NEAS[.]5496539d02433cdad79b51f14c823b10[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.5496539d02433cdad79b51f14c823b10.exe
Size

882KB
MD5

5496539d02433cdad79b51f14c823b10
SHA1

02bf37756f2bf6939755f953874f3bff264c4c3a
SHA256

150b05233f2642737b0ee78cdf2e3e580b4b4c89080ec2afb56993e7441cf032
SHA512

bf5da23c9a496eccec734993c4461fb20588364b53250458e1ebcac5b6978a0bacf55aea225e32ad1ae34fe735e9e89a4405cfa500aaa4bc796aff8af827c384
SSDEEP

12288:sfcaMBkR4bQjTOACprMhqoFyR0dZoQ/qseDJF1RjmYNElWdGbRixr4Z57jTp:uFMBkR42+UYy/TeDJF1Rj/+oQTp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5496539d02433cdad79b51f14c823b10.exe

Files

NEAS.5496539d02433cdad79b51f14c823b10.exe
.dll windows:10 windows x86

ac652a8885e877b8327238beb7a5a7e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CertOpenStore
CryptBinaryToStringW
CryptMsgClose
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgUpdate
CryptQueryObject

ntdll

NtQueryVirtualMemory
RtlAllocateHeap
RtlCaptureContext
RtlCaptureStackBackTrace
RtlCompareMemory
RtlDuplicateUnicodeString
RtlFreeHeap
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlReAllocateHeap
RtlSetLastWin32Error
VerSetConditionMask

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Lockit@std@@QAE@H@Z
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??1ios_base@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??Bid@locale@std@@QAEIXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?classic@locale@std@@SAABV12@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?fail@ios_base@std@@QBE_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?good@ios_base@std@@QBE_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CreateEventW
CreateFileMappingW
CreateFileW
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EncodePointer
EnterCriticalSection
FlushInstructionCache
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessTimes
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadId
GetTickCount64
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
K32EnumProcessModules
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseException
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
ResumeThread
SearchPathW
SetEnvironmentVariableW
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SuspendThread
SystemTimeToFileTime
TerminateProcess
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
UnhandledExceptionFilter
UnmapViewOfFile
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
WideCharToMultiByte

vcruntime140

__CxxFrameHandler3
__std_type_info_destroy_list
_except_handler3
_except_handler4_common
_purecall
memchr
memcmp
memcpy
memmove
memset
strchr
wcsrchr

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_seh_filter_dll
abort
exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf
_dup
_fileno
_fseeki64
_get_stream_buffer_pointers
_write
fclose
fflush
fgetc
fgetpos
fputc
fputs
fread
fsetpos
fwrite
setvbuf
ungetc

api-ms-win-crt-math-l1-1-0

_dsign
_dtest
_fdopen
ceil
floor
sqrt

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

_ltoa_s
_strtoui64
strtol

api-ms-win-crt-string-l1-1-0

_stricmp
_strnicmp
_wcsnicmp
_wcsupr_s
islower
isxdigit
strcmp
strlen
strncmp
strncpy
tolower
wcscat_s
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcstok_s

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand_s

Exports

Exports

??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??$AddMarkerToBuffer@UNoPayload@markers@baseprofiler@mozilla@@$$V@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UNoPayload@markers@01@@Z
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0AwakeTimeDuration@mozilla@@QAE@XZ
??0ConditionVariableImpl@detail@mozilla@@QAE@XZ
??0Decimal@blink@@QAE@ABV01@@Z
??0Decimal@blink@@QAE@ABVEncodedData@01@@Z
??0Decimal@blink@@QAE@H@Z
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z
??0LZ4FrameCompressionContext@Compression@mozilla@@QAE@HI_N0@Z
??0LZ4FrameDecompressionContext@Compression@mozilla@@QAE@_N@Z
??0LockedMarkerTypeFunctionsList@Streaming@base_profiler_markers_detail@mozilla@@QAE@XZ
??0MutexImpl@detail@mozilla@@QAE@XZ
??0PrintfTarget@mozilla@@IAE@XZ
??0RWLockImpl@detail@mozilla@@QAE@XZ
??0SHA1Sum@mozilla@@QAE@XZ
??0TimeStampValue@mozilla@@AAE@_K0_N@Z
??0TimeStampValue@mozilla@@AAE@_K@Z
??0UniqueJSONStrings@baseprofiler@mozilla@@QAE@AAVFailureLatch@2@@Z
??0UniqueJSONStrings@baseprofiler@mozilla@@QAE@AAVFailureLatch@2@ABV012@VProgressLogger@2@@Z
??1ConditionVariableImpl@detail@mozilla@@QAE@XZ
??1LZ4FrameCompressionContext@Compression@mozilla@@QAE@XZ
??1LZ4FrameDecompressionContext@Compression@mozilla@@QAE@XZ
??1LockedMarkerTypeFunctionsList@Streaming@base_profiler_markers_detail@mozilla@@QAE@XZ
??1MutexImpl@detail@mozilla@@QAE@XZ
??1ProfilingStack@baseprofiler@mozilla@@QAE@XZ
??1RWLockImpl@detail@mozilla@@QAE@XZ
??1UniqueJSONStrings@baseprofiler@mozilla@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIABUnothrow_t@std@@@Z
??3@YAXPAX@Z
??3@YAXPAXABUnothrow_t@std@@@Z
??3@YAXPAXI@Z
??4Decimal@blink@@QAEAAV01@ABV01@@Z
??8AwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??8AwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??8Decimal@blink@@QBE_NABV01@@Z
??9AwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??9AwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??9Decimal@blink@@QBE_NABV01@@Z
??DDecimal@blink@@QBE?AV01@ABV01@@Z
??GAwakeTimeDuration@mozilla@@QBE?AV01@ABV01@@Z
??GAwakeTimeStamp@mozilla@@QBE?AVAwakeTimeDuration@1@ABV01@@Z
??GDecimal@blink@@QBE?AV01@ABV01@@Z
??GDecimal@blink@@QBE?AV01@XZ
??GTimeStampValue@mozilla@@QBE_KABV01@@Z
??HAwakeTimeDuration@mozilla@@QBE?AV01@ABV01@@Z
??HAwakeTimeStamp@mozilla@@QBE?AV01@ABVAwakeTimeDuration@1@@Z
??HDecimal@blink@@QBE?AV01@ABV01@@Z
??KDecimal@blink@@QBE?AV01@ABV01@@Z
??MAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??MAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??MDecimal@blink@@QBE_NABV01@@Z
??NAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??NAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??NDecimal@blink@@QBE_NABV01@@Z
??OAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??OAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??ODecimal@blink@@QBE_NABV01@@Z
??PAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??PAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??PDecimal@blink@@QBE_NABV01@@Z
??RFileHandleDeleter@detail@mozilla@@QAEXUFileHandleHelper@12@@Z
??RProfilerBacktraceDestructor@baseprofiler@mozilla@@QAEXPAVProfilerBacktrace@12@@Z
??XDecimal@blink@@QAEAAV01@ABV01@@Z
??YAwakeTimeDuration@mozilla@@QAEXABV01@@Z
??YAwakeTimeStamp@mozilla@@QAEXABVAwakeTimeDuration@1@@Z
??YDecimal@blink@@QAEAAV01@ABV01@@Z
??YTimeStampValue@mozilla@@QAEAAV01@_J@Z
??ZAwakeTimeDuration@mozilla@@QAEXABV01@@Z
??ZAwakeTimeStamp@mozilla@@QAEXABVAwakeTimeDuration@1@@Z
??ZDecimal@blink@@QAEAAV01@ABV01@@Z
??ZTimeStampValue@mozilla@@QAEAAV01@_J@Z
??_0Decimal@blink@@QAEAAV01@ABV01@@Z
??_FDecimal@blink@@QAEXXZ
??_FLZ4FrameDecompressionContext@Compression@mozilla@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIABUnothrow_t@std@@@Z
??_V@YAXPAX@Z
??_V@YAXPAXABUnothrow_t@std@@@Z
??_V@YAXPAXI@Z
?AddRef@PageInformation@baseprofiler@mozilla@@QBEXXZ
?AddRef@ThreadInfo@baseprofiler@mozilla@@QBEXXZ
?BeginCompressing@LZ4FrameCompressionContext@Compression@mozilla@@QAE?AV?$Result@V?$Span@$$CBD$0PPPPPPPP@@mozilla@@I@3@V?$Span@D$0PPPPPPPP@@3@@Z
?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAAW4ProcessInitState@123@XZ
?CacheNtDllThunk@mozilla@@YAXXZ
?CheckQPC@TimeStampValue@mozilla@@ABE_KABV12@@Z
?CleanupProcessRuntime@mozilla@@YAXXZ
?ClearAndSetFailure@UniqueJSONStrings@baseprofiler@mozilla@@AAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ
?ConsumePreXULSkeletonUIHandle@mozilla@@YAPAUHWND__@@XZ
?ContinueCompressing@LZ4FrameCompressionContext@Compression@mozilla@@QAE?AV?$Result@V?$Span@$$CBD$0PPPPPPPP@@mozilla@@I@3@V?$Span@$$CBD$0PPPPPPPP@@3@@Z
?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPAUHINSTANCE__@@HPAPAD@Z
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z
?Decompress@LZ4FrameDecompressionContext@Compression@mozilla@@QAE?AV?$Result@ULZ4FrameDecompressionResult@Compression@mozilla@@I@3@V?$Span@D$0PPPPPPPP@@3@V?$Span@$$CBD$0PPPPPPPP@@3@@Z
?DeserializerForTag@Streaming@base_profiler_markers_detail@mozilla@@SAP6AXAAVProfileBufferEntryReader@3@AAVSpliceableJSONWriter@baseprofiler@3@@ZE@Z
?DllBlocklist_CheckStatus@@YA_NXZ
?DllBlocklist_Initialize@@YAXI@Z
?DllBlocklist_SetBasicDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z
?DllBlocklist_SetFullDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z
?DllBlocklist_WriteNotes@@YAXAAVAnnotationWriter@CrashReporter@@@Z
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z
?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ
?EndCompressing@LZ4FrameCompressionContext@Compression@mozilla@@QAE?AV?$Result@V?$Span@$$CBD$0PPPPPPPP@@mozilla@@I@3@XZ
?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ
?EnsureBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ
?ExtractBaseProfilerChunkManager@detail@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfileBufferChunkManagerWithLocalLimit@mozilla@@V?$DefaultDelete@VProfileBufferChunkManagerWithLocalLimit@mozilla@@@2@@3@XZ
?FeaturesIfActive@RacyFeatures@detail@baseprofiler@mozilla@@SA?AV?$Maybe@I@4@XZ
?FilterHasPid@detail@profiler@mozilla@@YA_NPBDVBaseProfilerProcessId@baseprofiler@3@@Z
?FiltersExcludePid@detail@profiler@mozilla@@YA_NV?$Span@QBD$0PPPPPPPP@@3@VBaseProfilerProcessId@baseprofiler@3@@Z
?FirstTimeStamp@TimeStamp@mozilla@@SA?AV12@XZ
?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z
?FramePointerStackWalk@mozilla@@YAXP6AXIPAX00@ZI0PAPAX0@Z
?GenerateRandomBytesFromOS@mozilla@@YA_NPAXI@Z
?GetCachedNtDllThunk@mozilla@@YAPAV?$Buffer@U_IMAGE_THUNK_DATA32@@@1@XZ
?GetClearedBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAPAVProfileChunkedBuffer@2@XZ
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAE?AV?$Maybe@I@3@ABV?$Span@$$CBD$0PPPPPPPP@@3@@Z
?GetPreXULSkeletonUIEnabled@mozilla@@YA_NXZ
?GetPreXULSkeletonUIErrorReason@mozilla@@YA?AV?$Maybe@W4PreXULSkeletonUIError@mozilla@@@1@XZ
?GetPreXULSkeletonUIWasShown@mozilla@@YA_NXZ
?GetProfilerEnvVarsForChildProcess@baseprofiler@mozilla@@YAX$$QAV?$function@$$A6AXPBD0@Z@std@@@Z
?GetProfilingCategoryPairInfo@baseprofiler@mozilla@@YAABUProfilingCategoryPairInfo@12@W4ProfilingCategoryPair@12@@Z
?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPAVProfilingStack@23@XZ
?GetProfilingStartTime@detail@baseprofiler@mozilla@@YA?AVTimeStamp@3@XZ
?GetQueryPerformanceFrequencyPerSec@mozilla@@YA_KXZ
?GetThreadRegistrationTime@detail@baseprofiler@mozilla@@YA?AVTimeStamp@3@XZ
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z
?HashBytes@mozilla@@YAIPBXI@Z
?InitializeUptime@mozilla@@YAXXZ
?InvalidArrayIndex_CRASH@detail@mozilla@@YAXII@Z
?IsActive@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsActiveAndSamplingUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsActiveAndUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsActiveWithFeature@RacyFeatures@detail@baseprofiler@mozilla@@SA_NI@Z
?IsActiveWithoutFeature@RacyFeatures@detail@baseprofiler@mozilla@@SA_NI@Z
?IsDynamicCodeDisabled@mozilla@@YA_NXZ
?IsEafPlusEnabled@mozilla@@YA_NXZ
?IsFloat32Representable@mozilla@@YA_NN@Z
?IsThreadBeingProfiled@detail@baseprofiler@mozilla@@YA_NXZ
?IsValidUtf8@detail@mozilla@@YA_NPBXI@Z
?IsWin32kLockedDown@mozilla@@YA_NXZ
?LocationToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Location@12@@Z
?MapRemoteViewOfFile@mozilla@@YAPAXPAX0_K0KKK@Z
?MozStackWalkThread@@YAXP6AXIPAX00@ZI00PAU_CONTEXT@@@Z
?NotePreXULSkeletonUIRestarting@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@XZ
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z
?NowLoRes@AwakeTimeStamp@mozilla@@SA?AV12@XZ
?PersistPreXULSkeletonUIValues@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@ABUSkeletonUISettings@1@@Z
?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ
?ProcessUptimeExcludingSuspendMs@mozilla@@YA?AV?$Maybe@_K@1@XZ
?ProcessUptimeMs@mozilla@@YA?AV?$Maybe@_K@1@XZ
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ
?RandomUint64OrDie@mozilla@@YA_KXZ
?RecordProcessRestart@TimeStamp@mozilla@@SAXXZ
?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z
?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ
?Release@PageInformation@baseprofiler@mozilla@@QBEXXZ
?Release@ThreadInfo@baseprofiler@mozilla@@QBEXXZ
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ
?ResolutionInTicks@BaseTimeDurationPlatformUtils@mozilla@@SA_JXZ
?SetActive@RacyFeatures@detail@baseprofiler@mozilla@@SAXI@Z
?SetGeckoProcessType@mozilla@@YAXPBD@Z
?SetInactive@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetPaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetPreXULSkeletonUIEnabledIfAllowed@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@_N@Z
?SetPreXULSkeletonUIThemeId@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@W4ThemeMode@1@@Z
?SetSamplingPaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetSamplingUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetWin32kLockedDownInPolicy@mozilla@@YAXXZ
?Shutdown@TimeStamp@mozilla@@SAXXZ
?SpliceStringTableElements@UniqueJSONStrings@baseprofiler@mozilla@@QAEXAAVSpliceableJSONWriter@23@@Z
?Startup@TimeStamp@mozilla@@SAXXZ
?Stream@MarkerSchema@mozilla@@QHAEXAAVJSONWriter@2@ABV?$Span@$$CBD$0PPPPPPPP@@2@@Z
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBGHPAH@Z
?StringToFloat@StringToDoubleConverter@double_conversion@@QBEMPBDHPAH@Z
?StringToFloat@StringToDoubleConverter@double_conversion@@QBEMPBGHPAH@Z
?TagForMarkerTypeFunctions@Streaming@base_profiler_markers_detail@mozilla@@SAEP6AXAAVProfileBufferEntryReader@3@AAVSpliceableJSONWriter@baseprofiler@3@@ZP6A?AV?$Span@$$CBD$0PPPPPPPP@@3@XZP6A?AVMarkerSchema@3@XZ@Z
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z
?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z
?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z
?ToMicroseconds@AwakeTimeDuration@mozilla@@QBENXZ
?ToMilliseconds@AwakeTimeDuration@mozilla@@QBENXZ
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z
?ToSeconds@AwakeTimeDuration@mozilla@@QBENXZ
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z
?ToSecondsSigDigits@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z
?UnmapRemoteViewOfFile@mozilla@@YA_NPAX0@Z
?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ
?Unused@mozilla@@3Uunused_t@1@B
?WasPreXULSkeletonUIMaximized@mozilla@@YA_NXZ
?WindowsBCryptInitialization@mozilla@@YA_NXZ
?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ
?abs@Decimal@blink@@QBE?AV12@XZ
?aes_enabled@sse_private@mozilla@@3_NA
?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_NH@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_NI@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_N_J@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_N_K@Z
?appendIntHex@PrintfTarget@mozilla@@QAE_NI@Z
?appendIntHex@PrintfTarget@mozilla@@QAE_N_K@Z
?appendIntOct@PrintfTarget@mozilla@@QAE_NI@Z
?appendIntOct@PrintfTarget@mozilla@@QAE_N_K@Z
?avx2_enabled@sse_private@mozilla@@3_NA
?avx_enabled@sse_private@mozilla@@3_NA
?baseprofiler_save_profile_to_file@baseprofiler@mozilla@@YAXPBD@Z
?ceil@Decimal@blink@@QBE?AV12@XZ
?compareTo@Decimal@blink@@ABE?AV12@ABV12@@Z
?compress@LZ4@Compression@mozilla@@SAIPBDIPAD@Z
?compressLimitedOutput@LZ4@Compression@mozilla@@SAIPBDIPADI@Z
?decompress@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z
?decompressPartial@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z
?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ
?finish@SHA1Sum@mozilla@@QAEXAAY0BE@E@Z
?floor@Decimal@blink@@QBE?AV12@XZ
?fma3_enabled@sse_private@mozilla@@3_NA
?fromDouble@Decimal@blink@@SA?AV12@N@Z
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A
?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A
?gOOMAllocationSize@@3IA
?gTwoCharEscapes@detail@mozilla@@3QBDB
?has_constant_tsc@sse_private@mozilla@@3_NA
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z
?lock@MutexImpl@detail@mozilla@@IAEXXZ
?memchr16@SIMD@mozilla@@SAPB_SPB_S_SI@Z
?memchr16AVX2@SIMD@mozilla@@SAPB_SPB_S_SI@Z
?memchr16SSE2@SIMD@mozilla@@SAPB_SPB_S_SI@Z
?memchr2x16@SIMD@mozilla@@SAPB_SPB_S_S1I@Z
?memchr2x8@SIMD@mozilla@@SAPBDPBDDDI@Z
?memchr64@SIMD@mozilla@@SAPB_KPB_K_KI@Z
?memchr64AVX2@SIMD@mozilla@@SAPB_KPB_K_KI@Z
?memchr8@SIMD@mozilla@@SAPBDPBDDI@Z
?memchr8AVX2@SIMD@mozilla@@SAPBDPBDDI@Z
?memchr8SSE2@SIMD@mozilla@@SAPBDPBDDI@Z
?mmx_enabled@sse_private@mozilla@@3_NA
?mozalloc_handle_oom@@YAXI@Z
?nan@Decimal@blink@@SA?AV12@XZ
?notify_all@ConditionVariableImpl@detail@mozilla@@QAEXXZ
?notify_one@ConditionVariableImpl@detail@mozilla@@QAEXXZ
?print@PrintfTarget@mozilla@@QAA_NPBDZZ
?profiler_active_without_feature@baseprofiler@mozilla@@YA_NI@Z
?profiler_add_js_marker@baseprofiler@mozilla@@YAXPBD0@Z
?profiler_add_sampled_counter@baseprofiler@mozilla@@YAXPAVBaseProfilerCount@12@@Z
?profiler_capture_backtrace@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfileChunkedBuffer@mozilla@@V?$DefaultDelete@VProfileChunkedBuffer@mozilla@@@2@@2@XZ
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z
?profiler_current_process_id@baseprofiler@mozilla@@YA?AVBaseProfilerProcessId@12@XZ
?profiler_current_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ
?profiler_ensure_started@baseprofiler@mozilla@@YAXV?$PowerOfTwo@I@2@NIPAPBDIABV?$Maybe@N@2@@Z
?profiler_feature_active@baseprofiler@mozilla@@YA_NI@Z
?profiler_get_available_features@baseprofiler@mozilla@@YAIXZ
?profiler_get_backtrace@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfilerBacktrace@baseprofiler@mozilla@@UProfilerBacktraceDestructor@23@@2@XZ
?profiler_get_buffer_info@baseprofiler@mozilla@@YA?AV?$Maybe@UProfilerBufferInfo@baseprofiler@mozilla@@@2@XZ
?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ
?profiler_get_profile@baseprofiler@mozilla@@YA?AV?$UniquePtr@$$BY0A@DV?$DefaultDelete@$$BY0A@D@mozilla@@@2@N_N0@Z
?profiler_get_start_params@baseprofiler@mozilla@@YAXPAHPAV?$Maybe@N@2@PANPAIPAV?$Vector@PBD$0A@VMallocAllocPolicy@mozilla@@@2@@Z
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z
?profiler_init_main_thread_id@baseprofiler@mozilla@@YAXXZ
?profiler_is_main_thread@baseprofiler@mozilla@@YA_NXZ
?profiler_is_paused@baseprofiler@mozilla@@YA_NXZ
?profiler_is_sampling_paused@baseprofiler@mozilla@@YA_NXZ
?profiler_main_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ
?profiler_pause@baseprofiler@mozilla@@YAXXZ
?profiler_pause_sampling@baseprofiler@mozilla@@YAXXZ
?profiler_register_page@baseprofiler@mozilla@@YAX_K0ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?profiler_register_thread@baseprofiler@mozilla@@YAPAVProfilingStack@12@PBDPAX@Z
?profiler_remove_sampled_counter@baseprofiler@mozilla@@YAXPAVBaseProfilerCount@12@@Z
?profiler_resume@baseprofiler@mozilla@@YAXXZ
?profiler_resume_sampling@baseprofiler@mozilla@@YAXXZ
?profiler_set_process_name@baseprofiler@mozilla@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBV34@@Z
?profiler_shutdown@baseprofiler@mozilla@@YAXXZ
?profiler_start@baseprofiler@mozilla@@YAXV?$PowerOfTwo@I@2@NIPAPBDIABV?$Maybe@N@2@@Z
?profiler_stop@baseprofiler@mozilla@@YAXXZ
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z
?profiler_thread_is_sleeping@baseprofiler@mozilla@@YA_NXZ
?profiler_thread_sleep@baseprofiler@mozilla@@YAXXZ
?profiler_thread_wake@baseprofiler@mozilla@@YAXXZ
?profiler_time@baseprofiler@mozilla@@YANXZ
?profiler_unregister_page@baseprofiler@mozilla@@YAX_K@Z
?profiler_unregister_thread@baseprofiler@mozilla@@YAXXZ
?readLock@RWLockImpl@detail@mozilla@@IAEXXZ
?readUnlock@RWLockImpl@detail@mozilla@@IAEXXZ
?remainder@Decimal@blink@@QBE?AV12@ABV12@@Z
?round@Decimal@blink@@QBE?AV12@XZ
?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A
?sse3_enabled@sse_private@mozilla@@3_NA
?sse4_1_enabled@sse_private@mozilla@@3_NA
?sse4_2_enabled@sse_private@mozilla@@3_NA
?sse4a_enabled@sse_private@mozilla@@3_NA
?ssse3_enabled@sse_private@mozilla@@3_NA
?toDouble@Decimal@blink@@QBENXZ
?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?toString@Decimal@blink@@QBE_NPADI@Z
?tryLock@MutexImpl@detail@mozilla@@IAE_NXZ
?tryReadLock@RWLockImpl@detail@mozilla@@IAE_NXZ
?tryWriteLock@RWLockImpl@detail@mozilla@@IAE_NXZ
?unlock@MutexImpl@detail@mozilla@@IAEXXZ
?update@SHA1Sum@mozilla@@QAEXPBXI@Z
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z
?wait@ConditionVariableImpl@detail@mozilla@@QAEXAAVMutexImpl@23@@Z
?wait_for@ConditionVariableImpl@detail@mozilla@@QAE?AW4CVStatus@3@AAVMutexImpl@23@ABV?$BaseTimeDuration@VTimeDurationValueCalculator@mozilla@@@3@@Z
?writeLock@RWLockImpl@detail@mozilla@@IAEXXZ
?writeUnlock@RWLockImpl@detail@mozilla@@IAEXXZ
?xgetbv@mozilla@@YA_KI@Z
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z
GetAllocatorStallSpecs
MOZ_CrashPrintf
MozDescribeCodeAddress
MozFormatCodeAddress
MozFormatCodeAddressDetails
MozStackWalk
MozWalkTheStack
MozWalkTheStackWithWriter
_HeapAlloc@12
_HeapFree@12
_HeapReAlloc@16
_aligned_free
_aligned_malloc
_expand
_msize
_recalloc
_strdup
_wcsdup
calloc
free
gMozCrashReason
gMozillaPoisonBase
gMozillaPoisonSize
gMozillaPoisonValue
jemalloc_free_dirty_pages
jemalloc_ptr_info
jemalloc_purge_freed_pages
jemalloc_set_main_thread
jemalloc_stats_internal
jemalloc_stats_num_bins
jemalloc_thread_local_arena
malloc
malloc_good_size
malloc_usable_size
moz_arena_calloc
moz_arena_free
moz_arena_malloc
moz_arena_memalign
moz_arena_realloc
moz_create_arena_with_params
moz_dispose_arena
moz_malloc_enclosing_size_of
moz_malloc_size_of
moz_malloc_usable_size
moz_set_max_dirty_page_modifier
moz_xcalloc
moz_xmalloc
moz_xmemalign
moz_xmemdup
moz_xrealloc
moz_xstrdup
mozalloc_abort
posix_memalign
realloc
strdup
strndup
wcsdup

Sections

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac652a8885e877b8327238beb7a5a7e8

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

ntdll

msvcp140

bcrypt

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 580KB - Virtual size: 580KB

.rdata Size: 69KB - Virtual size: 69KB

.data Size: 1024B - Virtual size: 7KB

.00cfg Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 25B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 228KB - Virtual size: 228KB

.text
Size: 580KB - Virtual size: 580KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 1024B - Virtual size: 7KB

.00cfg
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 25B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 228KB - Virtual size: 228KB