omgsoft[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

omgsoft.exe
Size

10.7MB
MD5

895531f9d849155e054903e7cc466888
SHA1

4271c3690af27765533a3f1eb30a40d5aebf90bc
SHA256

e60d911f2ef120ed782449f1136c23ddf0c1c81f7479c5ce31ed6dcea6f6adf9
SHA512

4c72b3d45291da1eb8290f7c6ad89c71d64e48f0e717126f8729efe683558c43439091e444cc0a7f9df09a90241cebabd09153b9578f5c0e79b2ed537cd68674
SSDEEP

196608:62VEhlCTPpx5v1i7qwDzfAPlqBtC1m4AVEhlCTPpx5v1i7qwDzfAPlqBtC1I:66Ehq1sqwHOld0Ehq1sqwHOldI

Score

1^/10

Malware Config

Signatures

Files

omgsoft.exe
.exe windows:4 windows x86 arch:x86

24f4223e271413c25abad52fd456a9bc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=PIRIFORM SOFTWARE LIMITED,O=PIRIFORM SOFTWARE LIMITED,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:20:71:b7:27:7e:00:c1:9a:d9:77:02:ac:8d:75:00:87:ff:4d:6e:02:c0:e3:55:ac:51:36:55:c1:96:af:36
Signer

Actual PE Digest

78:20:71:b7:27:7e:00:c1:9a:d9:77:02:ac:8d:75:00:87:ff:4d:6e:02:c0:e3:55:ac:51:36:55:c1:96:af:36

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
MoveFileW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
lstrcmpW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
ReadFile
MulDiv
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
FreeLibrary
GetPrivateProfileStringW
GetModuleHandleW
LoadLibraryExW

user32

GetWindowRect
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
ScreenToClient
EnableMenuItem
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
SystemParametersInfoW
EndDialog
RegisterClassW
DialogBoxParamW
CreateWindowExW
GetClassInfoW
DestroyWindow
CharNextW
ExitWindowsEx
SetWindowTextW
LoadImageW
SetTimer
ShowWindow
PostQuitMessage
wsprintfW
SetWindowLongW
FindWindowExW
IsWindow
CreatePopupMenu
AppendMenuW
GetSystemMetrics
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow

gdi32

SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor

shell32

ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHFileOperationW
SHBrowseForFolderW

advapi32

AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 450KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/JsisPlugins.dll
.dll windows:6 windows x86 arch:x86

bcb2b0b7e3ad7db4b14b8c68c2a9f8c2

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=PIRIFORM SOFTWARE LIMITED,O=PIRIFORM SOFTWARE LIMITED,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:47:09:94:f4:b9:cb:e9:74:52:96:17:74:85:b9:8d:6a:a2:5e:cc:af:ee:17:57:1e:04:db:03:ec:1a:da:d7
Signer

Actual PE Digest

bd:47:09:94:f4:b9:cb:e9:74:52:96:17:74:85:b9:8d:6a:a2:5e:cc:af:ee:17:57:1e:04:db:03:ec:1a:da:d7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\893f00f663353e48\bin\x86\MinSizeRel\JsisPlugins.pdb

Imports

kernel32

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
WriteFile
ResetEvent
GetCurrentThreadId
CreatePipe
CloseHandle
ReadFile
LoadLibraryW
GetProcAddress
FindResourceW
FileTimeToSystemTime
CompareFileTime
GetFileSizeEx
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleW
FreeLibrary
CreateFileW
InitializeCriticalSectionEx
GetLastError
RaiseException
DecodePointer
OutputDebugStringW
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
lstrcpynW
GlobalFree
GlobalAlloc
VerifyVersionInfoW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
GetACP
CreateProcessW
GetThreadPriority
SetThreadPriority
CreateEventW
WaitForSingleObject
DeleteCriticalSection
SetEvent
IsValidLocale
GetLocaleInfoW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
GetCPInfoExW
GetStringTypeW
InitOnceBeginInitialize
InitOnceComplete
WaitForSingleObjectEx
Sleep
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
GetCommandLineW
GetFileTime
SetLastError
GetExitCodeProcess
GetProcessId
OpenProcess
GetSystemDirectoryW
IsWow64Process
GetModuleFileNameW
LocalAlloc
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetVersion
FindResourceExW
FlushFileBuffers
GetTickCount
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileW
DeleteFileA
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
CreateMutexW
UnlockFileEx
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
InitializeCriticalSection
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetCurrentThread
SetConsoleCtrlHandler
GetStdHandle
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
VerSetConditionMask

user32

FindWindowExW
GetWindowThreadProcessId
SendMessageTimeoutW
UnregisterClassW
wsprintfW
IsWindowVisible
IsWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnumWindows
GetWindowLongW
MessageBoxW
GetWindowRect
EnableMenuItem
GetSystemMenu
SetDlgItemTextW
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
PostQuitMessage
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetShellWindow
LoadCursorW
GetMonitorInfoW
MonitorFromPoint
RegisterClassExW
CreateWindowExW
SetWindowLongW
RegisterWindowMessageW

ole32

CoCreateGuid
OleInitialize
OleUninitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree

crypt32

CryptHashCertificate
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptQueryObject

wintrust

WinVerifyTrust

shell32

ord680
SHGetKnownFolderPath
SHCreateItemFromParsingName
ShellExecuteExW

oleaut32

VariantInit
VariantCopy
SysFreeString
SysAllocString
VariantClear
VariantTimeToSystemTime

advapi32

ConvertStringSidToSidA
RegCloseKey
RegCreateKeyExW
RegCreateKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyTransactedW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyTransactedW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
OpenProcessToken
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
CreateProcessWithTokenW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
LookupAccountNameA
ConvertSidToStringSidA

shlwapi

AssocQueryStringA

secur32

GetUserNameExW

rpcrt4

UuidToStringA
UuidCreate
UuidFromStringA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Exports

Exports

nsisBrowser_Chrome_GetActiveDaysInPeriod
nsisBrowser_Chrome_GetLastVisitTimestamp
nsisBrowser_Chrome_GetTotalVisitsInPeriod
nsisBrowser_Chrome_GetUniqueVisitsInPeriod
nsisBrowser_EdgeV2_GetActiveDaysInPeriod
nsisBrowser_EdgeV2_GetLastVisitTimestamp
nsisBrowser_EdgeV2_GetTotalVisitsInPeriod
nsisBrowser_EdgeV2_GetUniqueVisitsInPeriod
nsisBrowser_Edge_GetSearchEngines
nsisBrowser_Mozilla_GetActiveDaysInPeriod
nsisBrowser_Mozilla_GetLastVisitTimestamp
nsisBrowser_Mozilla_GetTotalVisitsInPeriod
nsisBrowser_Mozilla_GetUniqueVisitsInPeriod
nsisBrowser_Mozilla_Mozlz4DecompressFileToFile
nsisBrowser_Msie_GetActiveDaysInPeriod
nsisBrowser_Msie_GetLastVisitTimestamp
nsisBrowser_Msie_GetTotalVisitsInPeriod
nsisBrowser_Msie_GetUniqueVisitsInPeriod
nsisBrowser_Opera_GetActiveDaysInPeriod
nsisBrowser_Opera_GetLastVisitTimestamp
nsisBrowser_Opera_GetTotalVisitsInPeriod
nsisBrowser_Opera_GetUniqueVisitsInPeriod
nsisBrowser_SafeZone_GetActiveDaysInPeriod
nsisBrowser_SafeZone_GetLastVisitTimestamp
nsisBrowser_SafeZone_GetLogActivityCount
nsisBrowser_SafeZone_GetTotalVisitsInPeriod
nsisBrowser_SafeZone_GetUniqueVisitsInPeriod
nsisPlugin_GetLoggingSeverity
nsisPlugin_Help
nsisPlugin_Init
nsisPlugin_RegisterLoggingCallback
nsisPlugin_SetLoggingSeverity
nsisPlugin_TestLoggingCallback
nsisSciterUI_AnimateBuffers
nsisSciterUI_AppendValue
nsisSciterUI_CenterWindowOnPrimaryDisplay
nsisSciterUI_ChangeDefaultValue
nsisSciterUI_ChangeLanguage
nsisSciterUI_ChangeOverrideValue
nsisSciterUI_ChangeProgressTask
nsisSciterUI_ChangeValue
nsisSciterUI_HideWindow
nsisSciterUI_HideWindowBorder
nsisSciterUI_Init
nsisSciterUI_LoadPage
nsisSciterUI_MessageBox
nsisSciterUI_MinimizeWindow
nsisSciterUI_Reset
nsisSciterUI_RestoreWindow
nsisSciterUI_ShowWindow
nsisSciterUI_ShowWindowBorder
nsisSciterUI_Shutdown
nsisSciterUI_SwapBuffers
nsisSciterUI_TriggerUpdate
nsisSciterUI_WaitForSingleEvent
nsisSystem_Hardware_GetMidexUuid
nsisSystem_Process_Close
nsisSystem_Process_Count
nsisSystem_Process_DeleteSelf
nsisSystem_Process_DeleteSelfEx
nsisSystem_Process_Exists
nsisSystem_Process_Terminate
nsisSystem_SchTasks_Process
nsisUtilities_OSUtils_CreateProcess
nsisUtilities_OSUtils_CreateProcessFromTrustedExecutable
nsisUtilities_OSUtils_CreateProcessFromTrustedExecutableEx
nsisUtilities_OSUtils_CreateProcessUnelevated
nsisUtilities_OSUtils_CreateRestrictedFolder
nsisUtilities_OSUtils_GetOsBuild
nsisUtilities_OSUtils_GetOsFullVersion
nsisUtilities_OSUtils_GetOsVersion
nsisUtilities_OSUtils_HasVisibleWindow
nsisUtilities_OSUtils_IsPinnedToTaskbar
nsisUtilities_OSUtils_UnpinShortcut
nsisUtilities_OSUtils_VerifyTrust
nsisUtilities_OSUtils_VerifyTrustEx
nsisUtilities_TagData_Extract

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Midex.dll
.dll windows:5 windows x86 arch:x86

a41019eae6c79e0cc9e9c9ed3b9687a0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=PIRIFORM SOFTWARE LIMITED,O=PIRIFORM SOFTWARE LIMITED,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:a8:ee:68:59:c5:c6:79:21:6a:04:64:ed:c8:e2:fc:ba:f2:db:21:9a:f2:79:87:b1:2d:b3:a9:74:64:d7:0e
Signer

Actual PE Digest

a3:a8:ee:68:59:c5:c6:79:21:6a:04:64:ed:c8:e2:fc:ba:f2:db:21:9a:f2:79:87:b1:2d:b3:a9:74:64:d7:0e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\3db0bf373ac3fc9b\Release Midex\Midex.pdb

Imports

kernel32

lstrcpynW
MultiByteToWideChar
GlobalAlloc
WideCharToMultiByte
HeapFree
EnterCriticalSection
DeviceIoControl
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetVolumePathNameW
CreateFileW
GetSystemDirectoryW
UnmapViewOfFile
HeapSize
GetVersion
GetVolumeNameForVolumeMountPointW
GetLastError
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
MapViewOfFile
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteFile
GetConsoleCP
GetConsoleMode

user32

wsprintfW

Exports

Exports

midex

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/jsis.dll
.dll windows:5 windows x86 arch:x86

5809b57e871b146bd3a9782d4448492e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=PIRIFORM SOFTWARE LIMITED,O=PIRIFORM SOFTWARE LIMITED,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:08:37:3b:0b:28:39:1f:f0:f6:10:35:0a:20:46:c7:0e:1a:14:e1:40:4e:5d:f7:3e:80:4a:a6:f9:69:a1:d3
Signer

Actual PE Digest

00:08:37:3b:0b:28:39:1f:f0:f6:10:35:0a:20:46:c7:0e:1a:14:e1:40:4e:5d:f7:3e:80:4a:a6:f9:69:a1:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\f369f300b8043bce\plugins\src\jsis\build\Release Unicode\jsis.pdb

Imports

uxtheme

SetWindowTheme

shlwapi

StrStrA
StrStrIW
StrStrIA
StrStrW

wininet

InternetQueryOptionW
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetSetOptionW
InternetCrackUrlW
InternetCloseHandle
InternetOpenW
InternetConnectW

kernel32

lstrlenW
CreateFileW
GetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
lstrcpyW
GetStdHandle
AllocConsole
FreeConsole
AttachConsole
ExitProcess
SetUnhandledExceptionFilter
SetErrorMode
SetFilePointer
GetLocalTime
lstrcmpW
FindClose
FindFirstFileW
FindNextFileW
GetLocaleInfoW
GetUserDefaultUILanguage
CloseHandle
DeleteFileW
FreeLibrary
GetProcAddress
GetVersion
LocalAlloc
LocalFree
GetCurrentProcess
GetExitCodeProcess
GetProcessId
WaitForSingleObject
GetTickCount
lstrcmpiW
LoadLibraryW
CreateProcessW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLongPathNameW
OpenProcess
ReleaseMutex
GetSystemTime
SystemTimeToFileTime
CreateMutexW
GetModuleFileNameW
GetModuleHandleW
GetCommandLineW
GetTempPathW
GetTempFileNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
MoveFileExW
GetVersionExA
IsWow64Process
GetGeoInfoW
ReadFile
lstrlenA
SetLastError
IsDebuggerPresent
CheckRemoteDebuggerPresent
WriteFile
GetFileSize
lstrcatW
GetLastError
GlobalFree
GlobalReAlloc
GlobalAlloc
lstrcpynA
GetUserGeoID

user32

SetFocus
GetSystemMetrics
GetSystemMenu
EnableMenuItem
SetForegroundWindow
LockSetForegroundWindow
GetWindowTextW
GetClientRect
GetWindowRect
SetCursor
HideCaret
GetWindowLongW
SetWindowLongW
LoadCursorW
DestroyIcon
LoadImageW
SystemParametersInfoW
CharUpperW
GetCursorPos
DestroyCaret
ScreenToClient
DefWindowProcW
CallWindowProcW
IsWindow
DrawTextExW
GetDC
ReleaseDC
MapWindowPoints
MapDialogRect
GetWindowPlacement
IsWindowVisible
GetParent
SendMessageW
MessageBoxW
wsprintfW
wsprintfA
wvsprintfW
SetWindowPos
ShowWindow
SendMessageTimeoutW
TrackMouseEvent
CharLowerW
GetWindowThreadProcessId
EnumWindows
GetKeyState
AllowSetForegroundWindow

gdi32

GetCharWidthW
SelectObject
GetTextExtentPoint32W
GetDeviceCaps
DeleteObject

advapi32

LookupAccountNameW
LookupAccountSidW
FreeSid
AllocateAndInitializeSid
IsValidSid
CreateWellKnownSid
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegEnumKeyW
GetUserNameW
RegSetValueExW
RegCreateKeyW
ConvertStringSidToSidW
ConvertSidToStringSidW
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserW
RegCloseKey
RegOpenKeyExW

shell32

SHGetFolderPathW
ShellExecuteExW

ole32

CoCreateGuid
StringFromGUID2

Exports

Exports

Int64Op
nsAddExStyle
nsAddFatalTrackingParam
nsAddInternalLogAnonymizeRule
nsAddInternalLogFilter
nsAddStyle
nsBumpWindow
nsCharCodeAt
nsCharLower
nsCharUpper
nsClearFatalTrackingParams
nsClearInternalLog
nsClearLoadedText
nsCloseLog
nsCloseTrace
nsConsoleAppend
nsConsoleAttach
nsConsoleDetach
nsConsoleLog
nsCrash
nsCreateMutex
nsDamm
nsDebugEnter
nsDebugLeave
nsDestructureMsgfilter
nsDetectVM
nsDu2px
nsEnableClose
nsEscapeNonAscii
nsExecAsync
nsExecAsyncClose
nsExecAsyncGetExitCode
nsExecAsyncGetPid
nsExecLogonUser
nsExtractTagData
nsFatal
nsFindProcessWindow
nsFreeBitmap
nsFreeIcon
nsGetClientSize
nsGetCommandLine
nsGetCurSelText
nsGetCurrentDirectory
nsGetCurrentProcess
nsGetDPI
nsGetDiskUsage
nsGetGeoCountryCode
nsGetInternalLogMessage
nsGetLocalTime
nsGetLocaleInfo
nsGetLogonSid
nsGetLongPathName
nsGetOwnerSid
nsGetParentWindow
nsGetPosition
nsGetProcessInfo
nsGetScreenSize
nsGetSize
nsGetSystemTime
nsGetTextExtent
nsGetUnixTimeString
nsGetUnixTimeStringLocal
nsGetUserDefaultGeoName
nsGetUserDefaultUILanguage
nsGetUserNameFromSid
nsGetUtcTimeString
nsGetWindowLong
nsGetWindowPos
nsGetWindowSize
nsGetWindowText
nsGetWindowsVersion
nsGetWorkArea
nsHideCaret
nsI18nAddSupportedLanguage
nsI18nChooseLcid
nsI18nGetChromiumLocale
nsI18nGetComboBoxSelectedLanguage
nsI18nLcidToLocale
nsI18nPopulateComboBox
nsI18nSortLanguagesByName
nsI18nTranslateLangName
nsInetAddParam
nsInetAddRawPostData
nsInetReset
nsInetSend
nsInit
nsInitLog
nsInitTrace
nsIsElevated
nsIsMaximized
nsIsMinimized
nsIsVisible
nsIsWow64Process
nsJsisStashLocalVars
nsJsisUnstashLocalVars
nsJsonify
nsLoadAndSetImage
nsLoadRichEdit
nsLoadTextFromFile
nsLockSetForegroundWindow
nsLogMessage
nsLogNsisStack
nsLstrcmp
nsLstrcmpi
nsMaximize
nsMessageBox
nsMinimize
nsMoveFileEx
nsMuiLoadImage
nsOwnerIsAdmin
nsPostInternalLog
nsPx2du
nsRelaunch
nsRelaunchClose
nsRelaunchWait
nsReleaseMutex
nsRemoveExStyle
nsRemoveStyle
nsRemoveWindowTheme
nsReopenLog
nsReopenTrace
nsReplaceInLoadedText
nsRestore
nsRichEditBuilderAddLink
nsRichEditBuilderAddText
nsRichEditBuilderEnd
nsRichEditBuilderLoadString
nsRichEditBuilderSetAlignment
nsRichEditBuilderSetColor
nsRichEditBuilderSetColorHex
nsRichEditBuilderSetFontSize
nsRichEditBuilderSetHighlight
nsRichEditBuilderSetHighlightHex
nsRichEditBuilderStart
nsRichEditClearSelection
nsRichEditDisableTextSelection
nsRichEditLoadFile
nsRichEditSetLinkHandler
nsRichEditSupportTabOrder
nsSaveLoadedText
nsSetClientSize
nsSetCurrentDirectory
nsSetFatalExitCode
nsSetFatalMessage
nsSetFatalTrackingUrl
nsSetFocus
nsSetInternalLogLevel
nsSetMouseCursor
nsSetPosition
nsSetSize
nsSetStretchedButtonImage
nsSetStretchedImage
nsSetWindowCursor
nsSetWindowLong
nsSetWindowPos
nsStackDelete
nsStackInsert
nsStackRead
nsStackSize
nsSubclass
nsSuppressCrashDialog
nsTrackMouseEvent
nsUnsubclass
nsUuid
nsWaitForProcess
nsWriteRegMultiSz

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsJSON.dll
.dll windows:5 windows x86 arch:x86

8338bb74c0af59997e6958029dda6f79

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=PIRIFORM SOFTWARE LIMITED,O=PIRIFORM SOFTWARE LIMITED,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:0c:c6:cf:e7:d0:ab:37:fe:c0:46:53:3c:4e:ab:41:84:67:b3:0c:48:b1:f3:01:c3:32:c7:05:1f:44:6c:d0
Signer

Actual PE Digest

5d:0c:c6:cf:e7:d0:ab:37:fe:c0:46:53:3c:4e:ab:41:84:67:b3:0c:48:b1:f3:01:c3:32:c7:05:1f:44:6c:d0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\7c64e6304ba228bc\Plugins\nsJSON.pdb

Imports

wininet

HttpSendRequestW
InternetOpenW
InternetQueryDataAvailable
InternetCloseHandle
InternetConnectW
InternetSetOptionW
InternetReadFile
HttpAddRequestHeadersW
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW

kernel32

lstrcmpW
lstrcpynW
GetExitCodeProcess
CreateProcessW
CreateThread
lstrcatW
GetLastError
FormatMessageW
GetModuleHandleA
WaitForSingleObject
CreatePipe
SetHandleInformation
ReadFile
lstrlenW
WriteFile
lstrlenA
CreateFileW
MultiByteToWideChar
GlobalAlloc
GlobalFree
CloseHandle
GetFileSize
WideCharToMultiByte
lstrcpyW
lstrcmpiW
GlobalReAlloc

user32

MsgWaitForMultipleObjectsEx
TranslateMessage
IsCharAlphaNumericW
wsprintfW
PeekMessageW
PostMessageW
DispatchMessageW

ole32

StringFromGUID2
CoCreateGuid

Exports

Exports

Delete
Get
GetJsisMember
JsisArrayPush
JsisArrayToStack
JsisCreateHandle
JsisInit
Quote
Serialize
Set
SetEscape
SetJsisMembers
Sort
Wait

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_106_
.dll windows:6 windows x86 arch:x86

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=PIRIFORM SOFTWARE LIMITED,O=PIRIFORM SOFTWARE LIMITED,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:42:66:60:7f:06:e4:7c:c8:78:6c:67:c5:4d:59:cb:a6:62:48:c9:b9:23:e7:a9:91:46:c5:7f:e0:dd:64:a6
Signer

Actual PE Digest

2e:42:66:60:7f:06:e4:7c:c8:78:6c:67:c5:4d:59:cb:a6:62:48:c9:b9:23:e7:a9:91:46:c5:7f:e0:dd:64:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\d58bb94b48143cdc\Contrib\build\out\x86\MinSizeRel\sciterui.pdb

Sections

.rdata
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24f4223e271413c25abad52fd456a9bc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bbCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

78:20:71:b7:27:7e:00:c1:9a:d9:77:02:ac:8d:75:00:87:ff:4d:6e:02:c0:e3:55:ac:51:36:55:c1:96:af:36Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 380KB

.rsrc Size: 450KB - Virtual size: 450KB

bcb2b0b7e3ad7db4b14b8c68c2a9f8c2

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bbCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

bd:47:09:94:f4:b9:cb:e9:74:52:96:17:74:85:b9:8d:6a:a2:5e:cc:af:ee:17:57:1e:04:db:03:ec:1a:da:d7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

crypt32

wintrust

shell32

oleaut32

advapi32

shlwapi

secur32

rpcrt4

wtsapi32

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 458KB - Virtual size: 457KB

.data Size: 49KB - Virtual size: 60KB

.rsrc Size: 1KB - Virtual size: 1KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

78:20:71:b7:27:7e:00:c1:9a:d9:77:02:ac:8d:75:00:87:ff:4d:6e:02:c0:e3:55:ac:51:36:55:c1:96:af:36
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 380KB

.rsrc
Size: 450KB - Virtual size: 450KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

bd:47:09:94:f4:b9:cb:e9:74:52:96:17:74:85:b9:8d:6a:a2:5e:cc:af:ee:17:57:1e:04:db:03:ec:1a:da:d7
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 458KB - Virtual size: 457KB

.data
Size: 49KB - Virtual size: 60KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 72KB - Virtual size: 72KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a3:a8:ee:68:59:c5:c6:79:21:6a:04:64:ed:c8:e2:fc:ba:f2:db:21:9a:f2:79:87:b1:2d:b3:a9:74:64:d7:0e
Signer

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:75:e1:f7:ec:9b:d8:a6:7a:3f:61:89:c6:3e:97:bb
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

00:08:37:3b:0b:28:39:1f:f0:f6:10:35:0a:20:46:c7:0e:1a:14:e1:40:4e:5d:f7:3e:80:4a:a6:f9:69:a1:d3
Signer

.text
Size: 67KB - Virtual size: 67KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 32KB - Virtual size: 38KB