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll64.exe, PID 6412 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
01:28:07	API Interceptor	4x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_1de486fd-c9ab-489c-aa10-0c38cdabb530\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7553661107287909
Encrypted:	false
SSDEEP:	96:1XF4WikayKyFsjB4RvCdJfmQXIDcQfc6n8cE8cw3zXaXz+HbHgSQgJjGckIkpkoa:dPikayFg0h4G/jgzuiFHZ24lO8yMc
MD5:	51D73750F8EC3782D0B0A3DC7BC2B996
SHA1:	17DCA2C60BB391002751BA2A7856A1C3FC24EE38
SHA-256:	352911EA726D68E166BF1C655D4AD5E784694C19D342C878C2EE2327639FB71D
SHA-512:	FA4379F2154609EFBBA2A24F17294698305AA21C02C89B7660FA31C61ACCA5014185D904ADC8487A91AEF651ABEC1C12EB1D3A8BAFC6D52E5B5978DFC018D056
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.3.4.7.6.7.5.3.3.4.3.9.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.3.4.7.6.7.5.7.7.1.8.9.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.d.e.4.8.6.f.d.-.c.9.a.b.-.4.8.9.c.-.a.a.1.0.-.0.c.3.8.c.d.a.b.b.5.3.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.0.4.8.a.a.1.3.-.4.c.9.a.-.4.d.3.d.-.a.1.8.8.-.7.4.3.f.9.3.e.c.e.7.b.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.m.o.z.g.l.u.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.1.8.-.0.0.0.1.-.0.0.1.4.-.5.9.6.0.-.e.d.c.a.b.f.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_273e8517-c54d-470f-b1be-6f82d7b9a01d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7552936570865588
Encrypted:	false
SSDEEP:	96:ewTFFlXTyWihyKy6ssjB4RvCdJfmQXIDcQfc6n8cE8cw3zXaXz+HbHgSQgJjGckk:rTPlihy6sg0h4G/j4zuiFHZ24lO8yMc
MD5:	C0C4019315E8C68952699B07050B4C5D
SHA1:	0DA07544FA24C6312A433904C8065AD72FDCB664
SHA-256:	13FE8447BFB8C40BA18C0AB4938406E9EA834A6825379F136A0E3945B401FF2F
SHA-512:	C1582928ABFA598A9878CF650B78976E66C58B49BA45FA302F47386B7DB5372257AE2E1D40253182BD3CA416049D3B66E3319EA72BED0DE43CA283162442AB62
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.3.4.7.6.8.1.2.2.0.1.1.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.3.4.7.6.8.1.4.2.3.2.4.6.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.3.e.8.5.1.7.-.c.5.4.d.-.4.7.0.f.-.b.1.b.e.-.6.f.8.2.d.7.b.9.a.0.1.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.2.f.5.9.0.7.-.6.e.a.7.-.4.a.3.8.-.9.5.6.b.-.8.1.0.a.6.f.5.9.9.a.e.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.m.o.z.g.l.u.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.4.-.0.0.0.1.-.0.0.1.4.-.0.a.6.5.-.8.3.c.e.b.f.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_a4d72ff2-2d42-46e7-9cd5-bbc934cbba1b\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7557099160110828
Encrypted:	false
SSDEEP:	96:+wFZyPWikyKydsjB4RvCdJfmQXIDcQfc6n8cE8cw3zXaXz+HbHgSQgJjGckICoY+:Dpikydg0h4G/j4zuiFHZ24lO8yMc
MD5:	4DA3CA8E1F1E0F4863CF75C7802F24F6
SHA1:	6EDAE2F10979F116FD23346005185C03EE2AA126
SHA-256:	80BF49AFC5745A1FB8D7CC92703A43E6E0804579D75519B07450A1C6B831EC59
SHA-512:	C8ABDE9E92722DB1DA3FDA7A2750A97D7C660958C6BBCF7094C92FEE7011962B13D3CCAB5E6D4EF52042E46C7E4A88E30A1B6D803D4A12C46B97C83096BFD1EA
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.3.4.7.6.7.8.1.7.8.3.3.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.3.4.7.6.7.8.4.9.0.8.2.8.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.4.d.7.2.f.f.2.-.2.d.4.2.-.4.6.e.7.-.9.c.d.5.-.b.b.c.9.3.4.c.b.b.a.1.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.7.6.e.a.1.4.9.-.a.5.6.3.-.4.f.8.e.-.b.d.4.1.-.6.c.c.a.0.d.2.1.e.1.2.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.m.o.z.g.l.u.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.2.c.-.0.0.0.1.-.0.0.1.4.-.6.5.3.d.-.b.7.c.c.b.f.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_e9164dc1-577d-4bcf-b83d-667d25519d07\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7556316461208111
Encrypted:	false
SSDEEP:	96:94FFaWiOyKyUsjB4RvCdJfmQXIDcQfc6n8cE8cw3zXaXz+HbHgSQgJjGckICoYhI:epiOyUg0h4G/j4zuiFHZ24lO8yMc
MD5:	D232FBAD78841FD314495724A070ABC6
SHA1:	3E20FF8F926F8AF2D96F30DAE22152D584698589
SHA-256:	D8C2E77E7086DDF39E534AFE6595B85C6F33A32BCC48A0E5C5694DEDEDC84FDE
SHA-512:	15AABDBA0A1180F5BDF62E11D9C834739DA291C323DC6521F369E4AD58DF2346AFC043FE52B75BAC925EC1BE346229A7B940FA988DCBC3AFD5F89C1E3AA5F609
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.3.4.7.6.7.5.3.2.8.4.0.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.3.4.7.6.7.5.7.8.1.5.3.1.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.1.6.4.d.c.1.-.5.7.7.d.-.4.b.c.f.-.b.8.3.d.-.6.6.7.d.2.5.5.1.9.d.0.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.5.e.3.c.f.8.f.-.8.8.f.9.-.4.e.1.d.-.a.9.7.6.-.6.8.9.d.2.4.b.2.f.d.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.m.o.z.g.l.u.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.0.8.-.0.0.0.1.-.0.0.1.4.-.7.b.0.d.-.e.c.c.a.b.f.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA43.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue May 28 05:27:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	52362
Entropy (8bit):	1.5373039531820891
Encrypted:	false
SSDEEP:	192:foy5leN1OM9Ns5bTVcYV/RuYyhpnNBGMF2/k:T5leNY6Ns5bTVcYV/RuYyhpnNP2s
MD5:	4F9D59DF6CC4E4EE68E70264D0532F4B
SHA1:	C5D9E5F39E074397BC0284062DE8D4DFEE9CD683
SHA-256:	EE8C122A5E7A3FCE55470B24B7E0707BC53FF02F6DCDC84DADB07A2AC0A176F6
SHA-512:	76114E912BF3A9C9ECA88DB61B4C1ADF6B9BFF41EA014A9FF284988FC219DAB7FD251E13476DA3F20A8262E7F102C7E4F1813046C3DBD10F5DCBEFBEF17B5E20
Malicious:	false
Preview:	MDMP..a..... .......[kUf.........................................(..........T.......8...........T...........x...............\|...........h...............................................................................eJ..............Lw......................T...........[kUf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA52.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue May 28 05:27:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	52358
Entropy (8bit):	1.5419125043685036
Encrypted:	false
SSDEEP:	192:fQU1BT1WKOMJ4Vu8/JKk6zdUUU5kRSyCe:Jd1WVMQu8xB+ayCe
MD5:	FA254B9291AA9D0F3AB808C80C3EABBC
SHA1:	36CE45A7E646EF674A0FC6C4F245E3F1031B2537
SHA-256:	1821FBF7E508344AF996D1FD75C69063A3BE5F9241CB4F3739846BAD21C65038
SHA-512:	E16E1EA94AA1739E4719535706C520AB12249C942CEBBB70A3D2B9CDC6FE9B497EEE4C984BFB60976E511289E341C6B31A654CA65F3810B704EBB0D5D50EBCCB
Malicious:	false
Preview:	MDMP..a..... .......[kUf.........................................(..........T.......8...........T...........................\|...........h...............................................................................eJ..............Lw......................T...........[kUf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAB1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	3.696289323447424
Encrypted:	false
SSDEEP:	192:R6l7wVeJidB3V6YYSwUgmfHASpDRC89bdD5LfXXbm:R6lXJoD6Y9RgmfHAk7dDlfHS
MD5:	4F3C42FCCEC73F01B560F93AE253A118
SHA1:	B75561E8A7868A7CE679C515D44A40CA851F811A
SHA-256:	2555A39A9C20AB470295CB75FBF7CAFED56ECD1044E9E7B6FACE843A648FCD72
SHA-512:	40B9919164E183D542F217A2DFC446C25D2BCE2171B4182B5ED0D1382D9F996726896B7378AE1D4756E2D6A8C7D08029D6C3569ED60276B9A28F0946530A4883
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAC1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8524
Entropy (8bit):	3.69662732712095
Encrypted:	false
SSDEEP:	192:R6l7wVeJI/Bi6YBXLfgmfHASpDa89bdDqLfVXbm:R6lXJAE6YRzgmfHAsdDOfVS
MD5:	2F816E24EAE903D7323DF7ACE10D3522
SHA1:	F97F5351FCE2707FCBD64C70233FDDA0F53B19DE
SHA-256:	7E0C7E1BEE25D2169F2A34B2415497B14244F935DCEE0970BD7EB9353DD3D1C6
SHA-512:	1AD94A06AED1C3A0C947A0063B38715FE56432EB9B190F0E3E13FBA12A837767AC758D9F2F2D7991485E3CD5F444A9399947FF4DD844FA60E3F628D16E15B982
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAF1.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.472760542446161
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg771I9hP9AWpW8VYoPYm8M4JC8Ca/4FPPyq85mOUDoptSTShhd:uIjfnI7ij7VkJcPPopoOhhd
MD5:	AF944479A21FAB454FF430630D0672AC
SHA1:	DF7F9D108899A48E1AE683E0A6D4E01961EE222E
SHA-256:	61817BDE60F078AE0E3373CFB8CF0FD05B195049578963C31505BE9E05D58DA3
SHA-512:	2D7E9FDB1EC920AE8CD64180EBC7027D706D4C57E5190566500F1B9E73579BAE1B41D52C27340CC5702EDAFDFF1CDA6826CA62EB09E2FBE0C0AF5A2FB22FEDF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="342510" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB10.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.4717799680230845
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg771I9hP9AWpW8VYM5Ym8M4JC8Ca/4FZyq85mOU7E2ptSTSgd:uIjfnI7ij7VHoJQ02poOgd
MD5:	1B0B8A6BDAE16DCB9E36132B2FA49888
SHA1:	D5A6FD881C9B05F024D7AA8FEDEF696C8A1A7B7E
SHA-256:	9EEE3D72426398C40BE9684D7E257473EBFF2E2192FED7621F49C28EFBF0A801
SHA-512:	EBC2B8B59B7CEFD895388C55DE046114A95314A70BD2698B78017B52479936CE7163F1E9298CBC7656A40164D6E1FCBF715FB320F3A5043F20BD4DC8DD1D8BA2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="342510" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD56E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue May 28 05:27:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	51210
Entropy (8bit):	1.5616217785847768
Encrypted:	false
SSDEEP:	96:5b8pwzkg2GVUJc9edlTahCqroi7MzjgWfarFWr9OQYWIcdxIBwGEv9:iuAleQZOMP9f5rnLG+9
MD5:	3362249B03A506AFAC2CD42E5F5ACB0F
SHA1:	D14B3D8F522B96FD7ACA7CCCA0F73586127682F3
SHA-256:	A35B42B67532D370F25157661A6744C64C73FC3B836C46DF90B827D8EDB5262C
SHA-512:	45EA29E38BA0F0DBC85B3A740DD0E78E6B9D7D2A67CBD6CD2F4E7D655AAC1F4B78C80786B56181AFA88AFF4BFA646D184D5FFD07D694BDF7EC861014982B0232
Malicious:	false
Preview:	MDMP..a..... .......^kUf.........................................(..........T.......8...........T...........x...............\|...........h...............................................................................eJ..............Lw......................T.......,...^kUf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5AE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	3.6964479357443722
Encrypted:	false
SSDEEP:	192:R6l7wVeJQTB46YYDwUgmfHASpDl89bdmqbf0hX8m:R6lXJk+6YURgmfHA1dmufgJ
MD5:	FC872BBFE2CA6740A2138A765405200F
SHA1:	FCB85E241AE88A561BD15F721EE2BEA4BEC4B8E6
SHA-256:	B5B4E47833DF60E47984765C92B593C7CE3F38D3C5A914DBA90E346F434234E9
SHA-512:	BAA4DCF7EEC8FC1513FE320964AA494E3F2E0909DFFFA664F2A5C03F4C5B9204D30F9E565A13717663D3CBAFA6339C9A6136AA44A2A247B6D18E357D4DA995D4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5CE.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.472820808514949
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg771I9hP9AWpW8VY+Ym8M4JC8Ca/4FyBDyq85mOU2ptSTS4d:uIjfnI7ij7VKJTSpoO4d
MD5:	A77280A71C1D4DF59288F1E8D5C8C1C4
SHA1:	CA7EB518E1CB4942FA2D82E67AA0E49BD02DC4D7
SHA-256:	B63717899AD03009284281FE3358F281AB2AF065BAAECE494A7B34EDBA93BEC6
SHA-512:	9D7EB4FCF9DDCB3815C080D6849F53A865DDD6D43B3229ABFB92BC0EEF871A4B8417646808A47F776FD7FCAF715BDBF22E10103442FB170A9F540E1B12B1AEA2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="342510" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE145.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue May 28 05:28:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	51178
Entropy (8bit):	1.5619391023963358
Encrypted:	false
SSDEEP:	96:5M8ST6va5Wkg2GVUJc9edlTahvY2+0INW9oi7M7loa5VeFMQYJGqd7HOwBdKWIrk:9S+vile1l+ZNWKOM7lorA7HNdU+
MD5:	A440CAFA943773EFDBB6791F121372C9
SHA1:	E98658B01BE6480BB4E63280BDB90C69CED8FC69
SHA-256:	61115D076C9214F47CDEBFD0CE4B299CA045B6EEDB3DD8EB4A39B186123F08AC
SHA-512:	A72D055ED9FB64387C6738F08EAA2FE061FC053C5E21FE181FAFB820654A172C4228F7BD73FB870862C20D02A4D46599D2D1369E87588E00EA897B13C154E69E
Malicious:	false
Preview:	MDMP..a..... .......akUf.........................................(..........T.......8...........T...........x...r...........\|...........h...............................................................................eJ..............Lw......................T...........akUf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE175.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	3.696238245506731
Encrypted:	false
SSDEEP:	192:R6l7wVeJieBn6YYSLwUgmfHASpDl89bPcbfWDFm:R6lXJrB6YvRgmfHA1PIfWM
MD5:	493CADE46004DC4AA12DD74F8FF946CA
SHA1:	54CE9C467FE938D63880E5731B7DBCAB9BA45F15
SHA-256:	CCCC28D2272DE8F18F32B248FB6A4C06699EEC29071F6CF49AFC4BC29284FFB7
SHA-512:	EF06C8B58C7BCAB7348DA98B07B9615479DD53FEACE1E627F87DC23534C45B34762AEED6CD318E624D0D8690203A30B41CEDF060A1B864306934B226D356518D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE195.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.473329859349416
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg771I9hP9AWpW8VYhYm8M4JC8Ca/4FVWyq85mOUptptSTSyd:uIjfnI7ij7VhJZttpoOyd
MD5:	B1EBA76BA5ACF604BCF074C7C58D50E5
SHA1:	6040673B09079C1260A4A15B5B0B458B750F7F96
SHA-256:	6B44610C8AF7B0481872E035759397A7F62AF1C07D898B0E855A725CC1823E7B
SHA-512:	45D42941BE626E231147E1422EA213BC9B1799443B75CB92BB12FBF3FA374ABDA35D46687F60C33139515C25CD18D6EEEB6F09FBAE87ECCE6D9C9C1A2973C3F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="342510" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466386427651027
Encrypted:	false
SSDEEP:	6144:rIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb9:sXD94zWlLZMM6YFHa+9
MD5:	3750BE69071D154E0BEA4FAE7BE93F8F
SHA1:	CC4D8FB18B507201587CCEA9D10D03839A541950
SHA-256:	0F333C9DABAFB11CB1E06BFE16A10F6630186E88F4699A06BF25589010FB59BD
SHA-512:	86471F103790F5ED0A285333C46E44658C005D785D8B0213D874E9041741291C70D739A515611906A502E8D6948B6F8837DC24EF4110CDB08FFBA11BDFC6BC53
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmng.................................................................................................................................................................................................................................................................................................................................................wM..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.535545454809225
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	mozglue.dll.dll
File size:	1'420'288 bytes
MD5:	805c3d7c57adfa1b6da148b1330fe00e
SHA1:	b732a4b1b914647034041d4c6465071e06d127cb
SHA256:	bbc93694f969ff53e2a99b46935b116ca2b241083a9df3eea953dd02ab344a67
SHA512:	e6f8b93a67ae249c9fc3cb0dbdb6d6e1bc1b0b1e16d41c6cbfb0a6f1d393effa85bd5f289b1299b2d5ca430ab1e573f0e240f25c840db2a4082ab14f9f73435c
SSDEEP:	24576:0skfObOBBsHGID3eteae2egpYvYeiLMf8WhT5xyvS:0skfEXv3eteae2NciLMf8WhA
TLSH:	CD658D0BE29610FDC16EE27897475A12F931BC514320BEEB57A067312E65FE0A73E724
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d................." .........................................................@............`........................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800011a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x800e63d0, 0x1, 0x800e5cf0, 0x1, 0x800e5d70, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fc4862845a8a8738f4c893f705252fe2

Entrypoint Preview

Instruction
jmp 00007F6038DC32BDh
adc dword ptr [eax], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1391e8	0x4b19	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13dd01	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x161000	0x6a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x159000	0x6984	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x162000	0x1bb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x153000	0x1c	.buildid
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1317a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13e780	0x8d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x139010	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x118df7	0x118e00	ebdcc4ed07a4ed034fbbd6128dc9448a	False	0.43936185747663553	data	6.402513762926191	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11a000	0x38328	0x38400	a1b76c60ba71fdf71df3264b4ee1bfcc	False	0.32470052083333334	data	6.22405255070616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.buildid	0x153000	0x7c	0x200	a20050ef740833989e097493e8ed1ee6	False	0.220703125	data	1.7541840484216018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x154000	0x4538	0x400	af394729e3ddf4c222b3a6529ec442ca	False	0.291015625	data	2.6274236756303253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x159000	0x6984	0x6a00	b72b1efee46977ba7561434bb2f02006	False	0.5407208136792453	PEX Binary Archive	5.977085832835681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x160000	0x28	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x161000	0x6a0	0x800	43c2a63ee1e6e6e440590188b9e58fd7	False	0.388671875	data	3.981181978625902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x162000	0x1bb0	0x1c00	6b4eadf51ab093ff8443b762e231cc01	False	0.37374441964285715	data	5.438881736459346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x161288	0x320	data	English	United States	0.48625
RT_MANIFEST	0x1615a8	0xf8	XML 1.0 document, ASCII text	English	United States	0.6975806451612904
RT_MANIFEST	0x1610d0	0x1b3	XML 1.0 document, ASCII text	English	United States	0.696551724137931

Imports

DLL	Import
CRYPT32.dll	CertCloseStore, CertFindCertificateInStore, CertFreeCertificateContext, CertGetNameStringW, CryptBinaryToStringW, CryptMsgClose, CryptMsgGetParam, CryptQueryObject
ntdll.dll	NtQueryVirtualMemory, RtlAllocateHeap, RtlCaptureContext, RtlCaptureStackBackTrace, RtlCompareMemory, RtlDuplicateUnicodeString, RtlFreeHeap, RtlFreeUnicodeString, RtlLookupFunctionEntry, RtlNtStatusToDosError, RtlReAllocateHeap, RtlRestoreContext, RtlSetLastWin32Error, RtlUnwindEx, RtlVirtualUnwind, VerSetConditionMask
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
WINTRUST.dll	WinVerifyTrust
dbghelp.dll	EnumerateLoadedModules64, SymFromAddr, SymGetLineFromAddr64, SymGetModuleInfo64, SymInitialize, SymLoadModule64, SymSetOptions
OLEAUT32.dll	SetOaNoCache
api-ms-win-crt-convert-l1-1-0.dll	_ltoa_s, _strtod_l, _strtoi64_l, _strtoui64, _strtoui64_l, mbrtowc, mbsrtowcs, strtod, strtol, strtoul, wcrtomb, wcrtomb_s, wcstod, wcstol, wcstoul
api-ms-win-crt-environment-l1-1-0.dll	__p__environ, __p__wenviron, getenv
api-ms-win-crt-math-l1-1-0.dll	_fdopen
api-ms-win-crt-private-l1-1-0.dll	memchr, memcmp, memcpy, memmove, strchr
api-ms-win-crt-runtime-l1-1-0.dll	__p___argc, __p___argv, __p___wargv, __sys_nerr, _assert, _beginthreadex, _configure_narrow_argv, _configure_wide_argv, _crt_at_quick_exit, _crt_atexit, _errno, _execute_onexit_table, _exit, _getpid, _initialize_narrow_environment, _initialize_onexit_table, _initialize_wide_environment, _initterm, _register_onexit_function, _register_thread_local_exe_atexit_callback, abort, exit, strerror_s
api-ms-win-crt-stdio-l1-1-0.dll	__acrt_iob_func, __stdio_common_vfprintf, __stdio_common_vfwprintf, __stdio_common_vsprintf, __stdio_common_vsscanf, __stdio_common_vswprintf, _close, _dup, _fileno, _open, _wfopen, _write, fclose, fflush, fopen, fputc, fputs, fread, fseek, ftell, fwrite
api-ms-win-crt-string-l1-1-0.dll	_isctype_l, _iswalpha_l, _iswcntrl_l, _iswdigit_l, _iswlower_l, _iswprint_l, _iswpunct_l, _iswspace_l, _iswupper_l, _iswxdigit_l, _strcoll_l, _stricmp, _strnicmp, _strxfrm_l, _tolower_l, _toupper_l, _towlower_l, _towupper_l, _wcscoll_l, _wcsupr_s, _wcsxfrm_l, islower, isspace, isupper, iswctype, isxdigit, mbrlen, memset, strcmp, strlen, strncmp, strncpy, tolower, wcscpy_s, wcslen, wcsncpy, wcsncpy_s
api-ms-win-crt-utility-l1-1-0.dll	rand_s
ADVAPI32.dll	CreateWellKnownSid, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, GetTokenInformation, InitializeSecurityDescriptor, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegGetValueW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, SetEntriesInAclW, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SystemFunction036
KERNEL32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, ActivateActCtx, AddRefActCtx, CloseHandle, CreateActCtxW, CreateFileA, CreateFileMappingW, CreateFileW, CreateThread, DeactivateActCtx, DeleteCriticalSection, DuplicateHandle, EncodePointer, EnterCriticalSection, FlsAlloc, FlsGetValue, FlsSetValue, FlushInstructionCache, FormatMessageA, FreeLibrary, GetCurrentProcess, GetCurrentThread, GetCurrentThreadId, GetEnvironmentVariableA, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetProcAddress, GetProcessTimes, GetSystemInfo, GetSystemTime, GetSystemTimeAdjustment, GetSystemTimeAsFileTime, GetThreadContext, GetThreadId, GetTickCount64, InitOnceExecuteOnce, InitializeConditionVariable, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSRWLock, IsDebuggerPresent, K32EnumProcessModules, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, LocalAlloc, LocalFree, MapViewOfFile, MultiByteToWideChar, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, QueryUnbiasedInterruptTime, RaiseException, ReleaseActCtx, ReleaseSRWLockExclusive, ReleaseSRWLockShared, ResumeThread, SearchPathW, SetEnvironmentVariableW, SetLastError, Sleep, SleepConditionVariableSRW, SuspendThread, SwitchToThread, SystemTimeToFileTime, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, TryEnterCriticalSection, UnmapViewOfFile, VerifyVersionInfoW, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte
api-ms-win-crt-locale-l1-1-0.dll	___lc_codepage_func, ___mb_cur_max_func, __pctype_func, _configthreadlocale, _create_locale, _free_locale, localeconv, setlocale
api-ms-win-crt-time-l1-1-0.dll	__daylight, __timezone, __tzname, _strftime_l, _tzset
api-ms-win-crt-multibyte-l1-1-0.dll	_mbtowc_l
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode

Exports

Name	Ordinal	Address
HeapAlloc	1	0x18000ba00
HeapFree	2	0x18000ba40
HeapReAlloc	3	0x18000ba20
MOZ_CrashPrintf	4	0x18008aa3c
MozDescribeCodeAddress	5	0x1800532b0
MozFormatCodeAddress	6	0x180053630
MozFormatCodeAddressDetails	7	0x1800535a0
MozStackWalk	8	0x180053070
MozWalkTheStack	9	0x180053780
MozWalkTheStackWithWriter	10	0x180053990
_Z18MozStackWalkThreadPFvjPvS_S_EjS_S_P8_CONTEXT	11	0x180052de0
_Z19mozalloc_handle_oomy	12	0x18000ba90
_Z21RegisterJitCodeRegionPhy	13	0x180052d30
_Z23DllBlocklist_Initializej	14	0x18000c1a0
_Z23DllBlocklist_WriteNotesRN13CrashReporter16AnnotationWriterE	15	0x18000ccb0
_Z23UnregisterJitCodeRegionPhy	16	0x180052d80
_Z24DllBlocklist_CheckStatusv	17	0x18000ccc0
_Z31DllBlocklist_SetFullDllServicesPN7mozilla4glue6detail15DllServicesBaseE	18	0x18000cce0
_Z32DllBlocklist_SetBasicDllServicesPN7mozilla4glue6detail15DllServicesBaseE	19	0x18000cd40
_ZN17double_conversion23DoubleToStringConverter13DoubleToAsciiEdNS0_8DtoaModeEiPciPbPiS4_	20	0x180092000
_ZN17double_conversion23DoubleToStringConverter19EcmaScriptConverterEv	21	0x180091780
_ZN24AutoSuppressStackWalkingC1Ev	22	0x180052d10
_ZN24AutoSuppressStackWalkingC2Ev	23	0x180052d10
_ZN24AutoSuppressStackWalkingD1Ev	24	0x180052d20
_ZN24AutoSuppressStackWalkingD2Ev	25	0x180052d20
_ZN5blink7Decimal10fromDoubleEd	26	0x180057b30
_ZN5blink7Decimal10fromStringERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEE	27	0x180057c00
_ZN5blink7Decimal13alignOperandsERKS0_S2_	28	0x180056fd0
_ZN5blink7Decimal3nanEv	29	0x180056fb0
_ZN5blink7Decimal4zeroENS0_4SignE	30	0x180057280
_ZN5blink7Decimal8infinityENS0_4SignE	31	0x180057260
_ZN5blink7DecimalC1ENS0_4SignEiy	32	0x1800563f0
_ZN5blink7DecimalC1ERKNS0_11EncodedDataE	33	0x1800564b0
_ZN5blink7DecimalC1ERKS0_	34	0x1800564c0
_ZN5blink7DecimalC1Ei	35	0x1800563c0
_ZN5blink7DecimalC2ENS0_4SignEiy	36	0x1800563f0
_ZN5blink7DecimalC2ERKNS0_11EncodedDataE	37	0x1800564b0
_ZN5blink7DecimalC2ERKS0_	38	0x1800564c0
_ZN5blink7DecimalC2Ei	39	0x1800563c0
_ZN5blink7DecimalaSERKS0_	40	0x1800564d0
_ZN5blink7DecimaldVERKS0_	41	0x180056c50
_ZN5blink7DecimalmIERKS0_	42	0x180056710
_ZN5blink7DecimalmLERKS0_	43	0x180056960
_ZN5blink7DecimalpLERKS0_	44	0x1800564e0
_ZN7mozilla11Compression26LZ4FrameCompressionContext14EndCompressingEv	45	0x18008af20
_ZN7mozilla11Compression26LZ4FrameCompressionContext16BeginCompressingENS_4SpanIcLy18446744073709551615EEE	46	0x18008ad30
_ZN7mozilla11Compression26LZ4FrameCompressionContext19ContinueCompressingENS_4SpanIKcLy18446744073709551615EEE	47	0x18008ae30
_ZN7mozilla11Compression26LZ4FrameCompressionContextC1Eiybb	48	0x18008ac50
_ZN7mozilla11Compression26LZ4FrameCompressionContextC2Eiybb	49	0x18008ac50
_ZN7mozilla11Compression26LZ4FrameCompressionContextD1Ev	50	0x18008ad20
_ZN7mozilla11Compression26LZ4FrameCompressionContextD2Ev	51	0x18008ad20
_ZN7mozilla11Compression28LZ4FrameDecompressionContext10DecompressENS_4SpanIcLy18446744073709551615EEENS2_IKcLy18446744073709551615EEE	52	0x18008b000
_ZN7mozilla11Compression28LZ4FrameDecompressionContextC1Eb	53	0x18008afb0
_ZN7mozilla11Compression28LZ4FrameDecompressionContextC2Eb	54	0x18008afb0
_ZN7mozilla11Compression28LZ4FrameDecompressionContextD1Ev	55	0x18008aff0
_ZN7mozilla11Compression28LZ4FrameDecompressionContextD2Ev	56	0x18008aff0
_ZN7mozilla11Compression3LZ410decompressEPKcyPcyPy	57	0x18008abe0
_ZN7mozilla11Compression3LZ417decompressPartialEPKcyPcyPy	58	0x18008ac10
_ZN7mozilla11Compression3LZ421compressLimitedOutputEPKcyPcy	59	0x18008abc0
_ZN7mozilla11Compression3LZ48compressEPKcyPc	60	0x18008ab80
_ZN7mozilla11sse_private11aes_enabledE	61	0x180156890
_ZN7mozilla11sse_private11avx_enabledE	62	0x180156891
_ZN7mozilla11sse_private12avx2_enabledE	63	0x180156892
_ZN7mozilla11sse_private12sse3_enabledE	64	0x180156893
_ZN7mozilla11sse_private13sse4a_enabledE	65	0x180156894
_ZN7mozilla11sse_private13ssse3_enabledE	66	0x180156895
_ZN7mozilla11sse_private14sse4_1_enabledE	67	0x180156896
_ZN7mozilla11sse_private14sse4_2_enabledE	68	0x180156897
_ZN7mozilla12MarkerSchema18FormatToStringSpanENS0_6FormatE	69	0x180022370
_ZN7mozilla12MarkerSchema20LocationToStringSpanENS0_8LocationE	70	0x180022310
_ZN7mozilla12PrintfTarget12appendIntDecEi	71	0x180050ef0
_ZN7mozilla12PrintfTarget12appendIntDecEj	72	0x1800510e0
_ZN7mozilla12PrintfTarget12appendIntDecEx	73	0x180051340
_ZN7mozilla12PrintfTarget12appendIntDecEy	74	0x180051560
_ZN7mozilla12PrintfTarget12appendIntHexEj	75	0x180051280
_ZN7mozilla12PrintfTarget12appendIntHexEy	76	0x180051720
_ZN7mozilla12PrintfTarget12appendIntOctEj	77	0x1800511c0
_ZN7mozilla12PrintfTarget12appendIntOctEy	78	0x180051650
_ZN7mozilla12PrintfTarget5printEPKcz	79	0x180052c90
_ZN7mozilla12PrintfTarget6vprintEPKcPc	80	0x180051b80
_ZN7mozilla12PrintfTargetC2Ev	81	0x180051b60
_ZN7mozilla12RandomUint64Ev	82	0x18008b240
_ZN7mozilla12baseprofiler13profiler_initEPv	83	0x180027370
_ZN7mozilla12baseprofiler13profiler_stopEv	84	0x18002c820
_ZN7mozilla12baseprofiler13profiler_timeEv	85	0x18002cbe0
_ZN7mozilla12baseprofiler14ProfilingStack18ensureCapacitySlowEv	86	0x1800234d6
_ZN7mozilla12baseprofiler14ProfilingStackD1Ev	87	0x180023490
_ZN7mozilla12baseprofiler14ProfilingStackD2Ev	88	0x180023490
_ZN7mozilla12baseprofiler14profiler_pauseEv	89	0x18002ca60
_ZN7mozilla12baseprofiler14profiler_startENS_10PowerOfTwoIjEEdjPPKcjRKNS_5MaybeIdEE	90	0x18002c3b0
_ZN7mozilla12baseprofiler15profiler_resumeEv	91	0x18002cce0
_ZN7mozilla12baseprofiler17AddMarkerToBufferINS0_7markers10TextMarkerEJNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEEEENS_23ProfileBufferBlockIndexERNS_20ProfileChunkedBufferERKNS_18ProfilerStringViewIcEERKNS_14MarkerCategoryEONS_13MarkerOptionsET_DpRKT0_	92	0x180022540
_ZN7mozilla12baseprofiler17AddMarkerToBufferINS0_7markers9NoPayloadEJEEENS_23ProfileBufferBlockIndexERNS_20ProfileChunkedBufferERKNS_18ProfilerStringViewIcEERKNS_14MarkerCategoryEONS_13MarkerOptionsET_DpRKT0_	93	0x180022650
_ZN7mozilla12baseprofiler17AutoProfilerLabel17GetProfilingStackEv	94	0x180023a80
_ZN7mozilla12baseprofiler17UniqueJSONStrings13GetOrAddIndexERKNS_4SpanIKcLy18446744073709551615EEE	95	0x18001f1d0
_ZN7mozilla12baseprofiler17UniqueJSONStrings25SpliceStringTableElementsERNS0_20SpliceableJSONWriterE	96	0x18001f1b0
_ZN7mozilla12baseprofiler17UniqueJSONStringsC1ENS_10JSONWriter15CollectionStyleE	97	0x18001eb20
_ZN7mozilla12baseprofiler17UniqueJSONStringsC1ERKS1_NS_10JSONWriter15CollectionStyleE	98	0x18001ec00
_ZN7mozilla12baseprofiler17UniqueJSONStringsC2ENS_10JSONWriter15CollectionStyleE	99	0x18001eb20
_ZN7mozilla12baseprofiler17UniqueJSONStringsC2ERKS1_NS_10JSONWriter15CollectionStyleE	100	0x18001ec00
_ZN7mozilla12baseprofiler17UniqueJSONStringsD1Ev	101	0x18001f150
_ZN7mozilla12baseprofiler17UniqueJSONStringsD2Ev	102	0x18001f150
_ZN7mozilla12baseprofiler17profiler_shutdownEv	103	0x180029cb0
_ZN7mozilla12baseprofiler18profiler_is_pausedEv	104	0x18002c9d0
_ZN7mozilla12baseprofiler20profiler_get_profileEdbb	105	0x18002a9b0
_ZN7mozilla12baseprofiler20profiler_thread_wakeEv	106	0x18002eb50
_ZN7mozilla12baseprofiler21profiler_thread_sleepEv	107	0x18002eaf0
_ZN7mozilla12baseprofiler22profiler_add_js_markerEPKcS2_	108	0x18002f0c0
_ZN7mozilla12baseprofiler22profiler_get_backtraceEv	109	0x18002ef20
_ZN7mozilla12baseprofiler22profiler_register_pageEyyRKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEy	110	0x18002e1a0
_ZN7mozilla12baseprofiler22scProfilerMainThreadIdE	111	0x1801568d8
_ZN7mozilla12baseprofiler23profiler_ensure_startedENS_10PowerOfTwoIjEEdjPPKcjRKNS_5MaybeIdEE	112	0x18002c570
_ZN7mozilla12baseprofiler23profiler_feature_activeEj	113	0x18002d210
_ZN7mozilla12baseprofiler23profiler_pause_samplingEv	114	0x18002cf00
_ZN7mozilla12baseprofiler24profiler_get_buffer_infoEv	115	0x18002c2c0
_ZN7mozilla12baseprofiler24profiler_get_core_bufferEv	116	0x1800239a0
_ZN7mozilla12baseprofiler24profiler_register_threadEPKcPv	117	0x18002d540
_ZN7mozilla12baseprofiler24profiler_resume_samplingEv	118	0x18002d080
_ZN7mozilla12baseprofiler24profiler_unregister_pageEy	119	0x18002e6e0
_ZN7mozilla12baseprofiler25profiler_get_start_paramsEPiPNS_5MaybeIdEEPdPjPNS_6VectorIPKcLy0ENS_17MallocAllocPolicyEEE	120	0x18002b480
_ZN7mozilla12baseprofiler25profiler_set_process_nameERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEPS8_	121	0x18002a860
_ZN7mozilla12baseprofiler26profiler_capture_backtraceEv	122	0x18002eca0
_ZN7mozilla12baseprofiler26profiler_current_thread_idEv	123	0x180024310
_ZN7mozilla12baseprofiler26profiler_unregister_threadEv	124	0x18002da30
_ZN7mozilla12baseprofiler27ProfilerBacktraceDestructorclEPNS0_17ProfilerBacktraceE	125	0x18002f000
_ZN7mozilla12baseprofiler27profiler_current_process_idEv	126	0x180021000
_ZN7mozilla12baseprofiler27profiler_is_sampling_pausedEv	127	0x18002ce70
_ZN7mozilla12baseprofiler27profiler_thread_is_sleepingEv	128	0x18002ec10
_ZN7mozilla12baseprofiler28GetProfilingCategoryPairInfoENS0_21ProfilingCategoryPairE	129	0x18001e280
_ZN7mozilla12baseprofiler28InitializeWin64ProfilerHooksEv	130	0x180026d00
_ZN7mozilla12baseprofiler28profiler_add_sampled_counterEPNS0_17BaseProfilerCountE	131	0x18002d260
_ZN7mozilla12baseprofiler29profiler_save_profile_to_fileEPKc	132	0x18002c120
_ZN7mozilla12baseprofiler31profiler_capture_backtrace_intoERNS_20ProfileChunkedBufferENS_19StackCaptureOptionsE	133	0x180022b10
_ZN7mozilla12baseprofiler31profiler_get_available_featuresEv	134	0x18002c280
_ZN7mozilla12baseprofiler31profiler_remove_sampled_counterEPNS0_17BaseProfilerCountE	135	0x18002d3b0
_ZN7mozilla12baseprofiler33GetProfilerEnvVarsForChildProcessEONSt3__18functionIFvPKcS4_EEE	136	0x18002b670
_ZN7mozilla12baseprofiler34profiler_suspend_and_sample_threadEijRNS0_22ProfilerStackCollectorEb	137	0x18002f350
_ZN7mozilla12baseprofiler37profiler_stream_json_for_this_processERNS0_20SpliceableJSONWriterEdbb	138	0x180024180
_ZN7mozilla12baseprofiler6detail12RacyFeatures11SetInactiveEv	139	0x1800239c0
_ZN7mozilla12baseprofiler6detail12RacyFeatures11SetUnpausedEv	140	0x1800239f0
_ZN7mozilla12baseprofiler6detail12RacyFeatures17SetSamplingPausedEv	141	0x180023a00
_ZN7mozilla12baseprofiler6detail12RacyFeatures19IsActiveAndUnpausedEv	142	0x180023a40
_ZN7mozilla12baseprofiler6detail12RacyFeatures19IsActiveWithFeatureEj	143	0x180023a20
_ZN7mozilla12baseprofiler6detail12RacyFeatures19SetSamplingUnpausedEv	144	0x180023a10
_ZN7mozilla12baseprofiler6detail12RacyFeatures27IsActiveAndSamplingUnpausedEv	145	0x180023a60
_ZN7mozilla12baseprofiler6detail12RacyFeatures8IsActiveEv	146	0x1800239d0
_ZN7mozilla12baseprofiler6detail12RacyFeatures9SetActiveEj	147	0x1800239b0
_ZN7mozilla12baseprofiler6detail12RacyFeatures9SetPausedEv	148	0x1800239e0
_ZN7mozilla12baseprofiler6detail21IsThreadBeingProfiledEv	149	0x18002ebb0
_ZN7mozilla12baseprofiler9AddMarkerINS0_7markers10TextMarkerEJNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEEEENS_23ProfileBufferBlockIndexERKNS_18ProfilerStringViewIcEERKNS_14MarkerCategoryEONS_13MarkerOptionsET_DpRKT0_	150	0x1800223d0
_ZN7mozilla14AwakeTimeStamp8NowLoResEv	151	0x180048670
_ZN7mozilla14AwakeTimeStampmIERKNS_17AwakeTimeDurationE	152	0x180048660
_ZN7mozilla14AwakeTimeStamppLERKNS_17AwakeTimeDurationE	153	0x180048650
_ZN7mozilla14TimeStampValueC1Eyybb	154	0x180053f60
_ZN7mozilla14TimeStampValueC2Eyybb	155	0x180053f60
_ZN7mozilla14TimeStampValuemIEx	156	0x180053fa0
_ZN7mozilla14TimeStampValuepLEx	157	0x180053f80
_ZN7mozilla15CacheNtDllThunkEv	158	0x180013fc0
_ZN7mozilla15ProcessUptimeMsEv	159	0x180054cd0
_ZN7mozilla16InitializeUptimeEv	160	0x180054a80
_ZN7mozilla16IsEafPlusEnabledEv	161	0x180055880
_ZN7mozilla17AwakeTimeDurationC1Ev	162	0x180048500
_ZN7mozilla17AwakeTimeDurationC2Ev	163	0x1800484f0
_ZN7mozilla17AwakeTimeDurationmIERKS0_	164	0x180048540
_ZN7mozilla17AwakeTimeDurationpLERKS0_	165	0x180048510
_ZN7mozilla17RandomUint64OrDieEv	166	0x18008b2b0
_ZN7mozilla18IsWin32kLockedDownEv	167	0x1800556a0
_ZN7mozilla19GetCachedNtDllThunkEv	168	0x1800145b0
_ZN7mozilla19MapRemoteViewOfFileEPvS0_yS0_ymm	169	0x180055130
_ZN7mozilla21CleanupProcessRuntimeEv	170	0x18004eca0
_ZN7mozilla21FramePointerStackWalkEPFvjPvS0_S0_EjS0_PS0_S0_	171	0x180053520
_ZN7mozilla21IsDynamicCodeDisabledEv	172	0x180055790
_ZN7mozilla21UnmapRemoteViewOfFileEPvS0_	173	0x180055360
_ZN7mozilla22IsFloat32RepresentableEd	174	0x18008b0e0
_ZN7mozilla24WindowsDpiInitializationEv	175	0x180054e80
_ZN7mozilla26GetPreXULSkeletonUIEnabledEv	176	0x18004f4b0
_ZN7mozilla26PollPreXULSkeletonUIEventsEv	177	0x18004fc00
_ZN7mozilla26SetPreXULSkeletonUIThemeIdENS_9ThemeModeE	178	0x18004f9e0
_ZN7mozilla27GetPreXULSkeletonUIWasShownEv	179	0x18004ed00
_ZN7mozilla28WasPreXULSkeletonUIMaximizedEv	180	0x18004ecf0
_ZN7mozilla28base_profiler_markers_detail9Streaming18DeserializerForTagEh	181	0x180021780
_ZN7mozilla28base_profiler_markers_detail9Streaming24MarkerTypeFunctionsArrayEv	182	0x1800217d0
_ZN7mozilla28base_profiler_markers_detail9Streaming25TagForMarkerTypeFunctionsEPFvRNS_24ProfileBufferEntryReaderERNS_12baseprofiler20SpliceableJSONWriterEEPFNS_4SpanIKcLy18446744073709551615EEEvEPFNS_12MarkerSchemaEvE	183	0x1800216a0
_ZN7mozilla29BaseTimeDurationPlatformUtils17ResolutionInTicksEv	184	0x180054200
_ZN7mozilla29BaseTimeDurationPlatformUtils18ToSecondsSigDigitsEx	185	0x180054140
_ZN7mozilla29BaseTimeDurationPlatformUtils21TicksFromMillisecondsEd	186	0x1800541a0
_ZN7mozilla29BaseTimeDurationPlatformUtils9ToSecondsEx	187	0x180054100
_ZN7mozilla29ConsumePreXULSkeletonUIHandleEv	188	0x18004ed10
_ZN7mozilla29PersistPreXULSkeletonUIValuesERKNS_18SkeletonUISettingsE	189	0x18004edd0
_ZN7mozilla30CreateAndStorePreXULSkeletonUIEP11HINSTANCE__iPPc	190	0x18004cd90
_ZN7mozilla30GetPreXULSkeletonUIErrorReasonEv	191	0x18004edc0
_ZN7mozilla30NotePreXULSkeletonUIRestartingEv	192	0x18004fc80
_ZN7mozilla30RegisterProfilerLabelEnterExitEPFPvPKcS2_S0_EPFvS0_E	193	0x1800482a0
_ZN7mozilla31ProcessUptimeExcludingSuspendMsEv	194	0x180054d70
_ZN7mozilla34GetQueryPerformanceFrequencyPerSecEv	195	0x180053f50
_ZN7mozilla35SetPreXULSkeletonUIEnabledIfAllowedEb	196	0x18004f4c0
_ZN7mozilla5mscom14ActCtxResource24GetAccessibilityResourceEv	197	0x1800592c0
_ZN7mozilla5mscom6detail21EndProcessRuntimeInitEv	198	0x1800593c0
_ZN7mozilla5mscom6detail23BeginProcessRuntimeInitEv	199	0x1800593a0
_ZN7mozilla6UnusedE	200	0x180123220
_ZN7mozilla6detail11IsValidUtf8EPKvy	201	0x18008c500
_ZN7mozilla6detail14gChaosFeaturesE	202	0x180158178
_ZN7mozilla6detail15gTwoCharEscapesE	203	0x1801230e0
_ZN7mozilla6detail17FileHandleDeleterclENS0_16FileHandleHelperE	204	0x18008c4e0
_ZN7mozilla6detail17gChaosModeCounterE	205	0x18015817c
_ZN7mozilla6detail21ConditionVariableImpl10notify_allEv	206	0x1800486f0
_ZN7mozilla6detail21ConditionVariableImpl10notify_oneEv	207	0x1800486e0
_ZN7mozilla6detail21ConditionVariableImpl4waitERNS0_9MutexImplE	208	0x180048700
_ZN7mozilla6detail21ConditionVariableImpl8wait_forERNS0_9MutexImplERKNS_16BaseTimeDurationINS_27TimeDurationValueCalculatorEEE	209	0x180048760
_ZN7mozilla6detail21ConditionVariableImplC1Ev	210	0x1800486d0
_ZN7mozilla6detail21ConditionVariableImplC2Ev	211	0x1800486d0
_ZN7mozilla6detail21ConditionVariableImplD1Ev	212	0x180048890
_ZN7mozilla6detail21ConditionVariableImplD2Ev	213	0x180048890
_ZN7mozilla6detail9MutexImpl4lockEv	214	0x180048980
_ZN7mozilla6detail9MutexImpl6unlockEv	215	0x1800489d0
_ZN7mozilla6detail9MutexImpl7tryLockEv	216	0x180048990
_ZN7mozilla6detail9MutexImplC1Ev	217	0x180048950
_ZN7mozilla6detail9MutexImplC2Ev	218	0x180048950
_ZN7mozilla6detail9MutexImplD1Ev	219	0x180048970
_ZN7mozilla6detail9MutexImplD2Ev	220	0x180048970
_ZN7mozilla6xgetbvEj	221	0x1800013f0
_ZN7mozilla7SHA1Sum6finishERA20_h	222	0x18008c430
_ZN7mozilla7SHA1Sum6updateEPKvj	223	0x18008b350
_ZN7mozilla7SHA1SumC1Ev	224	0x18008b320
_ZN7mozilla7SHA1SumC2Ev	225	0x18008b320
_ZN7mozilla9HashBytesEPKvy	226	0x18008b130
_ZN7mozilla9TimeStamp11NowUnfuzzedEb	227	0x180054870
_ZN7mozilla9TimeStamp12NowFuzzyTimeEv	228	0x180053e70
_ZN7mozilla9TimeStamp15ProcessCreationEPb	229	0x180053b70
_ZN7mozilla9TimeStamp15UpdateFuzzyTimeEx	230	0x180053e80
_ZN7mozilla9TimeStamp18GetFuzzyfoxEnabledEv	231	0x180053b40
_ZN7mozilla9TimeStamp18SetFuzzyfoxEnabledEb	232	0x180053b50
_ZN7mozilla9TimeStamp20ComputeProcessUptimeEv	233	0x180054940
_ZN7mozilla9TimeStamp20RecordProcessRestartEv	234	0x180053d80
_ZN7mozilla9TimeStamp20UpdateFuzzyTimeStampES0_	235	0x180053e50
_ZN7mozilla9TimeStamp3NowEb	236	0x180054790
_ZN7mozilla9TimeStamp7StartupEv	237	0x180054210
_ZN7mozilla9TimeStamp8NowFuzzyENS_14TimeStampValueE	238	0x180053da0
_ZN7mozilla9TimeStamp8ShutdownEv	239	0x1800546c0
_ZNK17double_conversion23DoubleToStringConverter11ToPrecisionEdiPNS_13StringBuilderE	240	0x180092720
_ZNK17double_conversion23DoubleToStringConverter13ToExponentialEdiPNS_13StringBuilderE	241	0x180092420
_ZNK17double_conversion23DoubleToStringConverter19HandleSpecialValuesEdPNS_13StringBuilderE	242	0x180091800
_ZNK17double_conversion23DoubleToStringConverter20ToShortestIeeeNumberEdPNS_13StringBuilderENS0_8DtoaModeE	243	0x180091ea0
_ZNK17double_conversion23DoubleToStringConverter27CreateDecimalRepresentationEPKciiiPNS_13StringBuilderE	244	0x180091b20
_ZNK17double_conversion23DoubleToStringConverter31CreateExponentialRepresentationEPKciiPNS_13StringBuilderE	245	0x1800918b0
_ZNK17double_conversion23DoubleToStringConverter7ToFixedEdiPNS_13StringBuilderE	246	0x180092220
_ZNK5blink7Decimal3absEv	247	0x180057710
_ZNK5blink7Decimal4ceilEv	248	0x180057730
_ZNK5blink7Decimal5floorEv	249	0x180057940
_ZNK5blink7Decimal5roundEv	250	0x180058190
_ZNK5blink7Decimal8toDoubleEv	251	0x1800582e0
_ZNK5blink7Decimal8toStringEPcy	252	0x180058950
_ZNK5blink7Decimal8toStringEv	253	0x180058450
_ZNK5blink7Decimal9compareToERKS0_	254	0x180057330
_ZNK5blink7Decimal9remainderERKS0_	255	0x1800580d0
_ZNK5blink7DecimaldvERKS0_	256	0x180056cb0
_ZNK5blink7DecimaleqERKS0_	257	0x1800572a0
_ZNK5blink7DecimalgeERKS0_	258	0x180057660
_ZNK5blink7DecimalgtERKS0_	259	0x1800575e0
_ZNK5blink7DecimalleERKS0_	260	0x180057530
_ZNK5blink7DecimalltERKS0_	261	0x1800574b0
_ZNK5blink7DecimalmiERKS0_	262	0x180056770
_ZNK5blink7DecimalmlERKS0_	263	0x1800569c0
_ZNK5blink7DecimalneERKS0_	264	0x180057400
_ZNK5blink7DecimalngEv	265	0x180056f70
_ZNK5blink7DecimalplERKS0_	266	0x180056540
_ZNK7mozilla12baseprofiler10ThreadInfo6AddRefEv	267	0x18001f530
_ZNK7mozilla12baseprofiler10ThreadInfo7ReleaseEv	268	0x18001f540
_ZNK7mozilla12baseprofiler15PageInformation6AddRefEv	269	0x18001bf60
_ZNK7mozilla12baseprofiler15PageInformation7ReleaseEv	270	0x18001bf70
_ZNK7mozilla14AwakeTimeStampeqERKS0_	271	0x1800484d0
_ZNK7mozilla14AwakeTimeStampgeERKS0_	272	0x1800484b0
_ZNK7mozilla14AwakeTimeStampgtERKS0_	273	0x1800484c0
_ZNK7mozilla14AwakeTimeStampleERKS0_	274	0x1800484a0
_ZNK7mozilla14AwakeTimeStampltERKS0_	275	0x180048490
_ZNK7mozilla14AwakeTimeStampmiERKS0_	276	0x180048630
_ZNK7mozilla14AwakeTimeStampneERKS0_	277	0x1800484e0
_ZNK7mozilla14AwakeTimeStampplERKNS_17AwakeTimeDurationE	278	0x180048640
_ZNK7mozilla14TimeStampValue8CheckQPCERKS0_	279	0x180053fc0
_ZNK7mozilla14TimeStampValuemiERKS0_	280	0x1800540e0
_ZNK7mozilla17AwakeTimeDuration14ToMicrosecondsEv	281	0x180048610
_ZNK7mozilla17AwakeTimeDuration14ToMillisecondsEv	282	0x1800485e0
_ZNK7mozilla17AwakeTimeDuration9ToSecondsEv	283	0x1800485b0
_ZNK7mozilla17AwakeTimeDurationeqERKS0_	284	0x180048590
_ZNK7mozilla17AwakeTimeDurationgeERKS0_	285	0x180048570
_ZNK7mozilla17AwakeTimeDurationgtERKS0_	286	0x180048580
_ZNK7mozilla17AwakeTimeDurationleERKS0_	287	0x180048560
_ZNK7mozilla17AwakeTimeDurationltERKS0_	288	0x180048550
_ZNK7mozilla17AwakeTimeDurationmiERKS0_	289	0x180048530
_ZNK7mozilla17AwakeTimeDurationneERKS0_	290	0x1800485a0
_ZNK7mozilla17AwakeTimeDurationplERKS0_	291	0x180048520
_ZNO7mozilla12MarkerSchema6StreamERNS_10JSONWriterERKNS_4SpanIKcLy18446744073709551615EEE	292	0x1800217f0
_aligned_free	293	0x1800045a0
_aligned_malloc	294	0x180005d50
_expand	295	0x180005a40
_msize	296	0x180005af0
_recalloc	297	0x180005900
_strdup	298	0x180005c50
_wcsdup	299	0x180005cd0
calloc	300	0x180004500
free	301	0x1800045a0
gMozCrashReason	302	0x180158500
gMozillaPoisonBase	303	0x180158508
gMozillaPoisonSize	304	0x180158510
gMozillaPoisonValue	305	0x180158518
gOOMAllocationSize	306	0x180158520
jemalloc_free_dirty_pages	307	0x1800050e0
jemalloc_ptr_info	308	0x1800052a0
jemalloc_purge_freed_pages	309	0x1800050d0
jemalloc_stats_internal	310	0x180004b30
jemalloc_thread_local_arena	311	0x180005250
malloc	312	0x1800044b0
malloc_good_size	313	0x180004aa0
malloc_usable_size	314	0x1800049c0
moz_arena_calloc	315	0x180005490
moz_arena_free	316	0x180005670
moz_arena_malloc	317	0x1800053b0
moz_arena_memalign	318	0x1800057c0
moz_arena_realloc	319	0x180005580
moz_create_arena_with_params	320	0x1800052b0
moz_dispose_arena	321	0x1800052e0
moz_malloc_enclosing_size_of	322	0x18000bcb0
moz_malloc_size_of	323	0x18000bca0
moz_malloc_usable_size	324	0x18000bc90
moz_xcalloc	325	0x18000bb10
moz_xmalloc	326	0x18000ba60
moz_xmemalign	327	0x18000bc50
moz_xmemdup	328	0x18000bc00
moz_xrealloc	329	0x18000bb50
moz_xstrdup	330	0x18000bb80
mozalloc_abort	331	0x18000b9a0
posix_memalign	332	0x1800046d0
realloc	333	0x180004550
strdup	334	0x180005c50
strndup	335	0x180005bd0
wcsdup	336	0x180005cd0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	01:27:54
Start date:	28/05/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\mozglue.dll.dll"
Imagebase:	0x7ff743eb0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:27:54
Start date:	28/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:27:55
Start date:	28/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1
Imagebase:	0x7ff7699e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:27:55
Start date:	28/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapAlloc
Imagebase:	0x7ff605d10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:27:55
Start date:	28/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\mozglue.dll.dll",#1
Imagebase:	0x7ff605d10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:27:55
Start date:	28/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7176 -s 296
Imagebase:	0x7ff7b0d10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:27:55
Start date:	28/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7192 -s 292
Imagebase:	0x7ff7b0d10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:27:58
Start date:	28/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapFree
Imagebase:	0x7ff605d10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:27:58
Start date:	28/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7468 -s 284
Imagebase:	0x7ff7b0d10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:28:01
Start date:	28/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\mozglue.dll.dll,HeapReAlloc
Imagebase:	0x7ff605d10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:28:01
Start date:	28/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7668 -s 236
Imagebase:	0x7ff7b0d10000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFDFF1B2EF0 Relevance: 135.6, APIs: 63, Strings: 14, Instructions: 843libraryencryptionloaderCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32 ref: 00007FFDFF1B2F87
WinVerifyTrust.WINTRUST ref: 00007FFDFF1B306F
WinVerifyTrust.WINTRUST ref: 00007FFDFF1B308E
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B30E0
VerSetConditionMask.NTDLL ref: 00007FFDFF1B311E
VerSetConditionMask.NTDLL ref: 00007FFDFF1B312B
VerSetConditionMask.NTDLL ref: 00007FFDFF1B3138
VerSetConditionMask.NTDLL ref: 00007FFDFF1B3145
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1B3157
CreateFileW.KERNEL32 ref: 00007FFDFF1B326E
GetLastError.KERNEL32 ref: 00007FFDFF1B32D8
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B3301
GetLastError.KERNEL32 ref: 00007FFDFF1B33A0
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B33C9
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B34BA
CryptQueryObject.CRYPT32 ref: 00007FFDFF1B353D
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B3592
CryptBinaryToStringW.CRYPT32 ref: 00007FFDFF1B35B4
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B35DE
WinVerifyTrust.WINTRUST ref: 00007FFDFF1B38EB
WinVerifyTrust.WINTRUST ref: 00007FFDFF1B390F
CloseHandle.KERNEL32 ref: 00007FFDFF1B3992
CryptMsgGetParam.CRYPT32 ref: 00007FFDFF1B39CE
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B39FA
CryptMsgGetParam.CRYPT32 ref: 00007FFDFF1B3A12
CertFindCertificateInStore.CRYPT32 ref: 00007FFDFF1B3A3B
CertGetNameStringW.CRYPT32 ref: 00007FFDFF1B3A85
CryptMsgClose.CRYPT32 ref: 00007FFDFF1B3AA3
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B3ACB
CertGetNameStringW.CRYPT32 ref: 00007FFDFF1B3AE7
CertFreeCertificateContext.CRYPT32 ref: 00007FFDFF1B3B16
CryptMsgClose.CRYPT32 ref: 00007FFDFF1B3B24
CertCloseStore.CRYPT32 ref: 00007FFDFF1B3B34
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3BA0
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3BC7
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3BE0
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3C1D
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3C44
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3C5D
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3C9D
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3CC4
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3CDD
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3D1D
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3D44
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3D5D
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3D9A
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3DC1
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3DDA
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3E22
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3E49
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3E62
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3EA2
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3EC9
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3EE2
LoadLibraryW.KERNEL32 ref: 00007FFDFF1B3F33
GetProcAddress.KERNEL32 ref: 00007FFDFF1B3F5A
FreeLibrary.KERNEL32 ref: 00007FFDFF1B3F73

Strings

CryptCATAdminAcquireContext, xrefs: 00007FFDFF1B3C3A
SHA256, xrefs: 00007FFDFF1B31C2
CryptCATAdminEnumCatalogFromHash, xrefs: 00007FFDFF1B3DB7
CryptCATAdminAcquireContext2, xrefs: 00007FFDFF1B3BBD
CryptCATAdminReleaseCatalogContext, xrefs: 00007FFDFF1B3EBF
P, xrefs: 00007FFDFF1B387A
CryptCATAdminCalcHashFromFileHandle2, xrefs: 00007FFDFF1B3CBA
wintrust.dll, xrefs: 00007FFDFF1B3B99, 00007FFDFF1B3C16, 00007FFDFF1B3C96, 00007FFDFF1B3D16, 00007FFDFF1B3D93, 00007FFDFF1B3E1B, 00007FFDFF1B3E9B, 00007FFDFF1B3F2C
H, xrefs: 00007FFDFF1B372F
CryptCATCatalogInfoFromContext, xrefs: 00007FFDFF1B3F50
P, xrefs: 00007FFDFF1B3003
CryptCATAdminCalcHashFromFileHandle, xrefs: 00007FFDFF1B3E3F
CryptCATAdminReleaseContext, xrefs: 00007FFDFF1B3D3A
1.3.6.1.4.1.311.72.1.1, xrefs: 00007FFDFF1B31AB

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Library$Free$AddressLoadProc$Cryptmemset$CertVerify$CloseConditionMaskTrust$String$CertificateErrorLastNameObjectParamQueryStore$BinaryContextCreateFileFindHandleInfoVersion_wcsupr_s
String ID: 1.3.6.1.4.1.311.72.1.1$CryptCATAdminAcquireContext$CryptCATAdminAcquireContext2$CryptCATAdminCalcHashFromFileHandle$CryptCATAdminCalcHashFromFileHandle2$CryptCATAdminEnumCatalogFromHash$CryptCATAdminReleaseCatalogContext$CryptCATAdminReleaseContext$CryptCATCatalogInfoFromContext$H$P$P$SHA256$wintrust.dll
API String ID: 3240079018-1367845056
Opcode ID: 2e0015e5ce21cc173d87d4281814c1a274f5ebee5147c83a4e44dbf2cac98609
Instruction ID: 54533dc383940ca295e5a3622f21c3bcc7d43d5552df3b189fde83e9890bbe8b
Opcode Fuzzy Hash: 2e0015e5ce21cc173d87d4281814c1a274f5ebee5147c83a4e44dbf2cac98609
Instruction Fuzzy Hash: 59924D21B19A82C5FB608B11A864BAA67A4FF84B94F444235DEBDD77E8DF3CE045C700

Function 00007FFDFF1ABE80 Relevance: 132.1, APIs: 63, Strings: 12, Instructions: 842stringlibraryloaderCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1ABEAC
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1ABEED
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1ABF13
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1ABF33
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1ABF6A
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1ABFA9
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1ABFCD
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1ABFFF
_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFF1AC025
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC02B
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC04F
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC07E
_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFF1AC09B
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC0A4
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC0C8
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC0F7
_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFF1AC116
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC11C
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC140

Part of subcall function 00007FFDFF1B5540: GetModuleHandleW.KERNEL32 ref: 00007FFDFF1B554E
Part of subcall function 00007FFDFF1B5540: GetProcAddress.KERNEL32 ref: 00007FFDFF1B555E

LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1AC15F
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC21D
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC255
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC262
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC26F
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC27C
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AC28B
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC2EA
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC317
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC324
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC331
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC33E
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC34B
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AC35A
LoadLibraryW.KERNEL32 ref: 00007FFDFF1AC3B4
InitOnceExecuteOnce.KERNEL32 ref: 00007FFDFF1AC417
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AC429
GetProcAddress.KERNEL32 ref: 00007FFDFF1AC439
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AC46F
LoadLibraryW.KERNEL32 ref: 00007FFDFF1AC4A4
InitializeCriticalSection.KERNEL32 ref: 00007FFDFF1AC4B8
InitOnceExecuteOnce.KERNEL32 ref: 00007FFDFF1AC533
LoadLibraryW.KERNEL32 ref: 00007FFDFF1AC565
LoadLibraryW.KERNEL32 ref: 00007FFDFF1AC59C
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AC5B0
InitOnceExecuteOnce.KERNEL32 ref: 00007FFDFF1AC611
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC7F1
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1AC811
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFF1AC840
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC879
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC8D3
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AC9B1
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC9EF
VerSetConditionMask.NTDLL ref: 00007FFDFF1AC9FC
VerSetConditionMask.NTDLL ref: 00007FFDFF1ACA09
VerSetConditionMask.NTDLL ref: 00007FFDFF1ACA16
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1ACA28
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1ACA7C
VerSetConditionMask.NTDLL ref: 00007FFDFF1ACABA
VerSetConditionMask.NTDLL ref: 00007FFDFF1ACAC7
VerSetConditionMask.NTDLL ref: 00007FFDFF1ACAD4
VerSetConditionMask.NTDLL ref: 00007FFDFF1ACAE1
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1ACAF3
VirtualQuery.KERNEL32 ref: 00007FFDFF1ACC74

Strings

LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 00007FFDFF1ACBC0
NativeNtBlockSet_Write, xrefs: 00007FFDFF1AC42F
user32.dll, xrefs: 00007FFDFF1AC468, 00007FFDFF1AC55E
BaseThreadInitThunk, xrefs: 00007FFDFF1AC5DC
LdrLoadDll, xrefs: 00007FFDFF1AC4FE
accelerator.dll, xrefs: 00007FFDFF1AC8AC
LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 00007FFDFF1AC8F6
98, xrefs: 00007FFDFF1AC2FE
l, xrefs: 00007FFDFF1AC48D
WRusr.dll, xrefs: 00007FFDFF1AC5A9
,.;, xrefs: 00007FFDFF1ABF60
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 00007FFDFF1ACB1C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ConditionMask$memcpy$Once$strlen$HandleInfoLibraryLoadModuleVerifyVersionmemset$CriticalExecuteInitSection_ltoa_s$AddressProcstrchr$EnterInitializeLeaveQueryVirtual_strtoui64isxdigitstrcmp
String ID: ,.;$98$BaseThreadInitThunk$LdrLoadDll$LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$NativeNtBlockSet_Write$WRusr.dll$accelerator.dll$l$user32.dll
API String ID: 1697571058-2706458132
Opcode ID: 2b50f8c3052a163ff06bf101a88f20492908477f8b7ba343f3ccf8c159566f4b
Instruction ID: 7e57e4080ff92a6f8ceaa7c6ad61d40b7cf2beaedfcb411585b4ac1a611900e5
Opcode Fuzzy Hash: 2b50f8c3052a163ff06bf101a88f20492908477f8b7ba343f3ccf8c159566f4b
Instruction Fuzzy Hash: DC728D22F18A8685EB109B11E864BBA67A1FF84794F440236DE7D8B7D9EF3CE445C700

Function 00007FFDFF1F30A0 Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 336stringwindowCOMMON

Download Yara Rule

APIs

SymGetModuleInfo64.DBGHELP ref: 00007FFDFF1F30E3
EnumerateLoadedModules64.DBGHELP ref: 00007FFDFF1F3105
SymGetModuleInfo64.DBGHELP ref: 00007FFDFF1F311A
SymGetLineFromAddr64.DBGHELP ref: 00007FFDFF1F3143
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F31D5
SymLoadModule64.DBGHELP ref: 00007FFDFF1F31EF
GetLastError.KERNEL32 ref: 00007FFDFF1F31FE
FormatMessageA.KERNEL32 ref: 00007FFDFF1F322F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F3241
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F3271
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F3276
LocalFree.KERNEL32 ref: 00007FFDFF1F3280
InitializeCriticalSection.KERNEL32 ref: 00007FFDFF1F3321
SymSetOptions.DBGHELP ref: 00007FFDFF1F3333
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F3339
SymInitialize.DBGHELP ref: 00007FFDFF1F334A
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F3361
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1F3371
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F33A4
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F33D9
SymFromAddr.DBGHELP ref: 00007FFDFF1F3412
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F3431
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1F3450
GetLastError.KERNEL32 ref: 00007FFDFF1F347F
FormatMessageA.KERNEL32 ref: 00007FFDFF1F34B2
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F34C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F34F4
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F34F9
LocalFree.KERNEL32 ref: 00007FFDFF1F3503

Strings

(null), xrefs: 00007FFDFF1F324B, 00007FFDFF1F34CE
SymLoadModule64, xrefs: 00007FFDFF1F325D
### ERROR: %s: %s, xrefs: 00007FFDFF1F3256, 00007FFDFF1F34D9
SymInitialize, xrefs: 00007FFDFF1F34E0
X, xrefs: 00007FFDFF1F33EF

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_func$CriticalCurrentProcessSectionstrncpy$ErrorFormatFreeFromInfo64InitializeLastLocalMessageModulefflush$AddrAddr64EnterEnumerateLeaveLineLoadLoadedModule64Modules64Options
String ID: ### ERROR: %s: %s$(null)$SymInitialize$SymLoadModule64$X
API String ID: 2604148449-1442368888
Opcode ID: 23bc9df46cd68bbab1c71562468f73e4832d71084128e528704a7a64aab76183
Instruction ID: cc4853fded2b5a0c6f17072051a80ce9d904649dfab6c719df609ba973703ef9
Opcode Fuzzy Hash: 23bc9df46cd68bbab1c71562468f73e4832d71084128e528704a7a64aab76183
Instruction Fuzzy Hash: D4D1A062B09B8282FB10CB55E864BBA67A0BB99B84F444235DE7DD77D8DF3CE4458700

Function 00007FFDFF1A5DF0 Relevance: 59.2, APIs: 31, Strings: 2, Instructions: 1440memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A5E11
VirtualFree.KERNEL32(?,00007FFDFF2F4320,?,00007FFDFF1A7687), ref: 00007FFDFF1A5ECC
VirtualAlloc.KERNEL32(?,00007FFDFF2F4320,?,00007FFDFF1A7687), ref: 00007FFDFF1A5F82
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A5FCB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00007FFDFF2F4320,?,00007FFDFF1A7687), ref: 00007FFDFF1A6000

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D
MOZ_CRASH(), xrefs: 00007FFDFF1A5FE4

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeaveabort
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 554903349-3566792288
Opcode ID: 6a1ae2c0a0b8f74a0b02f0b6b8df420ca78f50ca3187937ce1f6c38558f816f0
Instruction ID: c596305e0a3a9bb08219b8dfaa0f52efcd304a8e8e420935ef0bc6442a8a67c3
Opcode Fuzzy Hash: 6a1ae2c0a0b8f74a0b02f0b6b8df420ca78f50ca3187937ce1f6c38558f816f0
Instruction Fuzzy Hash: E7D24573B19B4181EB158B15D860B6837A4EB95BB4F188735DE7D8B3E8DF38E4A18340

Function 00007FFDFF1D3A10 Relevance: 50.2, APIs: 9, Strings: 19, Instructions: 1189COMMON

Download Yara Rule

Strings

time, xrefs: 00007FFDFF1D4751
count, xrefs: 00007FFDFF1D47F6
MOZ_RELEASE_ASSERT(len > 0), xrefs: 00007FFDFF1D4DC1
number, xrefs: 00007FFDFF1D47A2
MOZ_RELEASE_ASSERT(aMap.add(addPtr, std::forward<Key>(aKey), typename HashM::Entry::ValueType{})), xrefs: 00007FFDFF1D4F90
ProfileBuffer parse error: %s, xrefs: 00007FFDFF1D41CE, 00007FFDFF1D421E
sample_groups, xrefs: 00007FFDFF1D4541
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1D4FD2
expected a Count entry, xrefs: 00007FFDFF1D41D5
samples, xrefs: 00007FFDFF1D46F1
MOZ_RELEASE_ASSERT(data.append(sample)), xrefs: 00007FFDFF1D4FB1
expected a Time entry, xrefs: 00007FFDFF1D4225
%lld, xrefs: 00007FFDFF1D4697, 00007FFDFF1D48FF, 00007FFDFF1D492D
schema, xrefs: 00007FFDFF1D4722
data, xrefs: 00007FFDFF1D48BC
name, xrefs: 00007FFDFF1D4378
counters, xrefs: 00007FFDFF1D4265
description, xrefs: 00007FFDFF1D44DD
category, xrefs: 00007FFDFF1D4428

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: %lld$MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aMap.add(addPtr, std::forward<Key>(aKey), typename HashM::Entry::ValueType{}))$MOZ_RELEASE_ASSERT(data.append(sample))$MOZ_RELEASE_ASSERT(len > 0)$ProfileBuffer parse error: %s$category$count$counters$data$description$expected a Count entry$expected a Time entry$name$number$sample_groups$samples$schema$time
API String ID: 0-1277876198
Opcode ID: 3af7c75dfa0e054e0495470f28436689191dc8b02ae555d93cb2bf6a2494a1bd
Instruction ID: c901889d920df9029cd2070b598dbce88950348de576c6f6c62155b0acf87a92
Opcode Fuzzy Hash: 3af7c75dfa0e054e0495470f28436689191dc8b02ae555d93cb2bf6a2494a1bd
Instruction Fuzzy Hash: F6C22832F09B8295EB648B15E4A47AE6361FB85B94F444232CABD47BD8DF3CE554C700

Function 00007FFDFF1AE170 Relevance: 49.3, APIs: 26, Strings: 2, Instructions: 277COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AE1BA
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE1F4
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE22C
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE239
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE246
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE253
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AE262
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE2B8
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE2F0
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE2FD
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE30A
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE317
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AE326
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE3A6
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE3DE
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE3EB
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE3F8
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE405
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AE414
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE46B
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE4A3
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE4B0
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE4BD
VerSetConditionMask.NTDLL ref: 00007FFDFF1AE4CA
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AE4D9
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AE529

Strings

kernel32.dll, xrefs: 00007FFDFF1AE522
ntdll.dll, xrefs: 00007FFDFF1AE1B3

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset$HandleModule
String ID: kernel32.dll$ntdll.dll
API String ID: 3621615041-3159745453
Opcode ID: ebd44039817bf6a4b98146416b8bcbf37090bbb0f4b47ae433e1fa5ef02eb616
Instruction ID: 0f27ef565698aa7ef5027259136d72753f5c5fbdd1d1a1658032a4356ccab11a
Opcode Fuzzy Hash: ebd44039817bf6a4b98146416b8bcbf37090bbb0f4b47ae433e1fa5ef02eb616
Instruction Fuzzy Hash: B8A1C032B196428AF714DB21E870BAA77A1EF88784F144539D93ECB7D8DE7CD0428B40

Function 00007FFDFF1A2240 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 274memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A22CB
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A22D8
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A22FF
VirtualAlloc.KERNEL32 ref: 00007FFDFF1A2335
VirtualFree.KERNEL32 ref: 00007FFDFF1A2354
_write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1A2377
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A2616
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A265B
VirtualAlloc.KERNEL32 ref: 00007FFDFF1A2692

Strings

<jemalloc>, xrefs: 00007FFDFF1A235E, 00007FFDFF1A24DF, 00007FFDFF1A254A
: (malloc) Error in VirtualFree(), xrefs: 00007FFDFF1A2379, 00007FFDFF1A24F3, 00007FFDFF1A255E

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$LeaveVirtual$AllocEnter$Free_write
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 3454987380-2186867486
Opcode ID: 1b37eb42efae9c4d1439281a3cf7af9c637e5fe7cca59cad7b43d8450d774255
Instruction ID: 6308268891e07a3d83a0ff166783245b15582d8404736623b925b6d581e778ec
Opcode Fuzzy Hash: 1b37eb42efae9c4d1439281a3cf7af9c637e5fe7cca59cad7b43d8450d774255
Instruction Fuzzy Hash: 31B19D22F2AA8281FB509B21A920B792755BF49B90F484235DD3ECB7EDDF7CE5459300

Function 00007FFDFF1BA8C0 Relevance: 41.2, APIs: 17, Strings: 6, Instructions: 903librarystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1F5A50: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFF2F4320,00007FFDFF1BA906), ref: 00007FFDFF1F5A5F

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1BA91A
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1BA996
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1BA9F5
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1BAAAA
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1BAAF1
VerSetConditionMask.NTDLL ref: 00007FFDFF1BAB2F
VerSetConditionMask.NTDLL ref: 00007FFDFF1BAB3C
VerSetConditionMask.NTDLL ref: 00007FFDFF1BAB49
VerSetConditionMask.NTDLL ref: 00007FFDFF1BAB56
VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1BAB68
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1BAB91
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1BABA3
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1BAC0B
LoadLibraryExW.KERNEL32 ref: 00007FFDFF1BAC2A
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1BB11F
RtlCompareMemory.NTDLL ref: 00007FFDFF1BB225
FreeLibrary.KERNEL32 ref: 00007FFDFF1BB709

Part of subcall function 00007FFDFF23EAC0: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF23EB70

Strings

nvinitx.dll, xrefs: 00007FFDFF1BAB9C
nvd3d9wrapx.dll, xrefs: 00007FFDFF1BAB8A
detoured.dll, xrefs: 00007FFDFF1BAA90
msvp9dec_store.dll, xrefs: 00007FFDFF1BABE3
RSDS, xrefs: 00007FFDFF1BAD4B
0123456789ABCDEFV, xrefs: 00007FFDFF1BAD61

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ConditionMask$HandleLibraryModulememchrmemcpytolower$CompareFreeInfoLoadMemoryVerifyVersionmemsetstrlenwcslen
String ID: 0123456789ABCDEFV$RSDS$detoured.dll$msvp9dec_store.dll$nvd3d9wrapx.dll$nvinitx.dll
API String ID: 3158047195-3518246346
Opcode ID: 3b8295a80d0a471dd41b32c3843ebfbc353fb27f3b6e894103eeae7a925ed33b
Instruction ID: 75a361a83c7cfd0369f37799ae10d9aa1229f850e9a3896f6eadd9578f5b980a
Opcode Fuzzy Hash: 3b8295a80d0a471dd41b32c3843ebfbc353fb27f3b6e894103eeae7a925ed33b
Instruction Fuzzy Hash: 05928E62F1CAC685E7319B11A4A47FA6791FB85744F440331DABD8ABDADF2CE489C700

Function 00007FFDFF1A80A0 Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 252COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FFDFF1A7F64), ref: 00007FFDFF1A80D6
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFDFF1A80EF
GetEnvironmentVariableA.KERNEL32 ref: 00007FFDFF1A8167

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 00007FFDFF1A818E
Compile-time page size does not divide the runtime one., xrefs: 00007FFDFF1A84D9
<jemalloc>, xrefs: 00007FFDFF1A826E, 00007FFDFF1A84D2
MOZ_CRASH(), xrefs: 00007FFDFF1A84E5
MALLOC_OPTIONS, xrefs: 00007FFDFF1A8150

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ExclusiveLock$AcquireEnvironmentReleaseVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 3930940220-326518326
Opcode ID: fb404961f505b82d443296ef29e8554ca78c991c4ed3445397ebc78a7fc71561
Instruction ID: bf31dccc9caa5deabeec8849014315abd975d2254d7eb00f9ef71b9c1022d00f
Opcode Fuzzy Hash: fb404961f505b82d443296ef29e8554ca78c991c4ed3445397ebc78a7fc71561
Instruction Fuzzy Hash: 75B15622F18A8285FB118B10A874B7A27A5FF45B54F54433AC97ECA2E9DF2DE845C344

Function 00007FFDFF1D1080 Relevance: 28.6, APIs: 5, Strings: 11, Instructions: 619stringCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1D121D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1D1372

Strings

0x%llx, xrefs: 00007FFDFF1D1335
set , xrefs: 00007FFDFF1D168A
expected a Time entry, xrefs: 00007FFDFF1D122D
MOZ_RELEASE_ASSERT(len > 0), xrefs: 00007FFDFF1D1B7B
%lld, xrefs: 00007FFDFF1D1A71
MOZ_PROFILER_SYMBOLICATE, xrefs: 00007FFDFF1D19AE
ProfileBuffer parse error: %s, xrefs: 00007FFDFF1D1226
get , xrefs: 00007FFDFF1D1679
, xrefs: 00007FFDFF1D1379
(root), xrefs: 00007FFDFF1D124F
MOZ_RELEASE_ASSERT(is<N>()), xrefs: 00007FFDFF1D1B5A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_funcstrlen
String ID: $%lld$(root)$0x%llx$MOZ_PROFILER_SYMBOLICATE$MOZ_RELEASE_ASSERT(is<N>())$MOZ_RELEASE_ASSERT(len > 0)$ProfileBuffer parse error: %s$expected a Time entry$get $set
API String ID: 1158866396-3499799853
Opcode ID: bef988e78813fa52964dd672fb962b011a1d8cdf25baa93cfd1aa4106c0530ac
Instruction ID: ba2408bb7c6e63df3fabb0b9822527502a2140c9a4445ecfc8ef43379635aa4c
Opcode Fuzzy Hash: bef988e78813fa52964dd672fb962b011a1d8cdf25baa93cfd1aa4106c0530ac
Instruction Fuzzy Hash: BC525A62F0CBC289FB608B15E460BAE67A5EB85784F444235DAAD977DDDF2CE441CB00

Function 00007FFDFF1F56A0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 182libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F56CE
LoadLibraryW.KERNEL32 ref: 00007FFDFF1F5728
GetProcAddress.KERNEL32 ref: 00007FFDFF1F574F
FreeLibrary.KERNEL32 ref: 00007FFDFF1F5768
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F57BE
LoadLibraryW.KERNEL32 ref: 00007FFDFF1F5818
GetProcAddress.KERNEL32 ref: 00007FFDFF1F583F
FreeLibrary.KERNEL32 ref: 00007FFDFF1F5858
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F58AE
LoadLibraryW.KERNEL32 ref: 00007FFDFF1F5910
GetProcAddress.KERNEL32 ref: 00007FFDFF1F5937
FreeLibrary.KERNEL32 ref: 00007FFDFF1F5950

Strings

kernel32.dll, xrefs: 00007FFDFF1F5721, 00007FFDFF1F5811, 00007FFDFF1F5909
GetProcessMitigationPolicy, xrefs: 00007FFDFF1F5745, 00007FFDFF1F5835, 00007FFDFF1F592D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Library$AddressCurrentFreeLoadProcProcess
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 3066816673-1680159014
Opcode ID: f9b3a12b4d93c8799673f0b9984a4f2dc263f65ee4b3be0881367e72a5413e29
Instruction ID: 312fb00f6c72f69a6868dfd8a6523281f334bb2cd65e27dac6c220df21df7f88
Opcode Fuzzy Hash: f9b3a12b4d93c8799673f0b9984a4f2dc263f65ee4b3be0881367e72a5413e29
Instruction Fuzzy Hash: 49813521F2AA83C5FB509B11AC21BB963A5AF44BA4F944235D97DC72E8EF3CE405D710

Function 00007FFDFF1BE280 Relevance: 21.6, APIs: 11, Strings: 1, Instructions: 579threadCOMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BE2BA
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1BE311
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1BE34C

Strings

MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST)), xrefs: 00007FFDFF1BE29E

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CurrentThreadabortmemset
String ID: MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST))
API String ID: 1493726818-3647009154
Opcode ID: 904007bec7c247e7eda9d696567a6e68a5422074848cfcc312362a098858970b
Instruction ID: be688cab539e5ce5c1edeca076f0a6542df106b42ee71bdf8f671329112619ea
Opcode Fuzzy Hash: 904007bec7c247e7eda9d696567a6e68a5422074848cfcc312362a098858970b
Instruction Fuzzy Hash: 6D326033F18A8186EB619B25E4647AEB7A0FB84B94F444235DBAD43B99DF3CE445C700

Function 00007FFDFF1F4870 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113timeCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FFDFF1F48A0
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1F48AD
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1F48DC
GetTickCount64.KERNEL32 ref: 00007FFDFF1F48EA
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F4957
GetProcessTimes.KERNEL32 ref: 00007FFDFF1F4979
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFF1F49A6

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FFDFF1F4A03
kernel32.dll, xrefs: 00007FFDFF1F49FC

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalProcessSectionTime$Count64CounterCurrentEnterFileLeavePerformanceQuerySystemTickTimes
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 813980209-706389432
Opcode ID: d4f33474df4c96209328df1446315616db2397e40f506afb44b448d247174650
Instruction ID: 389f6007e38b9e265760e0ab562f2499d163e0c06206b886696b8dfdebb0446b
Opcode Fuzzy Hash: d4f33474df4c96209328df1446315616db2397e40f506afb44b448d247174650
Instruction Fuzzy Hash: A1415B26F1DA8681EB20CB59E8B19B96765BB84790F400632DABDC37E8DF2CE545C700

Function 00007FFDFF1B3FC0 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 259COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFF1B3FF0
GetModuleHandleW.KERNEL32 ref: 00007FFDFF1B4080
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B43BC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B43DD

Strings

MOZ_RELEASE_ASSERT(isSome()), xrefs: 00007FFDFF1B43A0
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B43C1
ntdll.dll, xrefs: 00007FFDFF1B40E4
ntdll.dll, xrefs: 00007FFDFF1B4079

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: HandleModuleabort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(isSome())$ntdll.dll$ntdll.dll
API String ID: 195255760-238817221
Opcode ID: 1f3acd31824971cf7250d6bf7a4684dee22cc9a0705ee02807830eef112aa5fd
Instruction ID: ea3135084f3fc8ae4835a4310abfacedc4fc43511a98f55182bd876856cb5614
Opcode Fuzzy Hash: 1f3acd31824971cf7250d6bf7a4684dee22cc9a0705ee02807830eef112aa5fd
Instruction Fuzzy Hash: A5C1A363F18A8182EB119F14E5A077863A1FB947A4F559335DBBE026E9DF3CE0918300

Function 00007FFDFF1B9D40 Relevance: 14.0, APIs: 9, Instructions: 496memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FFDFF1B9E63
RtlAllocateHeap.NTDLL ref: 00007FFDFF1BA1C2

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c1d07700b8eefe4e9b74a02f8bf275e795554e37618f25432144de3993624685
Instruction ID: 7b632cca001337ca0e5a03eed78a5e59f7b65e09dda060c76eee4f4990c48382
Opcode Fuzzy Hash: c1d07700b8eefe4e9b74a02f8bf275e795554e37618f25432144de3993624685
Instruction Fuzzy Hash: 202299A3F19A4582EB508F29D4547A92360FB69BA8F459326CF7E073D9DF38E585C300

Function 00007FFDFF1A3720 Relevance: 14.0, APIs: 11, Instructions: 227COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A37D0
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A3817
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A3823
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3874
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A38BE
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3947
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3957
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A3989
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A39B3
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1A3A44
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3A72

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$memset$memcpy
String ID:
API String ID: 3731777071-0
Opcode ID: 69923d064b3c143ac31e287d0b54d17374f289e564e94ea9c6faaae60f844d59
Instruction ID: 584bf489c7c8c885aed6fa03e186916e36661181d994bd6745ca6af2e7c6c5df
Opcode Fuzzy Hash: 69923d064b3c143ac31e287d0b54d17374f289e564e94ea9c6faaae60f844d59
Instruction Fuzzy Hash: F791D263F18A9282EB109B119464BB96394AB44BE0F444735DE3EABBDDDF3DE446D300

Function 00007FFDFF1BC830 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 427threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1BCC6B
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1BCCB2
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1BCD01
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BCE26
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BCF59

Strings

MOZ_RELEASE_ASSERT(isSome()), xrefs: 00007FFDFF1BCE0A
MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST)), xrefs: 00007FFDFF1BCF3D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CurrentThread$abort
String ID: MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST))$MOZ_RELEASE_ASSERT(isSome())
API String ID: 1325982422-2736632048
Opcode ID: 758ff7cabce662712028eb5ac3a9c32a1a19efab5ab612456e31417eacda19ec
Instruction ID: e15671234d5205c99bcf18b0f3c210df61bb34b65ef8769cbefd1b855acf8589
Opcode Fuzzy Hash: 758ff7cabce662712028eb5ac3a9c32a1a19efab5ab612456e31417eacda19ec
Instruction Fuzzy Hash: DE129323E18E8586E7668F34E4607AAB364FF55784F049322DBBE56299DF7CE085C300

Function 00007FFDFF1B14C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 173nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FFDFF1B152E
NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1B15C6
GetSystemInfo.KERNEL32 ref: 00007FFDFF1B1724

Strings

0, xrefs: 00007FFDFF1B1651
0, xrefs: 00007FFDFF1B166E

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: InfoMemoryQuerySystemVirtualrand_s
String ID: 0$0
API String ID: 371523016-203156872
Opcode ID: 7619b5ee3d16fbc226bcb0c448f71c2f7f8aded135f5b9342c4a8734e968f3ba
Instruction ID: 06886af631ad89fbc7108d52a99f2d294e5546fc4d7a604317d84b90868e5dc2
Opcode Fuzzy Hash: 7619b5ee3d16fbc226bcb0c448f71c2f7f8aded135f5b9342c4a8734e968f3ba
Instruction Fuzzy Hash: 7B51AE22F2D641C2FB508B15A824B6963A1AB857D8F494232EF7E937D8DF7CE445CA00

Function 00007FFDFF1B2D10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1B2D6E
GetProcAddress.KERNEL32 ref: 00007FFDFF1B2DAE
NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1B2DDC

Part of subcall function 00007FFDFF1AE170: GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AE1BA
Part of subcall function 00007FFDFF1AE170: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE1F4
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE22C
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE239
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE246
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE253
Part of subcall function 00007FFDFF1AE170: VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AE262
Part of subcall function 00007FFDFF1AE170: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE2B8
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE2F0
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE2FD
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE30A
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE317

RtlNtStatusToDosError.NTDLL ref: 00007FFDFF1B2E1A
RtlSetLastWin32Error.NTDLL ref: 00007FFDFF1B2E21

Strings

0, xrefs: 00007FFDFF1B2DC1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ConditionMask$ErrorMemoryQueryVirtualmemset$AddressHandleInfoLastModuleProcStatusVerifyVersionWin32
String ID: 0
API String ID: 3874634515-4108050209
Opcode ID: fab55ac286028d55f49cb45973cb781ae90964bd7a55e2f18a9260963790947c
Instruction ID: 55c4f45f4870fc35f805783ea06eb00296e6cdffc817d4516fe8e7550b0d4ffc
Opcode Fuzzy Hash: fab55ac286028d55f49cb45973cb781ae90964bd7a55e2f18a9260963790947c
Instruction Fuzzy Hash: BE41AF63F09681C5EB669A16A424B6A6390FB49BE0F104339EF7D436D8DF7CE485CB00

Function 00007FFDFF1AE030 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1AE08E
GetProcAddress.KERNEL32 ref: 00007FFDFF1AE0CE
NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1AE0FC

Part of subcall function 00007FFDFF1AE170: GetModuleHandleW.KERNEL32 ref: 00007FFDFF1AE1BA
Part of subcall function 00007FFDFF1AE170: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE1F4
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE22C
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE239
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE246
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE253
Part of subcall function 00007FFDFF1AE170: VerifyVersionInfoW.KERNEL32 ref: 00007FFDFF1AE262
Part of subcall function 00007FFDFF1AE170: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AE2B8
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE2F0
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE2FD
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE30A
Part of subcall function 00007FFDFF1AE170: VerSetConditionMask.NTDLL ref: 00007FFDFF1AE317

RtlNtStatusToDosError.NTDLL ref: 00007FFDFF1AE13A
RtlSetLastWin32Error.NTDLL ref: 00007FFDFF1AE141

Strings

0, xrefs: 00007FFDFF1AE0E1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ConditionMask$ErrorMemoryQueryVirtualmemset$AddressHandleInfoLastModuleProcStatusVerifyVersionWin32
String ID: 0
API String ID: 3874634515-4108050209
Opcode ID: a13ce9ee08c3b9759b7a1fe90ec39c299713ac9899a56b57158c0302d5b3c8b0
Instruction ID: 698b6711b5903b9bef51098bda87a9864fbb2f2c9b241b153488a5de32b49d42
Opcode Fuzzy Hash: a13ce9ee08c3b9759b7a1fe90ec39c299713ac9899a56b57158c0302d5b3c8b0
Instruction Fuzzy Hash: 8B31F273B1921141FB669A169864B6AA3A0EB407F4F540331EE7C867DDDF3CE081CB00

Function 00007FFDFF1AEA70 Relevance: 10.3, APIs: 4, Strings: 1, Instructions: 1524COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDFF1AEAE7
EncodePointer.KERNEL32 ref: 00007FFDFF1AEB4D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B03EA
EncodePointer.KERNEL32 ref: 00007FFDFF1B040E

Strings

MOZ_RELEASE_ASSERT(isSome()), xrefs: 00007FFDFF1B03CE

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: EncodePointer$abort
String ID: MOZ_RELEASE_ASSERT(isSome())
API String ID: 1499919548-2302506790
Opcode ID: a9ed67ac252f7b7b3e9b9b48862c9d0affd515aaba8bb2fafe2a0273e70dda83
Instruction ID: f3332fadbd09bb5106bff0384b9834a04aa0bd5be14a5c4b2a6f915622c2c33e
Opcode Fuzzy Hash: a9ed67ac252f7b7b3e9b9b48862c9d0affd515aaba8bb2fafe2a0273e70dda83
Instruction Fuzzy Hash: 8BF25B73B08A858AEB618F19D46076E77A1FB85B84F444222DBAE477D9DF3DE440CB00

Function 00007FFDFF1AD830 Relevance: 9.2, APIs: 6, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFDFF1AD927
VirtualProtect.KERNEL32 ref: 00007FFDFF1AD9AF
GetSystemInfo.KERNEL32 ref: 00007FFDFF1ADA5B

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ProtectVirtual$InfoSystem
String ID:
API String ID: 1426219593-0
Opcode ID: 388266d9a5b38e9d44e3347b09943150185eae56d0e76a27ab919b46bc801e89
Instruction ID: 418b7fe7ea182018954886e7e526ca26d9f7e47fb134b028d4ae740db89740ed
Opcode Fuzzy Hash: 388266d9a5b38e9d44e3347b09943150185eae56d0e76a27ab919b46bc801e89
Instruction Fuzzy Hash: B3716E23B18A8686EB109F12E8619797761FB44B94F544232DD7E8B7E8EF3CE409C700

Function 00007FFDFF1A2910 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 412COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A2CA8

Strings

MOZ_RELEASE_ASSERT(run_ind < gChunkNumPages - 1), xrefs: 00007FFDFF1A2C8C
MOZ_CRASH(), xrefs: 00007FFDFF1A28DF

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(run_ind < gChunkNumPages - 1)
API String ID: 4206212132-2876087220
Opcode ID: c46aa30a743e7a300eab4f403520fc89b787ee0cf36686f115663ca576239b56
Instruction ID: f10d1d0ec703ec3ff80d8cf28767c621ba46a7066f7a17b1b3f70abb8107fdcc
Opcode Fuzzy Hash: c46aa30a743e7a300eab4f403520fc89b787ee0cf36686f115663ca576239b56
Instruction Fuzzy Hash: C5F1BA63F25A9286EB218B15D864BB82364FB54BA0F484331DE3D4B7D8EF78E156D300

Function 00007FFDFF1B0550 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1B05FC
RtlNtStatusToDosError.NTDLL ref: 00007FFDFF1B062B
RtlSetLastWin32Error.NTDLL ref: 00007FFDFF1B0632
GetSystemInfo.KERNEL32 ref: 00007FFDFF1B0674

Strings

0, xrefs: 00007FFDFF1B05E1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Error$InfoLastMemoryQueryStatusSystemVirtualWin32
String ID: 0
API String ID: 402019679-4108050209
Opcode ID: 41fe86c5646333b49bbab2e82f0f0c0f8aad2a1a4e4be1d5a83827c620384998
Instruction ID: 648b7e7c22d2dd0a59ec2b609771ff7c12d9f30cd5b56623e9d80bf386eb37ec
Opcode Fuzzy Hash: 41fe86c5646333b49bbab2e82f0f0c0f8aad2a1a4e4be1d5a83827c620384998
Instruction Fuzzy Hash: 14319323F1D645C6FB648B159874A796391AB847A0F144335DA7D83BD8DF3CF845CA40

Function 00007FFDFF1A2FC0 Relevance: 7.7, APIs: 6, Instructions: 219COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A7486

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f50dd1a42e8108be889483ade9dbda34dc47781b03daba4c387aef1bc6629950
Instruction ID: 530a91fc8d54c7ee5d4a94018a71df573f3d82f5c8a49b1498e57981ef2c2bea
Opcode Fuzzy Hash: f50dd1a42e8108be889483ade9dbda34dc47781b03daba4c387aef1bc6629950
Instruction Fuzzy Hash: 1D711663F0969246FB218A1AAA24BB95345AB44BF0F494335CE3D4BBC8DF7DD5869300

Function 00007FFDFF1B5940 Relevance: 7.7, APIs: 5, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFF2F4320), ref: 00007FFDFF1B59AF
RtlCaptureStackBackTrace.NTDLL ref: 00007FFDFF1B59CD
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDFF2F4320), ref: 00007FFDFF1B5A28
RtlReAllocateHeap.NTDLL ref: 00007FFDFF1B5A7F
RtlFreeHeap.NTDLL(?,?,?,00007FFDFF2F4320), ref: 00007FFDFF1B5AAB

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: e3568e626e7958823e8e595c5f610cd87c0730abb196a95580b52b4f64f43021
Instruction ID: 7e91a96738462f153c1eb36e6a7e5aa18312ad04a90395f20520b6159b893d2a
Opcode Fuzzy Hash: e3568e626e7958823e8e595c5f610cd87c0730abb196a95580b52b4f64f43021
Instruction Fuzzy Hash: 7881D3A3F14A8582EB118B29D5946B86326FB55BE4F558331CF7E136DBDF39E1828300

Function 00007FFDFF1BD090 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BD39B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BD3BC

Strings

MOZ_RELEASE_ASSERT(mFrameToIndexMap.add(entry, aFrame, count)), xrefs: 00007FFDFF1BD3A0
MOZ_RELEASE_ASSERT(is<N>()), xrefs: 00007FFDFF1BD37F

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(is<N>())$MOZ_RELEASE_ASSERT(mFrameToIndexMap.add(entry, aFrame, count))
API String ID: 4206212132-2445066258
Opcode ID: 4c7c5dc215238196f1cd766ccebfc04653348d7a07a7321e3b2135ad2a68c04c
Instruction ID: e9d41e64d9b8bcdde2671c39da6b270b3c60d746f4affd9b181f40101a5ff27a
Opcode Fuzzy Hash: 4c7c5dc215238196f1cd766ccebfc04653348d7a07a7321e3b2135ad2a68c04c
Instruction Fuzzy Hash: C4A1C673B08A8586E7188B15E4506AAB7A1FB857D4F444235EFAD43BE8EF3CE545CB00

Function 00007FFDFF1AE840 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFDFF1AE9DB

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 83a1ed80f85dfc735371a930c5cb00240c2232fc84ca3837e8a35c5daf4ec2c2
Instruction ID: cbd8e9582531fbcc7131fd62c1022e90d47ad626549aa4e80871cd1b5d5a6408
Opcode Fuzzy Hash: 83a1ed80f85dfc735371a930c5cb00240c2232fc84ca3837e8a35c5daf4ec2c2
Instruction Fuzzy Hash: 10519023F0868245EB69EA16A934B7B6791EB447E0F444331DEBD4B6C8DF7CE4568700

Function 00007FFDFF1B0810 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1B06F5), ref: 00007FFDFF1B0956
GetSystemInfo.KERNEL32 ref: 00007FFDFF1B0979
GetSystemInfo.KERNEL32 ref: 00007FFDFF1B09B3

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B093A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: InfoSystem$abort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))
API String ID: 1091889720-2301055464
Opcode ID: a14ead13bca9921f94fbcaea955377c9ccb00f5bedd175a48713ea09edd30255
Instruction ID: be93aca78f0869757b93965bc6f51daf2e5ef7ce8bfb5b28b969e39873927d61
Opcode Fuzzy Hash: a14ead13bca9921f94fbcaea955377c9ccb00f5bedd175a48713ea09edd30255
Instruction Fuzzy Hash: 28417922F1969686FB41CB11E930AB92364BF44B90F444335EE7E877D9EF6CE8468300

Function 00007FFDFF1B8BC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B8D22

Part of subcall function 00007FFDFF1B8D30: GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1B8D54

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B8D01

Strings

MOZ_RELEASE_ASSERT(phase == MarkerTiming::Phase::Instant || phase == MarkerTiming::Phase::Interval || phase == MarkerTiming::Phase::IntervalStart || phase == MarkerTiming::Phase::IntervalEnd), xrefs: 00007FFDFF1B8D06
MOZ_RELEASE_ASSERT(aString.Length() < std::numeric_limits<Length>::max() / 2) (Double the string length doesn't fit in Length type), xrefs: 00007FFDFF1B8CE5

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort$CurrentThread
String ID: MOZ_RELEASE_ASSERT(aString.Length() < std::numeric_limits<Length>::max() / 2) (Double the string length doesn't fit in Length type)$MOZ_RELEASE_ASSERT(phase == MarkerTiming::Phase::Instant || phase == MarkerTiming::Phase::Interval || phase == MarkerTiming::Phase::IntervalStart || phase == MarkerTiming::Phase::IntervalEnd)
API String ID: 2509247791-973032051
Opcode ID: 53e5ef02f9bb49fce2a3734fa3594cd3b6939282da2764761092105da208da59
Instruction ID: 15b862454694814d8b5f21c4cc8324dacde408430ea0abaf0bf8bb2b91af57c9
Opcode Fuzzy Hash: 53e5ef02f9bb49fce2a3734fa3594cd3b6939282da2764761092105da208da59
Instruction Fuzzy Hash: 7B417EB3F0964585EB548B06D8A4AB82391BB84BA5F858232DF7D43BD8CB7CA5468304

Function 00007FFDFF1A7A90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A7AC3
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7C4F

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 00007FFDFF1A7C33

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abortmemset
String ID: MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)
API String ID: 1877358416-771901243
Opcode ID: 9a6331f6dde0698697fca6a7b0c1ab11ecec509ccb1fa50c43b766ea3f5dd803
Instruction ID: 0f6b8095ae46392541067a0d46e736a6c45607b1f6a94a8bd040a6ccf963c0b4
Opcode Fuzzy Hash: 9a6331f6dde0698697fca6a7b0c1ab11ecec509ccb1fa50c43b766ea3f5dd803
Instruction Fuzzy Hash: 9A41CFB3F1461286EB14CF1594A8A796394EB187A4F418731DE3D8A3C9EF3CE649C300

Function 00007FFDFF1A73A0 Relevance: 5.2, APIs: 4, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59796a8e9c2f0ffb2729ef0e945108f2ec3964a6faacb4bce40676a10a319af6
Instruction ID: e74eedc3abd175e3f954763a956bb53e1da05c9da107d41ae28532e99cba8028
Opcode Fuzzy Hash: 59796a8e9c2f0ffb2729ef0e945108f2ec3964a6faacb4bce40676a10a319af6
Instruction Fuzzy Hash: C8613223B15B9186FB108F19A824FA86394EB44BA4F8A9335DE3D4BBC9DF28D545C740

Function 00007FFDFF1B1A10 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1B1B96
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1B1B9B
FlushInstructionCache.KERNEL32 ref: 00007FFDFF1B1BA9

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessmemcpy
String ID:
API String ID: 3929534081-0
Opcode ID: f24c45149ebdbc9db2b21bf15b21904d3895423c3b17ac9a3af977b039ab24e1
Instruction ID: 259e15c74d6f2bee17cf5587918bc06126c44cfdd965d7f2334467c4d80c7dc2
Opcode Fuzzy Hash: f24c45149ebdbc9db2b21bf15b21904d3895423c3b17ac9a3af977b039ab24e1
Instruction Fuzzy Hash: 4551A323E0868186F7718B29D454B79BBA0E745798F698225DBBD137D9CF3CE485C700

Function 00007FFDFF1BD430 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF2F4320,?,00007FFDFF2F4320), ref: 00007FFDFF1BD786

Strings

MOZ_RELEASE_ASSERT(mStackToIndexMap.add(entry, aStack, count)), xrefs: 00007FFDFF1BD76A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mStackToIndexMap.add(entry, aStack, count))
API String ID: 4206212132-3571465025
Opcode ID: f6487b1ad986a4d9b99790eb31d044de730c1085bf404850aa0f48f9d1188100
Instruction ID: 8148c0a85ea0b69aa19df4447478c6495f2a32d7c035779c755e45ca00394ec1
Opcode Fuzzy Hash: f6487b1ad986a4d9b99790eb31d044de730c1085bf404850aa0f48f9d1188100
Instruction Fuzzy Hash: B991D433A0868982E7198F15E550AAA7770FB85798F454231EF6D43BE8EF38E545CB00

Function 00007FFDFF1B6110 Relevance: 3.2, APIs: 2, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FFDFF1B61F8
RtlReAllocateHeap.NTDLL ref: 00007FFDFF1B6262

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7380934a95c5562c083849077b9ec6f82f26691d9ed2413d568a2468dac0e504
Instruction ID: 37dba3322d1ba5f4f944ebce69c02c66e74b5fe45d57d3b2f8820103fd8356bc
Opcode Fuzzy Hash: 7380934a95c5562c083849077b9ec6f82f26691d9ed2413d568a2468dac0e504
Instruction Fuzzy Hash: 5671C063F19A4582EB018B58D6506B86351FBA5BE4F499375CF7E073E6EF28E182C304

Function 00007FFDFF28C530 Relevance: 1.6, Strings: 1, Instructions: 393COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FFDFF28C689, 00007FFDFF28C710, 00007FFDFF28C766, 00007FFDFF28C783, 00007FFDFF28C7D8, 00007FFDFF28C7F3, 00007FFDFF28C80C, 00007FFDFF28C82E, 00007FFDFF28C87F, 00007FFDFF28C8A5, 00007FFDFF28C8E9, 00007FFDFF28C925, 00007FFDFF28C985, 00007FFDFF28CA59, 00007FFDFF28CA73, 00007FFDFF28CA94, 00007FFDFF28CAC2, 00007FFDFF28CB09, 00007FFDFF28CB56

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-2272463933
Opcode ID: d25b56efe37b16f7c8b5b60b6a4431dbfdc8e3f06ace07b6d1c7a30835c69025
Instruction ID: 95eaca43b9ba0ea37d7530a79bd04b4af3a7401eab647976e17812f9e796c01b
Opcode Fuzzy Hash: d25b56efe37b16f7c8b5b60b6a4431dbfdc8e3f06ace07b6d1c7a30835c69025
Instruction Fuzzy Hash: 2EF14967B1866142E7588B3EE52553C77A5EBA8300F50D233E6A9C77E8EE3DC244D312

Function 00007FFDFF28C290 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FFDFF28C335, 00007FFDFF28C36A, 00007FFDFF28C400, 00007FFDFF28C440, 00007FFDFF28C45C, 00007FFDFF28C471, 00007FFDFF28C48D, 00007FFDFF28C4B8, 00007FFDFF28C4FD

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-2272463933
Opcode ID: 9340fcfe5a81475f1aa24d0ca1a7f5071a0cd534f036cc77c4465ac7d1cd1b8c
Instruction ID: 8f5e9f9847d0aead70ceeb41ed686a65514441bf807e9cf4e94e8327e202bb3b
Opcode Fuzzy Hash: 9340fcfe5a81475f1aa24d0ca1a7f5071a0cd534f036cc77c4465ac7d1cd1b8c
Instruction Fuzzy Hash: 7751E462B1826082E71D9B29E0B297C7765EB94F00F80E53BD7AB877E9DA3C4544D311

Function 00007FFDFF288700 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f885c75e60178c55a4f08cb21c4d6219f3f342c5c3de7fa1028c4771a7c1641
Instruction ID: 7f4a3b1138b685f144f5c47f4e3b22cc080007290246d088da861cce3305f3af
Opcode Fuzzy Hash: 1f885c75e60178c55a4f08cb21c4d6219f3f342c5c3de7fa1028c4771a7c1641
Instruction Fuzzy Hash: 51F18362B09B8182EB149B15E4617AE67A1FB84784F048636DEAEC7BCDDF3CE505C304

Function 00007FFDFF1E5BC0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ab2e118c1e06040105d676db89e8acca2f7249a62c0470968f65da4c1068ea
Instruction ID: cce2fa2aaa113bb571f881be5f9757b0e2182ddd89405ae1d0cd5d7edbc81bcb
Opcode Fuzzy Hash: a6ab2e118c1e06040105d676db89e8acca2f7249a62c0470968f65da4c1068ea
Instruction Fuzzy Hash: 99A1F1B3F14A818AEB108F24D5687BD2791FB94B98F559331DA7A432D8EB78E585C300

Function 00007FFDFF1D5AD0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843eee5b57b1d05981a9acb97f15f134a58e1dacd42d5a9d9108a206292f91b7
Instruction ID: 5c546c3ad805f1fc43abceccc3b9218b82381c210198939e716b700f6c8551cf
Opcode Fuzzy Hash: 843eee5b57b1d05981a9acb97f15f134a58e1dacd42d5a9d9108a206292f91b7
Instruction Fuzzy Hash: 0C81CC33F04B5587EB248A25E4A8BBD37A5E794B90F958235CE2A43BC8DF38D585C350

Function 00007FFDFF1D5000 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23198ed2dfd69f975ece865498b8e7543cf36f613b4eb1d24580b5a63bbfcae
Instruction ID: dfcea9347658d0b97b536c3991ff19659cc769d9b912f2167a2f21c082f4238f
Opcode Fuzzy Hash: f23198ed2dfd69f975ece865498b8e7543cf36f613b4eb1d24580b5a63bbfcae
Instruction Fuzzy Hash: 7F81FE73F047A487EB498A15D8A9BBD376AEB94B94F558239CE3A037C4DA38D944C340

Function 00007FFDFF1E3110 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c141aecc96ec28a7ac3e807e1ab0afa6c0259babdfb89bf3737cb31069e344c6
Instruction ID: 56cb528afd61c2463e86d0f3e61d58724ff983b4ecbc71eeba1d52be6aa00bef
Opcode Fuzzy Hash: c141aecc96ec28a7ac3e807e1ab0afa6c0259babdfb89bf3737cb31069e344c6
Instruction Fuzzy Hash: 0A71BD33F04A6586EB188F29D4A8EAC3B51E791B94F554239CE2E537D4EF38E545C300

Function 00007FFDFF1E5FA0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41f1d8fc246f284c1ebb9235ce45f95cee80fa6bbf20844b9c569e8b262ca37
Instruction ID: 62f25214fc06e9ecfc9c0e03a65cfeeec8ac6e848eb8e2443345c8081bdad05a
Opcode Fuzzy Hash: b41f1d8fc246f284c1ebb9235ce45f95cee80fa6bbf20844b9c569e8b262ca37
Instruction Fuzzy Hash: 5F71F133F1466587EB298F24D4A8AAC3796E790B94F858239CE3A437C4DF38E945C340

Function 00007FFDFF1E33E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662fc2a442d2059f31e037679ecaaa730282b39ca650bf14f7c310b8c710b0b1
Instruction ID: bbad38eee1aadc0ae757337ab722115a341f164df15659fd37ddcb00d0c3700f
Opcode Fuzzy Hash: 662fc2a442d2059f31e037679ecaaa730282b39ca650bf14f7c310b8c710b0b1
Instruction Fuzzy Hash: DD81F2B3F0478186EB118F14D46876E7BA0E7A4B58F168335CA2A173D4EB79E586C740

Function 00007FFDFF1ADD20 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8928c710deb336a23ec76e5386a5b557d4cf9d81ad269fda5149b136f950d87
Instruction ID: 682ed73c33ef03ce4b0de68398b489f7ef26a9625c02c16b8eda4134983450cb
Opcode Fuzzy Hash: d8928c710deb336a23ec76e5386a5b557d4cf9d81ad269fda5149b136f950d87
Instruction Fuzzy Hash: C161C463F15E8942EF148B248564AF92750FB65BF4F469735DE3E1A2CAFF28A185C300

Function 00007FFDFF1A3EEA Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8a69eba7e6f801ebfea9734bcec5f2d3bcce08b9fad43832d2752e664c66c8
Instruction ID: b30ffb1901110f859c77719f8b4fc609cfd26c18bcdc69c7842de3d849b28025
Opcode Fuzzy Hash: 3d8a69eba7e6f801ebfea9734bcec5f2d3bcce08b9fad43832d2752e664c66c8
Instruction Fuzzy Hash: 04516A33F2C29182FB29CA30A175FB82752AB51364F014336DD3E4B7D8DF69A8929301

Function 00007FFDFF1A76D0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3f552daf5cb8f7a4a98986bc68b034509f11997f0d30a7b3e678bd23fd6dc6
Instruction ID: 90c290585190890a1a115e6bb053275b4475739b8b778132e89e3fe98933f6f1
Opcode Fuzzy Hash: 8b3f552daf5cb8f7a4a98986bc68b034509f11997f0d30a7b3e678bd23fd6dc6
Instruction Fuzzy Hash: FA31EA93F16A0942AE1E8E46C87067817969B98FD038D467ECD1F0F794CF2CE606C310

Function 00007FFDFF287B00 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287BD3
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287C29
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287C65
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287CB7
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287D1A
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287D5A
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287DB2

Strings

libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_INSTALL_CONTEXT, xrefs: 00007FFDFF287CF8
libunwind: unwind_phase2_forced(ex_ojb=%p): start_ip=0x%llx, func=%s, lsda=0x%llx, personality=0x%llx, xrefs: 00007FFDFF287BED
libunwind: unwind_phase2_forced(ex_ojb=%p): stopped by stop function, xrefs: 00007FFDFF287D7D
libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_CONTINUE_UNWIND, xrefs: 00007FFDFF287CBD
.anonymous., xrefs: 00007FFDFF287BBE
libunwind: unwind_phase2_forced(ex_ojb=%p): calling personality function %p, xrefs: 00007FFDFF287C6B
libunwind: unwind_phase2_forced(ex_ojb=%p): calling stop function with _UA_END_OF_STACK, xrefs: 00007FFDFF287D20
libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned %d, _URC_FATAL_PHASE2_ERROR, xrefs: 00007FFDFF287DB8
libunwind: unwind_phase2_forced(ex_ojb=%p): stop function returned %d, xrefs: 00007FFDFF287C2F
libunwind: unwind_phase2_forced(ex_ojb=%p): __unw_step failed => _URC_END_OF_STACK, xrefs: 00007FFDFF287D60

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_func
String ID: .anonymous.$libunwind: unwind_phase2_forced(ex_ojb=%p): __unw_step failed => _URC_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): calling personality function %p$libunwind: unwind_phase2_forced(ex_ojb=%p): calling stop function with _UA_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned %d, _URC_FATAL_PHASE2_ERROR$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_CONTINUE_UNWIND$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_INSTALL_CONTEXT$libunwind: unwind_phase2_forced(ex_ojb=%p): start_ip=0x%llx, func=%s, lsda=0x%llx, personality=0x%llx$libunwind: unwind_phase2_forced(ex_ojb=%p): stop function returned %d$libunwind: unwind_phase2_forced(ex_ojb=%p): stopped by stop function
API String ID: 711238415-2195443546
Opcode ID: 58444f2fad51ae5125a71fca1b1a5af0dba51ff6478d2aff7d151de3d8a555f0
Instruction ID: e6c08bd3125223cf76d5dd259fb6f43323f35e71a85fdcaca968f1f2e8232134
Opcode Fuzzy Hash: 58444f2fad51ae5125a71fca1b1a5af0dba51ff6478d2aff7d151de3d8a555f0
Instruction Fuzzy Hash: 7E613C20B0C64741FB24ABA2A571ABD5351AF45BC4F40873ADE7DCBADADE2CE546C240

Function 00007FFDFF1A3AB0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3B15
VirtualFree.KERNEL32(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3B5C
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A3B89
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3C7C
VirtualAlloc.KERNEL32(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3CF2
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A3D1B
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3D85
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3DBB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3DDC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A3DFD
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A3E1C
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3E3F

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 00007FFDFF1A3D9F, 00007FFDFF1A3DC0
MOZ_CRASH(), xrefs: 00007FFDFF1A3DE1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Enterabort$LeaveVirtual$AllocFreememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 1261439145-884734703
Opcode ID: d7a06e0973de9c966c40ea65ce0f6f26502c99fc7e19ae0f3525909f8864cc7a
Instruction ID: 7e2c22bb9871e4ae45403d32f7789344526128161514509a65f10277ce7dea13
Opcode Fuzzy Hash: d7a06e0973de9c966c40ea65ce0f6f26502c99fc7e19ae0f3525909f8864cc7a
Instruction Fuzzy Hash: 2B91DA23F19A4285EB149B22A824B746795EF88BA0F484735DD3D9B7ECDF3DE4458300

Function 00007FFDFF1C35B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 232threadCOMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDFF1C356D,?,?,?,00007FFDFF1B4AB0), ref: 00007FFDFF1C362E
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1C356D,?), ref: 00007FFDFF1C36A3
GetCurrentThread.KERNEL32 ref: 00007FFDFF1C36A8
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1C356D,?), ref: 00007FFDFF1C36B1
DuplicateHandle.KERNEL32 ref: 00007FFDFF1C36D9
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1C3766
GetCurrentThread.KERNEL32 ref: 00007FFDFF1C376C
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1C3775
DuplicateHandle.KERNEL32 ref: 00007FFDFF1C379E
CloseHandle.KERNEL32 ref: 00007FFDFF1C3828
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1C387C

Strings

MOZ_RELEASE_ASSERT(stackPointer == 0), xrefs: 00007FFDFF1C3860
J, xrefs: 00007FFDFF1C3788
MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST)), xrefs: 00007FFDFF1C3612

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Current$Process$Handle$DuplicateThreadabort$Close
String ID: J$MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST))$MOZ_RELEASE_ASSERT(stackPointer == 0)
API String ID: 3232941954-3879247819
Opcode ID: 9b35bef42e75e452b3d3a525b8fa87d491f69029ad2b55de4b3971ec4398dbb7
Instruction ID: bcfb0c8e4359bb8e982dec3a0fea85fafbc11f36ff345b4881c1ac2347ae91db
Opcode Fuzzy Hash: 9b35bef42e75e452b3d3a525b8fa87d491f69029ad2b55de4b3971ec4398dbb7
Instruction Fuzzy Hash: 9F71BF73B19B418AEB508F16E864B6973A4FB48B94F504231DE6C877A8DF3DD492C700

Function 00007FFDFF1B1150 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FFDFF1B1225
GetLastError.KERNEL32 ref: 00007FFDFF1B1234
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,-5555555555555555,?,00000000,?,00007FFDFF2F4320,?,00007FFDFF1B10DB), ref: 00007FFDFF1B1475

Part of subcall function 00007FFDFF1B14C0: rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FFDFF1B152E
Part of subcall function 00007FFDFF1B14C0: NtQueryVirtualMemory.NTDLL ref: 00007FFDFF1B15C6

VirtualAlloc.KERNEL32 ref: 00007FFDFF1B1273
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B12B3
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B12F3
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B1333
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B1373
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B13B3
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B13EB
VirtualAlloc.KERNEL32 ref: 00007FFDFF1B1423

Strings

MOZ_RELEASE_ASSERT(idx < storage_.size()), xrefs: 00007FFDFF1B1459
kernelbase.dll, xrefs: 00007FFDFF1B149A
VirtualAlloc2, xrefs: 00007FFDFF1B14A1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Virtual$Alloc$ErrorLastMemoryQueryabortrand_s
String ID: MOZ_RELEASE_ASSERT(idx < storage_.size())$VirtualAlloc2$kernelbase.dll
API String ID: 3302686864-3446475624
Opcode ID: 224b81c773b7c4bdec9086cd6b68867740ff298e27b923e77f32fa9e36e4d123
Instruction ID: 7b2cd26950cdfe449eb8d7a1a03418479e4a140ca6c627b8246a3928cb684c62
Opcode Fuzzy Hash: 224b81c773b7c4bdec9086cd6b68867740ff298e27b923e77f32fa9e36e4d123
Instruction Fuzzy Hash: 4B816B22B0970281FB209B52A864B796790BF55FC8F554239DE7DA7BD9DF3CE1069300

Function 00007FFDFF1B86F0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 290COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B8A74
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00007FFDFF1B8AED
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00007FFDFF1B8B86
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00007FFDFF1B8BA7

Strings

MOZ_RELEASE_ASSERT(!mCurrentSpan.IsEmpty() || mNextSpanOrEmpty.IsEmpty()), xrefs: 00007FFDFF1B8B8B
MOZ_RELEASE_ASSERT(mNextSpanOrEmpty.LengthBytes() >= 1), xrefs: 00007FFDFF1B90CF
MOZ_RELEASE_ASSERT(aStart <= aEnd), xrefs: 00007FFDFF1B8F44
MOZ_RELEASE_ASSERT(isSome()), xrefs: 00007FFDFF1B8B6A
MOZ_RELEASE_ASSERT(RemainingBytes() >= 1), xrefs: 00007FFDFF1B8A58, 00007FFDFF1B92E9
MOZ_RELEASE_ASSERT(!isSome()), xrefs: 00007FFDFF1B8AD1
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B8F65, 00007FFDFF1B90A9, 00007FFDFF1B9165, 00007FFDFF1B91EE
MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len))), xrefs: 00007FFDFF1B8F23

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(!isSome())$MOZ_RELEASE_ASSERT(!mCurrentSpan.IsEmpty() || mNextSpanOrEmpty.IsEmpty())$MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(RemainingBytes() >= 1)$MOZ_RELEASE_ASSERT(aStart <= aEnd)$MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len)))$MOZ_RELEASE_ASSERT(isSome())$MOZ_RELEASE_ASSERT(mNextSpanOrEmpty.LengthBytes() >= 1)
API String ID: 4206212132-1811951072
Opcode ID: 8006fa6fceefc59e7768816f758d178eb469b5493a8921a7e47355d3767c29c1
Instruction ID: 4677a7fd3d83a0420766068cecb1629400e671b34c79e0e035ba7118d874ecd5
Opcode Fuzzy Hash: 8006fa6fceefc59e7768816f758d178eb469b5493a8921a7e47355d3767c29c1
Instruction Fuzzy Hash: 6AD1CE72B08B85CAEB609B15E450BAA77A4FB89B84F458235DFAC43799DF3CD446C700

Function 00007FFDFF1A8670 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A8737
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A8761
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A8773
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A87C8
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A88AE
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A88CE
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A88F2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A8913
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A8934

Strings

MOZ_RELEASE_ASSERT(malloc_initialized), xrefs: 00007FFDFF1A88D6
MOZ_RELEASE_ASSERT(!mArena || arena == mArena), xrefs: 00007FFDFF1A88F7
MOZ_RELEASE_ASSERT(mNode->mArenaId == mNode->mArena->mId), xrefs: 00007FFDFF1A8918

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Leaveabort$Enter$_errno
String ID: MOZ_RELEASE_ASSERT(!mArena || arena == mArena)$MOZ_RELEASE_ASSERT(mNode->mArenaId == mNode->mArena->mId)$MOZ_RELEASE_ASSERT(malloc_initialized)
API String ID: 1061758205-2543211959
Opcode ID: ad38a8c41b5acbfc384454e48bb0504778eefcfe0706927fe553f339d06c9237
Instruction ID: 9fd3d5095c388486a659377e856b52646310d2947bd2b3cb46b9ade0b921dfcf
Opcode Fuzzy Hash: ad38a8c41b5acbfc384454e48bb0504778eefcfe0706927fe553f339d06c9237
Instruction Fuzzy Hash: 29715823F19A4282FB558B569924B7863A1AF44BB0F144731CE3D8BBE8EF2CE4558304

Function 00007FFDFF1F32B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94stringwindowCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FFDFF1F3321
SymSetOptions.DBGHELP ref: 00007FFDFF1F3333
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F3339
SymInitialize.DBGHELP ref: 00007FFDFF1F334A
GetCurrentProcess.KERNEL32 ref: 00007FFDFF1F3361
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1F3371
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F33A4
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F33D9
SymFromAddr.DBGHELP ref: 00007FFDFF1F3412
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F3431
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1F3450
GetLastError.KERNEL32 ref: 00007FFDFF1F347F
FormatMessageA.KERNEL32 ref: 00007FFDFF1F34B2
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F34C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F34F4
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1F34F9
LocalFree.KERNEL32 ref: 00007FFDFF1F3503

Strings

X, xrefs: 00007FFDFF1F33EF

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentInitializeProcess__acrt_iob_func$AddrEnterErrorFormatFreeFromLastLeaveLocalMessageOptionsfflush
String ID: X
API String ID: 2944712559-3081909835
Opcode ID: 34560acf0fe2832e09a67f94cbddacd061426e9d15db419cca75be1c03a9caac
Instruction ID: a6397a17ef6d266182fbd2d10deac9e9d17e9bd0490839c4ddf63b7c71809508
Opcode Fuzzy Hash: 34560acf0fe2832e09a67f94cbddacd061426e9d15db419cca75be1c03a9caac
Instruction Fuzzy Hash: 02416262B096C686F711CB15E824BAAA760AB55780F444235CABD877D9DF7DE048C700

Function 00007FFDFF1B9310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00000000,?,00007FFDFF2F4320,?,00007FFDFF1B9B6B,?,?,?,?,?,?), ref: 00007FFDFF1B935C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF1B9249,?,?,?,?,?), ref: 00007FFDFF1B93E2
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00007FFDFF1B9249,?,?,?,?,?), ref: 00007FFDFF1B93EA
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00007FFDFF1B9249,?,?,?,?,?), ref: 00007FFDFF1B9405
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00000000,?,00007FFDFF2F4320,?,00007FFDFF1B9B6B,?,?,?,?,?,?), ref: 00007FFDFF1B945C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00000000,?,00007FFDFF2F4320,?,00007FFDFF1B9B6B,?,?,?,?,?,?), ref: 00007FFDFF1B947D

Strings

MOZ_RELEASE_ASSERT(aBytes <= RemainingBytes()), xrefs: 00007FFDFF1B93C6
MOZ_RELEASE_ASSERT(RemainingBytes() >= 1), xrefs: 00007FFDFF1B953A
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B9461
MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len))), xrefs: 00007FFDFF1B9440

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abortmemcpy
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(RemainingBytes() >= 1)$MOZ_RELEASE_ASSERT(aBytes <= RemainingBytes())$MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len)))
API String ID: 985927305-1561162902
Opcode ID: 0a4d4bc84f12bd6bfd608edcd99b1c61562ac97aade969f961087188011f1346
Instruction ID: e375ff3e8e60e80774a14e0d0cd78611201709a33696032a84dfa615b9f9fc23
Opcode Fuzzy Hash: 0a4d4bc84f12bd6bfd608edcd99b1c61562ac97aade969f961087188011f1346
Instruction Fuzzy Hash: 3951A462F19A4185EB109F26E860AA97365BB59BD4F848631DF7D837E9DF3CE042C700

Function 00007FFDFF1A3120 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A316D
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3190
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A319F
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A31FC
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A321E
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3244
VirtualFree.KERNEL32 ref: 00007FFDFF1A328C
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A32B9
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A32D3
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A331D

Strings

MOZ_CRASH(), xrefs: 00007FFDFF1A3301

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualabortmemset
String ID: MOZ_CRASH()
API String ID: 743283685-2608361144
Opcode ID: 68494dfa4d4a6d8781dd62b58b814b325bc393c877026d96bed0eff64da3a42e
Instruction ID: 406bfaa73ab6ace3c0a04749b7f2a2f342cb8059172f0973e49557bf5723d278
Opcode Fuzzy Hash: 68494dfa4d4a6d8781dd62b58b814b325bc393c877026d96bed0eff64da3a42e
Instruction Fuzzy Hash: 93518C62F19A5685EB019B11AC24B6967A4FF49BA0F440335DE3D977ECDF3DE449C200

Function 00007FFDFF1F2E10 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 159threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FFDFF1F2E60
GetThreadId.KERNEL32 ref: 00007FFDFF1F2E7D
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1F2E85
GetCurrentThread.KERNEL32 ref: 00007FFDFF1F2E9B
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1F2EB9
RtlCaptureContext.NTDLL ref: 00007FFDFF1F2ED6
GetThreadContext.KERNEL32 ref: 00007FFDFF1F2EE4
RtlLookupFunctionEntry.NTDLL ref: 00007FFDFF1F2FB6
RtlVirtualUnwind.NTDLL ref: 00007FFDFF1F2FED

Strings

#%02u: ??? (???:???), xrefs: 00007FFDFF1F2E10

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Thread$ContextCurrent$CaptureCriticalEntryFunctionInitializeLookupSectionUnwindVirtualmemset
String ID: #%02u: ??? (???:???)
API String ID: 500715747-4117503099
Opcode ID: 72e4ea9b2e68c300adf9148a6d287efa29337f07c7b5c1e4efee14b17cba0929
Instruction ID: f0e515d65acf625f85b2f6759ea89003847eca09c9f64ed6f57b13245f5c768e
Opcode Fuzzy Hash: 72e4ea9b2e68c300adf9148a6d287efa29337f07c7b5c1e4efee14b17cba0929
Instruction Fuzzy Hash: 7D51A162F19BC281EB648B11A820B7A63A0EF55B94F184236DD7E877DCDF7CE4859700

Function 00007FFDFF287940 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF28795A

Part of subcall function 00007FFDFF287B00: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287BD3
Part of subcall function 00007FFDFF287B00: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287C29
Part of subcall function 00007FFDFF287B00: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287C65

RtlUnwindEx.NTDLL ref: 00007FFDFF287A87
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287ABE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287AE2
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287AE7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF287AEC

Strings

_Unwind_Resume() can't return, xrefs: 00007FFDFF287ACE
_Unwind_Resume, xrefs: 00007FFDFF287AC7
libunwind: %s - %s, xrefs: 00007FFDFF287AC0
libunwind: _Unwind_Resume(ex_obj=%p), xrefs: 00007FFDFF287960

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_func$Unwindabortfflush
String ID: _Unwind_Resume$_Unwind_Resume() can't return$libunwind: %s - %s$libunwind: _Unwind_Resume(ex_obj=%p)
API String ID: 1489409410-3900785416
Opcode ID: 097bd26999f5dafbd0be5f0e3283ba9cf22f21a2599a3cf436b796a6cce58721
Instruction ID: 4b9156b6f9d183e9d9d05296df0e636abf132b088ce9a2753d124f28d3097015
Opcode Fuzzy Hash: 097bd26999f5dafbd0be5f0e3283ba9cf22f21a2599a3cf436b796a6cce58721
Instruction Fuzzy Hash: 75414E21D0CBC281F7369B54A4217F9A364FFD9344F006326EAD942A99EF79D2D2C740

Function 00007FFDFF1A7930 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A7944
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF1A3C98,?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A79A7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF1A3C98,?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A79D6
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00007FFDFF1A3C98,?,?,00000000,?,00007FFDFF1A881E), ref: 00007FFDFF1A7A28
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A7A46
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7A89

Strings

MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena), xrefs: 00007FFDFF1A79BA
basic_string, xrefs: 00007FFDFF1A7931
MOZ_RELEASE_ASSERT(node) (Double-free?), xrefs: 00007FFDFF1A798B
MOZ_RELEASE_ASSERT(node->mArenaId == node->mArena->mId), xrefs: 00007FFDFF1A7A6D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSectionabort$Enter$Leave
String ID: MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena)$MOZ_RELEASE_ASSERT(node) (Double-free?)$MOZ_RELEASE_ASSERT(node->mArenaId == node->mArena->mId)$basic_string
API String ID: 2515859248-2598928229
Opcode ID: 6171fe9ae348dd673af00544cf7611f5c5683862311a8f4e40e4011c62bb718c
Instruction ID: e5737989314b0ec89955d4b537bdbc9411b22fee966a2bab089a3eb6b2573db0
Opcode Fuzzy Hash: 6171fe9ae348dd673af00544cf7611f5c5683862311a8f4e40e4011c62bb718c
Instruction Fuzzy Hash: 15310926B19A4685EB159F15E970A6877A4FF48BA0F444336CE7DC77E8DF2CA50A8300

Function 00007FFDFF1C16A0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1C1712
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1C1733
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1C1754
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1C1775
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1C17CA

Strings

MOZ_RELEASE_ASSERT(aTag > 0 && static_cast<DeserializerTagAtomic>(aTag) <= static_cast<DeserializerTagAtomic>(sDeserializerCount)) (Out-of-range tag value), xrefs: 00007FFDFF1C17AE
MOZ_RELEASE_ASSERT(!!aMarkerTypeNameFunction), xrefs: 00007FFDFF1C1717
MOZ_RELEASE_ASSERT(!!aMarkerSchemaFunction), xrefs: 00007FFDFF1C1738
MOZ_RELEASE_ASSERT(!!aDeserializer), xrefs: 00007FFDFF1C16F6
MOZ_RELEASE_ASSERT(tag <= DeserializerMax) (Too many deserializers, consider increasing DeserializerMax. Or is a deserializer stored again and again?), xrefs: 00007FFDFF1C1759

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(!!aDeserializer)$MOZ_RELEASE_ASSERT(!!aMarkerSchemaFunction)$MOZ_RELEASE_ASSERT(!!aMarkerTypeNameFunction)$MOZ_RELEASE_ASSERT(aTag > 0 && static_cast<DeserializerTagAtomic>(aTag) <= static_cast<DeserializerTagAtomic>(sDeserializerCount)) (Out-of-range tag value)$MOZ_RELEASE_ASSERT(tag <= DeserializerMax) (Too many deserializers, consider increasing DeserializerMax. Or is a deserializer stored again and again?)
API String ID: 4206212132-3713037249
Opcode ID: e6492c535b4a329a4660446a0e85e15e98d628f1e2fffbc33ab229e0b87b654e
Instruction ID: 9b87ab0518381bfbd012eea04a38c8aee25fb83b04971e23943e06f3e5672547
Opcode Fuzzy Hash: e6492c535b4a329a4660446a0e85e15e98d628f1e2fffbc33ab229e0b87b654e
Instruction Fuzzy Hash: 61313C76B16B4289EB459F05E860BA43369FB98744F914231CA7DC33E9DF3CA115C700

Function 00007FFDFF23D020 Relevance: 16.9, APIs: 10, Strings: 1, Instructions: 426COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF286B90: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00007FFDFF288CD3,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFDFF286BBC

Part of subcall function 00007FFDFF287940: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF28795A
Part of subcall function 00007FFDFF287940: RtlUnwindEx.NTDLL ref: 00007FFDFF287A87
Part of subcall function 00007FFDFF287940: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287ABE
Part of subcall function 00007FFDFF287940: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287AE2
Part of subcall function 00007FFDFF287940: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF287AE7
Part of subcall function 00007FFDFF287940: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF287AEC

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00007FFDFF2F4320,00007FFDFF23D080), ref: 00007FFDFF23D21B
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00007FFDFF2F4320,00007FFDFF23D080), ref: 00007FFDFF23D233
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00007FFDFF2F4320,00007FFDFF23D080), ref: 00007FFDFF23D254
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00007FFDFF2F4320,00007FFDFF23D080), ref: 00007FFDFF23D34C
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?), ref: 00007FFDFF23D449
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?), ref: 00007FFDFF23D472

Strings

basic_string, xrefs: 00007FFDFF23D074

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: memcpy$__acrt_iob_func$Unwindabortfflushmemset
String ID: basic_string
API String ID: 799922112-1742559592
Opcode ID: 9442ec69d5b82701f7c3453c842e8d6011ec57b84a91e4a4f14aee343ba1ad5e
Instruction ID: b73048a52c41633ba484d7354b9f1965e20940d9d1c26a52bbfad23f394e1c13
Opcode Fuzzy Hash: 9442ec69d5b82701f7c3453c842e8d6011ec57b84a91e4a4f14aee343ba1ad5e
Instruction Fuzzy Hash: E7D12991F0869945EB109B629924ABD5751AB05BF4FC84731EE7CCB7CAEE3CE582C300

Function 00007FFDFF1BDCE0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 308COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BE0CA
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BE0EB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BE10C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BE12D

Strings

MOZ_RELEASE_ASSERT(len > 0), xrefs: 00007FFDFF1BE0AE
%lld, xrefs: 00007FFDFF1BDD93, 00007FFDFF1BDE59, 00007FFDFF1BDEF2, 00007FFDFF1BDF92, 00007FFDFF1BDFD6
MOZ_RELEASE_ASSERT(is<T>()), xrefs: 00007FFDFF1BE0CF
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1BE111
MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST)), xrefs: 00007FFDFF1BE0F0

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: %lld$MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(categoryPairIndex <= uint32_t(ProfilingCategoryPair::LAST))$MOZ_RELEASE_ASSERT(is<T>())$MOZ_RELEASE_ASSERT(len > 0)
API String ID: 4206212132-460166677
Opcode ID: 29cb456eced0ee6102f34184d17fd155af9c3c8e075c481a3e2f34b2a747e129
Instruction ID: ec3bae7a0449f3abb41db1c69725238c719a95c6a975e0399833d495415ff398
Opcode Fuzzy Hash: 29cb456eced0ee6102f34184d17fd155af9c3c8e075c481a3e2f34b2a747e129
Instruction Fuzzy Hash: 99D17A62F08B4695EB549B15E864AA92365FB45B94F804332DF3D833E8EF3CE546C300

Function 00007FFDFF1B7DE0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1B7E2C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B7EE9
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1B7EF1
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1B7F0C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B7F63
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B7F84

Strings

MOZ_RELEASE_ASSERT(aBytes <= RemainingBytes()), xrefs: 00007FFDFF1B7ECD
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B7F68
MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len))), xrefs: 00007FFDFF1B7F47

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abortmemcpy
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aBytes <= RemainingBytes())$MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len)))
API String ID: 985927305-4141780349
Opcode ID: c11e41605bc9ec9ce21bb33fec3cc7456cb3fb5bcd710b376ac1dfef0a10a06a
Instruction ID: 690a6ef7b5d72a010f494b1f4432fb7d13b875f54b79f844aa76eba1dfae33b3
Opcode Fuzzy Hash: c11e41605bc9ec9ce21bb33fec3cc7456cb3fb5bcd710b376ac1dfef0a10a06a
Instruction Fuzzy Hash: 51419162B19B0186EB15CF55E8606A97361AF48794F448731DF7D837E9DF3CE4858600

Function 00007FFDFF1A4280 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A42AF
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A42D2
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A42E1
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A430E
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A43D2

Strings

: (malloc) Error initializing arena, xrefs: 00007FFDFF1A4415
<jemalloc>, xrefs: 00007FFDFF1A43FA

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2978645861-3894294050
Opcode ID: 9aa0327d33deb4f0a8ed1c3ed75d32432c7bcf8adb93fca1e2813a0106e777cd
Instruction ID: 11117393e7c246e9115f0e3a4b32d6a254e8d30d29caa61cfd580fdea24d8503
Opcode Fuzzy Hash: 9aa0327d33deb4f0a8ed1c3ed75d32432c7bcf8adb93fca1e2813a0106e777cd
Instruction Fuzzy Hash: 35315A23B19A5281FB149B11E8B4A7963A0EF84B90F480636DD7E8B7ECDF6DE455C300

Function 00007FFDFF1CFC20 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1CFF38
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00007FFDFF1CFFBA
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00007FFDFF1D005F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00007FFDFF1D0080

Strings

MOZ_RELEASE_ASSERT(isSome()), xrefs: 00007FFDFF1D0043
MOZ_RELEASE_ASSERT(RemainingBytes() >= 1), xrefs: 00007FFDFF1CFF1C
MOZ_RELEASE_ASSERT(!isSome()), xrefs: 00007FFDFF1CFF9E
MOZ_RELEASE_ASSERT(!mCurrentSpan.IsEmpty() || mNextSpanOrEmpty.IsEmpty()), xrefs: 00007FFDFF1D0064

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(!isSome())$MOZ_RELEASE_ASSERT(!mCurrentSpan.IsEmpty() || mNextSpanOrEmpty.IsEmpty())$MOZ_RELEASE_ASSERT(RemainingBytes() >= 1)$MOZ_RELEASE_ASSERT(isSome())
API String ID: 4206212132-3012181549
Opcode ID: ce64a89b7adc102cfacbbe4354ba55cbc538d3d2681678c3ee686e96b7bbd51f
Instruction ID: 9388c4137fbf292d1ce8206d1957d5a6996797dfff42a1170a61b4d66df0feff
Opcode Fuzzy Hash: ce64a89b7adc102cfacbbe4354ba55cbc538d3d2681678c3ee686e96b7bbd51f
Instruction Fuzzy Hash: 78C1CF73B08B8586EB20CB15E464BAA77A5FB88B88F458235DEAC43799CF3CD445C700

Function 00007FFDFF1A230A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A2311
VirtualAlloc.KERNEL32 ref: 00007FFDFF1A2335
VirtualFree.KERNEL32 ref: 00007FFDFF1A2354
_write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1A2377
_write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1A238B
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A23D4
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A245F

Strings

<jemalloc>, xrefs: 00007FFDFF1A235E
: (malloc) Error in VirtualFree(), xrefs: 00007FFDFF1A2379

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$LeaveVirtual_write$AllocEnterFree
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 3260593319-2186867486
Opcode ID: 80d0ccbccb35580c4c8f702aba0e3dbdaefcd2d3d483ca97f681de85f009b995
Instruction ID: 94996aefc75aa1f23487930ad8de9256d4e035a2a5d49bf4dce8e63d5bd4d838
Opcode Fuzzy Hash: 80d0ccbccb35580c4c8f702aba0e3dbdaefcd2d3d483ca97f681de85f009b995
Instruction Fuzzy Hash: E631DC13F0AA9282FB104B21A824B392750BF99B80F091338CD7E9B3E9DF6CE5059300

Function 00007FFDFF2318B0 Relevance: 12.5, APIs: 7, Strings: 1, Instructions: 465COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF231922
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF2319D0
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF231AE5
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF231B6C
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF231BA2
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF231CC0
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF231D5F

Strings

0, xrefs: 00007FFDFF231972

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 63b63814bbcfadec44638506f77246782186ed9a7e4ed058b359e585b1ca6a19
Instruction ID: c0edce6861ee220abb8ad0daf4240baf928e8d5bab07593ab084fedb18cca0ed
Opcode Fuzzy Hash: 63b63814bbcfadec44638506f77246782186ed9a7e4ed058b359e585b1ca6a19
Instruction Fuzzy Hash: 0D1291B7A046818BDB15CF29C8A06B87791FB59B98F054B26DA3E8B7C8DB39D141C700

Function 00007FFDFF1B9840 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B98C4
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B98E5
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B99D8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B9A30

Part of subcall function 00007FFDFF1B9310: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00000000,?,00007FFDFF2F4320,?,00007FFDFF1B9B6B,?,?,?,?,?,?), ref: 00007FFDFF1B935C

Strings

MOZ_RELEASE_ASSERT(aBytes <= RemainingBytes()), xrefs: 00007FFDFF1B98A8, 00007FFDFF1B99BC
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B9A14
MOZ_RELEASE_ASSERT(aBytes <= aReader.RemainingBytes()), xrefs: 00007FFDFF1B98C9

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort$memcpy
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aBytes <= RemainingBytes())$MOZ_RELEASE_ASSERT(aBytes <= aReader.RemainingBytes())
API String ID: 1296626122-114971754
Opcode ID: ebde351a9eb0d2f8cfea78cde1f6794abf86003a0012f58c892f2e3f96ea6ed1
Instruction ID: 0be0068465e679eb52febd7143d6116628559054c6c9ec0ae783e878d6cdc4c2
Opcode Fuzzy Hash: ebde351a9eb0d2f8cfea78cde1f6794abf86003a0012f58c892f2e3f96ea6ed1
Instruction Fuzzy Hash: F451A462F15B0686EB158F16E960A697360BB58B94F809635DF7D837D9EF3CE0428700

Function 00007FFDFF1AE5E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AE64D
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1AE6C6
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1AE6E1
VirtualProtect.KERNEL32 ref: 00007FFDFF1AE790
VirtualProtect.KERNEL32 ref: 00007FFDFF1AE7C0
InitializeCriticalSectionEx.KERNEL32 ref: 00007FFDFF1AE819

Strings

MOZ_RELEASE_ASSERT(isSome()), xrefs: 00007FFDFF1AE631

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$ProtectVirtual$EnterInitializeLeaveabort
String ID: MOZ_RELEASE_ASSERT(isSome())
API String ID: 4100229881-2302506790
Opcode ID: da4fc6c7cf072031a680bfd5193c08f418a02d3ec1b07e7ac68d17c7c8b1dbf8
Instruction ID: 06f7e2daafff52f4b64b6d341d25546ff12c3ae95f10da44b059d4a2951bb8ff
Opcode Fuzzy Hash: da4fc6c7cf072031a680bfd5193c08f418a02d3ec1b07e7ac68d17c7c8b1dbf8
Instruction Fuzzy Hash: 71518E23B1C7C185E760DB15E460BAAB7A0FB85780F444235DAAD87AD9DF3CE445CB40

Function 00007FFDFF1AA210 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 371COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA6CC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA6F7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA71D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA746
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA76F

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AA6B0, 00007FFDFF1AA6D6, 00007FFDFF1AA6FC, 00007FFDFF1AA72A, 00007FFDFF1AA753

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: fef64e5501dab92a6ff740d7369abb4096fef12c006325a827d3abcbc59d8816
Instruction ID: d95abc34f5322a56eabc820fcd5b3831000828567c69302dc01c886aa145c10d
Opcode Fuzzy Hash: fef64e5501dab92a6ff740d7369abb4096fef12c006325a827d3abcbc59d8816
Instruction Fuzzy Hash: DFF14A23B09B4181EF598B25D464B3967A4FF45BB4F188BB5DE7E4A3D8DF38D4628200

Function 00007FFDFF1AADF0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 370COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB27E
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB2A9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB2CF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB2F8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB320

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AB262, 00007FFDFF1AB288, 00007FFDFF1AB2AE, 00007FFDFF1AB2DC, 00007FFDFF1AB304

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: bfef39aae52d314ae0869cff8fea727d61e83f8ad273812f3cafb9acb1be788b
Instruction ID: fc80dca4f436f71fedcdeaa6863bc863b188d8ed0093b974b7c203c634f03d79
Opcode Fuzzy Hash: bfef39aae52d314ae0869cff8fea727d61e83f8ad273812f3cafb9acb1be788b
Instruction Fuzzy Hash: 74E14D73B0AB8180EB65CB25D9607396794AF44BB8F188735DE7D4A3E8DF3DE4618200

Function 00007FFDFF1B2460 Relevance: 10.9, APIs: 7, Instructions: 369memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1B24A6
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1B24BD
EncodePointer.KERNEL32 ref: 00007FFDFF1B2518
EncodePointer.KERNEL32 ref: 00007FFDFF1B2558
VirtualProtect.KERNEL32 ref: 00007FFDFF1B2639
InitializeCriticalSectionEx.KERNEL32 ref: 00007FFDFF1B2A29

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$EncodePointer$EnterInitializeLeaveProtectVirtual
String ID:
API String ID: 733221412-0
Opcode ID: 2635138748efc718053542a9589dc6fbbd95bdec83796a0db75110f5ae55785d
Instruction ID: 8fa4108d2ed4f97ee41d1e9bcbb90a7a2c9204f2f38d324e05ac982f31944ec8
Opcode Fuzzy Hash: 2635138748efc718053542a9589dc6fbbd95bdec83796a0db75110f5ae55785d
Instruction Fuzzy Hash: 8C027C33A08681C6EB62CB05E0A4F6D67A1EB89754F154225DFAD477D8CFBDE489CB00

Function 00007FFDFF1A9680 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9AC6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9AD6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9AFF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9B20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9B48

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A9AA5, 00007FFDFF1A9AE3, 00007FFDFF1A9B04, 00007FFDFF1A9B2C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 91fa7406892c3f5383f222e17024fcf797821dadbd6dd9dd826c08a7f3d8715d
Instruction ID: f49d59286ca501bb573bb157fdc076fc9ebef4019b6e12d347ad21d30026ee94
Opcode Fuzzy Hash: 91fa7406892c3f5383f222e17024fcf797821dadbd6dd9dd826c08a7f3d8715d
Instruction Fuzzy Hash: 91E1F463B19B8580EB158F15D96073877A1AB84BB4F58C735DA7E8B7D8DF3DE4A08200

Function 00007FFDFF1A8B60 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A8F67, 00007FFDFF1A8F95, 00007FFDFF1A8FC6, 00007FFDFF1A8FEE

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-1351931279
Opcode ID: 4533f9e8d757173b5dfc4fac8eaa2584a68682a082190cbdb92822fcc0644e84
Instruction ID: b94ca9078c563e9df3e34ea71cfc0f1080cbd4b1101278ad7c22e268daa86ab0
Opcode Fuzzy Hash: 4533f9e8d757173b5dfc4fac8eaa2584a68682a082190cbdb92822fcc0644e84
Instruction Fuzzy Hash: 07D12973B1AB8180EB258B25D9607787791EB84BB4F188735DA7D4B7D8DF3CE4A08204

Function 00007FFDFF1B63D0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 262threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1B6412
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B651F
InitializeConditionVariable.KERNEL32 ref: 00007FFDFF1B6575
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF1B6616
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B6819

Strings

MOZ_RELEASE_ASSERT(mCaptureOptions != StackCaptureOptions::NoStack), xrefs: 00007FFDFF1B67FD

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeVariableabortmemset
String ID: MOZ_RELEASE_ASSERT(mCaptureOptions != StackCaptureOptions::NoStack)
API String ID: 1731547556-2505031320
Opcode ID: dc5c6dc8187874c79003195996ac24b4bf01e5ab187cd73106739fe354377c1e
Instruction ID: 9fefcee922923d3068bf12996349131ba49856e526b04262682c6c74d66aa7bc
Opcode Fuzzy Hash: dc5c6dc8187874c79003195996ac24b4bf01e5ab187cd73106739fe354377c1e
Instruction Fuzzy Hash: 49D14A22B19BC2C5E7218B21E4607EA67A0FB95784F444235DBAD47BEADF3CE155CB00

Function 00007FFDFF1D21A0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1D1C60,?,?,?,?,00000000), ref: 00007FFDFF1D2438
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1D1C60,?,?,?,?,00000000), ref: 00007FFDFF1D2459
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1D1C60,?,?,?,?,00000000), ref: 00007FFDFF1D247A

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1D243D
MOZ_RELEASE_ASSERT(!mNextSpanOrEmpty.IsEmpty()), xrefs: 00007FFDFF1D245E
MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len))), xrefs: 00007FFDFF1D241C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(!mNextSpanOrEmpty.IsEmpty())$MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len)))
API String ID: 4206212132-1303860549
Opcode ID: 9d6758811e040c27546bdffea3a5fbfbbd974b52bfa60c025306e93ef3b3a7c6
Instruction ID: 75e0f0312e3fbd6286cf31a194f3f2f0ec75eadb058c24aa9adc1609745c58d6
Opcode Fuzzy Hash: 9d6758811e040c27546bdffea3a5fbfbbd974b52bfa60c025306e93ef3b3a7c6
Instruction Fuzzy Hash: DC913673E05B4186EB258F15E460B6973B1FB58B50F488635DABD47798EFBCE4908340

Function 00007FFDFF1B46B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B47D6
AcquireSRWLockShared.KERNEL32 ref: 00007FFDFF1B489F
ReleaseSRWLockShared.KERNEL32 ref: 00007FFDFF1B48C3
AcquireSRWLockExclusive.KERNEL32 ref: 00007FFDFF1B4925
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFDFF1B4964

Part of subcall function 00007FFDFF1F4870: QueryPerformanceCounter.KERNEL32 ref: 00007FFDFF1F48A0
Part of subcall function 00007FFDFF1F4870: EnterCriticalSection.KERNEL32 ref: 00007FFDFF1F48AD
Part of subcall function 00007FFDFF1F4870: LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1F48DC
Part of subcall function 00007FFDFF1F4870: GetTickCount64.KERNEL32 ref: 00007FFDFF1F48EA

Strings

DllLoad, xrefs: 00007FFDFF1B4701

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Lock$AcquireCriticalExclusiveReleaseSectionShared$Count64CounterEnterLeavePerformanceQueryTickstrlen
String ID: DllLoad
API String ID: 355816014-2863419206
Opcode ID: f711674284b90ca27bedf5df5db004e743a7014576ec90bd63d90e6163517d02
Instruction ID: 8c420d0459845cc3fc3376d69d732b96fd68a71b4396d27017eb6b5d7b6c4107
Opcode Fuzzy Hash: f711674284b90ca27bedf5df5db004e743a7014576ec90bd63d90e6163517d02
Instruction Fuzzy Hash: 11711022F09B8285EB64DF55E4A0BB963A0EB85794F048235DFBD46BE9DF3CE4548700

Function 00007FFDFF1BC000 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1D0F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1D0FE7
Part of subcall function 00007FFDFF1D0F60: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1D1018

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1BC254

Strings

embedderInnerWindowID, xrefs: 00007FFDFF1BC18E
tabID, xrefs: 00007FFDFF1BC07D
innerWindowID, xrefs: 00007FFDFF1BC0B7
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1BC238
url, xrefs: 00007FFDFF1BC11F

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort$strlen
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$embedderInnerWindowID$innerWindowID$tabID$url
API String ID: 2656325428-3706838526
Opcode ID: 9ff456b8ba0322114b155801410619e1aee2aad73853af6b54da8fa4253792ee
Instruction ID: ee77ddc08f1cca7f7092105a3550a31a9f9fc982e5ff69f2b0d20a6a3c6b90ea
Opcode Fuzzy Hash: 9ff456b8ba0322114b155801410619e1aee2aad73853af6b54da8fa4253792ee
Instruction Fuzzy Hash: EF617F22A08B4286EB118B29E4607A97364FF85794F404332EF7D567E8EF3DE145C700

Function 00007FFDFF1AB9A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9B5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9BD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9C7
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9D1
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB9F2

Strings

MOZ_CRASH(), xrefs: 00007FFDFF1AB9D6

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_func$abortfputcfputs
String ID: MOZ_CRASH()
API String ID: 2697642930-2608361144
Opcode ID: 7ab5cd932dbb7aa9efb3a8e99077392c4fe44b9f8af130db5fe4c5978435caec
Instruction ID: 2852ed9671732dfa52c844831b854f8505e1ab6b629162ee8c2691ab7f052b59
Opcode Fuzzy Hash: 7ab5cd932dbb7aa9efb3a8e99077392c4fe44b9f8af130db5fe4c5978435caec
Instruction Fuzzy Hash: 87F08221F0924249FB08A751A879BB95356AF94BC5F408235CE3E8B3DECF1CA4424300

Function 00007FFDFF28F9E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,00007FFDFF285789,?,00007FFDFF2F4320,?,00007FFDFF1A84A3,?,?,?,?,?,?), ref: 00007FFDFF28FA04
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,00007FFDFF285789,?,00007FFDFF2F4320,?,00007FFDFF1A84A3,?,?,?,?,?,?), ref: 00007FFDFF28FA2F

Part of subcall function 00007FFDFF286B20: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FFDFF28FA41,?,?,00000000,?,00007FFDFF285789,?,00007FFDFF2F4320,?,00007FFDFF1A84A3), ref: 00007FFDFF286B37

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,00007FFDFF285789,?,00007FFDFF2F4320,?,00007FFDFF1A84A3,?,?,?,?,?,?), ref: 00007FFDFF28FA46
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,00007FFDFF285789,?,00007FFDFF2F4320,?,00007FFDFF1A84A3,?,?,?,?,?,?), ref: 00007FFDFF28FA50
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,00007FFDFF285789,?,00007FFDFF2F4320,?,00007FFDFF1A84A3,?,?,?,?,?,?), ref: 00007FFDFF28FA55

Strings

libc++abi: , xrefs: 00007FFDFF28FA06

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfabortfputc
String ID: libc++abi:
API String ID: 2403753412-4230439723
Opcode ID: ae7d9af0e107d2b88b5facf0ae1394903c7e0c79aa2800e1cad6ac27bd9183e9
Instruction ID: 9627b1093365e1238b6895dbe8f1024e1641dc53d40697635709ed5a3427ad48
Opcode Fuzzy Hash: ae7d9af0e107d2b88b5facf0ae1394903c7e0c79aa2800e1cad6ac27bd9183e9
Instruction Fuzzy Hash: C0F09020709B9542E714A751F865BAEA7A5EF997C0F108239EEADC7BDEDE2CD4018700

Function 00007FFDFF1ACD40 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FFDFF1B4EA1
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFDFF1B4EB9
RtlFreeHeap.NTDLL ref: 00007FFDFF1B4F1D
RtlFreeUnicodeString.NTDLL ref: 00007FFDFF1B4F2C
RtlFreeUnicodeString.NTDLL ref: 00007FFDFF1B4F4A
RtlFreeHeap.NTDLL ref: 00007FFDFF1B4F87

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireRelease
String ID:
API String ID: 3897921756-0
Opcode ID: 2fb4e39fee4d3cb03ce39fe25ab7a569b9f864e308b8082a4de786e0988733f9
Instruction ID: 6692f949b7899fc403d540c3c7e627cc65da4848c980f634baa33e6c52c7cdd9
Opcode Fuzzy Hash: 2fb4e39fee4d3cb03ce39fe25ab7a569b9f864e308b8082a4de786e0988733f9
Instruction Fuzzy Hash: 42316022F0A645C1FB199F1AE5A47BC2361AB84B84F488135DB3D477D9DF38E4A2C340

Function 00007FFDFF1B4D70 Relevance: 9.1, APIs: 6, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDFF1ACD1C), ref: 00007FFDFF1B4D8F
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDFF1ACD1C), ref: 00007FFDFF1B4DA3
RtlFreeHeap.NTDLL(?,?,?,?,00007FFDFF1ACD1C), ref: 00007FFDFF1B4E0D
RtlFreeUnicodeString.NTDLL(?,?,?,?,00007FFDFF1ACD1C), ref: 00007FFDFF1B4E1C
RtlFreeUnicodeString.NTDLL(?,?,?,?,00007FFDFF1ACD1C), ref: 00007FFDFF1B4E3A
RtlFreeHeap.NTDLL(?,?,?,?,00007FFDFF1ACD1C), ref: 00007FFDFF1B4E79

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireRelease
String ID:
API String ID: 3897921756-0
Opcode ID: 12784a5c51e06e29612ab1681db7c2e0ba645d1aadabd70205f74e644bd20384
Instruction ID: 4988b97c54c748f725098baca2bc6d2aee17458077417b8ca3ba21d57651d7f9
Opcode Fuzzy Hash: 12784a5c51e06e29612ab1681db7c2e0ba645d1aadabd70205f74e644bd20384
Instruction Fuzzy Hash: 50314A62F0A60581EB199F16D6A87AD2361BB84BC4F458532CF3C577D8EF38E4A2D340

Function 00007FFDFF1B7570 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B76CF

Strings

name, xrefs: 00007FFDFF1B7642
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B76B3
Text, xrefs: 00007FFDFF1B759E, 00007FFDFF1B76FA
type, xrefs: 00007FFDFF1B75B3

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$Text$name$type
API String ID: 4206212132-992871366
Opcode ID: 73ef477e4bed453952fad6ef58a3cd032935b2ed80e23db5d8df81217abf289e
Instruction ID: b2df5405f37cf38b94cc5306e3f99efe651639a0bf8c01951db380edbaf2dd9d
Opcode Fuzzy Hash: 73ef477e4bed453952fad6ef58a3cd032935b2ed80e23db5d8df81217abf289e
Instruction Fuzzy Hash: 9A413C66B19B4285EB00DB45E4607AAA3A0EB84790F544231EFAD87BECDF7CD449CB00

Function 00007FFDFF1A1003 Relevance: 7.6, APIs: 5, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FFDFF1A1075
_execute_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A1099
Sleep.KERNEL32 ref: 00007FFDFF1A10E5
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A112B
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A1145

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: Sleep_initterm$_execute_onexit_table
String ID:
API String ID: 516936197-0
Opcode ID: 744d8e9911833f193b0933af5282bc4564a23029908ac7898e4185f33218ffbc
Instruction ID: 9cb56106cee17c7c63a61022aa67ea4e2aaa7ee53db82d3bd202f7a3201b5606
Opcode Fuzzy Hash: 744d8e9911833f193b0933af5282bc4564a23029908ac7898e4185f33218ffbc
Instruction Fuzzy Hash: 29412A33F0964389F7529F21E960B7923A1AB44790F048631DE7CDB3D8DF2DA8918B40

Function 00007FFDFF1A3110 Relevance: 7.6, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A316D
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3190
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A319F
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A31FC
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A321E
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A3244
VirtualFree.KERNEL32 ref: 00007FFDFF1A328C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A331D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualabortmemset
String ID:
API String ID: 743283685-0
Opcode ID: ec0113e6a45b7be224d445350977fbcea0fd473510ff661a388307edc510321b
Instruction ID: 9fb08b1d83b1debddd432c16d7c09e338c793f72ecf0f1be42001d8dde090ddc
Opcode Fuzzy Hash: ec0113e6a45b7be224d445350977fbcea0fd473510ff661a388307edc510321b
Instruction Fuzzy Hash: 2D41AC63F29A5685EB118B11A924B696794FF48BE0F480336DE3D9BBDCDF3DE0458200

Function 00007FFDFF1BA710 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FFDFF2F4320,00007FFDFF1BA695,00007FFDFF2F4320,?,?,?,?,?,00007FFDFF1BA5AE), ref: 00007FFDFF1BA75A
GetModuleFileNameW.KERNEL32(?,?,00000000,00007FFDFF2F4320,00007FFDFF1BA695,00007FFDFF2F4320,?,?,?,?,?,00007FFDFF1BA5AE), ref: 00007FFDFF1BA775
GetLastError.KERNEL32(?,?,?,?,?,00007FFDFF1BA5AE), ref: 00007FFDFF1BA780
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FFDFF1BA5AE), ref: 00007FFDFF1BA7B4
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1BA7C2

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: memset$ErrorFileLastModuleNamewcscpy_s
String ID:
API String ID: 2029717089-0
Opcode ID: 3a05b1f4f7fd594bbad88a06efb9bd2ee16a2219c32fb9bd926d7eb587931ee3
Instruction ID: 5ee5a11274e8cfea9c2f8c5f56de29917085821ca5df6facafe519ad4bd5e0f9
Opcode Fuzzy Hash: 3a05b1f4f7fd594bbad88a06efb9bd2ee16a2219c32fb9bd926d7eb587931ee3
Instruction Fuzzy Hash: A021AC23F0960685F718DA236D64B7917A16F89FD0F444631DE3E8B7D9EE3DA0428200

Function 00007FFDFF1A6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-1351931279
Opcode ID: 5dcfbd0c6f3383fe61d4c56974f5986c6c773369bbe7a148864a6c796e3de3bd
Instruction ID: 79eb9a0099ac9f09f22e8c03408ab625ab979487b3ff86d17de3562766ed204b
Opcode Fuzzy Hash: 5dcfbd0c6f3383fe61d4c56974f5986c6c773369bbe7a148864a6c796e3de3bd
Instruction Fuzzy Hash: 2591F273B09B4180EB258B15D96076877A1AB88FB4F188735DE7D4B7E8DF3DE4A18200

Function 00007FFDFF1A9EB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA1C1
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA1E2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA203

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AA1A5, 00007FFDFF1AA1C6, 00007FFDFF1AA1E7

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 7a3398cd30242f0edb3619ce3d868cc7e7c1086afa907d4467bf32d9ddeaadac
Instruction ID: d659620fef6473427622b96245a5a7a869c26c49f3fbc59e6cd1cd9d1300111f
Opcode Fuzzy Hash: 7a3398cd30242f0edb3619ce3d868cc7e7c1086afa907d4467bf32d9ddeaadac
Instruction Fuzzy Hash: 12914B73B05B4184EB518F15DA607687BA5AB44BB4F588771CE7C4B7D8DF3AE8A28300

Function 00007FFDFF1AB690 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB947
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB968
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB989

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AB92B, 00007FFDFF1AB94C, 00007FFDFF1AB96D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: c134770873ef748d77f7eba37dcd01b26d80d9a13e0a1bb7bda5d9563afdb12e
Instruction ID: ab143be343d05ffae7ac86de86c0cea9e6171c2ef29b6575b1f034e47c3a74ca
Opcode Fuzzy Hash: c134770873ef748d77f7eba37dcd01b26d80d9a13e0a1bb7bda5d9563afdb12e
Instruction Fuzzy Hash: 21811673B0AB8180EB618B1AD56076877A5EB44BB0F598731CE7D4B7E9DF39E8518300

Function 00007FFDFF1A9370 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A962A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A964B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A966C

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A960E, 00007FFDFF1A962F, 00007FFDFF1A9650

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 08761683a3d6222fe92769d7e62d558c0e5f26662aa05662d5056fe8705f5126
Instruction ID: 9ac9ca5d85a7c4ae571a35b1bc4512dd3572257a77c53858cf44d421a1c6204b
Opcode Fuzzy Hash: 08761683a3d6222fe92769d7e62d558c0e5f26662aa05662d5056fe8705f5126
Instruction Fuzzy Hash: 5F814473B0AB4181EB558F159560B6827A0FB54BB0F690721CA7C8B7E8DF78E891C380

Function 00007FFDFF1A7C60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7EF9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7F1A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7F3B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A7EDD, 00007FFDFF1A7EFE, 00007FFDFF1A7F1F

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 92b00c620e7f428943a1ea85407a79a994c9c6ef4123655abbcf12a5697457f4
Instruction ID: 8cae9f70839f057adf3d1b306c152961bcd7c8de84e796b540d75a4795c21f16
Opcode Fuzzy Hash: 92b00c620e7f428943a1ea85407a79a994c9c6ef4123655abbcf12a5697457f4
Instruction Fuzzy Hash: 60811573B0AB8180EB518F15D56076877A5AB84BB0F198331CA7D4B7E9DF3DE9558300

Function 00007FFDFF1AAB00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AADA2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AADC3
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AADE4

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AAD86, 00007FFDFF1AADA7, 00007FFDFF1AADC8

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: b7b7a5ab08781aa74a6b8693c1418aae08ebc4e07ed6c546cdc0d031b8624a66
Instruction ID: 9610316c9536cc03de2b71e740e5a3c62e5df3083d5d4f5f0aae5f082a33cc1e
Opcode Fuzzy Hash: b7b7a5ab08781aa74a6b8693c1418aae08ebc4e07ed6c546cdc0d031b8624a66
Instruction Fuzzy Hash: 32814973B0AB4181EB958B10D560B6877A5FB44BB0F198775CABD4B3E8DF79E8518300

Function 00007FFDFF1B09E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1B0721), ref: 00007FFDFF1B0BD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1B0721), ref: 00007FFDFF1B0BFA

Strings

MOZ_RELEASE_ASSERT(idx < storage_.size()), xrefs: 00007FFDFF1B0BBD
MOZ_RELEASE_ASSERT(mPolicies && !mPolicies->empty()), xrefs: 00007FFDFF1B0BDE

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(idx < storage_.size())$MOZ_RELEASE_ASSERT(mPolicies && !mPolicies->empty())
API String ID: 4206212132-1281164836
Opcode ID: 33e2564d16cba6ef95253e3eeb4905a65429e68b396d8855ec7b5fa28ea42bf4
Instruction ID: 3d27865de5800f3e2ab7371ed7236cf13aee28c55e59ab5e0b1a07dbfedcd01a
Opcode Fuzzy Hash: 33e2564d16cba6ef95253e3eeb4905a65429e68b396d8855ec7b5fa28ea42bf4
Instruction Fuzzy Hash: 49517723B19A4686EB509F11D5A4B686361FB84B94F158736DF7E473E8EF3CE4918300

Function 00007FFDFF1A9C90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9E5F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9E80
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9EA8

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A9E43, 00007FFDFF1A9E64, 00007FFDFF1A9E8C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: d1202b729269641e697328ce04b4cda183700b2d9b2e65b21e3b0e26164c7df1
Instruction ID: 03b435986d9fab94c0f7259283a297333926ac82cf99c7cc8996e03a293a8c5c
Opcode Fuzzy Hash: d1202b729269641e697328ce04b4cda183700b2d9b2e65b21e3b0e26164c7df1
Instruction Fuzzy Hash: E8511773A15B8080DB158F55D8A176877A4EB85B70F688729DB7E8B3E5CF39D4A0C300

Function 00007FFDFF1AB470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00007FFDFF2F4320,-00000097,?,-0000009F,?), ref: 00007FFDFF1AB63F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00007FFDFF2F4320,-00000097,?,-0000009F,?), ref: 00007FFDFF1AB660
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00007FFDFF2F4320,-00000097,?,-0000009F,?), ref: 00007FFDFF1AB688

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AB623, 00007FFDFF1AB644, 00007FFDFF1AB66C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: e56b337af78beb37e872c065aa08cef3c2c99d5c6bb1f27490fa2c59232376dc
Instruction ID: 00b71ab61f3ed43d7d5aa2fb9c865fc6d0da71be38c627e0bc4575dac9c794ef
Opcode Fuzzy Hash: e56b337af78beb37e872c065aa08cef3c2c99d5c6bb1f27490fa2c59232376dc
Instruction Fuzzy Hash: CA512773A15B8080DB25CB55D86176877A4EB95BB4F18972ADA7E8B3E4CF3DD4A0C300

Function 00007FFDFF1A9150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A931F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9340
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9368

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A9303, 00007FFDFF1A9324, 00007FFDFF1A934C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 435441cb83c3bb75befde2e4f82de2ddfa5f3fa5b9657f27542388d00b8249a3
Instruction ID: dc0661d2ab202c1a2377d36d6c34c9cdbdb9393a77b49fa357fe0f52a1b0b985
Opcode Fuzzy Hash: 435441cb83c3bb75befde2e4f82de2ddfa5f3fa5b9657f27542388d00b8249a3
Instruction Fuzzy Hash: F6512873A15B8080DB158F55D86576877A4EB85B70F58832ADA7E8B3E8CF3DD4A0C300

Function 00007FFDFF1AA8D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AAAAF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AAAD0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AAAF9

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AAA93, 00007FFDFF1AAAB4, 00007FFDFF1AAADD

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 18b06ff1fa106fc48319f30effcfda0f40796595d5e2a2f7555e2da1edc9f899
Instruction ID: a556538cffbd1d757b9065c3eb9087bdaaa18dfaf42111958efa3f92d6807cf4
Opcode Fuzzy Hash: 18b06ff1fa106fc48319f30effcfda0f40796595d5e2a2f7555e2da1edc9f899
Instruction Fuzzy Hash: BB515773B04B4182DA48CB55D86176877A4FB81BB0F158B6ADA7E8B3D4DF38D4A2C340

Function 00007FFDFF1B9A40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?), ref: 00007FFDFF1B9BA6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?), ref: 00007FFDFF1B9BC7

Strings

MOZ_RELEASE_ASSERT(RemainingBytes() >= 1), xrefs: 00007FFDFF1B9B8A
MOZ_RELEASE_ASSERT(aString.Length() < std::numeric_limits<Length>::max() / 2) (Double the string length doesn't fit in Length type), xrefs: 00007FFDFF1B9BAB

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(RemainingBytes() >= 1)$MOZ_RELEASE_ASSERT(aString.Length() < std::numeric_limits<Length>::max() / 2) (Double the string length doesn't fit in Length type)
API String ID: 4206212132-2225812616
Opcode ID: c79dac7ed3d4b00b551e23e940c8ab37df897770c8c90709897167c74b5c15b8
Instruction ID: 4ecb2ddaca2a8f7bd00a0349c66e36d7edf8451d9543acd948a9f6b4f324a797
Opcode Fuzzy Hash: c79dac7ed3d4b00b551e23e940c8ab37df897770c8c90709897167c74b5c15b8
Instruction Fuzzy Hash: F941AD63B1560185EB11CF16D860A6573A0AB89B94F858732DE7C877D8DF3CE446C700

Function 00007FFDFF290A60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFDFF290A93
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF290AB5

Strings

LIBUNWIND_PRINT_APIS, xrefs: 00007FFDFF290A8C
libunwind: __unw_init_local(cursor=%p, context=%p), xrefs: 00007FFDFF290ABB

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_funcgetenv
String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_init_local(cursor=%p, context=%p)
API String ID: 1526152877-2955335536
Opcode ID: 04b13816fc31b6cfc080011eaab04b588e8c8863888f01d5bf631ead6396534c
Instruction ID: bbe61a13e16ba61a405a61d2430bd4b728e1d4a487a03a1703245743b0557518
Opcode Fuzzy Hash: 04b13816fc31b6cfc080011eaab04b588e8c8863888f01d5bf631ead6396534c
Instruction Fuzzy Hash: 33713322D18BC182F32A8B38A5557FAA364FFA5355F00A314DFE911652FF39B2D58300

Function 00007FFDFF239766 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF23981C
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF23988F

Strings

CONOUT$, xrefs: 00007FFDFF23977F
terminated, xrefs: 00007FFDFF23982D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: _closememcpy
String ID: terminated$CONOUT$
API String ID: 803185377-3061448572
Opcode ID: 067fdc391832bbd037d16a740f5f6b5b961225eab6512f2c3dba9008eb0eb321
Instruction ID: b5df98474faa22f1ef1efbbf1b4b206163aed9b098f4922d190d62ece3cc0987
Opcode Fuzzy Hash: 067fdc391832bbd037d16a740f5f6b5b961225eab6512f2c3dba9008eb0eb321
Instruction Fuzzy Hash: 70413872F09A1189EB00CF69D8A06AC37B2EB49798F104635DE3DE7BD9CE38D5508750

Function 00007FFDFF1B5C50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFDFF1B5C9F
RtlDuplicateUnicodeString.NTDLL ref: 00007FFDFF1B5CDF

Strings

NtQueryVirtualMemory, xrefs: 00007FFDFF1B5D41
ntdll.dll, xrefs: 00007FFDFF1B5D3A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CurrentDuplicateProcessStringUnicode
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 874982484-2623246514
Opcode ID: 38e44f4406cc80bb72ed8640e3f03bbf273c7515de9b6af49fe7264aba3f7392
Instruction ID: 5170f517892dfdd6ebb68323c6f336b2c2948e4cb42d792decfb31fa62dabd38
Opcode Fuzzy Hash: 38e44f4406cc80bb72ed8640e3f03bbf273c7515de9b6af49fe7264aba3f7392
Instruction Fuzzy Hash: B0218E62B18A8281FB509B21E864BB96764BF44B84F504235DF7DC26EEEF3CE185C704

Function 00007FFDFF1D0F60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1D0FE7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1D1018

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1D0FFC
@, xrefs: 00007FFDFF1D0FA1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abortstrlen
String ID: @$MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))
API String ID: 3923292279-1954329092
Opcode ID: e6ff2f2e7d6412c701b3350d116f738ab0c7be6a5dd00ace40ca0ee54cd89f69
Instruction ID: 17700500dd325e23d21cc6e6fd714648b52e63ed867bccb77a3559e068899179
Opcode Fuzzy Hash: e6ff2f2e7d6412c701b3350d116f738ab0c7be6a5dd00ace40ca0ee54cd89f69
Instruction Fuzzy Hash: 82216F32B18B8185E7208B15E4617AAB764EB897A4F444321EFAD877E9DF3DD0458B00

Function 00007FFDFF1AD070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32 ref: 00007FFDFF1AD0B4
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1AD0DA
SearchPathW.KERNEL32 ref: 00007FFDFF1AD0FD

Strings

.dll, xrefs: 00007FFDFF1AD0A4, 00007FFDFF1AD0ED

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: PathSearch$memset
String ID: .dll
API String ID: 680611649-2738580789
Opcode ID: 1d4a21e1f1d704a60eee4231059701053562865651ae4507a8983a92756dfff5
Instruction ID: 157447a9e63f02f8037040d1ec1b33df26a5eec9ea2a1e4aa6e2e04b0a53adf9
Opcode Fuzzy Hash: 1d4a21e1f1d704a60eee4231059701053562865651ae4507a8983a92756dfff5
Instruction Fuzzy Hash: 8F11C423B0475646EB11DB62AC21BA96351BB84BD0F848631DD6C9B7D4EF7CD082C340

Function 00007FFDFF2911B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,00000000,?,00007FFDFF287BA1), ref: 00007FFDFF2911E1
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF291203

Strings

LIBUNWIND_PRINT_APIS, xrefs: 00007FFDFF2911DA
libunwind: __unw_get_proc_name(cursor=%p, &buf=%p, bufLen=%lu), xrefs: 00007FFDFF29120D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_funcgetenv
String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_name(cursor=%p, &buf=%p, bufLen=%lu)
API String ID: 1526152877-3584756005
Opcode ID: 11db1f280710bc66d6d4a44b2f665609f1605e95136e2276dca0a6a92f0cde2e
Instruction ID: 47e7f39936b599eb738427950f0185e7db808809aa94030650a26e856cdda449
Opcode Fuzzy Hash: 11db1f280710bc66d6d4a44b2f665609f1605e95136e2276dca0a6a92f0cde2e
Instruction Fuzzy Hash: D601F110B1D2A782FB289B16AC319B81B846F59FC4F444375DD7EC77DACE2CA8468300

Function 00007FFDFF1B8E20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(aStart <= aEnd), xrefs: 00007FFDFF1B8F44
MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B8F65

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aStart <= aEnd)
API String ID: 0-2126766247
Opcode ID: 91d68dab7c149eeffc982c3b248413fab82978fa404b41607404b3307b5f8571
Instruction ID: 545e44b751b1b036c18329b0af5a8d730e9f3f951c89ed42ee0c9dcdb322f204
Opcode Fuzzy Hash: 91d68dab7c149eeffc982c3b248413fab82978fa404b41607404b3307b5f8571
Instruction Fuzzy Hash: 27015772F15B41C9EB498B16D864B683360BB49B48F608235CF7C833A9CF7EA5828744

Function 00007FFDFF1B8020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B807F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B80A0

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B8084
MOZ_RELEASE_ASSERT(aCount <= len), xrefs: 00007FFDFF1B8063

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aCount <= len)
API String ID: 4206212132-1435299861
Opcode ID: edb399a82ddbb83db1f7ce6c064d0aeecd0b2c538380663d4e7440af96821aec
Instruction ID: 3867fb97d813895058ea14f91ea3f2f8ec88045a76f05f582a1c847acffae3d5
Opcode Fuzzy Hash: edb399a82ddbb83db1f7ce6c064d0aeecd0b2c538380663d4e7440af96821aec
Instruction Fuzzy Hash: 24F04B71F15B42CAEB058B59D861BA833A0BB44BA4F558331CA3C823D8CF3DA4528700

Function 00007FFDFF1B7F90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDFF1B99F1), ref: 00007FFDFF1B7FF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDFF1B99F1), ref: 00007FFDFF1B8011

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B7FF5
MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len))), xrefs: 00007FFDFF1B7FD4

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len)))
API String ID: 4206212132-499271626
Opcode ID: be378d60a21a268fe7b49221807d1a7799528d9798a1be37aae94c697a017457
Instruction ID: cd057a52a84cf9f71bdd0290bf1cdbcc49fd07807f0df6f8ac76785bba78f2f1
Opcode Fuzzy Hash: be378d60a21a268fe7b49221807d1a7799528d9798a1be37aae94c697a017457
Instruction Fuzzy Hash: AE014B75B16B42C9EB098F69D860A6833A0BB44754F548735CF3C823E8CF3D94558704

Function 00007FFDFF2910A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,00000000,00007FFDFF287B73), ref: 00007FFDFF2910C8
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF2910EA

Strings

LIBUNWIND_PRINT_APIS, xrefs: 00007FFDFF2910C1
libunwind: __unw_get_proc_info(cursor=%p, &info=%p), xrefs: 00007FFDFF2910F0

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_funcgetenv
String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_info(cursor=%p, &info=%p)
API String ID: 1526152877-1935908800
Opcode ID: ff5a0e8a35bf27b82458485aa9cee9329b31a3c1e60840638f7ab77d77a529d1
Instruction ID: 63d3f90f0a743545a7b5eb68986721212f80f9c1eddeb06cbf3d57e39de58af0
Opcode Fuzzy Hash: ff5a0e8a35bf27b82458485aa9cee9329b31a3c1e60840638f7ab77d77a529d1
Instruction Fuzzy Hash: 7301DF10B1C2A382FB049B26AD61BB91B808F00BC5F044235CD3EC73E9DF2CA8868300

Function 00007FFDFF291130 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,00000000,00007FFDFF287B58), ref: 00007FFDFF291154
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF291176

Strings

LIBUNWIND_PRINT_APIS, xrefs: 00007FFDFF29114D
libunwind: __unw_resume(cursor=%p), xrefs: 00007FFDFF29117C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_funcgetenv
String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_resume(cursor=%p)
API String ID: 1526152877-227906034
Opcode ID: 224f5ffdb861268ff1c03b72ede533cc78e67b725fb12dd69d69d32240cf65b6
Instruction ID: 06a90a5e3f022c4ecac7ec63870d576fc90301f5733da67a862732799518c7c0
Opcode Fuzzy Hash: 224f5ffdb861268ff1c03b72ede533cc78e67b725fb12dd69d69d32240cf65b6
Instruction Fuzzy Hash: AEF0F610F0C6A393FB109B25A876ABC17405F11B84F0443B4C97DC73EADE1CA4479300

Function 00007FFDFF291030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,00000000,00007FFDFF287B37), ref: 00007FFDFF291054
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF291076

Strings

LIBUNWIND_PRINT_APIS, xrefs: 00007FFDFF29104D
libunwind: __unw_step(cursor=%p), xrefs: 00007FFDFF29107C

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_funcgetenv
String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_step(cursor=%p)
API String ID: 1526152877-3760164396
Opcode ID: 956a0e9178597dcf12a3d345c786cb14f5a834e9d51d24f0e7afda30e7cd7319
Instruction ID: a1bac6a191fd09948ede8092d9877483d1da3b8550258325b8c684e6b2c59ebd
Opcode Fuzzy Hash: 956a0e9178597dcf12a3d345c786cb14f5a834e9d51d24f0e7afda30e7cd7319
Instruction Fuzzy Hash: 20F09610F0C2E382FB109B159872AB81B509F15B44F044274CDBDC73DADE5EA4469300

Function 00007FFDFF2878D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF2878EB
RaiseException.KERNEL32 ref: 00007FFDFF287924

Strings

libunwind: _Unwind_RaiseException(ex_obj=%p), xrefs: 00007FFDFF2878F1
CCG , xrefs: 00007FFDFF287917

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: ExceptionRaise__acrt_iob_func
String ID: CCG $libunwind: _Unwind_RaiseException(ex_obj=%p)
API String ID: 889724658-1152080672
Opcode ID: d7301fd41601fc3ad014eb31804812a9a723f5c8f348144ef46a55e1e8731c60
Instruction ID: 6c6f2abd07ea3feff79f1b00612e76af5ab68a668838ddb6054ec3403d51d21c
Opcode Fuzzy Hash: d7301fd41601fc3ad014eb31804812a9a723f5c8f348144ef46a55e1e8731c60
Instruction Fuzzy Hash: 3CF02410F18AA242F32597A5A411AF85330AF84394F008231DDADC37E8EE3DD6C38240

Function 00007FFDFF1B9100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B9160
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B9181

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B9165
MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len))), xrefs: 00007FFDFF1B9144

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aStart <= len && (aLength == dynamic_extent || (aStart + aLength <= len)))
API String ID: 4206212132-499271626
Opcode ID: a11606476ee53672a8eee8ce8af2db3faedf1362b14e00101a72d86bf0114e07
Instruction ID: be9a0b00244de2e5e0c420974b84c1bcde67eb607a2b2b3c4e221b01bf4d4a8c
Opcode Fuzzy Hash: a11606476ee53672a8eee8ce8af2db3faedf1362b14e00101a72d86bf0114e07
Instruction Fuzzy Hash: 95E0E574B15A02DDEB059F69E864B643364BB48B44F908331CF3CC23A9DF7CA0058700

Function 00007FFDFF1A6610 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A67DF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A6800
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A6828

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 53cc3300f6d024342cd732ab5661bb0ce4a611919eca8f172d1dc119864b2c60
Instruction ID: 9e6c9accb25af05589be6ee8ac83b9dee9d04f81deaed45a3d6d906111adb8f7
Opcode Fuzzy Hash: 53cc3300f6d024342cd732ab5661bb0ce4a611919eca8f172d1dc119864b2c60
Instruction Fuzzy Hash: 8AF0B775B1AB029CEB059F54E861B683364BB48B44F908671CF7CC23A9DF3DA0068701

Function 00007FFDFF1A7170 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A734F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7370
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7399

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: ec9e1fde90036d805b7a6a7475b44f40904d23a18617e9b19902f21b3663107b
Instruction ID: 504586df0b9fe2080733444c0dfa08001490f86c56f760095a41d375b32eba10
Opcode Fuzzy Hash: ec9e1fde90036d805b7a6a7475b44f40904d23a18617e9b19902f21b3663107b
Instruction Fuzzy Hash: 64F0B775B1AB029DEB099F14E865B683365BB48748F908671CE7CC23A9DF7DA0068701

Function 00007FFDFF1B9190 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B91E9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B920A

Strings

MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent)), xrefs: 00007FFDFF1B91EE
MOZ_RELEASE_ASSERT(aCount <= size()), xrefs: 00007FFDFF1B91CD

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))$MOZ_RELEASE_ASSERT(aCount <= size())
API String ID: 4206212132-2269281326
Opcode ID: 6ca63ecd02d239a1d0fedc5e7520b5cac98e622177a7d6316c5e65867585aa55
Instruction ID: 9dd9f2c60389f86924b11f72e1eea5314f483e3504ac82207a731c8036679982
Opcode Fuzzy Hash: 6ca63ecd02d239a1d0fedc5e7520b5cac98e622177a7d6316c5e65867585aa55
Instruction Fuzzy Hash: A5E07575A19A02DDEB059F55E864B643364BB48744F904232CE3CC23A9DF3C90558710

Function 00007FFDFF23E550 Relevance: 6.5, APIs: 5, Instructions: 275COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF23E63E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF23E64F
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF23E684
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF23E772
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?), ref: 00007FFDFF23E81D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: e4f172410e415b862dfce2066f7c247fbfbb0b0bb200e6a4f4e4ad4d72ebfd7e
Instruction ID: e54ac40ebb013eecc3b26da9f76e8c1bf5def4d5e4a345aa9fd37a5c90054ef5
Opcode Fuzzy Hash: e4f172410e415b862dfce2066f7c247fbfbb0b0bb200e6a4f4e4ad4d72ebfd7e
Instruction Fuzzy Hash: 157128A2F09AA542EF149A169A349B917956F11BF0F584731DE3DCB7C9DE3CE4CA8300

Function 00007FFDFF1A58F2 Relevance: 6.4, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A5973
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A59BE
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A5A06
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A5A8A
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A5ACE

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 7c5cb63e55be01aa855f694a214c856afe551f3a237d1ab4c1a722fd82d40ee7
Instruction ID: 59859883c2f09be4518bc8e933e0fb2de7bff6db2b745e89c2658195828ca22e
Opcode Fuzzy Hash: 7c5cb63e55be01aa855f694a214c856afe551f3a237d1ab4c1a722fd82d40ee7
Instruction Fuzzy Hash: D2519E13B18A5680EB149B1698609792761FF89FF0F194731DE7D8B7E8EF2CE445C200

Function 00007FFDFF1A50A3 Relevance: 6.4, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A512C
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A5144
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A51E7
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A51F7
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A521A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: f1c3b20192f197b63bc9d11cc25272053c5537007c51042e2d440eeb5bf25d5f
Instruction ID: 31227ddf59685235a474a6fe0d8e237771316b028354a3acca6775da4c4c1113
Opcode Fuzzy Hash: f1c3b20192f197b63bc9d11cc25272053c5537007c51042e2d440eeb5bf25d5f
Instruction Fuzzy Hash: 7F519523F1DA4281EB64CB14E860A7A67A4EB85B90F440636DE7D877D8DF3DE481CB00

Function 00007FFDFF1A50E0 Relevance: 6.3, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A512C
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1A5144
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A51E7
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A51F7
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A521A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: c17ee9f0b777b4d9e0182e37f8cf3bb7365f2e8eff9156f4ff3bcc5e39d73716
Instruction ID: 30cee0af67b8024730c31eb13939f0bc888afe716f6cf8abea74c78da918c9ce
Opcode Fuzzy Hash: c17ee9f0b777b4d9e0182e37f8cf3bb7365f2e8eff9156f4ff3bcc5e39d73716
Instruction Fuzzy Hash: 47314323B19A4281EB64CB05E860A7A6764FB89B94F480635DD7D977D8DF3CE541CB00

Function 00007FFDFF1B06A0 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1B070A
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1B075E
GetSystemInfo.KERNEL32 ref: 00007FFDFF1B07A1
InitializeCriticalSectionEx.KERNEL32 ref: 00007FFDFF1B07E8

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeaveSystem
String ID:
API String ID: 4213993716-0
Opcode ID: 475bae41fa4725fff0954b0336bf63c575fdcc56b08c2cd62e0e8d97a668946f
Instruction ID: 7ddf5fabdcb5955eb8beca6b4e93294e3a5bfb321cdbe93ba605fb6eb16ad519
Opcode Fuzzy Hash: 475bae41fa4725fff0954b0336bf63c575fdcc56b08c2cd62e0e8d97a668946f
Instruction Fuzzy Hash: 96414E22F29682C2FB50DB11E860AB96754BF94790F544236DABEC37E9EF2CE445C700

Function 00007FFDFF1A8510 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1A80A0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FFDFF1A7F64), ref: 00007FFDFF1A80D6
Part of subcall function 00007FFDFF1A80A0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFDFF1A80EF

EnterCriticalSection.KERNEL32 ref: 00007FFDFF1A8580
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A85AA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A863C
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1A865A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$ExclusiveLeaveLock$AcquireEnterRelease_errno
String ID:
API String ID: 2079545705-0
Opcode ID: e034389a63e3a1e87b01c819824332dc0079528102a70396aabfa4becc34b1a8
Instruction ID: be0995618e6a9ece0276103f0963206fe91e193ece75b8017a9961e334f9defe
Opcode Fuzzy Hash: e034389a63e3a1e87b01c819824332dc0079528102a70396aabfa4becc34b1a8
Instruction Fuzzy Hash: 4B31A123F0965281FB149B069A20B799395AF58BF0F085231CD3D9B7DDDF3DA8869704

Function 00007FFDFF1F4790 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FFDFF1F47C0
EnterCriticalSection.KERNEL32 ref: 00007FFDFF1F47CD
LeaveCriticalSection.KERNEL32 ref: 00007FFDFF1F47FC
GetTickCount64.KERNEL32 ref: 00007FFDFF1F480A

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID:
API String ID: 2796706680-0
Opcode ID: 1d029ce5e65e07f4da393b95f3d777739d8733745191d385f3f19a2b2c0578ec
Instruction ID: 631a6592239974a112f0321746b5a7e7a798e3fcc4aa37b8cd284518dce1d468
Opcode Fuzzy Hash: 1d029ce5e65e07f4da393b95f3d777739d8733745191d385f3f19a2b2c0578ec
Instruction Fuzzy Hash: D0219D22B2DBC681FB60CB15E8A096A6764BB85B94F440631E9BDC37E8DF7CE445C700

Function 00007FFDFF1B2060 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1B244E

Strings

MOZ_RELEASE_ASSERT(effectiveLength) (Cannot Promote a zero-length function), xrefs: 00007FFDFF1B2432
@, xrefs: 00007FFDFF1B2104

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: @$MOZ_RELEASE_ASSERT(effectiveLength) (Cannot Promote a zero-length function)
API String ID: 4206212132-2484570821
Opcode ID: 7eee95dc42f2b07522422b6f8739d1829004b484042da665ac1c0b19beb0b751
Instruction ID: 1ec8bfba8ffc4cce1204b47163b58fd696e3b46f35e55c05a599f956e44b4d34
Opcode Fuzzy Hash: 7eee95dc42f2b07522422b6f8739d1829004b484042da665ac1c0b19beb0b751
Instruction Fuzzy Hash: C3B16D63E08BC186E7618B18A4507AAB360FB99354F549335DFED52B99EF7CE188C700

Function 00007FFDFF1ABB10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1AB9A0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9B5
Part of subcall function 00007FFDFF1AB9A0: fputs.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9BD
Part of subcall function 00007FFDFF1AB9A0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9C7
Part of subcall function 00007FFDFF1AB9A0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFF1AB9D1
Part of subcall function 00007FFDFF1AB9A0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AB9F2

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FFDFF1ABC2B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1ABC66

Strings

d, xrefs: 00007FFDFF1ABBDB

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: __acrt_iob_func$_errnoabortfputcfputsmemcpy
String ID: d
API String ID: 1257900873-2564639436
Opcode ID: 83411549f103eca4aa469849dd08b0bc3a635c849208f516a25211a37d0fa5ef
Instruction ID: 994ab0cc2950a33f49467e05807c0d39c302294ba43bf475869696b5506da196
Opcode Fuzzy Hash: 83411549f103eca4aa469849dd08b0bc3a635c849208f516a25211a37d0fa5ef
Instruction Fuzzy Hash: 1D318F13F0A6DA41FF39A76675619B853905F54BE0F484730EE7D4ABEDEF2CA8824600

Function 00007FFDFF1BDB30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF2F4320,00007FFDFF1BD736), ref: 00007FFDFF1BDCD3

Strings

MOZ_RELEASE_ASSERT(len > 0), xrefs: 00007FFDFF1BDCB7
%lld, xrefs: 00007FFDFF1BDB81, 00007FFDFF1BDBDE

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: %lld$MOZ_RELEASE_ASSERT(len > 0)
API String ID: 4206212132-3899699717
Opcode ID: b256974e0b3c3fb1e3c9dd31abb396a6a2646c937fae694762fa3d1cab10e4c6
Instruction ID: 622b4b1f3a4a2b74c17c280eb5241bc1fae52dbbfca81b19119bda02ddbb270c
Opcode Fuzzy Hash: b256974e0b3c3fb1e3c9dd31abb396a6a2646c937fae694762fa3d1cab10e4c6
Instruction Fuzzy Hash: A7413162B08B4A95EB189B19E864AA97361FB44B94F544332DF7D873E8EF7CE045C700

Function 00007FFDFF1AA780 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA894
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1AA8BD

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AA878, 00007FFDFF1AA8A1

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: a119a87f350f38d0bfdacf128e8ff69ee7c40357a66b966aa000460813a29684
Instruction ID: ddbedc4fdde9b54fc85a6eec210bf1dfd54378811381d2c03bc94e1517d7e218
Opcode Fuzzy Hash: a119a87f350f38d0bfdacf128e8ff69ee7c40357a66b966aa000460813a29684
Instruction Fuzzy Hash: 173138B3F05B4081DB48CF45D461A6837A4FB45BB4B148BAACA7D4B3E4CF39D4A28340

Function 00007FFDFF1A9010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A911A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9143

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A90FE, 00007FFDFF1A9127

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: d90ab99bd84c90fb2d762a38f73e127d7911d239c3e409c69979666253f1ce76
Instruction ID: 0bfe94b967b8a0099b12b6a8aabee61a3effb257d4babc9558c3e26bc6baa566
Opcode Fuzzy Hash: d90ab99bd84c90fb2d762a38f73e127d7911d239c3e409c69979666253f1ce76
Instruction Fuzzy Hash: 0F313BB3B05B8480DB058F59D461A6877A4FB45BB4B589725CA7D8B3E5CF3AD4B1C300

Function 00007FFDFF1A9B50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9C5A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A9C83

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A9C3E, 00007FFDFF1A9C67

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 055eac3e862fa58dcf3431aca707d985084d63c1e805f37f2cd5df163a2f9de4
Instruction ID: e86bb631c686720e135d495b6f77eb51d8780300dcb2b020de80b1a8ad01ab11
Opcode Fuzzy Hash: 055eac3e862fa58dcf3431aca707d985084d63c1e805f37f2cd5df163a2f9de4
Instruction Fuzzy Hash: 96313BB3A05F8480DB148F55D461A68B7A4FB45B74F589725CA7D8B3E9CF3D98A1C300

Function 00007FFDFF1AB330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFDFF2F4320,-00000097,?,-0000009F,?,?,00007FFDFF2F4320,?,00007FFDFF1A2D86), ref: 00007FFDFF1AB43A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFDFF2F4320,-00000097,?,-0000009F,?,?,00007FFDFF2F4320,?,00007FFDFF1A2D86), ref: 00007FFDFF1AB463

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1AB41E, 00007FFDFF1AB447

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 9be71dbdb9f6781e35d7c7272b4f70f13a16e3d21c80df8166ae90da7f82e01b
Instruction ID: bd5a2432383ad4e9d52c964c43ade9f578fe8d5f1b3e2d4deffa6464c9c2dd40
Opcode Fuzzy Hash: 9be71dbdb9f6781e35d7c7272b4f70f13a16e3d21c80df8166ae90da7f82e01b
Instruction Fuzzy Hash: 6C3117B3B05B8480EB15CF44E461A6877A4FB95BB4F189725CA7D4B3E5CF3998A1C300

Function 00007FFDFF1A7020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A7134
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A715D

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: a40e8adbeedcf4d454ab84b7b64633986f1222f67b667d94a79cd85942a212c2
Instruction ID: 025c6ebe979cc5e2b8a46a6785d10ae7667fc128c3bc5a050c0f15156a25b737
Opcode Fuzzy Hash: a40e8adbeedcf4d454ab84b7b64633986f1222f67b667d94a79cd85942a212c2
Instruction Fuzzy Hash: 011113B2B06B0584EB498F05A851B6837A4FB15B94F514629CE3C8B3D4DF3AE5A58340

Function 00007FFDFF1A64D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A65DA
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF1A6603

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: abort
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4206212132-1351931279
Opcode ID: 09edb4f1b95fc02a90a7ca46fa9d0813fc5d0d99acf20935d689055c68ce5c36
Instruction ID: 2f31b75731106676f44c7febe39deb05d21b637643b89cf37b15768dbea08b30
Opcode Fuzzy Hash: 09edb4f1b95fc02a90a7ca46fa9d0813fc5d0d99acf20935d689055c68ce5c36
Instruction Fuzzy Hash: 0511E5B2B09B4184EB458F05D460B6877A4BB45F94F598735CE7C873E9EF3DA4618B00

Function 00007FFDFF1A6830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 00007FFDFF1A641D, 00007FFDFF1A645B, 00007FFDFF1A647C, 00007FFDFF1A64A4, 00007FFDFF1A65BE, 00007FFDFF1A65E7, 00007FFDFF1A67C3, 00007FFDFF1A67E4, 00007FFDFF1A680C, 00007FFDFF1A6ADD, 00007FFDFF1A6AFE, 00007FFDFF1A6B1F, 00007FFDFF1A6F6F, 00007FFDFF1A6F9D, 00007FFDFF1A6FCE, 00007FFDFF1A6FF7, 00007FFDFF1A7118, 00007FFDFF1A7141, 00007FFDFF1A7333, 00007FFDFF1A7354, 00007FFDFF1A737D

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID:
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-1351931279
Opcode ID: c8b563dcdee3d0a493c4ff845565ef752f0673825cf5f65a3455f7e292956f8f
Instruction ID: 6b4987620f5b8fa00da692d41b8649273c6c672c393fcea94df4b54fb42d405f
Opcode Fuzzy Hash: c8b563dcdee3d0a493c4ff845565ef752f0673825cf5f65a3455f7e292956f8f
Instruction Fuzzy Hash: 55F03C75B19B4188FB508F15E861B693764BB48B84F608232DEBCC33A8DF3CA4028B00

Function 00007FFDFF1B5540 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFF1B554E
GetProcAddress.KERNEL32 ref: 00007FFDFF1B555E

Strings

GetNtLoaderAPI, xrefs: 00007FFDFF1B5554

Memory Dump Source

Source File: 00000000.00000002.1736288003.00007FFDFF1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF1A0000, based on PE: true

Associated: 00000000.00000002.1736277622.00007FFDFF1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736368521.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736394394.00007FFDFF2F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736407175.00007FFDFF2F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1736419720.00007FFDFF301000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff1a0000_loaddll64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 4c29717aabcd69f8a9a4fe76a0a3400b76c76e893432e2fc027fdb94f4b18357
Instruction ID: 73e5ca38c6d954b41364405a67048d62a021dc0a434007fb7fc6725b7ef08e4b
Opcode Fuzzy Hash: 4c29717aabcd69f8a9a4fe76a0a3400b76c76e893432e2fc027fdb94f4b18357
Instruction Fuzzy Hash: D9010C26F0AF56C1EB199B51F86486C23A5AF48F91B448234CA7DC77A8EF3CD456C700

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mozglue.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_1de486fd-c9ab-489c-aa10-0c38cdabb530\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_273e8517-c54d-470f-b1be-6f82d7b9a01d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_a4d72ff2-2d42-46e7-9cd5-bbc934cbba1b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_moz_27ecf4c285b5182533f7b3a93e8a8a8fddc58761_134389a9_e9164dc1-577d-4bcf-b83d-667d25519d07\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA43.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA52.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAB1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAC1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAF1.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB10.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD56E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5AE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5CE.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE145.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE175.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE195.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
mozglue.dll.dll