Virtual PC Sandbox Programs PACK (1)[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Virtual PC Sandbox Programs PACK (1).rar
Size

68.0MB
MD5

fcdd3867f5194a8c19818fd0468f1807
SHA1

93ad645ccf648c4c377aec81a238d2ebb9f34e7d
SHA256

41685e9960433b24f9c9051c72434d1dd7a9494caa1ea0b9a2fd779fbb7545b8
SHA512

25968929c0bdc96cc3b2ace18c02762714dbaf172a26aa092e7a866db17610995c8bea949d3d70fd8d2d042b870622540c5be244c4d2eae90a5a03b7e3fda74f
SSDEEP

1572864:FFhCmGFIz8op8oRFcykGMle40/lsla5lGWePMrxMVfb8Y/x+Lmn1:FFhCtIpppCi8EGEDdAAon1

Score

3^/10

Malware Config

Signatures

Unsigned PE 45 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BFE/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BFE/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BufferZoneProFree.exe
unpack001/Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/msvcr71.dll
unpack001/Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/pnpclean.dll
unpack001/Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/enigmavb.exe
unpack001/Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/ieproxy.dll
unpack001/Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/secproc/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/secproc/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/bcastdvr.proxy.dll
unpack001/Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/bcastdvr.proxy.dll
unpack001/Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/disk2vhd.exe
unpack001/Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/Sandboxie-Classic-x64-v5.49.0.exe
unpack001/Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/Launcher.exe
unpack009/$PLUGINSDIR/InstallOptions.dll
unpack009/$PLUGINSDIR/LangDLL.dll
unpack009/$PLUGINSDIR/System.dll
unpack009/$PLUGINSDIR/nsDialogs.dll
unpack001/Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/Sandboxie-Plus-x64-v0.7.2.exe
unpack001/Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/Jint.dll
unpack001/Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/shade_setup.exe
unpack001/Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/Jint.dll
unpack001/Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/WebDriver.dll
unpack001/Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/SD1.4.0.680_Setup.exe
unpack001/Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/WebDriver.dll
unpack001/Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/Setup_TimeFreeze.exe
unpack001/Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/rdpcorets.dll
unpack001/Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/rdpcorets.dll
unpack001/Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/Ionic.Zip.dll
unpack001/Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/Launcher.exe
unpack001/Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/comm.exe
unpack001/Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/libraries/virtual-desktop-accessor.dll
unpack001/Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/libraries/virtual-desktop-accessor.dll
unpack001/Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/virtual-desktop-enhancer.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/urlmon.exe	nsis_installer_1
static1/unpack001/Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/urlmon.exe	nsis_installer_2

Files

Virtual PC Sandbox Programs PACK (1).rar
.rar
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BFE/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BFE/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BFE/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BFE/msi.msi
.msi
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/BufferZoneProFree.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/msvcr71.dll
.dll windows:4 windows x86 arch:x86

7acc8c379c768a1ecd81ec502ff5f33e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr71.pdb

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
HeapAlloc
HeapFree
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
MultiByteToWideChar
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
InitializeCriticalSection
RtlUnwind
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
InterlockedExchange
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
HeapSize
VirtualProtect
GetSystemInfo
FlushFileBuffers
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
Sleep
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadCodePtr
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
ReadConsoleA
SetConsoleMode
GetConsoleMode
IsDBCSLeadByteEx
GetConsoleCP
ReadConsoleW
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreateFileA
CreatePipe
ReadFile
CreateFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
SetLocalTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@AAE@PBQBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_Fbad_cast@@QAEXXZ
??_Fbad_typeid@@QAEXXZ
??_U@YAPAXI@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPAGIPBGPAD@Z
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CppXcptFilter
__CxxCallUnwindDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__buffer_overrun
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__dllonexit
__doserrno
__fpecode
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__security_error_handler
__set_app_type
__set_buffer_overrun_handler
__setlc_active
__setusermatherr
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__uncaught_exception
__unguarded_readlc_active
__wargv
__wcserror
__wgetmainargs
__winitenv
_abnormal_termination
_access
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_realloc
_amsg_exit
_assert
_atodbl
_atoi64
_atoldbl
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_cexit
_cgets
_cgetws
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_clearfp
_close
_commit
_commode
_control87
_controlfp
_copysign
_cprintf
_cputs
_cputws
_creat
_cscanf
_ctime64
_cwait
_cwprintf
_cwscanf
_daylight
_dstbias
_dup
_dup2
_ecvt
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_heap_handle
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwch
_getwche
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64tow
_initterm
_inp
_inpd
_inpw
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcpunct
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lseek
_lseeki64
_ltoa
_ltow
_makepath
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscoll
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsicoll
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbcpy
_mbsnbicmp
_mbsnbicoll
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncoll
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_osplatform
_osver
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putenv
_putw
_putwch
_putws
_pwctype
_read
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotr
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_scprintf
_scwprintf
_searchenv
_seh_longjmp_unwind
_set_SSE2_enable
_set_error_mode
_set_purecall_handler
_set_sbh_threshold
_set_security_error_handler
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snscanf
_snwprintf
_snwscanf
_sopen
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp

Sections

.text
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/BufferZone Pro 4.02/pnpclean.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b94a10558c463cf7ccd8b8943132a4ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

pnpclean.pdb

Imports

msvcrt

_wcsicmp
_wcslwr
wcsstr
wcschr
_vsnwprintf
wcsrchr
_vsnprintf
toupper
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_resetstkoflw
_callnewh
malloc
_wcsdup
_purecall
free
wcscat_s
wcscpy_s
__C_specific_handler
memset

ntdll

RtlNtStatusToDosErrorNoTeb
NtQuerySystemInformation
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
NtSetInformationFile
NtQueryInformationFile
NtDeleteValueKey
NtSetValueKey
NtCreateKey
NtOpenKey
RtlInitUnicodeString
NtClose
RtlFreeUnicodeString
RtlFormatCurrentUserKeyPath
RtlNtStatusToDosError
RtlGetVersion
NtQueryValueKey
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlGUIDFromString
RtlInitUnicodeStringEx
RtlEqualUnicodeString
RtlPrefixUnicodeString

kernel32

CreateMutexW
DeviceIoControl
WaitForMultipleObjectsEx
GetCommandLineW
SetConsoleCtrlHandler
SetThreadLocale
EnterCriticalSection
GetThreadLocale
LeaveCriticalSection
InitializeCriticalSection
GetLastError
DisableThreadLibraryCalls
RaiseException
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
LoadLibraryExW
CompareStringOrdinal
GetSystemDirectoryW
GetModuleHandleExW
WaitForSingleObject
FreeLibraryAndExitThread
ResumeThread
CloseHandle
CreateThread
FreeLibrary
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
ReleaseMutex
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
FindResourceExW
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SleepEx
CreateFileW
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
SetEvent
WaitForSingleObjectEx
CreateEventW
MoveFileExW
FindClose
FindNextFileW
SetFileAttributesW
LCMapStringW
GetFileInformationByHandle
FindFirstFileW
DeleteFileW
CreateHardLinkW
SetFilePointer
FlushFileBuffers
GetFileSize
GetLocalTime
WriteFile
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCommandLineA
GetModuleFileNameA
SetLastError
LoadResource
LockResource
CompareFileTime
GetDiskFreeSpaceW
GetWindowsDirectoryW
SetUnhandledExceptionFilter

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW

user32

UnregisterClassA

shell32

CommandLineToArgvW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2

setupapi

SetupDiDestroyDeviceInfoList
SetupDiSetDeviceInstallParamsW
SetupDiSetDevicePropertyW
SetupDiRemoveDevice
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status_Ex
SetupDiGetDevicePropertyW
SetupDiGetClassDevsExW
SetupUninstallOEMInfW

drvstore

DriverStoreGetObjectPropertyW
DriverStoreDriverPackageResolveCallbackW
DriverStoreOpenW
DriverStoreClose
DriverPackageOpenW
DriverPackageGetVersionInfoW
DriverStoreEnumRelatedDriversW
DriverPackageEnumDriversW
DriverPackageClose
DriverStoreEnumW
DriverStoreFindW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RunDLL_PnpClean

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/enigmavb.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/ieproxy.dll
.dll regsvr32 windows:10 windows x64 arch:x64

cfbb05a9a82fd731579dd8e7aaa0f294

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

IEProxy.pdb

Imports

msvcrt

malloc
memcmp
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
memcpy
memcpy_s
_purecall
_vsnwprintf
wcsstr
__CxxFrameHandler3
wcschr
_callnewh
memset

rpcrt4

NdrGetUserMarshalInfo
RpcRaiseException
NdrStubCall3
NdrClientCall3
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
NdrOleFree
NdrCStdStubBuffer2_Release
NdrOleAllocate
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExA

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-rtcore-ntuser-window-l1-1-0

PostMessageW
SendMessageTimeoutW
FindWindowExW
AllowSetForegroundWindow
GetWindowThreadProcessId

api-ms-win-downlevel-shlwapi-l2-1-0

IUnknown_QueryService

api-ms-win-downlevel-shlwapi-l1-1-0

PathCreateFromUrlW

api-ms-win-downlevel-advapi32-l1-1-0

GetSidSubAuthorityCount
GetSidSubAuthority
GetKernelObjectSecurity
GetAce
GetSidIdentifierAuthority
GetSecurityDescriptorDacl

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient21
ObjectStublessClient24
ObjectStublessClient4
ObjectStublessClient25
ObjectStublessClient28
ObjectStublessClient30
ObjectStublessClient29
ObjectStublessClient31
CStdAsyncStubBuffer_Release
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Invoke
ObjectStublessClient26
ObjectStublessClient19
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient17
ObjectStublessClient12
ObjectStublessClient16
NdrProxyForwardingFunction7
NdrProxyForwardingFunction12
NdrProxyForwardingFunction9
ObjectStublessClient9
NdrProxyForwardingFunction10
ObjectStublessClient8
NdrProxyForwardingFunction13
NdrProxyForwardingFunction11
ObjectStublessClient7
NdrProxyForwardingFunction6
NdrProxyForwardingFunction8
NdrProxyForwardingFunction14
CStdStubBuffer2_Connect
CStdAsyncStubBuffer_QueryInterface
NdrProxyForwardingFunction3
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
ObjectStublessClient22

api-ms-win-core-marshal-l1-1-0

HWND_UserUnmarshal
HWND_UserFree
HWND_UserSize
HWND_UserUnmarshal64
HWND_UserSize64
HWND_UserMarshal64
HWND_UserMarshal
HWND_UserFree64
HBITMAP_UserMarshal64
HBITMAP_UserFree
HMENU_UserUnmarshal
HMENU_UserFree
HBITMAP_UserUnmarshal64
HMENU_UserUnmarshal64
HMENU_UserSize64
HMENU_UserSize
HMENU_UserMarshal64
HMENU_UserFree64
HICON_UserUnmarshal
HICON_UserMarshal64
HICON_UserMarshal
HICON_UserUnmarshal64
HICON_UserFree
HICON_UserSize64
HICON_UserSize
HICON_UserFree64
HBITMAP_UserUnmarshal
HBITMAP_UserSize64
HBITMAP_UserMarshal
HGLOBAL_UserUnmarshal
HGLOBAL_UserSize64
HGLOBAL_UserMarshal64
HGLOBAL_UserMarshal
HGLOBAL_UserFree
HGLOBAL_UserFree64
HGLOBAL_UserUnmarshal64
HGLOBAL_UserSize
HBITMAP_UserFree64
HBITMAP_UserSize
HMENU_UserMarshal

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-file-l1-1-0

CreateFileW
GetFinalPathNameByHandleW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-url-l1-1-0

UrlApplySchemeW
PathIsURLW
UrlCreateFromPathW
UrlCanonicalizeW
ParseURLW

api-ms-win-ole32-ie-l1-1-0

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 690KB - Virtual size: 689KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/secproc/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/secproc/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/secproc/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/secproc/ssl3.exe
.exe windows:1 windows x86 arch:x86

Code Sign

28:ae:43:a9:4a:59:86:0f:7c:d0:7d:67:ec:f2:63:c4
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/02/2019, 00:00

Not After

25/02/2023, 23:59

Subject

CN=Vladimir Sergeevich Sukhov IP,O=Vladimir Sergeevich Sukhov IP,STREET=5-64 Kooperativnaya ul.,L=Murom,ST=Vladimirskaya oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:f8:1c:b4:2c:c0:95:27:23:b0:77:c2:05:41:e3:04:2c:06:b2:e3:05:ef:5a:04:db:63:de:8c:3a:a3:96:6e
Signer

Actual PE Digest

71:f8:1c:b4:2c:c0:95:27:23:b0:77:c2:05:41:e3:04:2c:06:b2:e3:05:ef:5a:04:db:63:de:8c:3a:a3:96:6e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Enigma Virtual Box 9.60/toolkit.jar
.zip .js polyglot
content/global/XPCNativeWrapper.js
content/global/about.xhtml
.html .js polyglot
content/global/aboutMemory.css
content/global/aboutMemory.js
.js
content/global/aboutMemory.xhtml
.xml
content/global/aboutRights-unbranded.xhtml
.html
content/global/aboutRights.xhtml
.html
content/global/alerts/alert.js
.js
content/global/alerts/alert.xul
.xml
content/global/appPicker.js
.js
content/global/appPicker.xul
.xml
content/global/bindings/autocomplete.xml
.xml .js polyglot
content/global/bindings/browser.xml
.xml .js polyglot
content/global/bindings/button.xml
.xml .js polyglot
content/global/bindings/checkbox.xml
.xml .js polyglot
content/global/bindings/colorpicker.xml
.xml .js polyglot
content/global/bindings/datetimepicker.xml
.xml .js polyglot
content/global/bindings/dialog.xml
.xml .js polyglot
content/global/bindings/editor.xml
.xml
content/global/bindings/expander.xml
.xml .js polyglot
content/global/bindings/filefield.xml
.xml .js polyglot
content/global/bindings/findbar.xml
.xml .js polyglot
content/global/bindings/general.xml
.xml .js polyglot
content/global/bindings/groupbox.xml
.xml
content/global/bindings/listbox.xml
.xml .js polyglot
content/global/bindings/menu.xml
.xml .js polyglot
content/global/bindings/menulist.xml
.xml .js polyglot
content/global/bindings/notification.xml
.xml .js polyglot
content/global/bindings/numberbox.xml
.xml .js polyglot
content/global/bindings/popup.xml
.xml .js polyglot
content/global/bindings/preferences.xml
.xml .js polyglot
content/global/bindings/progressmeter.xml
.xml .js polyglot
content/global/bindings/radio.xml
.xml .js polyglot
content/global/bindings/resizer.xml
.xml
content/global/bindings/richlistbox.xml
.xml .js polyglot
content/global/bindings/scale.xml
.xml .js polyglot
content/global/bindings/scrollbar.xml
.xml
content/global/bindings/scrollbox.xml
.xml .js polyglot
content/global/bindings/spinbuttons.xml
.xml .js polyglot
content/global/bindings/splitter.xml
.xml .js polyglot
content/global/bindings/stringbundle.xml
.xml .js polyglot
content/global/bindings/tabbox.xml
.xml .js polyglot
content/global/bindings/text.xml
.xml .js polyglot
content/global/bindings/textbox.xml
.xml .js polyglot
content/global/bindings/toolbar.xml
.xml .js polyglot
content/global/bindings/toolbarbutton.xml
.xml
content/global/bindings/tree.xml
.xml .js polyglot
content/global/bindings/videocontrols.css
content/global/bindings/videocontrols.xml
.xml .js polyglot
content/global/bindings/wizard.xml
.xml .js polyglot
content/global/buildconfig.html
.html
content/global/charsetOverlay.js
.js
content/global/charsetOverlay.xul
.xml
content/global/commonDialog.css
content/global/commonDialog.js
.js
content/global/commonDialog.xul
.xml
content/global/config.js
.js
content/global/config.xul
.xml
content/global/configIntValue.xul
.xml .js polyglot
content/global/console.css
content/global/console.js
.js
content/global/console.xul
.xml
content/global/consoleBindings.xml
.xml .js polyglot
content/global/contentAreaUtils.js
.js
content/global/crash-submit-form.xhtml
.html
content/global/crashes.js
.js
content/global/crashes.xhtml
.html
content/global/customizeCharset.js
.js
content/global/customizeCharset.xul
.xml
content/global/customizeToolbar.css
content/global/customizeToolbar.js
.js
content/global/customizeToolbar.xul
.xml
content/global/dialogOverlay.js
.js
content/global/dialogOverlay.xul
.xml
content/global/directionDetector.html
.html
content/global/editMenuOverlay.js
content/global/editMenuOverlay.xul
.xml
content/global/filepicker.js
.js
content/global/filepicker.xul
.xml
content/global/findUtils.js
.js
content/global/finddialog.js
.js
content/global/finddialog.xul
.xml
content/global/globalOverlay.js
.js
content/global/globalOverlay.xul
.xml .js polyglot
content/global/inlineSpellCheckUI.js
.js
content/global/license.html
.html .js polyglot
content/global/menulist.css
content/global/mozilla.xhtml
.html
content/global/netError.xhtml
.html .js polyglot
content/global/notfound.wav
content/global/nsClipboard.js
.js
content/global/nsDragAndDrop.js
.js
content/global/nsHelperAppDlg.xul
.xml
content/global/nsProgressDialog.xul
.xml
content/global/nsUserSettings.js
.js
content/global/platformHTMLBindings.xml
.xml
content/global/plugins.css
content/global/plugins.html
.html .js polyglot
content/global/printPageSetup.js
.js
content/global/printPageSetup.xul
.xml
content/global/printPreviewBindings.xml
.xml .js polyglot
content/global/printPreviewProgress.js
.js
content/global/printPreviewProgress.xul
.xml
content/global/printProgress.js
.js
content/global/printProgress.xul
.xml
content/global/printUtils.js
.js
content/global/printdialog.js
.js
content/global/printdialog.xul
.xml
content/global/selectDialog.js
.js
content/global/selectDialog.xul
.xml
content/global/strres.js
.js
content/global/svg/svgBindings.xml
.xml
content/global/textbox.css
content/global/viewPartialSource.js
.js
content/global/viewPartialSource.xul
.xml
content/global/viewSource.css
content/global/viewSource.js
.js
content/global/viewSource.xul
.xml
content/global/viewSourceUtils.js
.js
content/global/viewZoomOverlay.js
.js
content/global/xml/XMLMonoPrint.css
content/global/xml/XMLPrettyPrint.css
content/global/xml/XMLPrettyPrint.xml
.xml .js polyglot
content/global/xml/XMLPrettyPrint.xsl
.xml
content/global/xul.css
content/mozapps/downloads/DownloadProgressListener.js
.js
content/mozapps/downloads/download.xml
.xml
content/mozapps/downloads/downloads.css
content/mozapps/downloads/downloads.js
.js
content/mozapps/downloads/downloads.xul
.xml
content/mozapps/downloads/helperApps.js
.js
content/mozapps/downloads/unknownContentType.xul
.xml
content/mozapps/extensions/about.js
.js
content/mozapps/extensions/about.xul
.xml
content/mozapps/extensions/blocklist.css
content/mozapps/extensions/blocklist.js
.js
content/mozapps/extensions/blocklist.xul
.xml
content/mozapps/extensions/errors.xul
.xml .js polyglot
content/mozapps/extensions/eula.js
.js
content/mozapps/extensions/eula.xul
.xml
content/mozapps/extensions/extensions.css
content/mozapps/extensions/extensions.js
.js
content/mozapps/extensions/extensions.xml
.xml .js polyglot
content/mozapps/extensions/extensions.xul
.xml
content/mozapps/extensions/list.js
.js
content/mozapps/extensions/list.xul
.xml
content/mozapps/extensions/update.js
.js
content/mozapps/extensions/update.xul
.xml
content/mozapps/extensions/updateinfo.xsl
.xml
content/mozapps/handling/dialog.js
.js
content/mozapps/handling/dialog.xul
.xml
content/mozapps/handling/handler.css
content/mozapps/handling/handler.xml
.xml
content/mozapps/plugins/pluginBlocked.png
.png
content/mozapps/plugins/pluginCrashed.png
.png
content/mozapps/plugins/pluginDisabled.png
.png
content/mozapps/plugins/pluginDownload.png
.png
content/mozapps/plugins/pluginFinderBinding.css
content/mozapps/plugins/pluginHelp-16.png
.png
content/mozapps/plugins/pluginInstallerDatasource.js
.js
content/mozapps/plugins/pluginInstallerService.js
.js
content/mozapps/plugins/pluginInstallerWizard.css
content/mozapps/plugins/pluginInstallerWizard.js
.js
content/mozapps/plugins/pluginInstallerWizard.xul
.xml
content/mozapps/plugins/pluginProblem.xml
.xml
content/mozapps/plugins/pluginProblemBinding.css
content/mozapps/plugins/pluginProblemContent.css
content/mozapps/plugins/pluginProblemLorentz.css
content/mozapps/preferences/changemp.js
.js
content/mozapps/preferences/changemp.xul
.xml
content/mozapps/preferences/fontbuilder.js
.js
content/mozapps/preferences/ocsp.js
.js
content/mozapps/preferences/ocsp.xul
.xml
content/mozapps/preferences/removemp.js
.js
content/mozapps/preferences/removemp.xul
.xml
content/mozapps/profile/createProfileWizard.js
.js
content/mozapps/profile/createProfileWizard.xul
.xml
content/mozapps/profile/profileSelection.js
.js
content/mozapps/profile/profileSelection.xul
.xml
content/mozapps/update/history.js
.js
content/mozapps/update/history.xul
.xml
content/mozapps/update/updates.css
content/mozapps/update/updates.js
.js
content/mozapps/update/updates.xml
.xml .js polyglot
content/mozapps/update/updates.xul
.xml
content/mozapps/xpinstall/xpinstallConfirm.css
content/mozapps/xpinstall/xpinstallConfirm.js
.js
content/mozapps/xpinstall/xpinstallConfirm.xul
.xml
content/mozapps/xpinstall/xpinstallItem.xml
.xml
content/passwordmgr/passwordManager.js
.js
content/passwordmgr/passwordManager.xul
.xml
content/passwordmgr/passwordManagerCommon.js
.js
content/passwordmgr/passwordManagerExceptions.js
.js
content/passwordmgr/passwordManagerExceptions.xul
.xml
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/Disk2vhd.chm
.chm
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/Eula.txt
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/bcastdvr.proxy.dll
.dll regsvr32 windows:10 windows x86 arch:x86

1b05ea5f90a138982c4f04f953c32511

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

bcastdvr.proxy.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
_XcptFilter
_amsg_exit
free
memcmp

rpcrt4

CStdStubBuffer_Disconnect
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
NdrStubForwardingFunction
CStdStubBuffer_CountRefs
NdrStubCall2
CStdStubBuffer_IsIIDSupported
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient27
CStdStubBuffer2_CountRefs
ObjectStublessClient28
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient11
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient14
ObjectStublessClient12
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
CStdStubBuffer2_Connect
ObjectStublessClient26
ObjectStublessClient24
ObjectStublessClient10
NdrProxyForwardingFunction3
ObjectStublessClient25
ObjectStublessClient22
ObjectStublessClient18
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient29
ObjectStublessClient17

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/Disk2vhd.chm
.chm
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/Eula.txt
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/bcastdvr.proxy.dll
.dll regsvr32 windows:10 windows x86 arch:x86

1b05ea5f90a138982c4f04f953c32511

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

bcastdvr.proxy.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
_XcptFilter
_amsg_exit
free
memcmp

rpcrt4

CStdStubBuffer_Disconnect
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
NdrStubForwardingFunction
CStdStubBuffer_CountRefs
NdrStubCall2
CStdStubBuffer_IsIIDSupported
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient27
CStdStubBuffer2_CountRefs
ObjectStublessClient28
ObjectStublessClient20
ObjectStublessClient15
ObjectStublessClient23
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
ObjectStublessClient11
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient14
ObjectStublessClient12
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
CStdStubBuffer2_Connect
ObjectStublessClient26
ObjectStublessClient24
ObjectStublessClient10
NdrProxyForwardingFunction3
ObjectStublessClient25
ObjectStublessClient22
ObjectStublessClient18
ObjectStublessClient16
ObjectStublessClient21
ObjectStublessClient29
ObjectStublessClient17

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/en-US.jar
.zip
locale/en-US/alerts/notificationNames.properties
locale/en-US/autoconfig/autoconfig.properties
locale/en-US/cookie/cookieAcceptDialog.dtd
locale/en-US/cookie/cookieAcceptDialog.properties
locale/en-US/global-platform/mac/accessible.properties
locale/en-US/global-platform/mac/intl.properties
locale/en-US/global-platform/mac/platformKeys.properties
locale/en-US/global-platform/unix/accessible.properties
locale/en-US/global-platform/unix/intl.properties
locale/en-US/global-platform/unix/platformKeys.properties
locale/en-US/global-platform/win/accessible.properties
locale/en-US/global-platform/win/intl.properties
locale/en-US/global-platform/win/platformKeys.properties
locale/en-US/global-region/region.dtd
locale/en-US/global-region/region.properties
locale/en-US/global/about.dtd
locale/en-US/global/aboutRights.dtd
locale/en-US/global/aboutRights.properties
locale/en-US/global/appPicker.dtd
locale/en-US/global/appstrings.properties
locale/en-US/global/brand.dtd
locale/en-US/global/browser.properties
locale/en-US/global/charsetOverlay.dtd
locale/en-US/global/charsetTitles.properties
locale/en-US/global/commonDialog.dtd
locale/en-US/global/commonDialogs.properties
locale/en-US/global/config.dtd
locale/en-US/global/config.properties
locale/en-US/global/console.dtd
locale/en-US/global/console.properties
locale/en-US/global/contentAreaCommands.properties
locale/en-US/global/crashes.dtd
locale/en-US/global/crashes.properties
locale/en-US/global/css.properties
locale/en-US/global/customizeCharset.dtd
locale/en-US/global/customizeToolbar.dtd
locale/en-US/global/customizeToolbar.properties
locale/en-US/global/dateFormat.properties
locale/en-US/global/datetimepicker.dtd
locale/en-US/global/dialog.properties
locale/en-US/global/dialogOverlay.dtd
locale/en-US/global/dom/dom.properties
locale/en-US/global/downloadProgress.properties
locale/en-US/global/editMenuOverlay.dtd
locale/en-US/global/filefield.properties
locale/en-US/global/filepicker.dtd
locale/en-US/global/filepicker.properties
locale/en-US/global/findbar.dtd
locale/en-US/global/findbar.properties
locale/en-US/global/finddialog.dtd
locale/en-US/global/finddialog.properties
locale/en-US/global/global-strres.properties
locale/en-US/global/global.dtd
locale/en-US/global/globalKeys.dtd
locale/en-US/global/gnomeprintdialog.properties
locale/en-US/global/intl.css
locale/en-US/global/intl.properties
locale/en-US/global/keys.properties
locale/en-US/global/languageNames.properties
locale/en-US/global/layout/HtmlForm.properties
locale/en-US/global/layout/MediaDocument.properties
locale/en-US/global/layout/xmlparser.properties
locale/en-US/global/layout_errors.properties
locale/en-US/global/license.dtd
locale/en-US/global/mozilla.dtd
locale/en-US/global/netError.dtd
locale/en-US/global/netErrorApp.dtd
locale/en-US/global/notification.dtd
locale/en-US/global/nsHelperAppDlg.dtd
locale/en-US/global/nsHelperAppDlg.properties
locale/en-US/global/nsProgressDialog.dtd
locale/en-US/global/nsProgressDialog.properties
locale/en-US/global/nsWebBrowserPersist.properties
locale/en-US/global/plugins.properties
locale/en-US/global/preferences.dtd
locale/en-US/global/printPageSetup.dtd
locale/en-US/global/printPreview.dtd
locale/en-US/global/printPreviewProgress.dtd
locale/en-US/global/printProgress.dtd
locale/en-US/global/printdialog.dtd
locale/en-US/global/printdialog.properties
locale/en-US/global/printing.properties
locale/en-US/global/printjoboptions.dtd
locale/en-US/global/prompts.properties
locale/en-US/global/regionNames.properties
locale/en-US/global/search/search.properties
locale/en-US/global/security/caps.properties
locale/en-US/global/storage.properties
locale/en-US/global/svg/svg.properties
locale/en-US/global/textcontext.dtd
locale/en-US/global/tree.dtd
locale/en-US/global/videocontrols.dtd
locale/en-US/global/viewSource.dtd
locale/en-US/global/viewSource.properties
locale/en-US/global/webservices/security.properties
locale/en-US/global/wizard.dtd
locale/en-US/global/wizard.properties
locale/en-US/global/xbl.properties
locale/en-US/global/xml/prettyprint.dtd
locale/en-US/global/xpinstall/xpinstall.properties
locale/en-US/global/xslt/xslt.properties
locale/en-US/global/xul.properties
locale/en-US/mozapps/downloads/downloads.dtd
locale/en-US/mozapps/downloads/downloads.properties
locale/en-US/mozapps/downloads/settingsChange.dtd
locale/en-US/mozapps/downloads/unknownContentType.dtd
locale/en-US/mozapps/downloads/unknownContentType.properties
locale/en-US/mozapps/extensions/about.dtd
locale/en-US/mozapps/extensions/blocklist.dtd
locale/en-US/mozapps/extensions/errors.dtd
locale/en-US/mozapps/extensions/extensions.dtd
locale/en-US/mozapps/extensions/extensions.properties
locale/en-US/mozapps/extensions/update.dtd
locale/en-US/mozapps/extensions/update.properties
locale/en-US/mozapps/handling/handling.dtd
locale/en-US/mozapps/handling/handling.properties
locale/en-US/mozapps/plugins/plugins.dtd
locale/en-US/mozapps/plugins/plugins.properties
locale/en-US/mozapps/preferences/changemp.dtd
locale/en-US/mozapps/preferences/ocsp.dtd
locale/en-US/mozapps/preferences/preferences.properties
locale/en-US/mozapps/preferences/removemp.dtd
locale/en-US/mozapps/profile/createProfileWizard.dtd
locale/en-US/mozapps/profile/profileSelection.dtd
locale/en-US/mozapps/profile/profileSelection.properties
locale/en-US/mozapps/update/history.dtd
locale/en-US/mozapps/update/incompatible.dtd
locale/en-US/mozapps/update/updates.dtd
locale/en-US/mozapps/update/updates.properties
locale/en-US/mozapps/xpinstall/xpinstallConfirm.dtd
locale/en-US/mozapps/xpinstall/xpinstallConfirm.properties
locale/en-US/necko/necko.properties
locale/en-US/passwordmgr/passwordManager.dtd
locale/en-US/passwordmgr/passwordmgr.properties
locale/en-US/pipnss/nsserrors.properties
locale/en-US/pipnss/pipnss.properties
locale/en-US/pipnss/security.properties
locale/en-US/pippki/certManager.dtd
locale/en-US/pippki/deviceManager.dtd
locale/en-US/pippki/pippki.dtd
locale/en-US/pippki/pippki.properties
locale/en-US/pippki/validation.dtd
locale/en-US/places/places.properties
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/classic/ntdll.exe
.exe windows:5 windows x86 arch:x86

267962dcb688834b5dd6fd9f808af1f3

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:02:29:27:7b:60:a7:7d:2c:7a:11:84:b0:79:58:b6:a0:4c:b7:bf
Signer

Actual PE Digest

d9:02:29:27:7b:60:a7:7d:2c:7a:11:84:b0:79:58:b6:a0:4c:b7:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\Disk2vhd\release\disk2vhd.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

vssapi

?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z

comctl32

ord17

cabinet

ord20
ord23
ord22

rpcrt4

UuidCreate

kernel32

FindNextFileW
GetDiskFreeSpaceExW
GetFullPathNameW
GetCommandLineW
CopyFileExW
GetDriveTypeW
FindResourceW
LoadResource
InterlockedIncrement
MoveFileExW
GetCurrentProcess
GetComputerNameW
OutputDebugStringW
LoadLibraryW
CopyFileW
SizeofResource
FormatMessageW
GetVersionExW
GetExitCodeProcess
GetFileAttributesW
GetStdHandle
GetCurrentDirectoryW
MoveFileW
LockResource
GetSystemInfo
GetVolumeNameForVolumeMountPointW
DeleteFileW
LocalFree
SetFileAttributesW
GetVolumeInformationW
ExpandEnvironmentStringsW
LocalAlloc
SleepEx
WaitForSingleObjectEx
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReadFileEx
EnterCriticalSection
GetLocalTime
CreateSemaphoreW
DeleteCriticalSection
WriteFileEx
GetVolumePathNameW
ExpandEnvironmentStringsA
GetStringTypeW
GetStringTypeA
DeviceIoControl
CloseHandle
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapSize
RtlUnwind
RaiseException
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetModuleFileNameA
HeapCreate
VirtualAlloc
VirtualFree
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
CreateThread
GetCurrentThreadId
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
ExitProcess
CreateEventW
FindClose
GetDiskFreeSpaceW
GetProcAddress
SetLastError
GetLastError
GetOverlappedResult
CreateFileW
GetModuleHandleW
WaitForSingleObject
InterlockedDecrement
GetLocaleInfoA
FindFirstFileW
GetFileTime
ReadFile
WideCharToMultiByte
WriteFile
SetFilePointer
CreateFileA
GetModuleFileNameW
lstrlenA
LoadLibraryA
GetModuleHandleA
Sleep
HeapAlloc
GetProcessHeap
SetEndOfFile

user32

ScreenToClient
GetWindowRect
GetMessageW
PostQuitMessage
PostMessageW
IsZoomed
GetParent
LoadCursorW
IsWindowEnabled
GetClientRect
SetPropW
GetDC
TranslateMessage
LoadAcceleratorsW
ChildWindowFromPoint
IsDialogMessageW
LoadIconW
OffsetRect
InflateRect
InvalidateRect
GetWindowLongW
GetClassNameW
ReleaseDC
GetDlgItem
SetWindowLongW
TranslateAcceleratorW
GetSysColor
CheckDlgButton
EnumChildWindows
ShowWindow
GetSysColorBrush
IsDlgButtonChecked
CreateDialogParamW
GetActiveWindow
DeferWindowPos
MessageBoxW
BeginDeferWindowPos
RegisterClassW
GetSystemMetrics
GetDlgItemTextW
SetDlgItemTextW
SendMessageW
EnableWindow
SetWindowTextW
EndDeferWindowPos
DrawFrameControl
GetPropW
CallWindowProcW
DefWindowProcW
DispatchMessageW
DialogBoxIndirectParamW
EndDialog
SetCursor
UnionRect
PtInRect

gdi32

StartPage
GetDeviceCaps
SetMapMode
StartDocW
EndDoc
SetTextColor
CreateFontIndirectW
SetBkMode
SelectObject
GetObjectW
GetStockObject
EndPage

comdlg32

PrintDlgW
GetSaveFileNameW

advapi32

RegQueryValueExA
RegCreateKeyW
RegSetValueExW
AdjustTokenPrivileges
RegFlushKey
RegDeleteValueW
LookupPrivilegeValueW
RegCreateKeyExW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA

shell32

ShellExecuteExW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitialize
CoCreateGuid
CoUninitialize
CLSIDFromString

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SystemTimeToVariantTime
VariantChangeType

shlwapi

PathFindExtensionW

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/disk2vhd.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Microsoft Disk2vhd 2.01/en-US.jar
.zip
locale/en-US/alerts/notificationNames.properties
locale/en-US/autoconfig/autoconfig.properties
locale/en-US/cookie/cookieAcceptDialog.dtd
locale/en-US/cookie/cookieAcceptDialog.properties
locale/en-US/global-platform/mac/accessible.properties
locale/en-US/global-platform/mac/intl.properties
locale/en-US/global-platform/mac/platformKeys.properties
locale/en-US/global-platform/unix/accessible.properties
locale/en-US/global-platform/unix/intl.properties
locale/en-US/global-platform/unix/platformKeys.properties
locale/en-US/global-platform/win/accessible.properties
locale/en-US/global-platform/win/intl.properties
locale/en-US/global-platform/win/platformKeys.properties
locale/en-US/global-region/region.dtd
locale/en-US/global-region/region.properties
locale/en-US/global/about.dtd
locale/en-US/global/aboutRights.dtd
locale/en-US/global/aboutRights.properties
locale/en-US/global/appPicker.dtd
locale/en-US/global/appstrings.properties
locale/en-US/global/brand.dtd
locale/en-US/global/browser.properties
locale/en-US/global/charsetOverlay.dtd
locale/en-US/global/charsetTitles.properties
locale/en-US/global/commonDialog.dtd
locale/en-US/global/commonDialogs.properties
locale/en-US/global/config.dtd
locale/en-US/global/config.properties
locale/en-US/global/console.dtd
locale/en-US/global/console.properties
locale/en-US/global/contentAreaCommands.properties
locale/en-US/global/crashes.dtd
locale/en-US/global/crashes.properties
locale/en-US/global/css.properties
locale/en-US/global/customizeCharset.dtd
locale/en-US/global/customizeToolbar.dtd
locale/en-US/global/customizeToolbar.properties
locale/en-US/global/dateFormat.properties
locale/en-US/global/datetimepicker.dtd
locale/en-US/global/dialog.properties
locale/en-US/global/dialogOverlay.dtd
locale/en-US/global/dom/dom.properties
locale/en-US/global/downloadProgress.properties
locale/en-US/global/editMenuOverlay.dtd
locale/en-US/global/filefield.properties
locale/en-US/global/filepicker.dtd
locale/en-US/global/filepicker.properties
locale/en-US/global/findbar.dtd
locale/en-US/global/findbar.properties
locale/en-US/global/finddialog.dtd
locale/en-US/global/finddialog.properties
locale/en-US/global/global-strres.properties
locale/en-US/global/global.dtd
locale/en-US/global/globalKeys.dtd
locale/en-US/global/gnomeprintdialog.properties
locale/en-US/global/intl.css
locale/en-US/global/intl.properties
locale/en-US/global/keys.properties
locale/en-US/global/languageNames.properties
locale/en-US/global/layout/HtmlForm.properties
locale/en-US/global/layout/MediaDocument.properties
locale/en-US/global/layout/xmlparser.properties
locale/en-US/global/layout_errors.properties
locale/en-US/global/license.dtd
locale/en-US/global/mozilla.dtd
locale/en-US/global/netError.dtd
locale/en-US/global/netErrorApp.dtd
locale/en-US/global/notification.dtd
locale/en-US/global/nsHelperAppDlg.dtd
locale/en-US/global/nsHelperAppDlg.properties
locale/en-US/global/nsProgressDialog.dtd
locale/en-US/global/nsProgressDialog.properties
locale/en-US/global/nsWebBrowserPersist.properties
locale/en-US/global/plugins.properties
locale/en-US/global/preferences.dtd
locale/en-US/global/printPageSetup.dtd
locale/en-US/global/printPreview.dtd
locale/en-US/global/printPreviewProgress.dtd
locale/en-US/global/printProgress.dtd
locale/en-US/global/printdialog.dtd
locale/en-US/global/printdialog.properties
locale/en-US/global/printing.properties
locale/en-US/global/printjoboptions.dtd
locale/en-US/global/prompts.properties
locale/en-US/global/regionNames.properties
locale/en-US/global/search/search.properties
locale/en-US/global/security/caps.properties
locale/en-US/global/storage.properties
locale/en-US/global/svg/svg.properties
locale/en-US/global/textcontext.dtd
locale/en-US/global/tree.dtd
locale/en-US/global/videocontrols.dtd
locale/en-US/global/viewSource.dtd
locale/en-US/global/viewSource.properties
locale/en-US/global/webservices/security.properties
locale/en-US/global/wizard.dtd
locale/en-US/global/wizard.properties
locale/en-US/global/xbl.properties
locale/en-US/global/xml/prettyprint.dtd
locale/en-US/global/xpinstall/xpinstall.properties
locale/en-US/global/xslt/xslt.properties
locale/en-US/global/xul.properties
locale/en-US/mozapps/downloads/downloads.dtd
locale/en-US/mozapps/downloads/downloads.properties
locale/en-US/mozapps/downloads/settingsChange.dtd
locale/en-US/mozapps/downloads/unknownContentType.dtd
locale/en-US/mozapps/downloads/unknownContentType.properties
locale/en-US/mozapps/extensions/about.dtd
locale/en-US/mozapps/extensions/blocklist.dtd
locale/en-US/mozapps/extensions/errors.dtd
locale/en-US/mozapps/extensions/extensions.dtd
locale/en-US/mozapps/extensions/extensions.properties
locale/en-US/mozapps/extensions/update.dtd
locale/en-US/mozapps/extensions/update.properties
locale/en-US/mozapps/handling/handling.dtd
locale/en-US/mozapps/handling/handling.properties
locale/en-US/mozapps/plugins/plugins.dtd
locale/en-US/mozapps/plugins/plugins.properties
locale/en-US/mozapps/preferences/changemp.dtd
locale/en-US/mozapps/preferences/ocsp.dtd
locale/en-US/mozapps/preferences/preferences.properties
locale/en-US/mozapps/preferences/removemp.dtd
locale/en-US/mozapps/profile/createProfileWizard.dtd
locale/en-US/mozapps/profile/profileSelection.dtd
locale/en-US/mozapps/profile/profileSelection.properties
locale/en-US/mozapps/update/history.dtd
locale/en-US/mozapps/update/incompatible.dtd
locale/en-US/mozapps/update/updates.dtd
locale/en-US/mozapps/update/updates.properties
locale/en-US/mozapps/xpinstall/xpinstallConfirm.dtd
locale/en-US/mozapps/xpinstall/xpinstallConfirm.properties
locale/en-US/necko/necko.properties
locale/en-US/passwordmgr/passwordManager.dtd
locale/en-US/passwordmgr/passwordmgr.properties
locale/en-US/pipnss/nsserrors.properties
locale/en-US/pipnss/pipnss.properties
locale/en-US/pipnss/security.properties
locale/en-US/pippki/certManager.dtd
locale/en-US/pippki/deviceManager.dtd
locale/en-US/pippki/pippki.dtd
locale/en-US/pippki/pippki.properties
locale/en-US/pippki/validation.dtd
locale/en-US/places/places.properties
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/Sandboxie-Classic-x64-v5.49.0.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/skci.dll
.dll windows:10 windows x64 arch:x64

258e187b1224e817873f8d0fc1a58064

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:b6:f3:b0:f4:0a:b2:d1:49:e6:c3:a8:af:ed:c3:98:21:98:de:52:54:9b:73:f1:87:13:47:da:fd:56:68:ff
Signer

Actual PE Digest

46:b6:f3:b0:f4:0a:b2:d1:49:e6:c3:a8:af:ed:c3:98:21:98:de:52:54:9b:73:f1:87:13:47:da:fd:56:68:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

skci.pdb

Imports

securekernel.exe

__C_specific_handler
SkAllocatePool
RtlAvlInsertNodeEx
SkInitializePushLock
qsort
SkReleasePushLockExclusive
SkAcquirePushLockShared
bsearch
SkReleasePushLockShared
SkAcquirePushLockExclusive
RtlAvlRemoveNode
RtlCompareMemory
SkFreePool
RtlImageNtHeaderEx
SeQuerySecureBootPlatformManifest
RtlUnicodeToUTF8N
SeQuerySecureBootPolicyValue
_ultow_s
RtlInitUnicodeString
SkQuerySystemTime
RtlFreeUnicodeString
SkSystemExceptionFilter
SkQuerySecureKernelInformation
SkobCreateHandle
SkmmFreeSecureAllocation
SkobCreateObject
SkobDereferenceObject
SkAllocateNormalModePool
SkFreeNormalModePool
KeRestoreExtendedProcessorState
KeBugCheckEx
RtlGetEnabledExtendedFeatures
KeSaveExtendedProcessorState
RtlGetVersion
bsearch_s
RtlTimeFieldsToTime
atoi
isdigit
RtlAnsiStringToUnicodeString
RtlUTF8ToUnicodeN
RtlDuplicateUnicodeString
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlPrefixUnicodeString
memset
__GSHandlerCheck
_local_unwind
memcmp
memcpy
memmove
wcscmp

Exports

Exports

SkciCompareSigningLevels
SkciCreateCodeCatalog
SkciCreateSecureImage
SkciFinalizeSecureImageHash
SkciFinishImageValidation
SkciFreeImageContext
SkciInitialize
SkciMatchHotPatch
SkciQueryImageAuthorID
SkciQueryImageUniqueID
SkciQueryInformation
SkciSetCodeIntegrityPolicy
SkciTransferVersionResource
SkciValidateDynamicCodePages
SkciValidateImageData

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1024B - Virtual size: 549B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGECONS
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 113B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/urlmon.exe
.exe windows:4 windows x86 arch:x86

ab6770b0a8635b9d92a5838920cfe770

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:b9:87:fe:55:f4:1c:c3:dd:40:4c:bb:80:0c:e5:fa:44:d7:e2:04:35:73:02:56:99:42:81:f4:be:0b:10:d4
Signer

Actual PE Digest

9b:b9:87:fe:55:f4:1c:c3:dd:40:4c:bb:80:0c:e5:fa:44:d7:e2:04:35:73:02:56:99:42:81:f4:be:0b:10:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileAttributesA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CompareFileTime
SearchPathA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
CreateDirectoryA
lstrcmpiA
GetTempPathA
GetCommandLineA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
WaitForSingleObject
ExitProcess
GetWindowsDirectoryA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
LoadLibraryExA
GetModuleHandleA
MultiByteToWideChar
FreeLibrary

user32

GetWindowRect
EnableMenuItem
GetSystemMenu
ScreenToClient
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
PostQuitMessage
RegisterClassA
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
OpenClipboard
TrackPopupMenu
SendMessageTimeoutA
GetDC
LoadImageA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
SetWindowLongA
EmptyClipboard
SetTimer
CreateDialogParamA
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

738dc9bb91549f627cf1953c2000e1d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryA
MultiByteToWideChar
SetCurrentDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock

user32

GetDlgCtrlID
CloseClipboard
GetClipboardData
MapWindowPoints
LoadCursorA
GetClientRect
SetWindowRgn
LoadIconA
GetWindowLongA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
SetCursor
PtInRect
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
EnableMenuItem
DrawTextA
GetSystemMenu
OpenClipboard
LoadImageA

gdi32

SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectA

shell32

SHGetPathFromIDListA
ShellExecuteA
SHBrowseForFolderA
SHGetDesktopFolder

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallType.ini
$PLUGINSDIR/KmdUtil.exe
.exe windows:6 windows x64 arch:x64

d41bba34c2b7943d327e7a0f7dc16c45

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:3c:e7:39:a3:fa:78:0e:b3:13:ae:db:c6:cb:e1:ec:d3:c9:90:11:3d:26:8d:3f:53:fa:d5:3a:02:c5:bd:ee
Signer

Actual PE Digest

4a:3c:e7:39:a3:fa:78:0e:b3:13:ae:db:c6:cb:e1:ec:d3:c9:90:11:3d:26:8d:3f:53:fa:d5:3a:02:c5:bd:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\KmdUtil.pdb

Imports

ntdll

NtUnloadDriver
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

sbiedll

Sbie_snwprintf
SbieApi_GetVersion
SbieApi_QueryConf
SbieApi_IsBoxEnabled
SbieApi_CallZero

kernel32

GetLastError
SetLastError
HeapAlloc
GetProcessHeap
Sleep
GetModuleFileNameW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageW
CloseHandle
GetCurrentProcess
HeapFree
GetCurrentProcessId
ExitProcess
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetModuleHandleW
GetProcAddress
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetFileType
GetStartupInfoW
QueryPerformanceCounter
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleOutputCP
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
CreateFileW
WideCharToMultiByte
SetStdHandle
FlushFileBuffers
GetModuleHandleExW
SetEndOfFile
WriteConsoleW
RaiseException
HeapSize
HeapReAlloc
InitializeSListHead
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
IsValidCodePage

user32

CreateWindowExW
RegisterClassW
DefWindowProcW
GetDesktopWindow
ShowWindow
DispatchMessageW
GetMessageW
MessageBoxW
GetWindowRect
DestroyWindow
SetFocus
GetFocus
GetParent
LoadIconW
SystemParametersInfoW
LoadCursorW
SendMessageW
GetWindowLongW
GetWindow
PostMessageW

gdi32

CreateFontIndirectW
GetStockObject

advapi32

OpenSCManagerW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
ControlService
CreateServiceW
DeleteService
StartServiceW
OpenServiceW
OpenProcessToken
AdjustTokenPrivileges
CloseServiceHandle
LookupPrivilegeValueW

shell32

CommandLineToArgvW

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

4e5f0ae8071ae04cdb537283701198ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetACP
GlobalFree
GetModuleHandleA
lstrcpynA
lstrcmpA
MulDiv
GlobalAlloc
lstrlenA
lstrcpyA

user32

SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetWindowTextA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

DeleteObject
CreateFontIndirectA
GetDeviceCaps

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SbieDll.dll
.dll windows:6 windows x64 arch:x64

de87bd8e4418b30a9f13d40bead5b83f

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:88:f5:83:93:08:65:b6:cc:8c:31:aa:e0:9e:7c:49:4f:cb:b9:09:b5:ed:ae:45:50:b6:ea:be:f4:89:e6:3c
Signer

Actual PE Digest

bd:88:f5:83:93:08:65:b6:cc:8c:31:aa:e0:9e:7c:49:4f:cb:b9:09:b5:ed:ae:45:50:b6:ea:be:f4:89:e6:3c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDll.pdb

Imports

ntdll

NtSetInformationJobObject
NtAssignProcessToJobObject
NtCreateJobObject
NtUnmapViewOfSection
NtMapViewOfSection
NtClose
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
NtAdjustPrivilegesToken
NtDuplicateObject
NtSetInformationToken
NtOpenProcess
RtlConvertSidToUnicodeString
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtQuerySecurityObject
RtlNtStatusToDosError
NtQueryVirtualMemory
NtAllocateVirtualMemory
NtProtectVirtualMemory
NtLoadDriver
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrUnloadDll
LdrLoadDll
NtYieldExecution
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtSaveKey
NtLoadKey
NtDeleteValueKey
NtDeleteKey
NtSetInformationKey
NtQueryKey
NtImpersonateAnonymousToken
NtImpersonateThread
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenSection
NtCreateSection
NtOpenSemaphore
NtCreateSemaphore
NtOpenMutant
NtCreateMutant
NtOpenEvent
NtCreateEvent
NtImpersonateClientOfPort
NtSecureConnectPort
NtCreatePort
RtlUnicodeStringToAnsiString
NtOpenThread
NtQueryInformationThread
NtOpenProcessToken
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
NtQueryInformationProcess
NtSetInformationThread
RtlGetFullPathName_U
RtlSetCurrentDirectory_U
RtlGetCurrentDirectory_U
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlCompareUnicodeString
NtQuerySystemInformation
NtSetInformationProcess
NtQueryVolumeInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
NtDeviceIoControlFile
NtWriteFile
NtReadFile
NtDeleteFile
NtSetInformationFile
NtQueryFullAttributesFile
NtQueryAttributesFile
NtQueryInformationFile
NtQueryDirectoryFile
NtOpenFile
NtCreateFile
NtOpenDirectoryObject
NtQueryObject
LdrGetProcedureAddress
NtSetValueKey
NtEnumerateKey
NtCreateKey
NtOpenKey
NtQueryValueKey
RtlInitUnicodeString
NtRequestWaitReplyPort
NtRegisterThreadTerminatePort
NtConnectPort
strstr
_wcsnicmp
towlower
memcpy
memset
wcschr
_itow
memmove
wcscpy_s
wcsncpy_s
wcsncpy
_wcsicmp
_wcslwr
wcstol
_wtoi
__chkstk
wcsncmp
wcsstr
memcmp
__C_specific_handler
wcsrchr
_wtoi64
strchr
strncmp
wcstoul
tolower
_stricmp
iswctype
_strlwr

kernel32

LeaveCriticalSection
SetLocaleInfoW
SetLocaleInfoA
PostQueuedCompletionStatus
EnumResourceNamesW
ReadFile
FormatMessageW
LoadLibraryExW
GetVersionExW
GetLongPathNameW
GetFullPathNameW
OpenMutexW
WinExec
CreateProcessA
TerminateProcess
QueueUserWorkItem
CreateFileA
SizeofResource
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
DuplicateHandle
GetProcessId
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetWindowsDirectoryW
CreateMutexW
ReleaseMutex
HeapDestroy
HeapCreate
ResumeThread
SetThreadPriority
GetExitCodeProcess
OpenEventW
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
GlobalAddAtomW
UnmapViewOfFile
MapViewOfFileEx
GetThreadTimes
FindResourceA
FindResourceW
LockResource
LoadResource
GlobalLock
GlobalUnlock
GlobalSize
GetConsoleWindow
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleTitleA
AllocConsole
GetStartupInfoW
OpenThread
GetCurrentThreadId
WaitForMultipleObjects
WideCharToMultiByte
GetSystemInfo
OpenProcess
GetCurrentProcess
Sleep
GetSystemWindowsDirectoryW
ReplaceFileW
MoveFileWithProgressW
MoveFileExW
GetPrivateProfileStringW
GetTickCount
GetCurrentThread
QueueUserAPC
TryEnterCriticalSection
GetFileAttributesW
DeleteFileW
CreateFileW
CreateDirectoryW
GetEnvironmentVariableW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleA
VirtualFree
GetCurrentProcessId
SetEvent
InitializeCriticalSection
OutputDebugStringW
VirtualAlloc
EnterCriticalSection
GetModuleFileNameW
VirtualProtect
CreateProcessW
ExitProcess
SetEnvironmentVariableW
GetProcAddress
CloseHandle
CreateThread
LoadLibraryW
GetLastError
SetLastError
GlobalAlloc
GlobalFree
WaitForSingleObject
CreateEventW
ExpandEnvironmentStringsW
FreeLibrary
GetModuleHandleW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetCommandLineW

Exports

Exports

SbieApi_CallOne
SbieApi_CallThree
SbieApi_CallTwo
SbieApi_CallZero
SbieApi_CheckInternetAccess
SbieApi_DisableForceProcess
SbieApi_EnumBoxes
SbieApi_EnumBoxesEx
SbieApi_EnumProcessEx
SbieApi_GetFileName
SbieApi_GetHomePath
SbieApi_GetMessage
SbieApi_GetUnmountHive
SbieApi_GetVersion
SbieApi_HookTramp
SbieApi_IsBoxEnabled
SbieApi_Log
SbieApi_LogEx
SbieApi_LogMsgEx
SbieApi_LogMsgExt
SbieApi_MonitorControl
SbieApi_MonitorGetEx
SbieApi_MonitorPut
SbieApi_MonitorPut2
SbieApi_OpenProcess
SbieApi_ProcessExemptionControl
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieApi_QueryConfBool
SbieApi_QueryPathList
SbieApi_QueryProcess
SbieApi_QueryProcessEx
SbieApi_QueryProcessEx2
SbieApi_QueryProcessInfo
SbieApi_QueryProcessInfoEx
SbieApi_QueryProcessPath
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_SetUserName
SbieApi_vLogEx
SbieDll_AssocQueryCommand
SbieDll_AssocQueryProgram
SbieDll_CallServer
SbieDll_CallServerQueue
SbieDll_CheckStringInList
SbieDll_ComCreateProxy
SbieDll_ComCreateStub
SbieDll_DeviceChange
SbieDll_DisableElevationHook
SbieDll_ExpandAndRunProgram
SbieDll_FormatMessage
SbieDll_FormatMessage0
SbieDll_FormatMessage1
SbieDll_FormatMessage2
SbieDll_FreeMem
SbieDll_GetBoolForStringFromList
SbieDll_GetBorderColor
SbieDll_GetDrivePath
SbieDll_GetHandlePath
SbieDll_GetLanguage
SbieDll_GetServiceRegistryValue
SbieDll_GetStartError
SbieDll_GetTokenElevationType
SbieDll_GetUserPathEx
SbieDll_Has32BitJumpHorizon
SbieDll_Hook
SbieDll_InitPStore
SbieDll_InjectLow
SbieDll_InjectLow_BuildTramp
SbieDll_InjectLow_CopyCode
SbieDll_InjectLow_CopyData
SbieDll_InjectLow_CopySyscalls
SbieDll_InjectLow_InitHelper
SbieDll_InjectLow_InitSyscalls
SbieDll_InjectLow_SendHandle
SbieDll_InjectLow_WriteJump
SbieDll_InjectLow_getPage
SbieDll_IsBoxedService
SbieDll_IsDirectory
SbieDll_IsOpenCOM
SbieDll_IsOpenClsid
SbieDll_KillAll
SbieDll_KillOne
SbieDll_MatchImage
SbieDll_PortName
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueueGetRpl
SbieDll_QueuePutReq
SbieDll_QueuePutRpl
SbieDll_RegisterDllCallback
SbieDll_RunFromHome
SbieDll_RunSandboxed
SbieDll_StartBoxedService
SbieDll_StartCOM
SbieDll_StartSbieSvc
SbieDll_TranslateNtToDosPath
SbieDll_UpdateConf
Sbie_snprintf
Sbie_snwprintf

Sections

.text
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SbieMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:8d:fe:0c:e2:37:0d:e7:2e:f9:cf:60:30:f7:7f:e3:31:e6:6d:77:ab:13:7a:34:fd:c2:50:e1:ca:12:87:78
Signer

Actual PE Digest

f2:8d:fe:0c:e2:37:0d:e7:2e:f9:cf:60:30:f7:7f:e3:31:e6:6d:77:ab:13:7a:34:fd:c2:50:e1:ca:12:87:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

f2ac1ab587d5531d5f1bf76c094aef4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalAlloc
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 510B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Warning.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

f03b2bab186574d8892d3d73fa9fd3fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
lstrcpyA
GetCurrentDirectoryA
HeapFree
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
GetProcessHeap

user32

DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
MapWindowPoints
GetWindowLongA
DrawTextA
GetClientRect
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
RemovePropA
DrawFocusRect
GetWindowTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
32/SbieDll.dll
.dll windows:6 windows x86 arch:x86

d94a6388b9aa1b664c769bcfb1f60ef3

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:dd:9d:3f:51:ad:4a:c1:51:45:1f:96:b2:b6:a6:6f:88:04:90:2d:f8:f1:8c:bd:d9:3e:6a:50:2d:ae:48:2e
Signer

Actual PE Digest

01:dd:9d:3f:51:ad:4a:c1:51:45:1f:96:b2:b6:a6:6f:88:04:90:2d:f8:f1:8c:bd:d9:3e:6a:50:2d:ae:48:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\Win32\SbieRelease\SbieDll.pdb

Imports

ntdll

NtSetInformationJobObject
NtAssignProcessToJobObject
NtCreateJobObject
NtUnmapViewOfSection
NtMapViewOfSection
RtlUnwind
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
NtAdjustPrivilegesToken
NtDuplicateObject
NtSetInformationToken
NtOpenProcess
RtlConvertSidToUnicodeString
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtQuerySecurityObject
RtlNtStatusToDosError
NtAllocateVirtualMemory
NtLoadDriver
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrUnloadDll
LdrLoadDll
NtYieldExecution
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtSaveKey
NtLoadKey
NtDeleteValueKey
NtDeleteKey
NtSetInformationKey
NtQueryKey
NtImpersonateAnonymousToken
NtImpersonateThread
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenSection
NtCreateSection
NtOpenSemaphore
NtCreateSemaphore
NtOpenMutant
NtCreateMutant
NtOpenEvent
NtCreateEvent
NtImpersonateClientOfPort
NtSecureConnectPort
NtCreatePort
RtlUnicodeStringToAnsiString
NtOpenThread
NtQueryInformationThread
NtOpenProcessToken
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
NtQueryInformationProcess
NtSetInformationThread
RtlGetFullPathName_U
RtlSetCurrentDirectory_U
RtlGetCurrentDirectory_U
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlCompareUnicodeString
NtQuerySystemInformation
NtSetInformationProcess
NtQueryVolumeInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
NtDeviceIoControlFile
NtWriteFile
NtReadFile
NtDeleteFile
NtSetInformationFile
NtQueryFullAttributesFile
NtQueryAttributesFile
NtQueryInformationFile
NtQueryDirectoryFile
NtOpenFile
NtCreateFile
NtOpenDirectoryObject
NtQueryObject
NtProtectVirtualMemory
LdrGetProcedureAddress
NtSetValueKey
NtEnumerateKey
NtCreateKey
NtOpenKey
NtQueryValueKey
RtlInitUnicodeString
NtRequestWaitReplyPort
NtRegisterThreadTerminatePort
NtConnectPort
NtClose
NtQueryVirtualMemory
strstr
_wcsnicmp
towlower
memcpy
memset
wcschr
_itow
memmove
wcscpy_s
wcsncpy_s
wcsncpy
_wcsicmp
_wcslwr
wcstol
_wtoi
_chkstk
wcsncmp
wcsstr
_stricmp
wcsrchr
_wtoi64
strchr
strncmp
wcstoul
tolower
iswctype
_strlwr

kernel32

VirtualProtect
SetLocaleInfoW
SetLocaleInfoA
PostQueuedCompletionStatus
EnumResourceNamesW
ReadFile
FormatMessageW
LoadLibraryExW
GetVersionExW
GetLongPathNameW
GetFullPathNameW
OpenMutexW
WinExec
CreateProcessA
TerminateProcess
QueueUserWorkItem
CreateFileA
SizeofResource
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
DuplicateHandle
GetProcessId
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetWindowsDirectoryW
CreateMutexW
ReleaseMutex
HeapDestroy
HeapCreate
ResumeThread
SetThreadPriority
GetExitCodeProcess
OpenEventW
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
GlobalAddAtomW
UnmapViewOfFile
MapViewOfFileEx
GetThreadTimes
FindResourceA
FindResourceW
LockResource
LoadResource
GlobalLock
GlobalUnlock
GlobalSize
GetConsoleWindow
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleTitleA
AllocConsole
GetStartupInfoW
OpenThread
GetCurrentThreadId
WaitForMultipleObjects
WideCharToMultiByte
GetSystemInfo
OpenProcess
Sleep
ReplaceFileW
MoveFileWithProgressW
MoveFileExW
GetPrivateProfileStringW
GetSystemWindowsDirectoryW
GetTickCount
GetCurrentThread
QueueUserAPC
TryEnterCriticalSection
InitializeCriticalSection
GetFileAttributesW
DeleteFileW
CreateFileW
CreateDirectoryW
GetEnvironmentVariableW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleA
VirtualFree
GetCurrentProcessId
SetEvent
OutputDebugStringW
VirtualAlloc
GetModuleFileNameW
CreateProcessW
ExitProcess
SetEnvironmentVariableW
GetCommandLineW
LocalFree
LocalAlloc
GetProcAddress
CloseHandle
CreateThread
LoadLibraryW
GetLastError
SetLastError
GlobalAlloc
GlobalFree
WaitForSingleObject
CreateEventW
GetCurrentProcess
ExpandEnvironmentStringsW
FreeLibrary
GetModuleHandleW
GetSystemTimeAsFileTime

Exports

Exports

SbieApi_CallOne
SbieApi_CallTwo
SbieApi_CallZero
SbieApi_CheckInternetAccess
SbieApi_DisableForceProcess
SbieApi_EnumBoxes
SbieApi_EnumProcessEx
SbieApi_GetFileName
SbieApi_GetHomePath
SbieApi_GetMessage
SbieApi_GetUnmountHive
SbieApi_GetVersion
SbieApi_HookTramp
SbieApi_IsBoxEnabled
SbieApi_Log
SbieApi_LogEx
SbieApi_MonitorControl
SbieApi_MonitorGetEx
SbieApi_MonitorPut
SbieApi_MonitorPut2
SbieApi_OpenProcess
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieApi_QueryConfBool
SbieApi_QueryPathList
SbieApi_QueryProcess
SbieApi_QueryProcessEx
SbieApi_QueryProcessInfo
SbieApi_QueryProcessPath
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_SetUserName
SbieDll_AssocQueryCommand
SbieDll_AssocQueryProgram
SbieDll_CallServer
SbieDll_ComCreateProxy
SbieDll_ComCreateStub
SbieDll_DeviceChange
SbieDll_DisableElevationHook
SbieDll_ExpandAndRunProgram
SbieDll_FormatMessage
SbieDll_FormatMessage0
SbieDll_FormatMessage1
SbieDll_FormatMessage2
SbieDll_FreeMem
SbieDll_GetDrivePath
SbieDll_GetHandlePath
SbieDll_GetLanguage
SbieDll_GetServiceRegistryValue
SbieDll_GetStartError
SbieDll_GetTokenElevationType
SbieDll_GetUserPathEx
SbieDll_Hook
SbieDll_InitPStore
SbieDll_IsBoxedService
SbieDll_IsDirectory
SbieDll_IsOpenCOM
SbieDll_IsOpenClsid
SbieDll_KillAll
SbieDll_KillOne
SbieDll_PortName
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueueGetRpl
SbieDll_QueuePutReq
SbieDll_QueuePutRpl
SbieDll_RegisterDllCallback
SbieDll_RunFromHome
SbieDll_RunSandboxed
SbieDll_StartBoxedService
SbieDll_StartCOM
SbieDll_StartSbieSvc
SbieDll_TranslateNtToDosPath
SbieDll_UpdateConf
Sbie_snprintf
Sbie_snwprintf
_SbieApi_CallOne@8
_SbieApi_CallThree@16
_SbieApi_CallTwo@12
_SbieApi_CallZero@4
_SbieApi_CheckInternetAccess@12
_SbieApi_DisableForceProcess@8
_SbieApi_EnumBoxes@8
_SbieApi_EnumBoxesEx@12
_SbieApi_EnumProcessEx@20
_SbieApi_GetFileName@12
_SbieApi_GetHomePath@16
_SbieApi_GetMessage@24
_SbieApi_GetUnmountHive@4
_SbieApi_GetVersion@4
_SbieApi_HookTramp@8
_SbieApi_IsBoxEnabled@4
_SbieApi_LogMsgEx@16
_SbieApi_LogMsgExt@8
_SbieApi_MonitorControl@8
_SbieApi_MonitorGetEx@20
_SbieApi_MonitorPut2@12
_SbieApi_MonitorPut@8
_SbieApi_OpenProcess@8
_SbieApi_ProcessExemptionControl@16
_SbieApi_QueryBoxPath@28
_SbieApi_QueryConf@20
_SbieApi_QueryConfBool@12
_SbieApi_QueryPathList@16
_SbieApi_QueryProcess@20
_SbieApi_QueryProcessEx2@28
_SbieApi_QueryProcessEx@24
_SbieApi_QueryProcessInfo@8
_SbieApi_QueryProcessInfoEx@16
_SbieApi_QueryProcessPath@28
_SbieApi_ReloadConf@4
_SbieApi_SessionLeader@8
_SbieApi_SetUserName@8
_SbieApi_vLogEx@16
_SbieDll_AssocQueryCommand@4
_SbieDll_AssocQueryProgram@4
_SbieDll_CallServer@4
_SbieDll_CallServerQueue@16
_SbieDll_CheckStringInList@12
_SbieDll_ComCreateProxy@16
_SbieDll_ComCreateStub@16
_SbieDll_DeviceChange@8
_SbieDll_DisableElevationHook@0
_SbieDll_ExpandAndRunProgram@4
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieDll_FormatMessage2@12
_SbieDll_FormatMessage@8
_SbieDll_FreeMem@4
_SbieDll_GetBoolForStringFromList@20
_SbieDll_GetBorderColor@16
_SbieDll_GetDrivePath@4
_SbieDll_GetHandlePath@12
_SbieDll_GetLanguage@4
_SbieDll_GetServiceRegistryValue@12
_SbieDll_GetStartError@0
_SbieDll_GetTokenElevationType@0
_SbieDll_GetUserPathEx@4
_SbieDll_Hook@12
_SbieDll_InitPStore@0
_SbieDll_InjectLow@16
_SbieDll_InjectLow_BuildTramp@12
_SbieDll_InjectLow_CopyCode@16
_SbieDll_InjectLow_CopyData@12
_SbieDll_InjectLow_CopySyscalls@4
_SbieDll_InjectLow_InitHelper@0
_SbieDll_InjectLow_InitSyscalls@4
_SbieDll_InjectLow_SendHandle@4
_SbieDll_InjectLow_WriteJump@16
_SbieDll_IsBoxedService@4
_SbieDll_IsDirectory@4
_SbieDll_IsOpenCOM@0
_SbieDll_IsOpenClsid@12
_SbieDll_KillAll@8
_SbieDll_KillOne@4
_SbieDll_MatchImage@12
_SbieDll_PortName@0
_SbieDll_QueueCreate@8
_SbieDll_QueueGetReq@24
_SbieDll_QueueGetRpl@16
_SbieDll_QueuePutReq@20
_SbieDll_QueuePutRpl@16
_SbieDll_RegisterDllCallback@4
_SbieDll_RunFromHome@16
_SbieDll_RunSandboxed@24
_SbieDll_StartBoxedService@8
_SbieDll_StartCOM@4
_SbieDll_StartSbieSvc@4
_SbieDll_TranslateNtToDosPath@4
_SbieDll_UpdateConf@20

Sections

.text
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
32/SbieSvc.exe
.exe windows:6 windows x86 arch:x86

8a63f56d16dd0fe66195005467d8925f

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:de:08:ab:29:33:25:21:12:f4:cf:61:8b:dd:96:48:47:93:b6:87:f9:5d:48:0f:28:f3:07:a6:d2:34:39:dd
Signer

Actual PE Digest

d9:de:08:ab:29:33:25:21:12:f4:cf:61:8b:dd:96:48:47:93:b6:87:f9:5d:48:0f:28:f3:07:a6:d2:34:39:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\Win32\SbieRelease\SbieSvc.pdb

Imports

sbiedll

_SbieDll_CheckStringInList@12
_SbieDll_FormatMessage0@4
_SbieDll_GetLanguage@4
_SbieApi_OpenProcess@8
_SbieApi_ReloadConf@4
_SbieApi_SessionLeader@8
_SbieApi_CheckInternetAccess@12
_SbieApi_QueryConf@20
_SbieDll_QueuePutRpl@16
_SbieDll_QueueGetReq@24
_SbieDll_QueueCreate@8
_SbieDll_FreeMem@4
_SbieDll_KillOne@4
_SbieApi_QueryPathList@16
_SbieApi_QueryProcessInfo@8
_SbieApi_GetHomePath@16
_SbieApi_QueryProcessPath@28
_SbieApi_CallThree@16
_SbieApi_CallTwo@12
_SbieDll_InjectLow@16
_SbieDll_InjectLow_InitSyscalls@4
_SbieDll_InjectLow_InitHelper@0
_SbieDll_PortName@0
_SbieDll_FormatMessage2@12
_SbieDll_GetServiceRegistryValue@12
_SbieApi_GetUnmountHive@4
_SbieApi_SetUserName@8
_SbieApi_QueryConfBool@12
_SbieApi_EnumProcessEx@20
_SbieApi_QueryProcessEx2@28
_SbieApi_GetMessage@24
_SbieApi_GetVersion@4
_SbieApi_CallOne@8
_SbieApi_CallZero@4
_SbieDll_RunSandboxed@24
_SbieApi_IsBoxEnabled@4
_SbieDll_IsOpenClsid@12
_SbieDll_ComCreateStub@16
_SbieDll_RunFromHome@16
_SbieApi_QueryProcess@20
SbieApi_LogEx
SbieApi_Log

ntdll

NtOpenKey
NtUnloadKey
NtCreatePort
RtlUnwind
NtRequestPort
NtReplyWaitReceivePort
RtlInitUnicodeString
RtlInitString
NtLoadDriver
RtlSetDaclSecurityDescriptor
NtCreateFile
NtClose
NtQueryInformationFile
NtSetInformationFile
NtReadFile
NtWriteFile
NtDuplicateObject
NtOpenProcess
NtAdjustPrivilegesToken
NtSetInformationProcess
NtOpenDirectoryObject
NtImpersonateClientOfPort
NtCompleteConnectPort
NtAcceptConnectPort
NtQueryDirectoryFile
NtRequestWaitReplyPort
NtConnectPort
NtFilterToken
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenProcessToken
NtSetInformationThread
NtQueryInformationProcess
RtlCreateSecurityDescriptor
NtLoadKey
NtQuerySystemInformation
RtlNtStatusToDosError

kernel32

GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStringTypeW
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
EncodePointer
CloseHandle
GetLastError
HeapCreate
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
OpenMutexW
CreateEventW
OpenEventW
Sleep
WaitForMultipleObjects
ExitProcess
TerminateProcess
CreateThread
GetCurrentThread
GetTickCount
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LocalFree
GetEnvironmentVariableW
SetCurrentDirectoryW
GetFullPathNameW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
WriteFile
SetLastError
GetProcessTimes
GetCurrentProcess
SetThreadPriority
TerminateThread
CreateProcessW
OpenProcess
GetLocalTime
GetVersionExW
VirtualAlloc
VirtualFree
GetModuleFileNameW
MultiByteToWideChar
GetProcAddress
LocalAlloc
CopyFileW
GetSystemWindowsDirectoryW
DuplicateHandle
ResetEvent
GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueryInformationJobObject
GetModuleHandleW
LoadLibraryW
GlobalSize
RegisterWaitForSingleObject
UnregisterWait
AllocConsole
GetConsoleWindow
GetConsoleProcessList
OutputDebugStringW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineW
GetSystemInfo
CancelIo
DefineDosDeviceW
OpenThread
TlsAlloc
TlsGetValue
TlsSetValue
ResumeThread
WriteProcessMemory
QueueUserWorkItem
GetExitCodeProcess
DeleteFileW
GetFileAttributesW
SetEndOfFile
SetFileAttributesW
HeapReAlloc
GetWindowsDirectoryW
WideCharToMultiByte
SuspendThread
ReadProcessMemory
MulDiv
SetStdHandle
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
DecodePointer
GetModuleHandleA
UnmapViewOfFile
WriteConsoleW

user32

RegisterClassExW
PackDDElParam
GetRawInputDeviceInfoW
GetRawInputDeviceInfoA
UserHandleGrantAccess
GetWindowInfo
MonitorFromWindow
ChangeDisplaySettingsExW
ChangeDisplaySettingsExA
GetIconInfo
GetWindow
GetWindowThreadProcessId
GetClassNameW
GetClassNameA
EnumThreadWindows
EnumWindows
GetShellWindow
FindWindowExW
FindWindowExA
FindWindowW
FindWindowA
EnumChildWindows
GetParent
GetDesktopWindow
GetClassLongW
GetClassLongA
GetWindowLongW
GetWindowLongA
ClipCursor
ShowWindow
ScreenToClient
ClientToScreen
SetCursorPos
GetWindowRect
GetClientRect
GetPropW
GetPropA
SetPropW
ReleaseDC
GetDC
SetForegroundWindow
BeginPaint
wsprintfW
GetMessageW
DispatchMessageW
SetTimer
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
CreateDesktopW
SetThreadDesktop
GetThreadDesktop
CreateWindowStationW
SetProcessWindowStation
GetProcessWindowStation
SendMessageA
IsWindowEnabled
IsWindowUnicode
KillTimer
EndPaint
GetMonitorInfoW
MapWindowPoints
GetClipboardData
SendMessageW
SendMessageTimeoutW
SendNotifyMessageA
EnumClipboardFormats
IsWindowVisible
GetClipboardSequenceNumber
IsZoomed
IsIconic
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostMessageW
PostMessageA
SendNotifyMessageW

advapi32

LookupPrivilegeValueW
LookupAccountSidW
AdjustTokenPrivileges
OpenProcessToken
DuplicateTokenEx
OpenThreadToken
CreateProcessAsUserW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
GetSecurityDescriptorSacl
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetTokenInformation
SetSecurityInfo
ControlService
EnumServicesStatusExW
StartServiceW
OpenEventLogW
ReportEventW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RevertToSelf
SetThreadToken
AddAccessAllowedAce
DuplicateToken
GetLengthSid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
EnumServicesStatusW
QueryServiceConfigW
GetSecurityInfo
AccessCheck
QueryServiceConfig2W
CryptHashData

psapi

EnumProcessModules
GetModuleBaseNameW

ole32

CoGetClassObject
CoMarshalInterface
CoUnmarshalInterface
CoInitializeSecurity
CoQueryProxyBlanket
CoSetProxyBlanket
CoCopyProxy
CoInitializeEx
CoTaskMemFree
CoGetObject
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CreateStreamOnHGlobal
StringFromGUID2

crypt32

CryptUnprotectData
CryptProtectData

secur32

LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaLookupAuthenticationPackage

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

CreateCompatibleDC
GetDIBits
GetMetaFileBitsEx
GetEnhMetaFileBits
CreateFontW
CreateSolidBrush
GetDeviceCaps
SelectObject
SetBkColor
SetTextColor
TextOutW
DeleteDC

netapi32

NetUseAdd

wtsapi32

WTSQueryUserToken

rpcrt4

RpcStringFreeW
RpcMgmtEpEltInqBegin
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcBindingToStringBindingW

Sections

.text
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KmdUtil.exe
.exe windows:6 windows x64 arch:x64

d41bba34c2b7943d327e7a0f7dc16c45

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:3c:e7:39:a3:fa:78:0e:b3:13:ae:db:c6:cb:e1:ec:d3:c9:90:11:3d:26:8d:3f:53:fa:d5:3a:02:c5:bd:ee
Signer

Actual PE Digest

4a:3c:e7:39:a3:fa:78:0e:b3:13:ae:db:c6:cb:e1:ec:d3:c9:90:11:3d:26:8d:3f:53:fa:d5:3a:02:c5:bd:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\KmdUtil.pdb

Imports

ntdll

NtUnloadDriver
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

sbiedll

Sbie_snwprintf
SbieApi_GetVersion
SbieApi_QueryConf
SbieApi_IsBoxEnabled
SbieApi_CallZero

kernel32

GetLastError
SetLastError
HeapAlloc
GetProcessHeap
Sleep
GetModuleFileNameW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageW
CloseHandle
GetCurrentProcess
HeapFree
GetCurrentProcessId
ExitProcess
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetModuleHandleW
GetProcAddress
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetFileType
GetStartupInfoW
QueryPerformanceCounter
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleOutputCP
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
CreateFileW
WideCharToMultiByte
SetStdHandle
FlushFileBuffers
GetModuleHandleExW
SetEndOfFile
WriteConsoleW
RaiseException
HeapSize
HeapReAlloc
InitializeSListHead
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
IsValidCodePage

user32

CreateWindowExW
RegisterClassW
DefWindowProcW
GetDesktopWindow
ShowWindow
DispatchMessageW
GetMessageW
MessageBoxW
GetWindowRect
DestroyWindow
SetFocus
GetFocus
GetParent
LoadIconW
SystemParametersInfoW
LoadCursorW
SendMessageW
GetWindowLongW
GetWindow
PostMessageW

gdi32

CreateFontIndirectW
GetStockObject

advapi32

OpenSCManagerW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
ControlService
CreateServiceW
DeleteService
StartServiceW
OpenServiceW
OpenProcessToken
AdjustTokenPrivileges
CloseServiceHandle
LookupPrivilegeValueW

shell32

CommandLineToArgvW

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LICENSE.TXT
Manifest0.txt
Manifest1.txt
.xml
Manifest2.txt
.xml
SandboxieBITS.exe
.exe windows:6 windows x64 arch:x64

8e27b546920ba69ed63c6b22c6b615b4

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:d9:30:cf:92:f5:82:9d:52:de:b4:6a:e6:17:21:d7:84:88:fc:5e:3b:c0:ee:05:c1:42:db:7d:a9:c8:05:69
Signer

Actual PE Digest

b5:d9:30:cf:92:f5:82:9d:52:de:b4:6a:e6:17:21:d7:84:88:fc:5e:3b:c0:ee:05:c1:42:db:7d:a9:c8:05:69

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieBITS.pdb

Imports

advapi32

SetThreadToken
OpenProcessToken
DuplicateTokenEx
LogonUserW
StartServiceCtrlDispatcherW

kernel32

CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
GetProcAddress
LoadLibraryW
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
LCMapStringW
GetStringTypeW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle

user32

MessageBoxW
wsprintfW

ole32

CoImpersonateClient

wtsapi32

WTSQueryUserToken

sbiedll

SbieDll_Hook

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieCrypto.exe
.exe windows:6 windows x64 arch:x64

951176485da897a689181f8f245a3f44

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:e1:8e:90:92:b7:13:eb:4f:94:6b:71:46:1e:cd:34:47:5f:20:6e:68:bd:5f:8c:46:a5:72:a5:26:06:6d:9a
Signer

Actual PE Digest

9b:e1:8e:90:92:b7:13:eb:4f:94:6b:71:46:1e:cd:34:47:5f:20:6e:68:bd:5f:8c:46:a5:72:a5:26:06:6d:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieCrypto.pdb

Imports

sbiedll

SbieDll_Hook

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry

kernel32

DuplicateHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
WaitForSingleObject
CreateMutexW
OpenMutexW
CreateEventW
OpenEventW
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
GetWindowsDirectoryW
GetVersionExW
GetModuleHandleW
GetProcAddress
LoadLibraryW
CreateFileW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
SetStdHandle
GetStringTypeW
QueryPerformanceCounter
HeapReAlloc
HeapSize
SetFilePointerEx
LCMapStringW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW

advapi32

StartServiceCtrlDispatcherW
SetServiceStatus
GetTokenInformation
DuplicateToken
AccessCheckByType
OpenProcessToken
SetThreadToken

user32

MessageBoxW
wsprintfW

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieDcomLaunch.exe
.exe windows:6 windows x64 arch:x64

75cf98cc6b1909387747ab8b515f9256

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:a8:11:56:0d:01:af:f4:f1:fd:c3:a0:40:d8:9b:dd:1c:a6:8f:28:cf:fd:ad:08:82:e5:5d:6e:3c:ba:57:a6
Signer

Actual PE Digest

2d:a8:11:56:0d:01:af:f4:f1:fd:c3:a0:40:d8:9b:dd:1c:a6:8f:28:cf:fd:ad:08:82:e5:5d:6e:3c:ba:57:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieDcomLaunch.pdb

Imports

sbiedll

SbieDll_StartBoxedService
SbieApi_QueryProcess
SbieApi_EnumProcessEx
SbieApi_OpenProcess
SbieDll_Hook
SbieDll_IsBoxedService

kernel32

WaitForSingleObject
CreateEventW
OpenEventW
GetCurrentProcessId
ExitProcess
CreateThread
GetCurrentThreadId
TlsAlloc
SetEvent
TlsSetValue
OpenProcess
GetVersionExW
CreateFileMappingW
GetModuleHandleW
GetProcAddress
LoadLibraryW
LocalFree
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
GetLastError
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CreateFileW
WriteConsoleW
TlsGetValue
IsDebuggerPresent
HeapSize
SetFilePointerEx
LCMapStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW

advapi32

ConvertSidToStringSidW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
QueryServiceStatusEx
QueryServiceStatus
OpenServiceW
ControlService
CloseServiceHandle
GetTokenInformation
DuplicateToken
AccessCheckByType
OpenProcessToken
SetThreadToken

ntdll

NtOpenKey
RtlInitUnicodeString
NtQueryValueKey
RtlAdjustPrivilege
NtClose
NtQueryInformationProcess

user32

MessageBoxW
wsprintfW

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieRpcSs.exe
.exe windows:6 windows x64 arch:x64

279cf56153f689c2745ddce009d385e0

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:c9:c4:66:cb:79:1b:3e:1e:7d:01:9a:3a:58:eb:83:df:d8:21:2d:11:58:66:44:36:43:15:0c:a9:f9:13:eb
Signer

Actual PE Digest

c8:c9:c4:66:cb:79:1b:3e:1e:7d:01:9a:3a:58:eb:83:df:d8:21:2d:11:58:66:44:36:43:15:0c:a9:f9:13:eb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieRpcSs.pdb

Imports

sbiedll

SbieDll_QueuePutRpl
SbieDll_QueueGetReq
SbieDll_QueueCreate
SbieDll_FreeMem
SbieDll_IsBoxedService
SbieDll_IsOpenCOM
SbieDll_CallServer
SbieDll_Hook
SbieApi_Log
SbieDll_ExpandAndRunProgram
SbieDll_StartBoxedService
SbieDll_KillAll
SbieApi_QueryConf
SbieApi_OpenProcess
SbieApi_EnumProcessEx
SbieApi_QueryProcess
SbieApi_QueryProcessInfo

ws2_32

listen
bind
gethostbyname
gethostname
WSAStartup
WSASetLastError
WSASocketW

advapi32

ConvertSidToStringSidW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
QueryServiceStatusEx
QueryServiceStatus
OpenServiceW
ControlService
CloseServiceHandle
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
DuplicateToken
AccessCheckByType
OpenThreadToken
OpenProcessToken
SetThreadToken

kernel32

CreateFileW
WriteConsoleW
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleMode
GetModuleHandleW
CloseHandle
HeapAlloc
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
GetProcessTimes
ExitProcess
CreateThread
OpenProcess
GetSystemTimeAsFileTime
RegisterWaitForSingleObject
GetLastError
SetLastError
HeapFree
CreateMutexW
OpenMutexW
OpenEventW
GetCurrentProcessId
GetCurrentThreadId
SetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetVersionExW
CreateFileMappingW
GetProcAddress
LoadLibraryW
LocalFree
Sleep
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
SetFilePointerEx
RaiseException
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
QueryPerformanceCounter
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
GetCommandLineA

ntdll

RtlInitUnicodeString
NtQueryValueKey
RtlAdjustPrivilege
NtYieldExecution
NtUnmapViewOfSection
NtMapViewOfSection
NtClose
NtOpenKey

user32

MessageBoxW
wsprintfW
GetWindowThreadProcessId
EnumWindows
GetWindowLongW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
GetMessageW

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieWUAU.exe
.exe windows:6 windows x64 arch:x64

e0107bd50ce8b259db6f57c9f53fe4bb

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8b:02:e5:4e:f8:e0:6c:3f:42:ea:c2:77:ce:99:14:ed:0a:7e:ba:02:5d:27:b2:4b:76:aa:7e:71:e3:ae:2b:dd
Signer

Actual PE Digest

8b:02:e5:4e:f8:e0:6c:3f:42:ea:c2:77:ce:99:14:ed:0a:7e:ba:02:5d:27:b2:4b:76:aa:7e:71:e3:ae:2b:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieWUAU.pdb

Imports

sbiedll

SbieDll_Hook
SbieApi_EnumProcessEx
SbieApi_QueryProcess

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry

kernel32

GetConsoleMode
CreateFileW
WriteConsoleW
GetStringTypeW
GetConsoleOutputCP
IsProcessorFeaturePresent
FlushFileBuffers
HeapReAlloc
HeapSize
HeapFree
SetLastError
GetCurrentThreadId
GetVersionExW
GetLastError
CloseHandle
LoadLibraryW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
SetStdHandle
SetFilePointerEx
LCMapStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieCtrl.exe
.exe windows:6 windows x64 arch:x64

43eb97256389794a7d7b91287ce202db

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:0a:8e:85:57:bd:64:dc:e6:d4:09:15:22:a5:97:95:d0:28:1d:f3:0e:8c:c7:a5:e3:72:d6:27:44:f8:34:9c
Signer

Actual PE Digest

7e:0a:8e:85:57:bd:64:dc:e6:d4:09:15:22:a5:97:95:d0:28:1d:f3:0e:8c:c7:a5:e3:72:d6:27:44:f8:34:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieCtrl.pdb

Imports

sbiedll

SbieDll_GetTokenElevationType
SbieDll_KillOne
SbieDll_DeviceChange
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_GetHomePath
SbieApi_MonitorGetEx
SbieApi_MonitorControl
SbieApi_ProcessExemptionControl
SbieApi_GetMessage
SbieDll_GetStartError
SbieDll_StartSbieSvc
SbieApi_GetVersion
SbieApi_EnumProcessEx
SbieApi_QueryProcessInfo
SbieApi_QueryProcessEx
SbieDll_TranslateNtToDosPath
SbieDll_GetUserPathEx
SbieDll_GetDrivePath
SbieApi_QueryConfBool
SbieApi_GetFileName
SbieApi_QueryBoxPath
SbieDll_KillAll
SbieDll_GetBorderColor
SbieApi_DisableForceProcess
SbieApi_Log
SbieDll_RunFromHome
SbieDll_GetLanguage
SbieDll_FormatMessage2
SbieDll_FormatMessage1
SbieDll_FormatMessage0
SbieDll_FormatMessage
SbieDll_UpdateConf
SbieDll_FreeMem
SbieDll_CallServer
SbieApi_IsBoxEnabled
SbieApi_EnumBoxesEx
SbieApi_QueryConf

ntdll

RtlUnwindEx
VerSetConditionMask
NtOpenKey
NtQueryDirectoryObject
NtOpenDirectoryObject
RtlPcToFileHeader
RtlInitUnicodeString
NtQueryFullAttributesFile
NtQueryDirectoryFile
NtCreateFile
NtClose

psapi

GetModuleFileNameExW

winhttp

WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpOpen
WinHttpSetOption
WinHttpReadData
WinHttpCloseHandle

kernel32

FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
GetCurrentProcess
lstrcmpiW
lstrcpyW
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
VerifyVersionInfoW
GetProfileIntW
SearchPathW
GetTempFileNameW
GetStringTypeW
LCMapStringW
GetCPInfo
ResetEvent
GlobalFlags
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
GetCurrentDirectoryW
GetStartupInfoW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
DecodePointer
RaiseException
GetLastError
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LocalFree
CloseHandle
LocalAlloc
FormatMessageW
GetTickCount
FindResourceExW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
IsDebuggerPresent
OutputDebugStringW
ExitProcess
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
HeapQueryInformation
GetSystemInfo
VirtualAlloc
VirtualQuery
FileTimeToSystemTime
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentThread
GlobalGetAtomNameW
lstrcmpA
ResumeThread
SuspendThread
SetThreadPriority
SetEvent
VirtualProtect
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleExW
GetSystemDirectoryW
EncodePointer
OutputDebugStringA
WideCharToMultiByte
SetLastError
OpenProcess
GetProcessTimes
GetModuleHandleA
GetTempPathW
WriteFile
WaitForMultipleObjects
CreateEventW
CopyFileW
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DeleteFileW
GetDriveTypeW
CreateThread
ExpandEnvironmentStringsW
MoveFileW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
QueryPerformanceFrequency
SetStdHandle
GetFileType
GetStdHandle
FreeLibrary
GetSystemTimeAsFileTime
OpenEventW
GetFileAttributesW
GetCurrentThreadId
GetProcAddress
GetLocaleInfoW
WaitForSingleObject
ProcessIdToSessionId
OpenMutexW
CreateMutexW
GetShortPathNameW
SetCurrentDirectoryW
GetCommandLineW
GetSystemWindowsDirectoryW
GetVersionExW
GetCurrentProcessId
GlobalSize
ReadFile
GetFileSizeEx
CreateFileW
Sleep
MulDiv
GetWindowsDirectoryW
GetFileTime
MultiByteToWideChar
LoadLibraryW
WaitForSingleObjectEx

user32

GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
CharUpperBuffW
GetDoubleClickTime
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetComboBoxInfo
UpdateLayeredWindow
DrawIcon
FrameRect
CopyIcon
SetCursorPos
IsZoomed
DrawFrameControl
DrawEdge
EnumDisplayMonitors
NotifyWinEvent
HideCaret
EnableScrollBar
MessageBeep
DrawFocusRect
GetNextDlgGroupItem
LockWindowUpdate
GetMenuDefaultItem
TrackMouseEvent
CharUpperW
SetParent
GetSystemMenu
UnionRect
SendDlgItemMessageA
CopyImage
RealChildWindowFromPoint
ShowOwnedPopups
ReuseDDElParam
UnpackDDElParam
SetRectEmpty
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
SendDlgItemMessageW
CheckDlgButton
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
MoveWindow
WinHelpW
GetScrollInfo
SetScrollInfo
GetTopWindow
GetClassLongPtrW
EqualRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetDlgItem
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetMessageTime
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetLastActivePopup
IsWindowEnabled
IntersectRect
InflateRect
FillRect
RemoveMenu
GetMenuState
GetMenuStringW
EnumWindows
GetSysColorBrush
IsWindow
GetIconInfo
CreateIconIndirect
LoadImageW
MonitorFromRect
MonitorFromPoint
SetMenuDefaultItem
ModifyMenuW
AppendMenuW
InsertMenuW
GetMenuItemID
CreatePopupMenu
SetFocus
PostQuitMessage
UpdateWindow
LoadMenuW
GetActiveWindow
RegisterWindowMessageW
wsprintfW
IsRectEmpty
TabbedTextOutW
GrayStringW
DrawTextExW
SystemParametersInfoW
DrawStateW
DrawTextW
GetMenuItemRect
SetMenuItemInfoW
GetMenuItemInfoW
DeleteMenu
GetMenuItemCount
IsMenu
GetMessagePos
GetMessageW
DrawIconEx
FindWindowExW
SetForegroundWindow
GetDlgCtrlID
IsIconic
InvalidateRect
DestroyCursor
LoadBitmapW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnumChildWindows
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
OffsetRect
SetRect
InvertRect
SetCursor
GetWindowDC
ReleaseCapture
SetCapture
CallWindowProcW
DestroyIcon
ClientToScreen
GetSubMenu
EnableMenuItem
GetKeyState
GetFocus
IsClipboardFormatAvailable
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetWindow
RegisterClipboardFormatW
GetTitleBarInfo
GetMonitorInfoW
MonitorFromWindow
LoadIconW
GetWindowThreadProcessId
FindWindowW
SetClassLongPtrW
WindowFromPoint
GetCursorPos
SetWindowRgn
GetForegroundWindow
GetSystemMetrics
SetWindowPos
SetLayeredWindowAttributes
DestroyWindow
CreateWindowExW
EnumThreadWindows
GetWindowLongW
FlashWindowEx
ShowWindow
CopyRect
GetSysColor
EndPaint
BeginPaint
KillTimer
SetTimer
ScreenToClient
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
TranslateMessage
UnregisterClassW
LoadCursorW
GetClassNameW
GetParent
GetDesktopWindow
GetWindowRect
GetClientRect
EnableWindow
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
ReleaseDC
GetDC
SetActiveWindow

gdi32

CreateBitmap
MoveToEx
SetViewportExtEx
CreateHatchBrush
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
SetRectRgn
DPtoLP
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
CreateDCW
StretchBlt
CreateDIBSection
SetDIBColorTable
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
GetRgnBox
ExtTextOutW
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CopyMetaFileW
GetTextCharsetInfo
CreatePatternBrush
TextOutW
SetTextColor
RectVisible
PtVisible
GetCurrentObject
GetClipBox
Escape
CreatePen
Rectangle
GetDeviceCaps
GetStockObject
GetTextExtentPoint32W
PatBlt
SelectObject
GetTextMetricsW
DeleteDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetBkColor
GetTextColor
CreateSolidBrush
DeleteObject
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
CreatePolygonRgn
CreateFontIndirectW
SetPixel
GetObjectW
CombineRgn
CreateEllipticRgn
CreateRectRgn
Ellipse
OffsetRgn
GetPixel
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType
ExcludeClipRect

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetOpenFileNameW
ChooseColorW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

EnumServicesStatusW
OpenEventLogW
ReadEventLogW
GetUserNameW
RegCloseKey
RegEnumValueW
RegOpenKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueW
RegEnumKeyW
OpenSCManagerW
CloseEventLog
CloseServiceHandle
RegNotifyChangeKeyValue
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetFileInfoW
ShellExecuteExW
Shell_NotifyIconW
DragQueryFileW
DragAcceptFiles
ord165
SHGetFolderPathW
ExtractIconExW
DragFinish
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHAppBarMessage
SHFileOperationW
SHBrowseForFolderW
ShellExecuteW
SHGetDesktopFolder

comctl32

_TrackMouseEvent
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Remove
ImageList_GetIconSize
ImageList_GetImageInfo

shlwapi

PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW

uxtheme

DrawThemeText
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
GetCurrentThemeName
GetThemeColor
IsAppThemed
GetThemePartSize
CloseThemeData
DrawThemeParentBackground
OpenThemeData
DrawThemeBackground

ole32

CoTaskMemAlloc
OleDuplicateData
ReleaseStgMedium
CoUninitialize
CoCreateGuid
CoDisconnectObject
CoInitializeEx
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
CoInitialize
CoCreateInstance
GetRunningObjectTable
CreateClassMoniker
CoTaskMemFree
CreateStreamOnHGlobal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator

oleaut32

VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString

gdiplus

GdipCloneImage
GdipLoadImageFromStream
GdipFree
GdiplusShutdown
GdipGetImageHeight
GdipImageGetFrameDimensionsList
GdipDisposeImage
GdipAlloc
GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipImageGetFrameCount
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipCreateHBITMAPFromBitmap

ws2_32

ntohl

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 676KB - Virtual size: 675KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieDll.dll
.dll windows:6 windows x64 arch:x64

de87bd8e4418b30a9f13d40bead5b83f

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:88:f5:83:93:08:65:b6:cc:8c:31:aa:e0:9e:7c:49:4f:cb:b9:09:b5:ed:ae:45:50:b6:ea:be:f4:89:e6:3c
Signer

Actual PE Digest

bd:88:f5:83:93:08:65:b6:cc:8c:31:aa:e0:9e:7c:49:4f:cb:b9:09:b5:ed:ae:45:50:b6:ea:be:f4:89:e6:3c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDll.pdb

Imports

ntdll

NtSetInformationJobObject
NtAssignProcessToJobObject
NtCreateJobObject
NtUnmapViewOfSection
NtMapViewOfSection
NtClose
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
NtAdjustPrivilegesToken
NtDuplicateObject
NtSetInformationToken
NtOpenProcess
RtlConvertSidToUnicodeString
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtQuerySecurityObject
RtlNtStatusToDosError
NtQueryVirtualMemory
NtAllocateVirtualMemory
NtProtectVirtualMemory
NtLoadDriver
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrUnloadDll
LdrLoadDll
NtYieldExecution
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtSaveKey
NtLoadKey
NtDeleteValueKey
NtDeleteKey
NtSetInformationKey
NtQueryKey
NtImpersonateAnonymousToken
NtImpersonateThread
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenSection
NtCreateSection
NtOpenSemaphore
NtCreateSemaphore
NtOpenMutant
NtCreateMutant
NtOpenEvent
NtCreateEvent
NtImpersonateClientOfPort
NtSecureConnectPort
NtCreatePort
RtlUnicodeStringToAnsiString
NtOpenThread
NtQueryInformationThread
NtOpenProcessToken
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
NtQueryInformationProcess
NtSetInformationThread
RtlGetFullPathName_U
RtlSetCurrentDirectory_U
RtlGetCurrentDirectory_U
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlCompareUnicodeString
NtQuerySystemInformation
NtSetInformationProcess
NtQueryVolumeInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
NtDeviceIoControlFile
NtWriteFile
NtReadFile
NtDeleteFile
NtSetInformationFile
NtQueryFullAttributesFile
NtQueryAttributesFile
NtQueryInformationFile
NtQueryDirectoryFile
NtOpenFile
NtCreateFile
NtOpenDirectoryObject
NtQueryObject
LdrGetProcedureAddress
NtSetValueKey
NtEnumerateKey
NtCreateKey
NtOpenKey
NtQueryValueKey
RtlInitUnicodeString
NtRequestWaitReplyPort
NtRegisterThreadTerminatePort
NtConnectPort
strstr
_wcsnicmp
towlower
memcpy
memset
wcschr
_itow
memmove
wcscpy_s
wcsncpy_s
wcsncpy
_wcsicmp
_wcslwr
wcstol
_wtoi
__chkstk
wcsncmp
wcsstr
memcmp
__C_specific_handler
wcsrchr
_wtoi64
strchr
strncmp
wcstoul
tolower
_stricmp
iswctype
_strlwr

kernel32

LeaveCriticalSection
SetLocaleInfoW
SetLocaleInfoA
PostQueuedCompletionStatus
EnumResourceNamesW
ReadFile
FormatMessageW
LoadLibraryExW
GetVersionExW
GetLongPathNameW
GetFullPathNameW
OpenMutexW
WinExec
CreateProcessA
TerminateProcess
QueueUserWorkItem
CreateFileA
SizeofResource
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
DuplicateHandle
GetProcessId
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetWindowsDirectoryW
CreateMutexW
ReleaseMutex
HeapDestroy
HeapCreate
ResumeThread
SetThreadPriority
GetExitCodeProcess
OpenEventW
DeleteCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
RaiseException
GlobalAddAtomW
UnmapViewOfFile
MapViewOfFileEx
GetThreadTimes
FindResourceA
FindResourceW
LockResource
LoadResource
GlobalLock
GlobalUnlock
GlobalSize
GetConsoleWindow
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleTitleA
AllocConsole
GetStartupInfoW
OpenThread
GetCurrentThreadId
WaitForMultipleObjects
WideCharToMultiByte
GetSystemInfo
OpenProcess
GetCurrentProcess
Sleep
GetSystemWindowsDirectoryW
ReplaceFileW
MoveFileWithProgressW
MoveFileExW
GetPrivateProfileStringW
GetTickCount
GetCurrentThread
QueueUserAPC
TryEnterCriticalSection
GetFileAttributesW
DeleteFileW
CreateFileW
CreateDirectoryW
GetEnvironmentVariableW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleA
VirtualFree
GetCurrentProcessId
SetEvent
InitializeCriticalSection
OutputDebugStringW
VirtualAlloc
EnterCriticalSection
GetModuleFileNameW
VirtualProtect
CreateProcessW
ExitProcess
SetEnvironmentVariableW
GetProcAddress
CloseHandle
CreateThread
LoadLibraryW
GetLastError
SetLastError
GlobalAlloc
GlobalFree
WaitForSingleObject
CreateEventW
ExpandEnvironmentStringsW
FreeLibrary
GetModuleHandleW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetCommandLineW

Exports

Exports

SbieApi_CallOne
SbieApi_CallThree
SbieApi_CallTwo
SbieApi_CallZero
SbieApi_CheckInternetAccess
SbieApi_DisableForceProcess
SbieApi_EnumBoxes
SbieApi_EnumBoxesEx
SbieApi_EnumProcessEx
SbieApi_GetFileName
SbieApi_GetHomePath
SbieApi_GetMessage
SbieApi_GetUnmountHive
SbieApi_GetVersion
SbieApi_HookTramp
SbieApi_IsBoxEnabled
SbieApi_Log
SbieApi_LogEx
SbieApi_LogMsgEx
SbieApi_LogMsgExt
SbieApi_MonitorControl
SbieApi_MonitorGetEx
SbieApi_MonitorPut
SbieApi_MonitorPut2
SbieApi_OpenProcess
SbieApi_ProcessExemptionControl
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieApi_QueryConfBool
SbieApi_QueryPathList
SbieApi_QueryProcess
SbieApi_QueryProcessEx
SbieApi_QueryProcessEx2
SbieApi_QueryProcessInfo
SbieApi_QueryProcessInfoEx
SbieApi_QueryProcessPath
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_SetUserName
SbieApi_vLogEx
SbieDll_AssocQueryCommand
SbieDll_AssocQueryProgram
SbieDll_CallServer
SbieDll_CallServerQueue
SbieDll_CheckStringInList
SbieDll_ComCreateProxy
SbieDll_ComCreateStub
SbieDll_DeviceChange
SbieDll_DisableElevationHook
SbieDll_ExpandAndRunProgram
SbieDll_FormatMessage
SbieDll_FormatMessage0
SbieDll_FormatMessage1
SbieDll_FormatMessage2
SbieDll_FreeMem
SbieDll_GetBoolForStringFromList
SbieDll_GetBorderColor
SbieDll_GetDrivePath
SbieDll_GetHandlePath
SbieDll_GetLanguage
SbieDll_GetServiceRegistryValue
SbieDll_GetStartError
SbieDll_GetTokenElevationType
SbieDll_GetUserPathEx
SbieDll_Has32BitJumpHorizon
SbieDll_Hook
SbieDll_InitPStore
SbieDll_InjectLow
SbieDll_InjectLow_BuildTramp
SbieDll_InjectLow_CopyCode
SbieDll_InjectLow_CopyData
SbieDll_InjectLow_CopySyscalls
SbieDll_InjectLow_InitHelper
SbieDll_InjectLow_InitSyscalls
SbieDll_InjectLow_SendHandle
SbieDll_InjectLow_WriteJump
SbieDll_InjectLow_getPage
SbieDll_IsBoxedService
SbieDll_IsDirectory
SbieDll_IsOpenCOM
SbieDll_IsOpenClsid
SbieDll_KillAll
SbieDll_KillOne
SbieDll_MatchImage
SbieDll_PortName
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueueGetRpl
SbieDll_QueuePutReq
SbieDll_QueuePutRpl
SbieDll_RegisterDllCallback
SbieDll_RunFromHome
SbieDll_RunSandboxed
SbieDll_StartBoxedService
SbieDll_StartCOM
SbieDll_StartSbieSvc
SbieDll_TranslateNtToDosPath
SbieDll_UpdateConf
Sbie_snprintf
Sbie_snwprintf

Sections

.text
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieDrv.sys
.sys windows:10 windows x64 arch:x64

b1d11ab87acb865bd23dcbed2ca47e72

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:25

Not After

02/12/2021, 22:25

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:88:d9:c2:7f:ad:96:68:d5:34:43:4c:31:db:ec:f7:cb:2b:92:76:c1:e2:ef:77:43:39:6c:fd:c5:30:bf:b1
Signer

Actual PE Digest

b6:88:d9:c2:7f:ad:96:68:d5:34:43:4c:31:db:ec:f7:cb:2b:92:76:c1:e2:ef:77:43:39:6c:fd:c5:30:bf:b1

Digest Algorithm

sha256

PE Digest Matches

true

b6:88:d9:c2:7f:ad:96:68:d5:34:43:4c:31:db:ec:f7:cb:2b:92:76:c1:e2:ef:77:43:39:6c:fd:c5:30:bf:b1
Signer

Actual PE Digest

b6:88:d9:c2:7f:ad:96:68:d5:34:43:4c:31:db:ec:f7:cb:2b:92:76:c1:e2:ef:77:43:39:6c:fd:c5:30:bf:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDrv.pdb

Imports

ntoskrnl.exe

ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExGetPreviousMode
IofCompleteRequest
IoCreateDevice
IoDeleteDevice
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
PsGetCurrentProcessId
SeFilterToken
LpcRequestPort
__C_specific_handler
LpcPortObjectType
wcschr
RtlCompareUnicodeString
RtlFreeUnicodeString
swprintf
_wcsicmp
_wcsnicmp
RtlUnicodeStringToInteger
ExAcquireResourceSharedLite
ZwYieldExecution
_itow
RtlQueryRegistryValues
towlower
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoGetCurrentProcess
RtlConvertSidToUnicodeString
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
ZwCreateFile
ZwQueryInformationFile
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
wcsrchr
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlGetVersion
KeDelayExecutionThread
PsGetVersion
ZwOpenKey
ZwQueryValueKey
RtlCreateAcl
RtlAddAce
RtlAddAccessAllowedAceEx
RtlSetSaclSecurityDescriptor
ZwSetInformationFile
ZwWriteFile
IoCreateFileSpecifyDeviceObjectHint
NtClose
ObOpenObjectByPointer
sprintf
IoFileObjectType
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
PsGetProcessWin32WindowStation
ExWindowStationObjectType
_wcslwr
KeBugCheckEx
ExInitializeResourceLite
ExDeleteResourceLite
IoCreateFile
ProbeForWrite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ZwCreateDirectoryObject
SeSinglePrivilegeCheck
PsGetProcessId
ZwDuplicateObject
ZwOpenDirectoryObject
ZwSetSecurityObject
ZwCreateSymbolicLinkObject
NtDuplicateObject
wcscmp
PsProcessType
PsLookupProcessByProcessId
ObReferenceObjectByName
ZwQueryDirectoryObject
wcsstr
CmUnRegisterCallback
MmGetSystemRoutineAddress
ZwCreateKey
ZwSetValueKey
ObQueryNameString
ZwOpenProcessTokenEx
ZwSetInformationToken
ZwLoadKey
ObOpenObjectByName
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
PsGetCurrentThreadId
DbgPrint
RtlInt64ToUnicodeString
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessCreateTimeQuadPart
PsSetThreadHardErrorsAreDisabled
SeQuerySessionIdToken
PsDereferenceImpersonationToken
PsReferenceImpersonationToken
PsGetProcessSessionId
SeTokenObjectType
KeStackAttachProcess
KeUnstackDetachProcess
PsGetProcessPeb
ZwOpenProcess
ZwQueryInformationProcess
PsGetProcessJob
SeTokenIsAdmin
ZwQueryInformationToken
NtDeviceIoControlFile
PsImpersonateClient
ZwQuerySystemInformation
strcmp
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsGetThreadId
SeTokenType
PsGetThreadProcess
ZwDuplicateToken
ZwOpenThreadToken
ZwOpenProcessToken
SeTokenImpersonationLevel
PsGetProcessExitProcessCalled
PsThreadType
ZwDeviceIoControlFile
RtlEqualSid
RtlLengthSid
RtlAddAccessAllowedAce
ZwSetInformationProcess
ExRaiseStatus
ProbeForRead
ExFreePoolWithTag
ExAllocatePoolWithTag
KeAreApcsDisabled
RtlInitUnicodeString
wcsncpy
ZwReadFile
wcsncmp

fltmgr.sys

FltReleaseFileNameInformation
FltGetFileNameInformation
FltSetCallbackDataDirty
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter

ksecdd.sys

SecLookupAccountName

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INITDATA
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieIni.exe
.exe windows:6 windows x64 arch:x64

afde0202e8968717f551ae7fc5ca596e

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ea:17:86:68:50:af:0a:99:7c:08:26:df:60:b4:6b:7f:36:91:50:44:9f:28:6a:78:89:bf:7c:c4:0d:c3:27:6c
Signer

Actual PE Digest

ea:17:86:68:50:af:0a:99:7c:08:26:df:60:b4:6b:7f:36:91:50:44:9f:28:6a:78:89:bf:7c:c4:0d:c3:27:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieIni.pdb

Imports

sbiedll

SbieDll_UpdateConf
SbieApi_QueryConf
SbieDll_TranslateNtToDosPath
SbieApi_EnumBoxesEx
SbieApi_IsBoxEnabled

kernel32

WriteFile
WriteConsoleW
CreateFileW
CloseHandle
GetCommandLineW
HeapAlloc
GetProcessHeap
ExitProcess
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:8d:fe:0c:e2:37:0d:e7:2e:f9:cf:60:30:f7:7f:e3:31:e6:6d:77:ab:13:7a:34:fd:c2:50:e1:ca:12:87:78
Signer

Actual PE Digest

f2:8d:fe:0c:e2:37:0d:e7:2e:f9:cf:60:30:f7:7f:e3:31:e6:6d:77:ab:13:7a:34:fd:c2:50:e1:ca:12:87:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SbieSvc.exe
.exe windows:6 windows x64 arch:x64

30aebb0a8f8855d7877a2496978a57c0

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:9a:a6:e2:6f:7d:86:01:59:16:ca:5c:16:5b:bc:a1:49:68:8f:fb:d7:be:36:1e:a2:f3:36:b8:e9:e9:d0:b3
Signer

Actual PE Digest

80:9a:a6:e2:6f:7d:86:01:59:16:ca:5c:16:5b:bc:a1:49:68:8f:fb:d7:be:36:1e:a2:f3:36:b8:e9:e9:d0:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieSvc.pdb

Imports

sbiedll

SbieDll_IsOpenClsid
SbieDll_ComCreateStub
SbieApi_EnumProcessEx
SbieApi_QueryConfBool
SbieApi_SetUserName
SbieApi_GetMessage
SbieDll_RunFromHome
SbieApi_GetVersion
SbieApi_CallOne
SbieApi_CallZero
SbieApi_QueryProcessEx2
SbieApi_GetUnmountHive
SbieDll_GetServiceRegistryValue
SbieDll_FormatMessage2
SbieDll_PortName
SbieDll_InjectLow_InitHelper
SbieDll_InjectLow_InitSyscalls
SbieDll_InjectLow
SbieApi_CallTwo
SbieApi_CallThree
SbieApi_QueryProcessPath
SbieDll_RunSandboxed
SbieApi_QueryProcess
SbieApi_IsBoxEnabled
SbieApi_GetHomePath
SbieApi_QueryProcessInfo
SbieApi_QueryPathList
SbieDll_KillOne
SbieDll_FreeMem
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueuePutRpl
SbieApi_QueryConf
SbieApi_CheckInternetAccess
SbieApi_SessionLeader
SbieApi_ReloadConf
SbieApi_OpenProcess
SbieDll_GetLanguage
SbieDll_FormatMessage0
SbieDll_CheckStringInList
SbieApi_Log
SbieApi_LogEx

ntdll

NtUnloadKey
NtCreatePort
NtClose
NtReplyWaitReceivePort
RtlCaptureContext
RtlLookupFunctionEntry
NtRequestPort
NtOpenKey
RtlUnwindEx
RtlPcToFileHeader
RtlInitUnicodeString
NtLoadDriver
RtlSetDaclSecurityDescriptor
NtCreateFile
NtQueryDirectoryFile
NtQueryInformationFile
NtSetInformationFile
NtReadFile
NtWriteFile
NtQueryKey
RtlVirtualUnwind
NtQuerySystemInformation
NtDuplicateObject
NtOpenProcess
NtAdjustPrivilegesToken
NtSetInformationProcess
NtOpenDirectoryObject
NtImpersonateClientOfPort
NtCompleteConnectPort
NtAcceptConnectPort
RtlNtStatusToDosError
NtRequestWaitReplyPort
NtConnectPort
NtFilterToken
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenProcessToken
NtSetInformationThread
NtQueryInformationProcess
RtlCreateSecurityDescriptor
NtLoadKey

kernel32

GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStringTypeW
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
CloseHandle
GetLastError
HeapCreate
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
OpenMutexW
CreateEventW
OpenEventW
Sleep
WaitForMultipleObjects
ExitProcess
TerminateProcess
CreateThread
GetCurrentThread
OpenProcess
GetTickCount
CreateFileMappingW
OpenFileMappingW
GetCommandLineA
UnmapViewOfFile
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LocalFree
GetEnvironmentVariableW
SetCurrentDirectoryW
GetFullPathNameW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
WriteFile
SetLastError
GetProcessTimes
GetCurrentProcess
SetThreadPriority
TerminateThread
CreateProcessW
GetLocalTime
GetVersionExW
VirtualAlloc
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LocalAlloc
CopyFileW
GetSystemWindowsDirectoryW
DuplicateHandle
ResetEvent
GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueryInformationJobObject
GetModuleHandleW
LoadLibraryW
GlobalSize
RegisterWaitForSingleObject
UnregisterWait
AllocConsole
GetConsoleWindow
GetConsoleProcessList
OutputDebugStringW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineW
GetSystemInfo
CancelIo
DefineDosDeviceW
OpenThread
TlsAlloc
TlsGetValue
TlsSetValue
ResumeThread
WriteProcessMemory
QueueUserWorkItem
GetExitCodeProcess
DeleteFileW
GetFileAttributesW
SetEndOfFile
SetFileAttributesW
HeapReAlloc
GetWindowsDirectoryW
WideCharToMultiByte
SuspendThread
ReadProcessMemory
MulDiv
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
MapViewOfFile
EncodePointer

user32

IsZoomed
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostMessageW
PostMessageA
SendNotifyMessageW
SendNotifyMessageA
SendMessageTimeoutW
GetClipboardData
SendMessageA
GetProcessWindowStation
SetProcessWindowStation
CreateWindowStationW
GetThreadDesktop
SetThreadDesktop
CreateDesktopW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetTimer
DispatchMessageW
GetMessageW
wsprintfW
EnumClipboardFormats
GetClipboardSequenceNumber
KillTimer
IsWindowUnicode
GetMonitorInfoW
EndPaint
BeginPaint
ShowWindow
RegisterClassExW
PackDDElParam
GetRawInputDeviceInfoW
GetRawInputDeviceInfoA
UserHandleGrantAccess
GetWindowInfo
MonitorFromWindow
ChangeDisplaySettingsExW
ChangeDisplaySettingsExA
GetIconInfo
GetWindow
GetWindowThreadProcessId
GetClassNameW
GetClassNameA
EnumThreadWindows
EnumWindows
GetShellWindow
FindWindowExW
FindWindowExA
FindWindowW
FindWindowA
EnumChildWindows
GetParent
GetDesktopWindow
GetClassLongPtrW
GetClassLongPtrA
GetClassLongW
GetClassLongA
GetWindowLongPtrW
GetWindowLongPtrA
GetWindowLongW
GetWindowLongA
ClipCursor
MapWindowPoints
ScreenToClient
ClientToScreen
SetCursorPos
GetWindowRect
GetClientRect
GetPropW
GetPropA
SetPropW
ReleaseDC
GetDC
SetForegroundWindow
SendMessageW
IsWindowEnabled

advapi32

CreateProcessAsUserW
SetThreadToken
RevertToSelf
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
ReportEventW
OpenEventLogW
StartServiceW
EnumServicesStatusExW
ControlService
SetSecurityInfo
OpenThreadToken
SetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DuplicateTokenEx
OpenProcessToken
AdjustTokenPrivileges
LookupAccountSidW
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
GetSecurityInfo
AccessCheck
QueryServiceConfig2W
QueryServiceConfigW
EnumServicesStatusW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetLengthSid
DuplicateToken
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
RegOpenUserClassesRoot
RegOpenCurrentUser
GetSecurityDescriptorSacl
AddAccessAllowedAce

psapi

EnumProcessModules
GetModuleBaseNameW

ole32

CoInitializeEx
CoGetClassObject
CoMarshalInterface
CoUnmarshalInterface
CoInitializeSecurity
CoQueryProxyBlanket
CoSetProxyBlanket
CreateStreamOnHGlobal
StringFromGUID2
CoTaskMemFree
CoGetObject
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoCopyProxy

crypt32

CryptProtectData
CryptUnprotectData

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

GetDIBits
GetMetaFileBitsEx
DeleteDC
CreateCompatibleDC
CreateFontW
CreateSolidBrush
GetDeviceCaps
SelectObject
SetBkColor
SetTextColor
GetEnhMetaFileBits
TextOutW

netapi32

NetUseAdd

wtsapi32

WTSQueryUserToken

rpcrt4

RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcStringFreeW
RpcMgmtEpEltInqBegin
RpcBindingToStringBindingW

Sections

.text
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SboxHostDll.dll
.dll windows:6 windows x64 arch:x64

c19da5ee28378278969e1d0ca50e49f0

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:a6:e1:99:90:5b:65:eb:66:85:b1:c1:5e:8f:55:59:5c:24:31:db:18:f1:78:4a:9f:51:36:f1:5a:d2:29:1c
Signer

Actual PE Digest

2f:a6:e1:99:90:5b:65:eb:66:85:b1:c1:5e:8f:55:59:5c:24:31:db:18:f1:78:4a:9f:51:36:f1:5a:d2:29:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SboxHostDll.pdb

Imports

sbiedll

SbieApi_QueryProcessInfo
SbieDll_Hook

psapi

EnumProcesses

kernel32

GetModuleHandleW
CreateMutexW
CloseHandle
GetProcessId
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
lstrcmpiW
GetModuleFileNameW
OpenProcess
GetProcAddress
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetFilePointerEx
GetConsoleMode
CreateFileW
WriteConsoleW
LocalFree
RtlPcToFileHeader
GetConsoleOutputCP
WriteFile
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers

advapi32

GetTokenInformation
IsValidSid
GetLengthSid
CopySid
ConvertSidToStringSidW

userenv

UnloadUserProfile

Exports

Exports

InjectDllMain

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Start.exe
.exe windows:6 windows x64 arch:x64

9ebeff9199235eb9224e61cc9a447e0e

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:ce:7a:be:3c:96:ea:ae:5c:d9:a7:e5:75:66:e7:26:48:fb:77:c9:98:ae:cb:5b:5e:3e:bf:40:f6:8c:42:57
Signer

Actual PE Digest

48:ce:7a:be:3c:96:ea:ae:5c:d9:a7:e5:75:66:e7:26:48:fb:77:c9:98:ae:cb:5b:5e:3e:bf:40:f6:8c:42:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\Start.pdb

Imports

ntdll

NtCreateFile
NtQueryInformationFile
VerSetConditionMask
NtSetInformationFile
RtlInitUnicodeString
RtlNtStatusToDosError
NtOpenKey
NtTerminateProcess
RtlVirtualUnwind
NtTerminateThread
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlCaptureContext
NtClose

user32

SetClassLongPtrW
SetWindowRgn
SetParent
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
GetWindowRgn
DestroyCursor
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
GetMenuDefaultItem
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
KillTimer
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
InvalidateRect
TrackMouseEvent
MapDialogRect
GetNextDlgTabItem
CreateDialogIndirectParamW
PostQuitMessage
OffsetRect
SetRectEmpty
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
InflateRect
GetMenuItemInfoW
FillRect
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
RealChildWindowFromPoint
CharUpperW
IsDialogMessageW
CheckDlgButton
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongPtrW
PtInRect
EqualRect
CopyRect
AdjustWindowRectEx
RemovePropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
GetForegroundWindow
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
IsWindow
GetClassInfoExW
GetClassInfoW
PostMessageW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetFocus
GetWindowTextLengthW
LoadCursorW
GetSysColor
ReleaseDC
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetLastActivePopup
GetWindowThreadProcessId
GetParent
UnhookWindowsHookEx
AllowSetForegroundWindow
GetAsyncKeyState
PostThreadMessageW
GetMessageW
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowTextW
IsWindowEnabled
MoveWindow
DrawIconEx
GetSysColorBrush
GetDC
SetForegroundWindow
InsertMenuItemW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
GetMenuItemCount
DestroyMenu
CreatePopupMenu
CreateMenu
RegisterClassW
DefWindowProcW
DestroyIcon
ExitWindowsEx
wsprintfW
LoadImageW
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
ScreenToClient
ClientToScreen
MessageBoxW
GetWindowRect
GetClientRect
SetWindowTextW
GetPropW
SetPropW
GetSystemMetrics
EnableWindow
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
CallWindowProcW
SendMessageW
DrawStateW
IntersectRect
EnableMenuItem

shell32

ExtractIconW
ExtractIconExW
SHGetFolderPathW
SHBindToParent
SHGetFileInfoW
ShellExecuteExW
SHGetPathFromIDListW
ExtractAssociatedIconW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
ShellExecuteW

shlwapi

AssocQueryStringW
SHAutoComplete
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW

kernel32

GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
SetFilePointerEx
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
FlushFileBuffers
ReadFile
OutputDebugStringW
WriteConsoleW
LoadResource
LCMapStringW
CompareStringW
IsValidCodePage
LockResource
SizeofResource
FindResourceW
OutputDebugStringA
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
InitializeCriticalSection
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
LocalAlloc
LocalReAlloc
GlobalSize
MulDiv
CopyFileW
SetThreadPriority
ResumeThread
lstrcmpA
GlobalGetAtomNameW
FileTimeToSystemTime
GetModuleHandleExW
GetFileType
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemDirectoryW
GlobalDeleteAtom
GetFileAttributesExW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeCriticalSectionAndSpinCount
HeapSize
RaiseException
DecodePointer
FormatMessageW
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
GetFileSize
GetVolumeInformationW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
lstrcmpiW
GlobalFlags
GetUserDefaultUILanguage
VirtualProtect
FileTimeToLocalFileTime
GetFileTime
SystemTimeToTzSpecificLocalTime
lstrcpyW
FindResourceExW
GetWindowsDirectoryW
VerifyVersionInfoW
GetTempPathW
GetTickCount
GetProfileIntW
SearchPathW
GetTempFileNameW
LoadLibraryW
GetProcAddress
GetVersionExW
GetCurrentThreadId
GetLastError
WriteFile
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCommandLineW
GetStdHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
HeapReAlloc
GetLogicalDrives
CreateFileW
GetSystemWindowsDirectoryW
GetFullPathNameW
GetFileAttributesW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetModuleFileNameW
GetSystemTimeAsFileTime
ProcessIdToSessionId
CreateProcessW
GetExitCodeProcess
ExitProcess
Sleep
QueryPerformanceCounter
DeleteCriticalSection
CreateEventW
WaitForSingleObject
HeapDestroy
HeapCreate
InitializeSListHead
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapQueryInformation
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualQuery
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
GetStartupInfoW
GetModuleHandleW
LocalFree
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
CloseHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
GetTimeZoneInformation
SetLastError

gdi32

CreateFontIndirectW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetTextFaceW
GetPixel
GetObjectType
DPtoLP
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CombineRgn
CreateHatchBrush
BitBlt
DeleteObject
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
DeleteDC
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextExtentPoint32W
CreateRectRgnIndirect
CreatePen
SetRectRgn
GetClipBox
SelectObject
PatBlt
CreateCompatibleDC
CreateCompatibleBitmap

sbiedll

SbieDll_IsDirectory
SbieDll_FormatMessage1
SbieDll_TranslateNtToDosPath
SbieApi_EnumBoxes
SbieApi_EnumProcessEx
SbieApi_QueryBoxPath
SbieDll_FreeMem
SbieDll_FormatMessage0
SbieApi_QueryConf
SbieApi_QueryProcess
SbieDll_KillAll
SbieDll_GetHandlePath
SbieApi_QueryProcessInfo
SbieDll_InitPStore
SbieApi_GetHomePath
SbieApi_DisableForceProcess
SbieApi_ReloadConf
SbieApi_IsBoxEnabled
SbieDll_GetTokenElevationType
SbieDll_FormatMessage
SbieDll_RunSandboxed
SbieDll_CallServer
SbieDll_StartCOM
SbieDll_RunFromHome
SbieApi_EnumBoxesEx
SbieDll_StartSbieSvc
SbieDll_GetStartError
SbieApi_QueryConfBool
SbieDll_GetLanguage

ole32

OleDuplicateData
ReleaseStgMedium
CoDisconnectObject
CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize

advapi32

RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumValueW

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

uxtheme

GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme

oleaut32

SysAllocStringLen
SysFreeString
LoadTypeLi
SysAllocString
VariantInit
VarBstrFromDate
VariantChangeType
VariantCopy
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePixelFormat
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageGraphicsContext

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Templates.ini
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/cc/xpti.dat
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/skci.dll
.dll windows:10 windows x64 arch:x64

258e187b1224e817873f8d0fc1a58064

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:b6:f3:b0:f4:0a:b2:d1:49:e6:c3:a8:af:ed:c3:98:21:98:de:52:54:9b:73:f1:87:13:47:da:fd:56:68:ff
Signer

Actual PE Digest

46:b6:f3:b0:f4:0a:b2:d1:49:e6:c3:a8:af:ed:c3:98:21:98:de:52:54:9b:73:f1:87:13:47:da:fd:56:68:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

skci.pdb

Imports

securekernel.exe

__C_specific_handler
SkAllocatePool
RtlAvlInsertNodeEx
SkInitializePushLock
qsort
SkReleasePushLockExclusive
SkAcquirePushLockShared
bsearch
SkReleasePushLockShared
SkAcquirePushLockExclusive
RtlAvlRemoveNode
RtlCompareMemory
SkFreePool
RtlImageNtHeaderEx
SeQuerySecureBootPlatformManifest
RtlUnicodeToUTF8N
SeQuerySecureBootPolicyValue
_ultow_s
RtlInitUnicodeString
SkQuerySystemTime
RtlFreeUnicodeString
SkSystemExceptionFilter
SkQuerySecureKernelInformation
SkobCreateHandle
SkmmFreeSecureAllocation
SkobCreateObject
SkobDereferenceObject
SkAllocateNormalModePool
SkFreeNormalModePool
KeRestoreExtendedProcessorState
KeBugCheckEx
RtlGetEnabledExtendedFeatures
KeSaveExtendedProcessorState
RtlGetVersion
bsearch_s
RtlTimeFieldsToTime
atoi
isdigit
RtlAnsiStringToUnicodeString
RtlUTF8ToUnicodeN
RtlDuplicateUnicodeString
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlPrefixUnicodeString
memset
__GSHandlerCheck
_local_unwind
memcmp
memcpy
memmove
wcscmp

Exports

Exports

SkciCompareSigningLevels
SkciCreateCodeCatalog
SkciCreateSecureImage
SkciFinalizeSecureImageHash
SkciFinishImageValidation
SkciFreeImageContext
SkciInitialize
SkciMatchHotPatch
SkciQueryImageAuthorID
SkciQueryImageUniqueID
SkciQueryInformation
SkciSetCodeIntegrityPolicy
SkciTransferVersionResource
SkciValidateDynamicCodePages
SkciValidateImageData

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1024B - Virtual size: 549B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGECONS
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 113B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie 5.49.0/xpti.dat
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/Sandboxie-Plus-x64-v0.7.2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/comctl32.dll
.dll windows:10 windows x64 arch:x64

d15202401c121e13acfb0eed0fa1c497

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:24:91:3b:ec:8e:c4:2e:86:db:1c:3b:e9:4c:47:94:f0:82:fd:af:9c:69:56:de:d8:87:3e:19:c8:ff:35:6d
Signer

Actual PE Digest

ef:24:91:3b:ec:8e:c4:2e:86:db:1c:3b:e9:4c:47:94:f0:82:fd:af:9c:69:56:de:d8:87:3e:19:c8:ff:35:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

comctl32v582.pdb

Imports

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlLookupFunctionEntry
NtQueryInformationProcess
RtlCaptureContext

advapi32

AllocateAndInitializeSid
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyW
RegQueryValueW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
OpenProcessToken
RegOpenCurrentUser
CheckTokenMembership
FreeSid
RegOpenKeyExW

gdi32

SetPixelV
SetDIBColorTable
GetDIBits
SetDIBits
SetBkMode
SetPixel
GetTextExtentPointW
CreateCompatibleDC
CreateDIBSection
CreateCompatibleBitmap
SelectObject
StretchDIBits
BitBlt
DeleteObject
GetStockObject
CreateRectRgn
OffsetWindowOrgEx
SetWindowOrgEx
GetObjectW
CreateFontIndirectW
TranslateCharsetInfo
GetDeviceCaps
SetLayout
DeleteDC
ExtTextOutW
GetTextMetricsW
GetDIBColorTable
CreatePalette
CreateHalftonePalette
GetTextExtentPoint32W
CreatePatternBrush
SelectPalette
RealizePalette
UnrealizeObject
StretchBlt
GetCharWidthW
SetBkColor
SetTextColor
GetDCOrgEx
SetBrushOrgEx
EnumFontFamiliesExW
RectVisible
SaveDC
IntersectClipRect
RestoreDC
GetTextAlign
SetTextAlign
GetNearestColor
CreateSolidBrush
PatBlt
GetLayout
CreatePen
Polyline
CreateBitmapIndirect
CreateBitmap
CreateFontW
TextOutW
GetClipBox
Arc
MoveToEx
LineTo
Ellipse
Rectangle
SelectClipRgn
GetBitmapBits
GetCurrentObject
CreateRoundRectRgn
CreatePolygonRgn
CombineRgn
FillRgn
FrameRgn
CreateRectRgnIndirect
OffsetRgn
GetPixel
GetClipRgn
ExcludeClipRect
GetTextColor
GetBkColor
GetPaletteEntries

kernel32

FlushFileBuffers
VirtualProtect
VirtualQuery
GetCPInfo
WriteConsoleW
HeapFree
LoadLibraryW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
FreeLibrary
lstrcmpiA
lstrcmpiW
LocalFree
lstrlenW
LocalAlloc
WideCharToMultiByte
LocalReAlloc
LocalSize
HeapReAlloc
FindResourceW
LoadResource
LockResource
GlobalAlloc
GlobalFree
FreeResource
GetCurrentProcess
CloseHandle
GetTickCount
lstrlenA
MulDiv
CheckForReadOnlyResource
SizeofResource
lstrcmpW
EnumResourceLanguagesW
FindResourceExW
GetLocaleInfoW
GetThreadLocale
FindResourceExA
MultiByteToWideChar
GetNumberFormatW
GetCurrentProcessId
GlobalAddAtomW
GetCurrentThreadId
GetACP
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
QueryActCtxW
ActivateActCtx
DeactivateActCtx
EnterCriticalSection
LeaveCriticalSection
lstrcmpA
CompareStringW
GetSystemDefaultLCID
Sleep
GetUserDefaultLangID
GetDateFormatW
GetLocalTime
EnumCalendarInfoW
GetUserDefaultLCID
GetStringTypeExW
GetTimeFormatW
GetLastError
SetEvent
WaitForSingleObject
CreateEventW
CreateThread
GlobalReAlloc
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
GetCommandLineA
FlsSetValue
GetVersionExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsFree
ExitProcess
HeapCreate
HeapDestroy
HeapSetInformation
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
VirtualAlloc
OutputDebugStringA
HeapSize
WriteFile
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointer
LoadLibraryExW
SetThreadStackGuarantee
GetSystemInfo
SetStdHandle

user32

RegisterClassW
GetProcessDefaultLayout
CopyIcon
GetWindowTextLengthW
CharLowerW
GetWindowRect
GetClientRect
GetWindowLongW
ClientToScreen
GetParent
SetWindowPos
GetSysColor
GetDC
ReleaseDC
GetSystemMetrics
SetRect
MapWindowPoints
SetCapture
PeekMessageW
CallMsgFilterW
ReleaseCapture
IsWindow
PtInRect
TranslateMessage
DispatchMessageW
WaitMessage
GetCapture
RegisterWindowMessageW
SystemParametersInfoW
GetSysColorBrush
SendMessageW
GetMessageTime
MessageBeep
SetRectEmpty
GetDoubleClickTime
ScrollWindowEx
RedrawWindow
UnionRect
GetMessagePos
ScreenToClient
GetDlgItem
SetWindowLongW
CopyRect
DeferWindowPos
LoadImageW
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DestroyWindow
LoadStringW
SetWindowTextW
DrawTextW
ShowWindow
IsWindowVisible
MapDialogRect
SetWindowLongPtrW
DestroyIcon
CreateWindowExW
MonitorFromWindow
GetMonitorInfoW
EnableWindow
CopyImage
SetForegroundWindow
GetNextDlgTabItem
GetDlgCtrlID
IsChild
SetFocus
SendDlgItemMessageW
GetFocus
InvalidateRect
SetCursor
LoadCursorW
SetDlgItemTextW
IsWindowEnabled
BeginDeferWindowPos
EndDeferWindowPos
GetClassNameW
GetKeyState
IsDialogMessageW
FillRect
GetWindowLongPtrW
BeginPaint
EndPaint
SetWindowTextA
DefWindowProcW
GetDesktopWindow
GetMessageW
PostQuitMessage
GetActiveWindow
SetActiveWindow
SetLastErrorEx
IsZoomed
InflateRect
DrawFrameControl
UpdateWindow
GetIconInfo
DestroyCaret
CreateWindowExA
DrawEdge
DrawIconEx
IntersectRect
EqualRect
GetUpdateRect
GetWindowDC
PostMessageW
GetAsyncKeyState
EnumChildWindows
GetWindow
MoveWindow
GetWindowTextW
GetCaretBlinkTime
SetTimer
GetCursorPos
KillTimer
GetPropW
GetWindowThreadProcessId
RemovePropW
SetPropW
CallWindowProcW
SendNotifyMessageW
SetCursorPos
LoadIconW
DrawIcon
SetScrollInfo
EnableScrollBar
GetScrollInfo
IsRectEmpty
InvertRect
GetScrollPos
GetScrollRange
ShowScrollBar
SetScrollPos
SetScrollRange
GetMenuItemID
GetMenuItemCount
GetMenuItemInfoW
GetMenuState
SetMenu
CheckMenuItem
GetSubMenu
GetSystemMenu
SubtractRect
UnregisterClassW
CreateIconIndirect
DrawFocusRect
CharPrevW
WindowFromPoint
OffsetRect
SetParent
DestroyMenu
CreatePopupMenu
AppendMenuW
AdjustWindowRect
TrackPopupMenu
MonitorFromRect
FrameRect
ChildWindowFromPoint
EndDialog
DialogBoxIndirectParamW
GetCursor
GetForegroundWindow
MonitorFromPoint
AdjustWindowRectEx
GetMenu
SetWindowRgn
GetWindowRgn
InvalidateRgn
GetShellWindow
GetKeyboardLayout
GetKeyboardState
SetKeyboardState
DestroyCursor
GetUpdateRgn
LockWindowUpdate
GetDCEx
ValidateRect
DrawTextExW
MapVirtualKeyW
GetKeyNameTextW
HideCaret
GrayStringW
SetCaretPos
ShowCaret
CreateCaret

Exports

Exports

AddMRUStringW
CreateMRUListW
CreateMappedBitmap
CreatePropertySheetPage
CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
CreateStatusWindowA
CreateStatusWindowW
CreateToolbar
CreateToolbarEx
CreateUpDownControl
DPA_Clone
DPA_Create
DPA_CreateEx
DPA_DeleteAllPtrs
DPA_DeletePtr
DPA_Destroy
DPA_DestroyCallback
DPA_EnumCallback
DPA_GetPtr
DPA_GetPtrIndex
DPA_Grow
DPA_InsertPtr
DPA_LoadStream
DPA_Merge
DPA_SaveStream
DPA_Search
DPA_SetPtr
DPA_Sort
DSA_Create
DSA_DeleteAllItems
DSA_DeleteItem
DSA_Destroy
DSA_DestroyCallback
DSA_EnumCallback
DSA_GetItem
DSA_GetItemPtr
DSA_InsertItem
DSA_SetItem
DefSubclassProc
DestroyPropertySheetPage
DllGetVersion
DrawInsert
DrawStatusText
DrawStatusTextA
DrawStatusTextW
EnumMRUListW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollProp
FlatSB_GetScrollPropPtr
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
FreeMRUList
GetEffectiveClientRect
GetMUILanguage
ImageList_Add
ImageList_AddIcon
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Copy
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_DrawIndirect
ImageList_Duplicate
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetFlags
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_GetImageRect
ImageList_LoadImage
ImageList_LoadImageA
ImageList_LoadImageW
ImageList_Merge
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetFilter
ImageList_SetFlags
ImageList_SetIconSize
ImageList_SetImageCount
ImageList_SetOverlayImage
ImageList_Write
InitCommonControls
InitCommonControlsEx
InitMUILanguage
InitializeFlatSB
LBItemFromPt
MakeDragList
MenuHelp
PropertySheet
PropertySheetA
PropertySheetW
RegisterClassNameW
RemoveWindowSubclass
SetWindowSubclass
ShowHideMenuCtl
Str_SetPtrW
UninitializeFlatSB
_TrackMouseEvent

Sections

.text
Size: 518KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/d3d9.dll
.dll windows:10 windows x64 arch:x64

f3fd9d8ce2d0ce4ac0275b43760bba08

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:c4:38:c3:09:4a:4d:82:fc:63:be:c6:91:61:48:42:c7:3f:36:04:ee:e6:a7:b9:03:79:c5:e4:e3:5a:fa:e8
Signer

Actual PE Digest

c0:c4:38:c3:09:4a:4d:82:fc:63:be:c6:91:61:48:42:c7:3f:36:04:ee:e6:a7:b9:03:79:c5:e4:e3:5a:fa:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d3d9.pdb

Imports

msvcrt

memmove
memset
pow
powf
sinf
sqrt
sqrtf
strcmp
memcpy
__dllonexit
_unlock
_lock
memcmp
_wtoi
wcschr
_wcsnicmp
swprintf_s
swscanf_s
_wcsicmp
wcscpy_s
wcscat_s
_wcslwr
wcsstr
wcsrchr
wcsncmp
toupper
strncmp
wcsspn
qsort
sprintf_s
strcat_s
??1exception@@UEAA@XZ
logf
log10f
floorf
floor
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
ceil
_CxxThrowException
memcpy_s
_vsnwprintf
_vsnprintf_s
_purecall
memmove_s
malloc
free
expf
cosf
cos
wcstol
_onexit
_vsnprintf
_stricmp
strcpy_s
strrchr
__C_specific_handler
abort
sscanf_s
strstr
__iscsym
_XcptFilter
_amsg_exit
_initterm
__CxxFrameHandler3
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
wcscmp

ntdll

ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
RtlVerifyVersionInfo
RtlImageDirectoryEntryToData
RtlGetVersion
NtClose
RtlRunOnceExecuteOnce
ZwQueryKey
ZwEnumerateValueKey
RtlUnicodeStringToInteger
RtlCopyUnicodeString
EtwEventWriteNoRegistration
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitString
RtlUnicodeStringToAnsiString
ZwSetInformationProcess
ZwQueryInformationProcess
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
RtlFormatCurrentUserKeyPath
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwOpenKey
RtlFreeUnicodeString
ZwOpenFile
RtlDosPathNameToNtPathName_U_WithStatus
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
RtlInitUnicodeString
ZwClose
RtlFreeHeap
ZwEnumerateKey
RtlReAllocateHeap
RtlAllocateHeap
NtQueryWnfStateData
NtQueryInformationProcess
RtlGUIDFromString
EtwEventWriteTransfer
EtwLogTraceEvent
NtQueryValueKey
EtwEventUnregister
EtwEventRegister
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsA
EtwGetTraceEnableLevel
RtlIsCriticalSectionLockedByThread
RtlPublishWnfStateData
RtlUpcaseUnicodeString

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA
RegQueryValueExA
RegDeleteValueA
RegEnumValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegGetValueA
RegQueryInfoKeyA

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
SetSecurityDescriptorDacl
AllocateLocallyUniqueId
GetSidSubAuthority
GetSidLengthRequired
InitializeSid
SetSecurityDescriptorSacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
SetKernelObjectSecurity
GetLengthSid
AddMandatoryAce

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-gdi-dpiinfo-l1-1-0

GetCurrentDpiInfo

user32

IsRectEmpty
SetWindowLongA
GetForegroundWindow
UnregisterClassA
PeekMessageA
LoadCursorW
TranslateMessage
SetPropW
AttachThreadInput
MsgWaitForMultipleObjects
RemovePropW
GetPropW
DestroyWindow
DispatchMessageA
GetWindow
GetWindowThreadProcessId
SetForegroundWindow
mouse_event
GetWindowLongA
IsWindow
IsIconic
SetWindowDisplayAffinity
GetWindowDisplayAffinity
GetAncestor
PtInRect
NotifyOverlayWindow
SetCursorPos
GetCursorPos
CreateIconIndirect
GetWindowDC
GetDesktopWindow
DestroyIcon
GetCursor
SetCursor
UnionRect
SetRectEmpty
UnregisterHotKey
RegisterHotKey
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MonitorFromWindow
GetDC
GetWindowInfo
ReleaseDC
GetSystemMetrics
EqualRect
GetWindowRect
GetKeyState
PostMessageA
SendMessageA
CallWindowProcA
SetWindowLongPtrA
CallWindowProcW
SetWindowLongPtrW
KillTimer
SetTimer
IsZoomed
ShowWindow
IsWindowVisible
IsWindowUnicode
GetWindowLongPtrA
GetWindowLongPtrW
OffsetRect
EnumDisplayMonitors
DefWindowProcA
LoadIconA
RegisterClassA
CreateWindowExA
EnumDisplayDevicesA
DisplayConfigGetDeviceInfo
SystemParametersInfoA
SetWindowPos
GetMonitorInfoA
IntersectRect
SetRect
GetClientRect
EnumDisplaySettingsA
ClientToScreen

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA
GetFileVersionInfoExA
GetFileVersionInfoSizeExA

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

win32u

NtUnBindCompositionSurface
NtQueryCompositionSurfaceStatistics
NtBindCompositionSurface
NtNotifyPresentToCompositionSurface

gdi32

StretchBlt
D3DKMTCacheHybridQueryValue
D3DKMTGetCachedHybridQueryValue
CreateDIBitmap
GetNearestColor
GetDeviceCaps
GetSystemPaletteEntries
DdEntry27
DdEntry20
DdEntry2
DdEntry38
DdEntry54
CreateCompatibleBitmap
SelectObject
CreateDIBSection
DdEntry30
DdEntry16
DdEntry42
CreateCompatibleDC
DdEntry25
DdEntry6
DdEntry31
DdEntry29
DdEntry33
DdEntry44
DdEntry43
DdEntry50
DdEntry46
DdEntry24
DdEntry12
DdEntry9
DdEntry26
SetLayout
DdEntry37
DdEntry22
GetDeviceGammaRamp
DdEntry28
DdEntry23
GetDIBits
DdEntry56
DdEntry17
DdEntry35
CreateRectRgn
DdEntry13
DdEntry19
DdEntry21
DdEntry53
GetRegionData
DdEntry45
DdEntry48
DdEntry40
DdEntry4
DdEntry5
GdiEntry1
DdEntry18
DdEntry36
DdEntry34
SetStretchBltMode
DdEntry39
DdEntry3
DdEntry11
DdEntry10
DeleteObject
DdEntry1
GetRandomRgn
DdEntry41
DdEntry49
D3DKMTMakeResident
D3DKMTPresent
D3DKMTEvict
D3DKMTDestroyAllocation2
D3DKMTLock2
D3DKMTCreateAllocation
D3DKMTMapGpuVirtualAddress
D3DKMTDestroyContext
D3DKMTDestroyAllocation
D3DKMTFreeGpuVirtualAddress
D3DKMTCloseAdapter
D3DKMTCreateHwQueue
D3DKMTSharedPrimaryUnLockNotification
D3DKMTRegisterTrimNotification
D3DKMTWaitForSynchronizationObjectFromCpu
D3DKMTEnumAdapters
D3DKMTUnregisterTrimNotification
D3DKMTDestroyOverlay
D3DKMTGetSharedPrimaryHandle
D3DKMTEscape
D3DKMTSubmitPresentToHwQueue
D3DKMTUnlock2
D3DKMTUpdateAllocationProperty
D3DKMTWaitForSynchronizationObject
D3DKMTDestroySynchronizationObject
D3DKMTQueryStatistics
D3DKMTShareObjects
D3DKMTConfigureSharedResource
D3DKMTSetGammaRamp
D3DKMTCreateSynchronizationObject2
D3DKMTCheckOcclusion
D3DKMTGetDisplayModeList
GdiEntry13
D3DKMTReclaimAllocations
D3DKMTCreateSynchronizationObject
D3DKMTUpdateGpuVirtualAddress
D3DKMTOpenAdapterFromHdc
D3DKMTDestroyDCFromMemory
D3DKMTOpenResource
D3DKMTQueryResourceInfoFromNtHandle
D3DKMTDestroyPagingQueue
D3DKMTCreateAllocation2
D3DKMTQueryAllocationResidency
D3DKMTUpdateOverlay
D3DKMTSharedPrimaryLockNotification
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTCreateDevice
D3DKMTSubmitCommand
D3DKMTRender
D3DKMTCheckExclusiveOwnership
D3DKMTQueryVidPnExclusiveOwnership
D3DKMTDestroyHwQueue
D3DKMTInvalidateCache
D3DKMTSignalSynchronizationObjectFromGpu
D3DKMTSetQueuedLimit
D3DKMTWaitForSynchronizationObjectFromGpu
DeleteDC
D3DKMTSetDisplayMode
D3DKMTSubmitSignalSyncObjectsToHwQueue
D3DKMTSetVidPnSourceOwner1
D3DKMTSignalSynchronizationObject
D3DKMTReclaimAllocations2
D3DKMTCreateContext
D3DKMTSubmitCommandToHwQueue
D3DKMTReleaseProcessVidPnSourceOwners
D3DKMTCreatePagingQueue
D3DKMTSubmitWaitForSyncObjectsToHwQueue
D3DKMTCreateDCFromMemory
D3DKMTDestroyDevice
D3DKMTReserveGpuVirtualAddress
D3DKMTGetMultisampleMethodList
D3DKMTCheckMonitorPowerState
D3DKMTSignalSynchronizationObjectFromGpu2
D3DKMTSetAllocationPriority
D3DKMTOpenAdapterFromDeviceName
D3DKMTCreateContextVirtual
D3DKMTQueryResourceInfo
D3DKMTSignalSynchronizationObject2
D3DKMTGetScanLine
D3DKMTMarkDeviceAsError
D3DKMTUnlock
D3DKMTLock
D3DKMTOpenResource2
D3DKMTGetContextSchedulingPriority
D3DKMTWaitForSynchronizationObject2
D3DKMTSignalSynchronizationObjectFromCpu
D3DKMTGetMultiPlaneOverlayCaps
BitBlt
D3DKMTWaitForVerticalBlankEvent
D3DKMTQueryAdapterInfo
D3DKMTSetContextSchedulingPriority
D3DKMTOpenResourceFromNtHandle
D3DKMTGetDeviceState
D3DKMTGetResourcePresentPrivateDriverData
D3DKMTOfferAllocations
D3DKMTGetOverlayState
D3DKMTOpenSyncObjectFromNtHandle2
D3DKMTFlipOverlay
D3DKMTCreateOverlay
CreateDCA

kernel32

GetFileSize
GetVersionExA
GetLogicalProcessorInformation
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetLongPathNameW
GetDriveTypeW
ExpandEnvironmentStringsW
FindClose
FindNextFileW
FindFirstFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
RegQueryValueExW
GetCurrentPackageFamilyName
InitOnceComplete
OpenProcess
GetApplicationUserModelId
RegOpenKeyExW
RegGetValueW
K32GetModuleFileNameExW
GetPackageFamilyName
GetCurrentApplicationUserModelId
InitOnceBeginInitialize
CreateEventA
CreateThread
SetEvent
GetModuleHandleExA
WaitForMultipleObjects
GetProcessMitigationPolicy
GetModuleFileNameW
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateNamedPipeA
CreateFileA
WaitNamedPipeA
TransactNamedPipe
GetPrivateProfileStringA
WriteFile
PeekNamedPipe
ReadFile
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
SetNamedPipeHandleState
OpenMutexW
CreateMutexW
CreateSemaphoreA
GlobalAddAtomA
ResetEvent
OpenEventW
GetTickCount
LocalFree
LocalAlloc
VerifyVersionInfoA
DisableThreadLibraryCalls
CreateSemaphoreExA
FreeLibraryAndExitThread
GetModuleHandleA
QueryPerformanceCounter
GetSystemTime
WideCharToMultiByte
LoadLibraryW
QueryPerformanceFrequency
Sleep
GetProcessId
GetCurrentProcess
InitializeSRWLock
lstrcmpA
SetErrorMode
LoadLibraryA
InitializeCriticalSection
LoadLibraryExW
FreeLibrary
OutputDebugStringA
GetNativeSystemInfo
IsDebuggerPresent
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
SetLastError
CreateSemaphoreExW
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA

dwmapi

DwmIsCompositionEnabled
ord128
ord100
ord101
ord136
ord137

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance

Exports

Exports

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
DebugSetLevel
DebugSetMute
Direct3D9EnableMaximizedWindowedModeShim
Direct3DCreate9
Direct3DCreate9Ex
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/comctl32.dll
.dll windows:10 windows x64 arch:x64

d15202401c121e13acfb0eed0fa1c497

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:24:91:3b:ec:8e:c4:2e:86:db:1c:3b:e9:4c:47:94:f0:82:fd:af:9c:69:56:de:d8:87:3e:19:c8:ff:35:6d
Signer

Actual PE Digest

ef:24:91:3b:ec:8e:c4:2e:86:db:1c:3b:e9:4c:47:94:f0:82:fd:af:9c:69:56:de:d8:87:3e:19:c8:ff:35:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

comctl32v582.pdb

Imports

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlLookupFunctionEntry
NtQueryInformationProcess
RtlCaptureContext

advapi32

AllocateAndInitializeSid
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyW
RegQueryValueW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
OpenProcessToken
RegOpenCurrentUser
CheckTokenMembership
FreeSid
RegOpenKeyExW

gdi32

SetPixelV
SetDIBColorTable
GetDIBits
SetDIBits
SetBkMode
SetPixel
GetTextExtentPointW
CreateCompatibleDC
CreateDIBSection
CreateCompatibleBitmap
SelectObject
StretchDIBits
BitBlt
DeleteObject
GetStockObject
CreateRectRgn
OffsetWindowOrgEx
SetWindowOrgEx
GetObjectW
CreateFontIndirectW
TranslateCharsetInfo
GetDeviceCaps
SetLayout
DeleteDC
ExtTextOutW
GetTextMetricsW
GetDIBColorTable
CreatePalette
CreateHalftonePalette
GetTextExtentPoint32W
CreatePatternBrush
SelectPalette
RealizePalette
UnrealizeObject
StretchBlt
GetCharWidthW
SetBkColor
SetTextColor
GetDCOrgEx
SetBrushOrgEx
EnumFontFamiliesExW
RectVisible
SaveDC
IntersectClipRect
RestoreDC
GetTextAlign
SetTextAlign
GetNearestColor
CreateSolidBrush
PatBlt
GetLayout
CreatePen
Polyline
CreateBitmapIndirect
CreateBitmap
CreateFontW
TextOutW
GetClipBox
Arc
MoveToEx
LineTo
Ellipse
Rectangle
SelectClipRgn
GetBitmapBits
GetCurrentObject
CreateRoundRectRgn
CreatePolygonRgn
CombineRgn
FillRgn
FrameRgn
CreateRectRgnIndirect
OffsetRgn
GetPixel
GetClipRgn
ExcludeClipRect
GetTextColor
GetBkColor
GetPaletteEntries

kernel32

FlushFileBuffers
VirtualProtect
VirtualQuery
GetCPInfo
WriteConsoleW
HeapFree
LoadLibraryW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
FreeLibrary
lstrcmpiA
lstrcmpiW
LocalFree
lstrlenW
LocalAlloc
WideCharToMultiByte
LocalReAlloc
LocalSize
HeapReAlloc
FindResourceW
LoadResource
LockResource
GlobalAlloc
GlobalFree
FreeResource
GetCurrentProcess
CloseHandle
GetTickCount
lstrlenA
MulDiv
CheckForReadOnlyResource
SizeofResource
lstrcmpW
EnumResourceLanguagesW
FindResourceExW
GetLocaleInfoW
GetThreadLocale
FindResourceExA
MultiByteToWideChar
GetNumberFormatW
GetCurrentProcessId
GlobalAddAtomW
GetCurrentThreadId
GetACP
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
QueryActCtxW
ActivateActCtx
DeactivateActCtx
EnterCriticalSection
LeaveCriticalSection
lstrcmpA
CompareStringW
GetSystemDefaultLCID
Sleep
GetUserDefaultLangID
GetDateFormatW
GetLocalTime
EnumCalendarInfoW
GetUserDefaultLCID
GetStringTypeExW
GetTimeFormatW
GetLastError
SetEvent
WaitForSingleObject
CreateEventW
CreateThread
GlobalReAlloc
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DebugBreak
IsDebuggerPresent
GetCommandLineA
FlsSetValue
GetVersionExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsFree
ExitProcess
HeapCreate
HeapDestroy
HeapSetInformation
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
VirtualAlloc
OutputDebugStringA
HeapSize
WriteFile
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointer
LoadLibraryExW
SetThreadStackGuarantee
GetSystemInfo
SetStdHandle

user32

RegisterClassW
GetProcessDefaultLayout
CopyIcon
GetWindowTextLengthW
CharLowerW
GetWindowRect
GetClientRect
GetWindowLongW
ClientToScreen
GetParent
SetWindowPos
GetSysColor
GetDC
ReleaseDC
GetSystemMetrics
SetRect
MapWindowPoints
SetCapture
PeekMessageW
CallMsgFilterW
ReleaseCapture
IsWindow
PtInRect
TranslateMessage
DispatchMessageW
WaitMessage
GetCapture
RegisterWindowMessageW
SystemParametersInfoW
GetSysColorBrush
SendMessageW
GetMessageTime
MessageBeep
SetRectEmpty
GetDoubleClickTime
ScrollWindowEx
RedrawWindow
UnionRect
GetMessagePos
ScreenToClient
GetDlgItem
SetWindowLongW
CopyRect
DeferWindowPos
LoadImageW
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DestroyWindow
LoadStringW
SetWindowTextW
DrawTextW
ShowWindow
IsWindowVisible
MapDialogRect
SetWindowLongPtrW
DestroyIcon
CreateWindowExW
MonitorFromWindow
GetMonitorInfoW
EnableWindow
CopyImage
SetForegroundWindow
GetNextDlgTabItem
GetDlgCtrlID
IsChild
SetFocus
SendDlgItemMessageW
GetFocus
InvalidateRect
SetCursor
LoadCursorW
SetDlgItemTextW
IsWindowEnabled
BeginDeferWindowPos
EndDeferWindowPos
GetClassNameW
GetKeyState
IsDialogMessageW
FillRect
GetWindowLongPtrW
BeginPaint
EndPaint
SetWindowTextA
DefWindowProcW
GetDesktopWindow
GetMessageW
PostQuitMessage
GetActiveWindow
SetActiveWindow
SetLastErrorEx
IsZoomed
InflateRect
DrawFrameControl
UpdateWindow
GetIconInfo
DestroyCaret
CreateWindowExA
DrawEdge
DrawIconEx
IntersectRect
EqualRect
GetUpdateRect
GetWindowDC
PostMessageW
GetAsyncKeyState
EnumChildWindows
GetWindow
MoveWindow
GetWindowTextW
GetCaretBlinkTime
SetTimer
GetCursorPos
KillTimer
GetPropW
GetWindowThreadProcessId
RemovePropW
SetPropW
CallWindowProcW
SendNotifyMessageW
SetCursorPos
LoadIconW
DrawIcon
SetScrollInfo
EnableScrollBar
GetScrollInfo
IsRectEmpty
InvertRect
GetScrollPos
GetScrollRange
ShowScrollBar
SetScrollPos
SetScrollRange
GetMenuItemID
GetMenuItemCount
GetMenuItemInfoW
GetMenuState
SetMenu
CheckMenuItem
GetSubMenu
GetSystemMenu
SubtractRect
UnregisterClassW
CreateIconIndirect
DrawFocusRect
CharPrevW
WindowFromPoint
OffsetRect
SetParent
DestroyMenu
CreatePopupMenu
AppendMenuW
AdjustWindowRect
TrackPopupMenu
MonitorFromRect
FrameRect
ChildWindowFromPoint
EndDialog
DialogBoxIndirectParamW
GetCursor
GetForegroundWindow
MonitorFromPoint
AdjustWindowRectEx
GetMenu
SetWindowRgn
GetWindowRgn
InvalidateRgn
GetShellWindow
GetKeyboardLayout
GetKeyboardState
SetKeyboardState
DestroyCursor
GetUpdateRgn
LockWindowUpdate
GetDCEx
ValidateRect
DrawTextExW
MapVirtualKeyW
GetKeyNameTextW
HideCaret
GrayStringW
SetCaretPos
ShowCaret
CreateCaret

Exports

Exports

AddMRUStringW
CreateMRUListW
CreateMappedBitmap
CreatePropertySheetPage
CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
CreateStatusWindowA
CreateStatusWindowW
CreateToolbar
CreateToolbarEx
CreateUpDownControl
DPA_Clone
DPA_Create
DPA_CreateEx
DPA_DeleteAllPtrs
DPA_DeletePtr
DPA_Destroy
DPA_DestroyCallback
DPA_EnumCallback
DPA_GetPtr
DPA_GetPtrIndex
DPA_Grow
DPA_InsertPtr
DPA_LoadStream
DPA_Merge
DPA_SaveStream
DPA_Search
DPA_SetPtr
DPA_Sort
DSA_Create
DSA_DeleteAllItems
DSA_DeleteItem
DSA_Destroy
DSA_DestroyCallback
DSA_EnumCallback
DSA_GetItem
DSA_GetItemPtr
DSA_InsertItem
DSA_SetItem
DefSubclassProc
DestroyPropertySheetPage
DllGetVersion
DrawInsert
DrawStatusText
DrawStatusTextA
DrawStatusTextW
EnumMRUListW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollProp
FlatSB_GetScrollPropPtr
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
FreeMRUList
GetEffectiveClientRect
GetMUILanguage
ImageList_Add
ImageList_AddIcon
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Copy
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_DrawIndirect
ImageList_Duplicate
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetFlags
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_GetImageRect
ImageList_LoadImage
ImageList_LoadImageA
ImageList_LoadImageW
ImageList_Merge
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetFilter
ImageList_SetFlags
ImageList_SetIconSize
ImageList_SetImageCount
ImageList_SetOverlayImage
ImageList_Write
InitCommonControls
InitCommonControlsEx
InitMUILanguage
InitializeFlatSB
LBItemFromPt
MakeDragList
MenuHelp
PropertySheet
PropertySheetA
PropertySheetW
RegisterClassNameW
RemoveWindowSubclass
SetWindowSubclass
ShowHideMenuCtl
Str_SetPtrW
UninitializeFlatSB
_TrackMouseEvent

Sections

.text
Size: 518KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/d3d9.dll
.dll windows:10 windows x64 arch:x64

f3fd9d8ce2d0ce4ac0275b43760bba08

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:c4:38:c3:09:4a:4d:82:fc:63:be:c6:91:61:48:42:c7:3f:36:04:ee:e6:a7:b9:03:79:c5:e4:e3:5a:fa:e8
Signer

Actual PE Digest

c0:c4:38:c3:09:4a:4d:82:fc:63:be:c6:91:61:48:42:c7:3f:36:04:ee:e6:a7:b9:03:79:c5:e4:e3:5a:fa:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d3d9.pdb

Imports

msvcrt

memmove
memset
pow
powf
sinf
sqrt
sqrtf
strcmp
memcpy
__dllonexit
_unlock
_lock
memcmp
_wtoi
wcschr
_wcsnicmp
swprintf_s
swscanf_s
_wcsicmp
wcscpy_s
wcscat_s
_wcslwr
wcsstr
wcsrchr
wcsncmp
toupper
strncmp
wcsspn
qsort
sprintf_s
strcat_s
??1exception@@UEAA@XZ
logf
log10f
floorf
floor
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
ceil
_CxxThrowException
memcpy_s
_vsnwprintf
_vsnprintf_s
_purecall
memmove_s
malloc
free
expf
cosf
cos
wcstol
_onexit
_vsnprintf
_stricmp
strcpy_s
strrchr
__C_specific_handler
abort
sscanf_s
strstr
__iscsym
_XcptFilter
_amsg_exit
_initterm
__CxxFrameHandler3
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
wcscmp

ntdll

ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
RtlVerifyVersionInfo
RtlImageDirectoryEntryToData
RtlGetVersion
NtClose
RtlRunOnceExecuteOnce
ZwQueryKey
ZwEnumerateValueKey
RtlUnicodeStringToInteger
RtlCopyUnicodeString
EtwEventWriteNoRegistration
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitString
RtlUnicodeStringToAnsiString
ZwSetInformationProcess
ZwQueryInformationProcess
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
RtlFormatCurrentUserKeyPath
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwOpenKey
RtlFreeUnicodeString
ZwOpenFile
RtlDosPathNameToNtPathName_U_WithStatus
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
RtlInitUnicodeString
ZwClose
RtlFreeHeap
ZwEnumerateKey
RtlReAllocateHeap
RtlAllocateHeap
NtQueryWnfStateData
NtQueryInformationProcess
RtlGUIDFromString
EtwEventWriteTransfer
EtwLogTraceEvent
NtQueryValueKey
EtwEventUnregister
EtwEventRegister
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsA
EtwGetTraceEnableLevel
RtlIsCriticalSectionLockedByThread
RtlPublishWnfStateData
RtlUpcaseUnicodeString

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA
RegQueryValueExA
RegDeleteValueA
RegEnumValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegGetValueA
RegQueryInfoKeyA

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
SetSecurityDescriptorDacl
AllocateLocallyUniqueId
GetSidSubAuthority
GetSidLengthRequired
InitializeSid
SetSecurityDescriptorSacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
SetKernelObjectSecurity
GetLengthSid
AddMandatoryAce

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-gdi-dpiinfo-l1-1-0

GetCurrentDpiInfo

user32

IsRectEmpty
SetWindowLongA
GetForegroundWindow
UnregisterClassA
PeekMessageA
LoadCursorW
TranslateMessage
SetPropW
AttachThreadInput
MsgWaitForMultipleObjects
RemovePropW
GetPropW
DestroyWindow
DispatchMessageA
GetWindow
GetWindowThreadProcessId
SetForegroundWindow
mouse_event
GetWindowLongA
IsWindow
IsIconic
SetWindowDisplayAffinity
GetWindowDisplayAffinity
GetAncestor
PtInRect
NotifyOverlayWindow
SetCursorPos
GetCursorPos
CreateIconIndirect
GetWindowDC
GetDesktopWindow
DestroyIcon
GetCursor
SetCursor
UnionRect
SetRectEmpty
UnregisterHotKey
RegisterHotKey
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MonitorFromWindow
GetDC
GetWindowInfo
ReleaseDC
GetSystemMetrics
EqualRect
GetWindowRect
GetKeyState
PostMessageA
SendMessageA
CallWindowProcA
SetWindowLongPtrA
CallWindowProcW
SetWindowLongPtrW
KillTimer
SetTimer
IsZoomed
ShowWindow
IsWindowVisible
IsWindowUnicode
GetWindowLongPtrA
GetWindowLongPtrW
OffsetRect
EnumDisplayMonitors
DefWindowProcA
LoadIconA
RegisterClassA
CreateWindowExA
EnumDisplayDevicesA
DisplayConfigGetDeviceInfo
SystemParametersInfoA
SetWindowPos
GetMonitorInfoA
IntersectRect
SetRect
GetClientRect
EnumDisplaySettingsA
ClientToScreen

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA
GetFileVersionInfoExA
GetFileVersionInfoSizeExA

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

win32u

NtUnBindCompositionSurface
NtQueryCompositionSurfaceStatistics
NtBindCompositionSurface
NtNotifyPresentToCompositionSurface

gdi32

StretchBlt
D3DKMTCacheHybridQueryValue
D3DKMTGetCachedHybridQueryValue
CreateDIBitmap
GetNearestColor
GetDeviceCaps
GetSystemPaletteEntries
DdEntry27
DdEntry20
DdEntry2
DdEntry38
DdEntry54
CreateCompatibleBitmap
SelectObject
CreateDIBSection
DdEntry30
DdEntry16
DdEntry42
CreateCompatibleDC
DdEntry25
DdEntry6
DdEntry31
DdEntry29
DdEntry33
DdEntry44
DdEntry43
DdEntry50
DdEntry46
DdEntry24
DdEntry12
DdEntry9
DdEntry26
SetLayout
DdEntry37
DdEntry22
GetDeviceGammaRamp
DdEntry28
DdEntry23
GetDIBits
DdEntry56
DdEntry17
DdEntry35
CreateRectRgn
DdEntry13
DdEntry19
DdEntry21
DdEntry53
GetRegionData
DdEntry45
DdEntry48
DdEntry40
DdEntry4
DdEntry5
GdiEntry1
DdEntry18
DdEntry36
DdEntry34
SetStretchBltMode
DdEntry39
DdEntry3
DdEntry11
DdEntry10
DeleteObject
DdEntry1
GetRandomRgn
DdEntry41
DdEntry49
D3DKMTMakeResident
D3DKMTPresent
D3DKMTEvict
D3DKMTDestroyAllocation2
D3DKMTLock2
D3DKMTCreateAllocation
D3DKMTMapGpuVirtualAddress
D3DKMTDestroyContext
D3DKMTDestroyAllocation
D3DKMTFreeGpuVirtualAddress
D3DKMTCloseAdapter
D3DKMTCreateHwQueue
D3DKMTSharedPrimaryUnLockNotification
D3DKMTRegisterTrimNotification
D3DKMTWaitForSynchronizationObjectFromCpu
D3DKMTEnumAdapters
D3DKMTUnregisterTrimNotification
D3DKMTDestroyOverlay
D3DKMTGetSharedPrimaryHandle
D3DKMTEscape
D3DKMTSubmitPresentToHwQueue
D3DKMTUnlock2
D3DKMTUpdateAllocationProperty
D3DKMTWaitForSynchronizationObject
D3DKMTDestroySynchronizationObject
D3DKMTQueryStatistics
D3DKMTShareObjects
D3DKMTConfigureSharedResource
D3DKMTSetGammaRamp
D3DKMTCreateSynchronizationObject2
D3DKMTCheckOcclusion
D3DKMTGetDisplayModeList
GdiEntry13
D3DKMTReclaimAllocations
D3DKMTCreateSynchronizationObject
D3DKMTUpdateGpuVirtualAddress
D3DKMTOpenAdapterFromHdc
D3DKMTDestroyDCFromMemory
D3DKMTOpenResource
D3DKMTQueryResourceInfoFromNtHandle
D3DKMTDestroyPagingQueue
D3DKMTCreateAllocation2
D3DKMTQueryAllocationResidency
D3DKMTUpdateOverlay
D3DKMTSharedPrimaryLockNotification
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTCreateDevice
D3DKMTSubmitCommand
D3DKMTRender
D3DKMTCheckExclusiveOwnership
D3DKMTQueryVidPnExclusiveOwnership
D3DKMTDestroyHwQueue
D3DKMTInvalidateCache
D3DKMTSignalSynchronizationObjectFromGpu
D3DKMTSetQueuedLimit
D3DKMTWaitForSynchronizationObjectFromGpu
DeleteDC
D3DKMTSetDisplayMode
D3DKMTSubmitSignalSyncObjectsToHwQueue
D3DKMTSetVidPnSourceOwner1
D3DKMTSignalSynchronizationObject
D3DKMTReclaimAllocations2
D3DKMTCreateContext
D3DKMTSubmitCommandToHwQueue
D3DKMTReleaseProcessVidPnSourceOwners
D3DKMTCreatePagingQueue
D3DKMTSubmitWaitForSyncObjectsToHwQueue
D3DKMTCreateDCFromMemory
D3DKMTDestroyDevice
D3DKMTReserveGpuVirtualAddress
D3DKMTGetMultisampleMethodList
D3DKMTCheckMonitorPowerState
D3DKMTSignalSynchronizationObjectFromGpu2
D3DKMTSetAllocationPriority
D3DKMTOpenAdapterFromDeviceName
D3DKMTCreateContextVirtual
D3DKMTQueryResourceInfo
D3DKMTSignalSynchronizationObject2
D3DKMTGetScanLine
D3DKMTMarkDeviceAsError
D3DKMTUnlock
D3DKMTLock
D3DKMTOpenResource2
D3DKMTGetContextSchedulingPriority
D3DKMTWaitForSynchronizationObject2
D3DKMTSignalSynchronizationObjectFromCpu
D3DKMTGetMultiPlaneOverlayCaps
BitBlt
D3DKMTWaitForVerticalBlankEvent
D3DKMTQueryAdapterInfo
D3DKMTSetContextSchedulingPriority
D3DKMTOpenResourceFromNtHandle
D3DKMTGetDeviceState
D3DKMTGetResourcePresentPrivateDriverData
D3DKMTOfferAllocations
D3DKMTGetOverlayState
D3DKMTOpenSyncObjectFromNtHandle2
D3DKMTFlipOverlay
D3DKMTCreateOverlay
CreateDCA

kernel32

GetFileSize
GetVersionExA
GetLogicalProcessorInformation
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetLongPathNameW
GetDriveTypeW
ExpandEnvironmentStringsW
FindClose
FindNextFileW
FindFirstFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
RegQueryValueExW
GetCurrentPackageFamilyName
InitOnceComplete
OpenProcess
GetApplicationUserModelId
RegOpenKeyExW
RegGetValueW
K32GetModuleFileNameExW
GetPackageFamilyName
GetCurrentApplicationUserModelId
InitOnceBeginInitialize
CreateEventA
CreateThread
SetEvent
GetModuleHandleExA
WaitForMultipleObjects
GetProcessMitigationPolicy
GetModuleFileNameW
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateNamedPipeA
CreateFileA
WaitNamedPipeA
TransactNamedPipe
GetPrivateProfileStringA
WriteFile
PeekNamedPipe
ReadFile
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
SetNamedPipeHandleState
OpenMutexW
CreateMutexW
CreateSemaphoreA
GlobalAddAtomA
ResetEvent
OpenEventW
GetTickCount
LocalFree
LocalAlloc
VerifyVersionInfoA
DisableThreadLibraryCalls
CreateSemaphoreExA
FreeLibraryAndExitThread
GetModuleHandleA
QueryPerformanceCounter
GetSystemTime
WideCharToMultiByte
LoadLibraryW
QueryPerformanceFrequency
Sleep
GetProcessId
GetCurrentProcess
InitializeSRWLock
lstrcmpA
SetErrorMode
LoadLibraryA
InitializeCriticalSection
LoadLibraryExW
FreeLibrary
OutputDebugStringA
GetNativeSystemInfo
IsDebuggerPresent
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
SetLastError
CreateSemaphoreExW
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA

dwmapi

DwmIsCompositionEnabled
ord128
ord100
ord101
ord136
ord137

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance

Exports

Exports

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
DebugSetLevel
DebugSetMute
Direct3D9EnableMaximizedWindowedModeShim
Direct3DCreate9
Direct3DCreate9Ex
Direct3DShaderValidatorCreate9
PSGPError
PSGPSampleTexture

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Sandboxie-Plus 0.7.2/freebl3/nssdbm3.exe
.exe windows:6 windows x86 arch:x86

5a594319a0d69dbc452e748bcf05892e

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:47

Not After

04/06/2025, 17:47

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:83:cd:b6:ad:c1:8c:51:4d:45:fa:02
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/10/2020, 16:27

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:82:f2:47:83:26:ca:50:6c:21:ac:f2:4b:e2:d6:37:0d:ce:2c:79:fc:a2:8b:ca:16:26:22:d3:a8:ad:7c:5e
Signer

Actual PE Digest

00:82:f2:47:83:26:ca:50:6c:21:ac:f2:4b:e2:d6:37:0d:ce:2c:79:fc:a2:8b:ca:16:26:22:d3:a8:ad:7c:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 718KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/Jint.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\jint\Jint\obj\Release\net451\Jint.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/msacm32.dll
.dll windows:10 windows x86 arch:x86

d708117077f81f5ebb8a7ce8dab0b96b

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:64:04:69:25:10:88:de:3a:54:50:63:59:34:87:31:dc:6d:85:71:52:d3:a1:d4:19:23:73:ff:c1:e4:c5:c9
Signer

Actual PE Digest

e3:64:04:69:25:10:88:de:3a:54:50:63:59:34:87:31:dc:6d:85:71:52:d3:a1:d4:19:23:73:ff:c1:e4:c5:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msacm32.pdb

Imports

msvcrt

_vsnwprintf
memcmp
_initterm
_except_handler4_common
memcpy
free
_amsg_exit
_XcptFilter
iswctype
malloc
memset

ntdll

NtClose
RtlOpenCurrentUser

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
RegEnumValueA
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExA

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW
GetProfileStringW
GetPrivateProfileStringW

api-ms-win-core-processthreads-l1-1-0

TlsFree
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TlsGetValue
TerminateProcess
TlsAlloc
TlsSetValue

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegOpenKeyW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyA
RegOpenKeyA

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerBuffW
CharPrevW

api-ms-win-core-libraryloader-l1-2-0

LockResource
GetModuleFileNameW
LoadResource
FreeResource
LoadStringW
GetProcAddress
GetModuleHandleW
SizeofResource

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
SetEvent
CreateEventW
EnterCriticalSection
InitializeCriticalSection
ResetEvent
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
GlobalAlloc
LocalAlloc

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrcmpW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalLock

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetACP

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-mm-misc-l1-1-0

SendDriverMessage
CloseDriver
OpenDriver

api-ms-win-mm-mme-l1-1-0

waveInGetDevCapsW
waveOutGetNumDevs
waveOutGetDevCapsW
waveOutOpen
waveInOpen
waveInGetNumDevs

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

XRegThunkEntry
acmDriverAddA
acmDriverAddW
acmDriverClose
acmDriverDetailsA
acmDriverDetailsW
acmDriverEnum
acmDriverID
acmDriverMessage
acmDriverOpen
acmDriverPriority
acmDriverRemove
acmFilterChooseA
acmFilterChooseW
acmFilterDetailsA
acmFilterDetailsW
acmFilterEnumA
acmFilterEnumW
acmFilterTagDetailsA
acmFilterTagDetailsW
acmFilterTagEnumA
acmFilterTagEnumW
acmFormatChooseA
acmFormatChooseW
acmFormatDetailsA
acmFormatDetailsW
acmFormatEnumA
acmFormatEnumW
acmFormatSuggest
acmFormatTagDetailsA
acmFormatTagDetailsW
acmFormatTagEnumA
acmFormatTagEnumW
acmGetVersion
acmMessage32
acmMetrics
acmStreamClose
acmStreamConvert
acmStreamMessage
acmStreamOpen
acmStreamPrepareHeader
acmStreamReset
acmStreamSize
acmStreamUnprepareHeader

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/shade_setup.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/CoreShell.exe
.exe windows:5 windows x86 arch:x86

48aa5c8931746a9655524f67b25a47ef

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0c:91:08:08:c7:b1:b5:5d:14:f6:8f:5f:14:00:7b:32
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/12/2015, 00:00

Not After

09/03/2019, 12:00

Subject

SERIALNUMBER=5373881,CN=Cybergenic Corporation,O=Cybergenic Corporation,POSTALCODE=95051,STREET=4675 Stevens Creek Blvd.\, Suite 110,L=Santa Clara,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:68:6c:1b:bd:4a:1c:42:cc:24:19:32:56:ae:58:5e:b5:43:41:a3
Signer

Actual PE Digest

4b:68:6c:1b:bd:4a:1c:42:cc:24:19:32:56:ae:58:5e:b5:43:41:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep

comctl32

InitCommonControls

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/Jint.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\jint\Jint\obj\Release\net451\Jint.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shade Sandbox 1.6/sxs/msacm32.dll
.dll windows:10 windows x86 arch:x86

d708117077f81f5ebb8a7ce8dab0b96b

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:64:04:69:25:10:88:de:3a:54:50:63:59:34:87:31:dc:6d:85:71:52:d3:a1:d4:19:23:73:ff:c1:e4:c5:c9
Signer

Actual PE Digest

e3:64:04:69:25:10:88:de:3a:54:50:63:59:34:87:31:dc:6d:85:71:52:d3:a1:d4:19:23:73:ff:c1:e4:c5:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msacm32.pdb

Imports

msvcrt

_vsnwprintf
memcmp
_initterm
_except_handler4_common
memcpy
free
_amsg_exit
_XcptFilter
iswctype
malloc
memset

ntdll

NtClose
RtlOpenCurrentUser

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
RegEnumValueA
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExA

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW
GetProfileStringW
GetPrivateProfileStringW

api-ms-win-core-processthreads-l1-1-0

TlsFree
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TlsGetValue
TerminateProcess
TlsAlloc
TlsSetValue

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegOpenKeyW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyA
RegOpenKeyA

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerBuffW
CharPrevW

api-ms-win-core-libraryloader-l1-2-0

LockResource
GetModuleFileNameW
LoadResource
FreeResource
LoadStringW
GetProcAddress
GetModuleHandleW
SizeofResource

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
SetEvent
CreateEventW
EnterCriticalSection
InitializeCriticalSection
ResetEvent
DeleteCriticalSection
WaitForSingleObject

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
GlobalAlloc
LocalAlloc

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrcmpW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalLock

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetACP

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-mm-misc-l1-1-0

SendDriverMessage
CloseDriver
OpenDriver

api-ms-win-mm-mme-l1-1-0

waveInGetDevCapsW
waveOutGetNumDevs
waveOutGetDevCapsW
waveOutOpen
waveInOpen
waveInGetNumDevs

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

XRegThunkEntry
acmDriverAddA
acmDriverAddW
acmDriverClose
acmDriverDetailsA
acmDriverDetailsW
acmDriverEnum
acmDriverID
acmDriverMessage
acmDriverOpen
acmDriverPriority
acmDriverRemove
acmFilterChooseA
acmFilterChooseW
acmFilterDetailsA
acmFilterDetailsW
acmFilterEnumA
acmFilterEnumW
acmFilterTagDetailsA
acmFilterTagDetailsW
acmFilterTagEnumA
acmFilterTagEnumW
acmFormatChooseA
acmFormatChooseW
acmFormatDetailsA
acmFormatDetailsW
acmFormatEnumA
acmFormatEnumW
acmFormatSuggest
acmFormatTagDetailsA
acmFormatTagDetailsW
acmFormatTagEnumA
acmFormatTagEnumW
acmGetVersion
acmMessage32
acmMetrics
acmStreamClose
acmStreamConvert
acmStreamMessage
acmStreamOpen
acmStreamPrepareHeader
acmStreamReset
acmStreamSize
acmStreamUnprepareHeader

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/WebDriver.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/all.exe
.exe windows:4 windows x86 arch:x86

fa4d5c869351014d1ce952f2833a7558

Code Sign

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

46:18:48:d3:5b:0d:46:ab:ba:30:b9:e1:bc:76:07:48
Certificate

Issuer

CN=WoSign Class 2 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

05/04/2017, 01:31

Not After

05/07/2020, 01:31

Subject

CN=Yang Ping,O=Yang Ping,L=Chongqing,ST=Chongqing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 2 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:c9:fe:3b:da:05:b3:ce:85:98:5e:1a:4d:9a:0c:2e
Certificate

Issuer

CN=WoSign Class 2 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

05/04/2017, 01:28

Not After

05/07/2020, 01:28

Subject

CN=Yang Ping,O=Yang Ping,L=Chongqing,ST=Chongqing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:9a:d8:05:bb:29:ad:45:5a:98:8c:2a:55:d9:42:2d
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 2 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:0e:d2:98:ca:09:86:bb:c7:a2:b4:ba:8e:21:5a:28:24:25:5b:14:af:f5:d5:65:1a:7e:40:25:33:15:45:2d
Signer

Actual PE Digest

2c:0e:d2:98:ca:09:86:bb:c7:a2:b4:ba:8e:21:5a:28:24:25:5b:14:af:f5:d5:65:1a:7e:40:25:33:15:45:2d

Digest Algorithm

sha256

PE Digest Matches

true

d1:77:8a:f2:07:96:46:fa:be:de:c4:3e:a9:fc:25:d5:3d:88:97:6d
Signer

Actual PE Digest

d1:77:8a:f2:07:96:46:fa:be:de:c4:3e:a9:fc:25:d5:3d:88:97:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

shell32

ShellExecuteExW

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memcpy
free
malloc
wcscmp
memcmp
memmove
strlen
wcslen
wcscpy
wcscat
memset

kernel32

GetStartupInfoA
GetModuleHandleA
SetFilePointer
WriteFile
ReadFile
CreateFileW
DeleteFileW
FindNextFileW
RemoveDirectoryW
FindFirstFileW
FindClose
GetModuleFileNameW
GetCommandLineW
GetTempPathW
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
CreateDirectoryW
GetLastError
SetFileTime
SetFileAttributesW
CreateProcessW
CloseHandle
WaitForSingleObject

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/RuriLib/en-US.dic
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/SD1.4.0.680_Setup.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/WebDriver.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Shadow Defender 1.5.0.726/en-US.dic
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/Setup_TimeFreeze.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/mf.dll
.dll windows:10 windows x64 arch:x64

719459db14d9cc3099d34aaeb3530c6a

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:49:8e:be:f2:6c:9c:39:ee:56:ff:63:51:67:de:96:40:1d:4c:c2:36:5b:f7:3a:dc:10:0b:79:b6:27:ed:6e
Signer

Actual PE Digest

a4:49:8e:be:f2:6c:9c:39:ee:56:ff:63:51:67:de:96:40:1d:4c:c2:36:5b:f7:3a:dc:10:0b:79:b6:27:ed:6e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mf.pdb

Imports

msvcrt

wcscat_s
strncpy_s
_wcsnicmp
wcsnlen
strnlen
_vsnwprintf
wcscpy_s
qsort
_wcsicmp
wcsncmp
memmove_s
realloc
_initterm
wcsncpy_s
malloc
_callnewh
__CxxFrameHandler3
free
__C_specific_handler
_errno
_lock
_amsg_exit
_XcptFilter
_unlock
wcsrchr
_purecall
__dllonexit
_onexit
memcpy_s
memchr
memcmp
memcpy
memmove
memset

ntdll

RtlGetPersistedStateLocation
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlAddFunctionTable
NtQuerySystemInformation

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
LoadResource
FindResourceExW
SizeofResource
FreeLibrary
LoadStringW
DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
EnterCriticalSection
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
AcquireSRWLockShared
DeleteCriticalSection
ReleaseMutex
InitializeCriticalSection
InitializeSRWLock
CreateEventW
SetEvent

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
TlsSetValue
TlsGetValue
ProcessIdToSessionId

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
VirtualFree
UnmapViewOfFile
MapViewOfFile
VirtualAlloc

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
FormatMessageW

api-ms-win-core-file-l1-1-0

CreateFileW
GetFinalPathNameByHandleW
GetDiskFreeSpaceW
GetFileSize
GetFullPathNameW
ReadFile
WriteFile

api-ms-win-core-shlwapi-legacy-l1-1-0

PathSkipRootW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetLocalTime
GetVersionExW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

rpcrt4

UuidFromStringW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AppendPropVariant
ConvertPropVariant
CopyPropertyStore
CreateNamedPropertyStore
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ExtractPropVariant
MFCreate3GPMediaSink
MFCreateAC3MediaSink
MFCreateADTSMediaSink
MFCreateASFByteStreamPlugin
MFCreateASFContentInfo
MFCreateASFIndexer
MFCreateASFIndexerByteStream
MFCreateASFMediaSink
MFCreateASFMediaSinkActivate
MFCreateASFMultiplexer
MFCreateASFProfile
MFCreateASFProfileFromPresentationDescriptor
MFCreateASFSplitter
MFCreateASFStreamSelector
MFCreateASFStreamingMediaSink
MFCreateASFStreamingMediaSinkActivate
MFCreateAggregateSource
MFCreateAppSourceProxy
MFCreateAudioRenderer
MFCreateAudioRendererActivate
MFCreateByteCacheFile
MFCreateCacheManager
MFCreateCredentialCache
MFCreateDeviceSource
MFCreateDeviceSourceActivate
MFCreateDrmNetNDSchemePlugin
MFCreateFMPEG4MediaSink
MFCreateFileBlockMap
MFCreateFileSchemePlugin
MFCreateHttpSchemePlugin
MFCreateLPCMByteStreamPlugin
MFCreateMP3ByteStreamPlugin
MFCreateMP3MediaSink
MFCreateMPEG4MediaSink
MFCreateMediaProcessor
MFCreateMediaSession
MFCreateMuxSink
MFCreateNSCByteStreamPlugin
MFCreateNetSchemePlugin
MFCreatePMPHost
MFCreatePMPMediaSession
MFCreatePMPServer
MFCreatePresentationClock
MFCreatePresentationDescriptorFromASFProfile
MFCreateProtectedEnvironmentAccess
MFCreateProxyLocator
MFCreateRemoteDesktopPlugin
MFCreateSAMIByteStreamPlugin
MFCreateSampleCopierMFT
MFCreateSampleGrabberSinkActivate
MFCreateSecureHttpSchemePlugin
MFCreateSequencerSegmentOffset
MFCreateSequencerSource
MFCreateSequencerSourceRemoteStream
MFCreateSimpleTypeHandler
MFCreateSoundEventSchemePlugin
MFCreateSourceResolver
MFCreateStandardQualityManager
MFCreateTopoLoader
MFCreateTopology
MFCreateTopologyNode
MFCreateTranscodeProfile
MFCreateTranscodeSinkActivate
MFCreateTranscodeTopology
MFCreateTranscodeTopologyFromByteStream
MFCreateUrlmonSchemePlugin
MFCreateVideoRenderer
MFCreateVideoRendererActivate
MFCreateWMAEncoderActivate
MFCreateWMVEncoderActivate
MFEnumDeviceSources
MFGetLocalId
MFGetMultipleServiceProviders
MFGetService
MFGetSupportedMimeTypes
MFGetSupportedSchemes
MFGetSystemId
MFGetTopoNodeCurrentType
MFLoadSignedLibrary
MFRR_CreateActivate
MFReadSequencerSegmentOffset
MFRequireProtectedEnvironment
MFShutdownObject
MFTranscodeGetAudioOutputAvailableTypes
MergePropertyStore

Sections

.text
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

?g_Encry
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

?g_Encry
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/mf.dll
.dll windows:10 windows x64 arch:x64

719459db14d9cc3099d34aaeb3530c6a

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:49:8e:be:f2:6c:9c:39:ee:56:ff:63:51:67:de:96:40:1d:4c:c2:36:5b:f7:3a:dc:10:0b:79:b6:27:ed:6e
Signer

Actual PE Digest

a4:49:8e:be:f2:6c:9c:39:ee:56:ff:63:51:67:de:96:40:1d:4c:c2:36:5b:f7:3a:dc:10:0b:79:b6:27:ed:6e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mf.pdb

Imports

msvcrt

wcscat_s
strncpy_s
_wcsnicmp
wcsnlen
strnlen
_vsnwprintf
wcscpy_s
qsort
_wcsicmp
wcsncmp
memmove_s
realloc
_initterm
wcsncpy_s
malloc
_callnewh
__CxxFrameHandler3
free
__C_specific_handler
_errno
_lock
_amsg_exit
_XcptFilter
_unlock
wcsrchr
_purecall
__dllonexit
_onexit
memcpy_s
memchr
memcmp
memcpy
memmove
memset

ntdll

RtlGetPersistedStateLocation
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlAddFunctionTable
NtQuerySystemInformation

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
LoadResource
FindResourceExW
SizeofResource
FreeLibrary
LoadStringW
DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
EnterCriticalSection
CreateMutexExW
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
AcquireSRWLockShared
DeleteCriticalSection
ReleaseMutex
InitializeCriticalSection
InitializeSRWLock
CreateEventW
SetEvent

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
TlsSetValue
TlsGetValue
ProcessIdToSessionId

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
VirtualFree
UnmapViewOfFile
MapViewOfFile
VirtualAlloc

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
FormatMessageW

api-ms-win-core-file-l1-1-0

CreateFileW
GetFinalPathNameByHandleW
GetDiskFreeSpaceW
GetFileSize
GetFullPathNameW
ReadFile
WriteFile

api-ms-win-core-shlwapi-legacy-l1-1-0

PathSkipRootW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetLocalTime
GetVersionExW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

rpcrt4

UuidFromStringW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AppendPropVariant
ConvertPropVariant
CopyPropertyStore
CreateNamedPropertyStore
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ExtractPropVariant
MFCreate3GPMediaSink
MFCreateAC3MediaSink
MFCreateADTSMediaSink
MFCreateASFByteStreamPlugin
MFCreateASFContentInfo
MFCreateASFIndexer
MFCreateASFIndexerByteStream
MFCreateASFMediaSink
MFCreateASFMediaSinkActivate
MFCreateASFMultiplexer
MFCreateASFProfile
MFCreateASFProfileFromPresentationDescriptor
MFCreateASFSplitter
MFCreateASFStreamSelector
MFCreateASFStreamingMediaSink
MFCreateASFStreamingMediaSinkActivate
MFCreateAggregateSource
MFCreateAppSourceProxy
MFCreateAudioRenderer
MFCreateAudioRendererActivate
MFCreateByteCacheFile
MFCreateCacheManager
MFCreateCredentialCache
MFCreateDeviceSource
MFCreateDeviceSourceActivate
MFCreateDrmNetNDSchemePlugin
MFCreateFMPEG4MediaSink
MFCreateFileBlockMap
MFCreateFileSchemePlugin
MFCreateHttpSchemePlugin
MFCreateLPCMByteStreamPlugin
MFCreateMP3ByteStreamPlugin
MFCreateMP3MediaSink
MFCreateMPEG4MediaSink
MFCreateMediaProcessor
MFCreateMediaSession
MFCreateMuxSink
MFCreateNSCByteStreamPlugin
MFCreateNetSchemePlugin
MFCreatePMPHost
MFCreatePMPMediaSession
MFCreatePMPServer
MFCreatePresentationClock
MFCreatePresentationDescriptorFromASFProfile
MFCreateProtectedEnvironmentAccess
MFCreateProxyLocator
MFCreateRemoteDesktopPlugin
MFCreateSAMIByteStreamPlugin
MFCreateSampleCopierMFT
MFCreateSampleGrabberSinkActivate
MFCreateSecureHttpSchemePlugin
MFCreateSequencerSegmentOffset
MFCreateSequencerSource
MFCreateSequencerSourceRemoteStream
MFCreateSimpleTypeHandler
MFCreateSoundEventSchemePlugin
MFCreateSourceResolver
MFCreateStandardQualityManager
MFCreateTopoLoader
MFCreateTopology
MFCreateTopologyNode
MFCreateTranscodeProfile
MFCreateTranscodeSinkActivate
MFCreateTranscodeTopology
MFCreateTranscodeTopologyFromByteStream
MFCreateUrlmonSchemePlugin
MFCreateVideoRenderer
MFCreateVideoRendererActivate
MFCreateWMAEncoderActivate
MFCreateWMVEncoderActivate
MFEnumDeviceSources
MFGetLocalId
MFGetMultipleServiceProviders
MFGetService
MFGetSupportedMimeTypes
MFGetSupportedSchemes
MFGetSystemId
MFGetTopoNodeCurrentType
MFLoadSignedLibrary
MFRR_CreateActivate
MFReadSequencerSegmentOffset
MFRequireProtectedEnvironment
MFShutdownObject
MFTranscodeGetAudioOutputAvailableTypes
MergePropertyStore

Sections

.text
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

?g_Encry
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

?g_Encry
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/npnul32.exe
.exe windows:4 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:6e:c2:a3:4b:70:b3:32:c4:a7:4a:7f:b2:e3:a6:06
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/01/2016, 00:00

Not After

04/01/2017, 23:59

Subject

CN=Igloo systems Inc.,O=Igloo systems Inc.,L=Namyangju-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:82:7c:67:ea:f8:16:d6:ae:59:03:aa:45:e1:2c:cf:66:ab:de:8e
Signer

Actual PE Digest

35:82:7c:67:ea:f8:16:d6:ae:59:03:aa:45:e1:2c:cf:66:ab:de:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 797KB - Virtual size: 797KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/newdev/rdpcorets.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a18681cf7fc4526bce25b48ecb511ef1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RdpCoreTS.pdb

Imports

msvcrt

fclose
_wcsnicmp
floorf
log
wcsncmp
swprintf_s
wprintf
vswprintf_s
wcscpy_s
_CxxThrowException
_vsnwprintf
isalpha
swscanf
_amsg_exit
_aligned_free
_wcsicmp
fwrite
fprintf
malloc
free
wcscat_s
wcsnlen
_callnewh
_purecall
printf
ceilf
_wfopen
_strnicmp
calloc
?terminate@@YAXXZ
memcmp
memcpy
_lock
_XcptFilter
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??0exception@@QEAA@XZ
strncpy_s
strnlen
sprintf_s
qsort
??1type_info@@UEAA@XZ
_initterm
__CxxFrameHandler3
wcschr
wcsncpy_s
memcpy_s
wcsrchr
memmove_s
_stricmp
_unlock
__dllonexit
memmove
memset
_wtoi
__C_specific_handler
_onexit
sqrt
_wfopen_s
_errno
pow
sqrtf
vsprintf_s
realloc
_aligned_malloc
wcscmp

oleaut32

UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
VariantCopy
VariantClear
SysAllocStringByteLen
VariantInit
SysAllocString
SysStringByteLen

api-ms-win-core-synch-l1-1-0

CreateEventW
EnterCriticalSection
SetEvent
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ResetEvent
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

SuspendThread
GetExitCodeThread
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
ResumeThread
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadResource
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
SizeofResource

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW

api-ms-win-core-com-l1-1-0

CLSIDFromString
PropVariantClear
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
IIDFromString
PropVariantCopy
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventWrite
EventUnregister
EventRegister
EventActivityIdControl

ws2_32

closesocket

iphlpapi

GetAdapterIndex

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

FindClose
GetFileAttributesW
FindNextFileW
FindFirstFileW
ReadFile
CreateDirectoryW
WriteFile
SetFilePointerEx
ReadFileEx
DeleteFileW
WriteFileEx
GetTempFileNameW
GetFileInformationByHandle
CreateFileW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId
MoveFileW
BindIoCompletionCallback

ntdll

RtlNtStatusToDosError
RtlInitializeGenericTable
RtlEnumerateGenericTable
RtlDeleteElementGenericTable
WinSqmAddToStream
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
RtlIpv4StringToAddressW
RtlInitUnicodeString
NtCreateFile
RtlLookupElementGenericTable
RtlInsertElementGenericTable
NtQuerySystemInformation
RtlIpv6StringToAddressW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx
DeviceIoControl

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW
BuildSecurityDescriptorW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
AccessCheckAndAuditAlarmW
InitializeSecurityDescriptor
MakeSelfRelativeSD
ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetCPInfo
IsDBCSLeadByte

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

crypt32

CryptProtectMemory
CryptUnprotectMemory

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-stringansi-l1-1-0

CharNextA
CharPrevA

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

pdh

PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetRawCounterValue

user32

UnionRect
LoadCursorW
DispatchMessageW
GetWindowThreadProcessId
GetMessageW
UnregisterDeviceNotification
IsClipboardFormatAvailable
UnregisterClassW
RegisterDeviceNotificationW
UnregisterClassA
CreateWindowExW
RegisterClassW
CopyRect
SetRect
GetClipboardFormatNameW
PostMessageW
SetWindowLongPtrW
RegisterClipboardFormatW
SendMessageW
GetWindowLongPtrW
DefWindowProcW
DestroyWindow

regapi

RegWinstationQuerySecurityConfig_Merged

rfxvmt

RfxVmtCloseChannel
RfxVmtWriteChannel
RfxVmtReadChannel
RfxVmtCreateChannel
RfxVmtGetDataAvailableEvent

rdpbase

RDPBASE_CreateInstance
?RdpPerfLoggerStaticTerminate@@YAXXZ
RDPServerStackDiagnostics_Unregister
?RdpPerfLoggerStaticInitialize@@YAXXZ
RDPServerStackDiagnostics_Register
RdpX_Threading_CreateCriticalSection
PAL_System_Sleep
RdpX_AtomicDecrement32
RdpX_AtomicIncrement32
PAL_System_AtomicCompareAndExchangePointer
RDPServerStackDiagnostics_LogDisconnect
RDPServerStackDiagnostics_LogFailure
RDPServerStackDiagnostics_LogCheckpoint
RDPWSStreamConnector_CreateInstance
PAL_System_CritSecInit
RDPENCORE_AddGlobalObject
PAL_System_SwitchToThread
RDPAPI_GetGlobalObject
PAL_System_AtomicCompareAndExchange
TSCreateCoreEvents
RDPENCHLPREG_ReadValueDWORD
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_AtomicIncrement
PAL_System_AtomicDecrement
PAL_System_CritSecTerminate
TSAlloc
TSFree
PAL_System_CritSecIsLockedByCurrentThread
TRC_TraceBufferW
MemCopyAligned_SSE
MemMoveReverseAligned_SSE
GetSupportedSSELevel_SSE
PAL_System_GetNumberOfProcessors
?NSRunLengthDecode@@YAKPEBEKPEAEK@Z
PAL_System_MemFree
RdpX_GetActivityIdPrefix
RgnlibBA_CreateInstance
RDPAPI_GetGenericCounter
CRDPCaps_CreateInstance
PAL_System_CritSecTryEnter
RDPAPI_GetLongCounter
PAL_System_ThreadGetId
PAL_System_MemAlloc

rdpserverbase

?GetGfxPipeSettingBOOL@@YAJPEAGHPEAH@Z
?LogRDPGraphicsFirstNonBlackFramePostLogon@RDPGraphicsTraceLogging@@YAXI@Z
RDPSERVERBASE_CreateInstance
?LogRDPGraphicsFirstNonBlackFrame@RDPGraphicsTraceLogging@@YAX_K@Z
?LogRDPGraphicsError@RDPGraphicsTraceLogging@@YAXU_GUID@@IIJ@Z
?LogRDPGraphicsSubsampleFailure@RDPGraphicsTraceLogging@@YAXJI@Z
?GetGraphicsSourceContext@RdpSurface@@QEAAJPEAPEAUIRdpGFXSourceUpdateContext@@@Z
RDPEncryptionTraceLogging_Register
?RDPGraphicsTraceLogging_Unregister@RDPGraphicsTraceLogging@@YAXXZ
RDPEncryptionTraceLogging_Unregister
?LogRDPGraphicsVOBRHint@RDPGraphicsTraceLogging@@YAXI_KII@Z
?LogRDPGraphicsSubsampleAdapter@RDPGraphicsTraceLogging@@YAXPEBGII@Z
?GetEncodingPixelMap@RdpSurface@@QEAAJPEAPEAVPixelMap@@@Z
?RDPGraphicsTraceLogging_Register@RDPGraphicsTraceLogging@@YAJXZ
?GetGfxPipeSettingUINT@@YAJPEAGIPEAI@Z

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetEntriesInAclW

rpcrt4

RpcBindingSetOption
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoExW
UuidCreate
I_RpcExceptionFilter
UuidToStringW
NdrClientCall3

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
PeekNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState

api-ms-win-core-shlwapi-legacy-l1-1-0

PathUnquoteSpacesW
PathGetDriveNumberW
PathQuoteSpacesW
PathSkipRootW
PathIsUNCW
PathFindExtensionW

api-ms-win-core-url-l1-1-0

UrlIsW

userenv

ExpandEnvironmentStringsForUserW

api-ms-win-core-perfcounters-l1-1-0

PerfDeleteInstance
PerfIncrementULongCounterValue
PerfSetCounterSetInfo
PerfCreateInstance
PerfStartProviderEx
PerfStopProvider
PerfSetULongCounterValue

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-core-comm-l1-1-0

SetCommTimeouts

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

gdi32

GetObjectW
DeleteObject
CreatePalette
GetMetaFileBitsEx
GetStockObject
GetPaletteEntries
SetMetaFileBitsEx
CreateMetaFileW
PlayMetaFile
CloseMetaFile
DeleteMetaFile

d3d11

D3D11CreateDevice

tlscsp

ord1
ord3
ord4
ord7
ord2

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RFX_CreateGFXService
RFX_CreatePluginFactory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Toolwiz Time Freeze 4.3.1.5000/rdpcorets.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a18681cf7fc4526bce25b48ecb511ef1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RdpCoreTS.pdb

Imports

msvcrt

fclose
_wcsnicmp
floorf
log
wcsncmp
swprintf_s
wprintf
vswprintf_s
wcscpy_s
_CxxThrowException
_vsnwprintf
isalpha
swscanf
_amsg_exit
_aligned_free
_wcsicmp
fwrite
fprintf
malloc
free
wcscat_s
wcsnlen
_callnewh
_purecall
printf
ceilf
_wfopen
_strnicmp
calloc
?terminate@@YAXXZ
memcmp
memcpy
_lock
_XcptFilter
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??0exception@@QEAA@XZ
strncpy_s
strnlen
sprintf_s
qsort
??1type_info@@UEAA@XZ
_initterm
__CxxFrameHandler3
wcschr
wcsncpy_s
memcpy_s
wcsrchr
memmove_s
_stricmp
_unlock
__dllonexit
memmove
memset
_wtoi
__C_specific_handler
_onexit
sqrt
_wfopen_s
_errno
pow
sqrtf
vsprintf_s
realloc
_aligned_malloc
wcscmp

oleaut32

UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
VariantCopy
VariantClear
SysAllocStringByteLen
VariantInit
SysAllocString
SysStringByteLen

api-ms-win-core-synch-l1-1-0

CreateEventW
EnterCriticalSection
SetEvent
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ResetEvent
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

SuspendThread
GetExitCodeThread
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
ResumeThread
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadResource
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
SizeofResource

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW

api-ms-win-core-com-l1-1-0

CLSIDFromString
PropVariantClear
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
IIDFromString
PropVariantCopy
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventWrite
EventUnregister
EventRegister
EventActivityIdControl

ws2_32

closesocket

iphlpapi

GetAdapterIndex

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

FindClose
GetFileAttributesW
FindNextFileW
FindFirstFileW
ReadFile
CreateDirectoryW
WriteFile
SetFilePointerEx
ReadFileEx
DeleteFileW
WriteFileEx
GetTempFileNameW
GetFileInformationByHandle
CreateFileW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId
MoveFileW
BindIoCompletionCallback

ntdll

RtlNtStatusToDosError
RtlInitializeGenericTable
RtlEnumerateGenericTable
RtlDeleteElementGenericTable
WinSqmAddToStream
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
RtlIpv4StringToAddressW
RtlInitUnicodeString
NtCreateFile
RtlLookupElementGenericTable
RtlInsertElementGenericTable
NtQuerySystemInformation
RtlIpv6StringToAddressW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx
DeviceIoControl

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW
BuildSecurityDescriptorW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
AccessCheckAndAuditAlarmW
InitializeSecurityDescriptor
MakeSelfRelativeSD
ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetCPInfo
IsDBCSLeadByte

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

crypt32

CryptProtectMemory
CryptUnprotectMemory

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-stringansi-l1-1-0

CharNextA
CharPrevA

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

pdh

PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetRawCounterValue

user32

UnionRect
LoadCursorW
DispatchMessageW
GetWindowThreadProcessId
GetMessageW
UnregisterDeviceNotification
IsClipboardFormatAvailable
UnregisterClassW
RegisterDeviceNotificationW
UnregisterClassA
CreateWindowExW
RegisterClassW
CopyRect
SetRect
GetClipboardFormatNameW
PostMessageW
SetWindowLongPtrW
RegisterClipboardFormatW
SendMessageW
GetWindowLongPtrW
DefWindowProcW
DestroyWindow

regapi

RegWinstationQuerySecurityConfig_Merged

rfxvmt

RfxVmtCloseChannel
RfxVmtWriteChannel
RfxVmtReadChannel
RfxVmtCreateChannel
RfxVmtGetDataAvailableEvent

rdpbase

RDPBASE_CreateInstance
?RdpPerfLoggerStaticTerminate@@YAXXZ
RDPServerStackDiagnostics_Unregister
?RdpPerfLoggerStaticInitialize@@YAXXZ
RDPServerStackDiagnostics_Register
RdpX_Threading_CreateCriticalSection
PAL_System_Sleep
RdpX_AtomicDecrement32
RdpX_AtomicIncrement32
PAL_System_AtomicCompareAndExchangePointer
RDPServerStackDiagnostics_LogDisconnect
RDPServerStackDiagnostics_LogFailure
RDPServerStackDiagnostics_LogCheckpoint
RDPWSStreamConnector_CreateInstance
PAL_System_CritSecInit
RDPENCORE_AddGlobalObject
PAL_System_SwitchToThread
RDPAPI_GetGlobalObject
PAL_System_AtomicCompareAndExchange
TSCreateCoreEvents
RDPENCHLPREG_ReadValueDWORD
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_AtomicIncrement
PAL_System_AtomicDecrement
PAL_System_CritSecTerminate
TSAlloc
TSFree
PAL_System_CritSecIsLockedByCurrentThread
TRC_TraceBufferW
MemCopyAligned_SSE
MemMoveReverseAligned_SSE
GetSupportedSSELevel_SSE
PAL_System_GetNumberOfProcessors
?NSRunLengthDecode@@YAKPEBEKPEAEK@Z
PAL_System_MemFree
RdpX_GetActivityIdPrefix
RgnlibBA_CreateInstance
RDPAPI_GetGenericCounter
CRDPCaps_CreateInstance
PAL_System_CritSecTryEnter
RDPAPI_GetLongCounter
PAL_System_ThreadGetId
PAL_System_MemAlloc

rdpserverbase

?GetGfxPipeSettingBOOL@@YAJPEAGHPEAH@Z
?LogRDPGraphicsFirstNonBlackFramePostLogon@RDPGraphicsTraceLogging@@YAXI@Z
RDPSERVERBASE_CreateInstance
?LogRDPGraphicsFirstNonBlackFrame@RDPGraphicsTraceLogging@@YAX_K@Z
?LogRDPGraphicsError@RDPGraphicsTraceLogging@@YAXU_GUID@@IIJ@Z
?LogRDPGraphicsSubsampleFailure@RDPGraphicsTraceLogging@@YAXJI@Z
?GetGraphicsSourceContext@RdpSurface@@QEAAJPEAPEAUIRdpGFXSourceUpdateContext@@@Z
RDPEncryptionTraceLogging_Register
?RDPGraphicsTraceLogging_Unregister@RDPGraphicsTraceLogging@@YAXXZ
RDPEncryptionTraceLogging_Unregister
?LogRDPGraphicsVOBRHint@RDPGraphicsTraceLogging@@YAXI_KII@Z
?LogRDPGraphicsSubsampleAdapter@RDPGraphicsTraceLogging@@YAXPEBGII@Z
?GetEncodingPixelMap@RdpSurface@@QEAAJPEAPEAVPixelMap@@@Z
?RDPGraphicsTraceLogging_Register@RDPGraphicsTraceLogging@@YAJXZ
?GetGfxPipeSettingUINT@@YAJPEAGIPEAI@Z

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetEntriesInAclW

rpcrt4

RpcBindingSetOption
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoExW
UuidCreate
I_RpcExceptionFilter
UuidToStringW
NdrClientCall3

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
PeekNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState

api-ms-win-core-shlwapi-legacy-l1-1-0

PathUnquoteSpacesW
PathGetDriveNumberW
PathQuoteSpacesW
PathSkipRootW
PathIsUNCW
PathFindExtensionW

api-ms-win-core-url-l1-1-0

UrlIsW

userenv

ExpandEnvironmentStringsForUserW

api-ms-win-core-perfcounters-l1-1-0

PerfDeleteInstance
PerfIncrementULongCounterValue
PerfSetCounterSetInfo
PerfCreateInstance
PerfStartProviderEx
PerfStopProvider
PerfSetULongCounterValue

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-core-comm-l1-1-0

SetCommTimeouts

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

gdi32

GetObjectW
DeleteObject
CreatePalette
GetMetaFileBitsEx
GetStockObject
GetPaletteEntries
SetMetaFileBitsEx
CreateMetaFileW
PlayMetaFile
CloseMetaFile
DeleteMetaFile

d3d11

D3D11CreateDevice

tlscsp

ord1
ord3
ord4
ord7
ord2

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RFX_CreateGFXService
RFX_CreatePluginFactory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/LICENSE
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/README.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/LICENCE.dat
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/LICENSE
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/README.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/comm.exe
.exe windows:5 windows x64 arch:x64

f9309fff2ca1987b729c2da5521e6655

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

WSACleanup
inet_addr
gethostbyname
gethostname
WSAStartup

winmm

mixerSetControlDetails
waveOutGetVolume
joyGetPosEx
mixerGetControlDetailsW
mixerOpen
mixerGetDevCapsW
mixerGetLineControlsW
waveOutSetVolume
mixerClose
mciSendStringW
joyGetDevCapsW
mixerGetLineInfoW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

ImageList_Create
CreateStatusWindowW
ImageList_ReplaceIcon
ImageList_GetIconSize
ImageList_Destroy
ImageList_AddMasked

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
GetModuleBaseNameW

kernel32

LockResource
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
SetLastError
GetEnvironmentVariableW
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceW
SetVolumeLabelW
CreateFileW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
CreateDirectoryW
ReadFile
WriteFile
DeleteFileW
SetFileAttributesW
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetWindowsDirectoryW
GetTempPathW
GetFullPathNameW
GetShortPathNameW
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
LoadResource
CompareStringW
RemoveDirectoryW
CopyFileW
GetCurrentProcess
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
GlobalSize
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
EncodePointer
RtlPcToFileHeader
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCommandLineW
ExitProcess
GetModuleHandleExW
HeapSize
HeapReAlloc
HeapQueryInformation
HeapFree
HeapAlloc
SizeofResource
FindResourceW
GetSystemTimeAsFileTime
GetModuleFileNameW
DeleteCriticalSection
GetCPInfo
GetVersionExW
FreeLibrary
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetLastError
CreateMutexW
CloseHandle
GetExitCodeThread
SetThreadPriority
CreateThread
GetStringTypeExW
lstrcmpiW
GetCurrentThreadId
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
GetCurrentDirectoryW
SetErrorMode
InitializeCriticalSection
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
TlsSetValue
TlsFree
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetProcessHeap
FindFirstFileExW
IsValidCodePage
GetCommandLineA
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
QueryDosDeviceW
ReadConsoleW

user32

RedrawWindow
SetWindowLongPtrW
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongPtrW
DefDlgProcW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
GetWindowLongPtrW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
MessageBoxW
GetTopWindow
MoveWindow
GetQueueStatus
GetWindowRect
GetClientRect
SystemParametersInfoW
AdjustWindowRectEx
DrawTextW
SetRect
GetIconInfo
MapWindowPoints
IsWindowVisible
LoadImageW
ChangeClipboardChain
SetClipboardViewer
LoadAcceleratorsW
EnableMenuItem
GetMenu
CreateWindowExW
RegisterClassExW
LoadCursorW
DestroyIcon
DestroyWindow
IsCharAlphaW
MapVirtualKeyW
ClientToScreen
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
RemovePropW
SetPropW
GetPropW
FlashWindow
SetMenu
ExitWindowsEx
GetMenuStringW
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSystemMenu
GetLastInputInfo
SetWindowTextW
GetCursor
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
MessageBeep
SetDlgItemTextW
GetDlgItem
SendDlgItemMessageW
DialogBoxParamW
SetForegroundWindow
DefWindowProcW
FillRect
DrawIconEx
GetSysColorBrush
GetSysColor
RegisterWindowMessageW
IsIconic
IsZoomed
EnumWindows
GetWindowTextLengthW
EnableWindow
InvalidateRect
SetLayeredWindowAttributes
SetWindowPos
SetWindowRgn
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
SetFocus
SetActiveWindow
VkKeyScanExW
EnumChildWindows
CheckMenuItem

gdi32

GetPixel
GetClipRgn
GetCharABCWidthsW
SetBkMode
CreatePatternBrush
SetBrushOrgEx
EnumFontFamiliesExW
CreateDIBSection
GdiFlush
SetBkColor
ExcludeClipRect
SetTextColor
GetClipBox
BitBlt
CreateCompatibleBitmap
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
CreateDCW
CreateSolidBrush
CreateFontW
FillRgn
GetDeviceCaps
DeleteObject

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
GetUserNameW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegConnectRegistryW
RegDeleteValueW

shell32

DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW
ExtractIconW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromString
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

SafeArrayGetLBound
GetActiveObject
SysStringLen
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayGetDim
SafeArrayDestroy
SafeArrayGetUBound
VariantCopyInd
SafeArrayCopy
SysAllocString
VariantChangeType
VariantClear
SafeArrayCreate
SysFreeString

Sections

.text
Size: 778KB - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/docs/installation.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/docs/issue-page.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/docs/known-issues.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/docs/settings.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/+.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/1.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/10.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/2.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/3.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/4.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/5.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/6.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/7.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/8.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/9.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/black-on-white.zip
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/white-monitors-by-rob3110.zip
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/icons/white-on-black.zip
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/libraries/read-ini.ahk
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/libraries/tooltip.ahk
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/libraries/virtual-desktop-accessor.dll
.dll windows:6 windows x64 arch:x64

2483e0c9213ade268a6d6d833c82b583

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Source\CandCPP\VirtualDesktopAccessor\x64\Release\VirtualDesktopAccessor.pdb

Imports

user32

PostMessageW

ole32

CoInitialize
CoCreateInstance

msvcp140

?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

vcruntime140

__std_exception_copy
__CxxFrameHandler3
__std_terminate
__C_specific_handler
__std_type_info_destroy_list
__std_exception_destroy
_CxxThrowException
memset

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initialize_narrow_environment
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

kernel32

RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter

Exports

Exports

EnableKeepMinimized
GetCurrentDesktopNumber
GetDesktopCount
GetDesktopIdByNumber
GetDesktopNumber
GetDesktopNumberById
GetWindowDesktopId
GetWindowDesktopNumber
GoToDesktopNumber
IsPinnedApp
IsPinnedWindow
IsWindowOnCurrentVirtualDesktop
IsWindowOnDesktopNumber
MoveWindowToDesktopNumber
PinApp
PinWindow
RegisterPostMessageHook
RestartVirtualDesktopAccessor
RestoreMinimized
UnPinApp
UnPinWindow
UnregisterPostMessageHook

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/settings.ini
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/data/virtual-desktop-enhancer.ahk
.ps1
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/docs/installation.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/docs/issue-page.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/docs/known-issues.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/docs/settings.md
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/+.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/1.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/10.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/2.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/3.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/4.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/5.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/6.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/7.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/8.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/9.ico
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/black-on-white.zip
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/white-monitors-by-rob3110.zip
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/icons/white-on-black.zip
.zip
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/libraries/read-ini.ahk
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/libraries/tooltip.ahk
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/libraries/virtual-desktop-accessor.dll
.dll windows:6 windows x64 arch:x64

2483e0c9213ade268a6d6d833c82b583

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Source\CandCPP\VirtualDesktopAccessor\x64\Release\VirtualDesktopAccessor.pdb

Imports

user32

PostMessageW

ole32

CoInitialize
CoCreateInstance

msvcp140

?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

vcruntime140

__std_exception_copy
__CxxFrameHandler3
__std_terminate
__C_specific_handler
__std_type_info_destroy_list
__std_exception_destroy
_CxxThrowException
memset

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initialize_narrow_environment
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

kernel32

RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter

Exports

Exports

EnableKeepMinimized
GetCurrentDesktopNumber
GetDesktopCount
GetDesktopIdByNumber
GetDesktopNumber
GetDesktopNumberById
GetWindowDesktopId
GetWindowDesktopNumber
GoToDesktopNumber
IsPinnedApp
IsPinnedWindow
IsWindowOnCurrentVirtualDesktop
IsWindowOnDesktopNumber
MoveWindowToDesktopNumber
PinApp
PinWindow
RegisterPostMessageHook
RestartVirtualDesktopAccessor
RestoreMinimized
UnPinApp
UnPinWindow
UnregisterPostMessageHook

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/settings.ini
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/virtual-desktop-enhancer.ahk
.ps1
Virtual PC Sandbox Programs PACK/Windows 10 Virtual Desktop Enhancer 0.11.2 Beta/virtual-desktop-enhancer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 478KB - Virtual size: 477KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 50KB - Virtual size: 50KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 11KB - Virtual size: 10KB

.rsrc Size: 134KB - Virtual size: 134KB

.reloc Size: 512B - Virtual size: 12B

7acc8c379c768a1ecd81ec502ff5f33e

Headers

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 228KB - Virtual size: 226KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 24KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 12KB - Virtual size: 10KB

b94a10558c463cf7ccd8b8943132a4ad

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

user32

shell32

ole32

setupapi

drvstore

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 50KB - Virtual size: 49KB

.reloc Size: 512B - Virtual size: 212B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

.text
Size: 478KB - Virtual size: 477KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 50KB - Virtual size: 50KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 134KB - Virtual size: 134KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 228KB - Virtual size: 226KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 24KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 12KB - Virtual size: 10KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 50KB - Virtual size: 49KB

.reloc
Size: 512B - Virtual size: 212B

.text
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 134KB - Virtual size: 134KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 690KB - Virtual size: 689KB

.data
Size: 15KB - Virtual size: 16KB

.pdata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 416B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 63KB - Virtual size: 63KB

.text
Size: 478KB - Virtual size: 477KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 50KB - Virtual size: 50KB