1396169 - Hitman Pro Alert for new version 55.0.3 (64 bits)

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[fs]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170824053622

Steps to reproduce:

Just start the browser


Actual results:

Hitman Pro reports next:

Intruder

PID          8680
Application  C:\Program Files\Mozilla Firefox\firefox.exe
Description  Firefox 55.0.3

Detour Report
#  Address             Owner                    Disassembly
-- ------------------  ------------------------ ------------------------
GetMessageA
 1 0x0000000076DF6100  USER32.dll               JMP 0x3cd60d15
 2 0x000000003CD60D15  (unknown)                

GetMessageW
 1 0x0000000076DF9E74  USER32.dll               JMP 0x3cd60cd4
 2 0x000000003CD60CD4  (unknown)                

PeekMessageA
 1 0x0000000076DF39C0  USER32.dll               JMP 0x3cd60c98
 2 0x000000003CD60C98  (unknown)                

PeekMessageW
 1 0x0000000076DF8FF4  USER32.dll               JMP 0x3cd60c58
 2 0x000000003CD60C58  (unknown)                

CreateFileA
 1 0x0000000076F01B80  kernel32.dll             JMP 0x9b0d9d
 2 0x00000000009B0D9D  (unknown)                

CreateFileMappingA
 1 0x0000000076EEDF80  kernel32.dll             JMP 0x9c01c1
 2 0x00000000009C01C1  (unknown)                

CreateProcessA
 1 0x0000000076F7AFC0  kernel32.dll             JMP 0x9c0070
 2 0x00000000009C0070  (unknown)                

CreateProcessInternalA
 1 0x0000000076F7A2F0  kernel32.dll             JMP 0x9b0856
 2 0x00000000009B0856  (unknown)                

CreateProcessInternalW
 1 0x0000000076EFDD20  kernel32.dll             JMP 0x9c0310
 2 0x00000000009C0310  (unknown)                

CreateProcessW
 1 0x0000000076F005E0  kernel32.dll             JMP 0x9b09a7
 2 0x00000000009B09A7  (unknown)                

GetThreadSelectorEntry
 1 0x0000000076F310D0  kernel32.dll             JMP 0x9b0703
 2 0x00000000009B0703  (unknown)                

LoadLibraryA
 1 0x0000000076EF6510  kernel32.dll             JMP 0x9b0eec
 2 0x00000000009B0EEC  (unknown)                

LoadLibraryW
 1 0x0000000076EF6420  kernel32.dll             JMP 0x9b0afd
 2 0x00000000009B0AFD  (unknown)                

WinExec
 1 0x0000000076F7B500  kernel32.dll             JMP 0x9b0c4c
 2 0x00000000009B0C4C  (unknown)                

KiUserApcDispatcher
 1 0x000000007704B950  ntdll.dll                JMP 0x3cd60d56
 2 0x000000003CD60D56  (unknown)                

KiUserExceptionDispatcher
 1 0x000000007704BA9A  ntdll.dll                JMP 0x3cd60d96
 2 0x000000003CD60D96  (unknown)                

LdrFindEntryForAddress
 1 0x0000000077039C60  ntdll.dll                JMP 0x9a0c4a
 2 0x00000000009A0C4A  (unknown)                MOV RAX, 0x920070
                                        LOCK ADD DWORD [RAX+0x10], 0x1
                                        CMP DWORD [RAX+0x14], 0x0
                                        JZ 0x9a0cc8
                                        JMP 0x9a0c6b
 3 0x00000000009A0C6B  (unknown)                

LdrGetProcedureAddress
 1 0x0000000077052620  ntdll.dll                JMP 0x9a0311
 2 0x00000000009A0311  (unknown)                

LdrHotPatchRoutine
 1 0x00000000770F2740  ntdll.dll                JMP 0x9b0070
 2 0x00000000009B0070  (unknown)                

LdrLoadDll
 1 0x0000000077025BE0  ntdll.dll                JMP 0x9a0afb
 2 0x00000000009A0AFB  (unknown)                

NtAllocateVirtualMemory
 1 0x000000007704BCB0  ntdll.dll                JMP 0x3cd60f16
 2 0x000000003CD60F16  (unknown)                

NtCreateFile
 1 0x000000007704C080  ntdll.dll                JMP 0x9b05b1
 2 0x00000000009B05B1  (unknown)                

NtCreateProcess
 1 0x000000007704C550  ntdll.dll                JMP 0x9a0467
 2 0x00000000009A0467  (unknown)                

NtCreateSection
 1 0x000000007704BFD0  ntdll.dll                JMP 0x9a0ee8
 2 0x00000000009A0EE8  (unknown)                

NtCreateThreadEx
 1 0x000000007704C5B0  ntdll.dll                JMP 0x9a0708
 2 0x00000000009A0708  (unknown)                

NtCreateUserProcess
 1 0x000000007704C600  ntdll.dll                JMP 0x9a01bf
 2 0x00000000009A01BF  (unknown)                

NtFreeVirtualMemory
 1 0x000000007704BD10  ntdll.dll                JMP 0x3cd60ed6
 2 0x000000003CD60ED6  (unknown)                

NtMapViewOfSection
 1 0x000000007704BDB0  ntdll.dll                JMP 0x9b0310
 2 0x00000000009B0310  (unknown)                

NtProtectVirtualMemory
 1 0x000000007704C030  ntdll.dll                JMP 0x9a0d99
 2 0x00000000009A0D99  (unknown)                

NtSetInformationProcess
 1 0x000000007704BCF0  ntdll.dll                JMP 0x9b045f
 2 0x00000000009B045F  (unknown)                

NtUnmapViewOfSection
 1 0x000000007704BDD0  ntdll.dll                JMP 0x3cd60e56
 2 0x000000003CD60E56  (unknown)                

NtWaitForDebugEvent
 1 0x000000007704D410  ntdll.dll                JMP 0x3cd60fd6
 2 0x000000003CD60FD6  (unknown)                

NtWriteVirtualMemory
 1 0x000000007704BED0  ntdll.dll                JMP 0x9a085a
 2 0x00000000009A085A  (unknown)                

RtlInstallFunctionTableCallback
 1 0x00000000770022C0  ntdll.dll                JMP 0x3cd60f95
 2 0x000000003CD60F95  (unknown)                

RtlPcToFileHeader
 1 0x000000007700C4F0  ntdll.dll                JMP 0x9a05b9
 2 0x00000000009A05B9  (unknown)                MOV RAX, 0x920070
                                        LOCK ADD DWORD [RAX+0x10], 0x1
                                        CMP DWORD [RAX+0x14], 0x0
                                        JZ 0x9a0637
                                        JMP 0x9a05da
 3 0x00000000009A05DA  (unknown)                

PR_Close
 1 0x000007FED20AE3B0  nss3.dll                 JMP 0x7fe800201bf
 2 0x000007FE800201BF  (unknown)                MOV RAX, 0x920000
                                        LOCK ADD DWORD [RAX+0x10], 0x1
                                        CMP DWORD [RAX+0x14], 0x0
                                        JZ 0x7fe8002023d
                                        JMP 0x7fe800201e5
 3 0x000007FE800201E5  (unknown)                

PR_Read *
 1 0x000007FED20AE3B8  nss3.dll                 JMP 0x7fe80020461
 2 0x000007FE80020461  (unknown)                MOV RAX, 0x920000
                                        LOCK ADD DWORD [RAX+0x10], 0x1
                                        CMP DWORD [RAX+0x14], 0x0
                                        JZ 0x7fe800204df
                                        JMP 0x7fe8002047d
 3 0x000007FE8002047D  (unknown)                

PR_Write *
 1 0x000007FED20AE3C0  nss3.dll                 JMP 0x7fe80020310
 2 0x000007FE80020310  (unknown)                MOV RAX, 0x920000
                                        LOCK ADD DWORD [RAX+0x10], 0x1
                                        CMP DWORD [RAX+0x14], 0x0
                                        JZ 0x7fe8002038e
                                        JMP 0x7fe8002032c
 3 0x000007FE8002032C  (unknown)                

SSL_SetURL
 1 0x000007FED213F8D4  nss3.dll                 JMP 0x7fe80020070
 2 0x000007FE80020070  (unknown)                MOV RAX, 0x920000
                                        LOCK ADD DWORD [RAX+0x10], 0x1
                                        CMP DWORD [RAX+0x14], 0x0
                                        JZ 0x7fe800200ee
                                        JMP 0x7fe80020091
 3 0x000007FE80020091  (unknown)                

CreateFileMappingNumaW
 1 0x000007FEFD051930  KernelBase.dll           JMP 0x7fe800001c3
 2 0x000007FE800001C3  (unknown)                

CreateFileMappingW
 1 0x000007FEFD050890  KernelBase.dll           JMP 0x7fe80000af3
 2 0x000007FE80000AF3  (unknown)                

CreateFileW
 1 0x000007FEFD045FE0  KernelBase.dll           JMP 0x7fe80000855
 2 0x000007FE80000855  (unknown)                

CreateRemoteThreadEx
 1 0x000007FEFD04ACB0  KernelBase.dll           JMP 0x7fe80010070
 2 0x000007FE80010070  (unknown)                

HeapCreate
 1 0x000007FEFD04B2D0  KernelBase.dll           JMP 0x7fe80000ee4
 2 0x000007FE80000EE4  (unknown)                

LoadLibraryExA
 1 0x000007FEFD04C750  KernelBase.dll           JMP 0x7fe80010311
 2 0x000007FE80010311  (unknown)                

MapViewOfFile
 1 0x000007FEFD050A90  KernelBase.dll           JMP 0x7fe80000c42
 2 0x000007FE80000C42  (unknown)                

MapViewOfFileEx
 1 0x000007FEFD0507E0  KernelBase.dll           JMP 0x7fe800005b4
 2 0x000007FE800005B4  (unknown)                

VirtualAlloc
 1 0x000007FEFD041900  KernelBase.dll           JMP 0x7fe80000070
 2 0x000007FE80000070  (unknown)                

VirtualAllocEx
 1 0x000007FEFD073870  KernelBase.dll           JMP 0x7fe80000d92
 2 0x000007FE80000D92  (unknown)                

VirtualProtect
 1 0x000007FEFD0513B0  KernelBase.dll           JMP 0x7fe80000465
 2 0x000007FE80000465  (unknown)                

VirtualProtectEx
 1 0x000007FEFD0513E0  KernelBase.dll           JMP 0x7fe800009a4
 2 0x000007FE800009A4  (unknown)                

WriteProcessMemory
 1 0x000007FEFD0738A0  KernelBase.dll           JMP 0x7fe800101c0
 2 0x000007FE800101C0  (unknown)                


Thumbprint
2f4260f0b06342c88789af51376351cf4dd5c429e1e845b37390a6176acbeb41


Expected results:

No alert!

Comment 1

[Kohei Yoshino [:kohei]]

Guess it's false alarm. Please report the issue to the HitmanPro support.