sandboxie-5-69-6[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

sandboxie-5-69-6.exe
Size

2.9MB
MD5

f52f352a4def55c78779707efc001f3e
SHA1

efcce55e998886319858ef83cb3ceeb86dc23eb6
SHA256

95dbd294f511335bb0b368c487abe48e8d72aa4b165cba94d32cef71a5e46916
SHA512

9faeb5435b9f68a718b89dde2152437368b722183f9ee2b66d1a6650e703e862707d6b288487a5224aab5918116a5380e2408ef9ef08dc8e2fd06a14ae28d5bf
SSDEEP

49152:094iRfnCtFDyfWcyGAGTidbcW+/MVuiz1Py1v1GkfEgVAmm/S:0942fILBGAI4x+/a51snbmmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

sandboxie-5-69-6.exe
.exe windows:4 windows x86 arch:x86

ab6770b0a8635b9d92a5838920cfe770

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:74:73:3d:a6:03:76:ae:9c:00:97:75:64:bd:dd:e9:80:12:ca:80:46:bb:b1:39:87:7f:43:d5:6e:e0:c3:ee
Signer

Actual PE Digest

f1:74:73:3d:a6:03:76:ae:9c:00:97:75:64:bd:dd:e9:80:12:ca:80:46:bb:b1:39:87:7f:43:d5:6e:e0:c3:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileAttributesA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CompareFileTime
SearchPathA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
CreateDirectoryA
lstrcmpiA
GetTempPathA
GetCommandLineA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
WaitForSingleObject
ExitProcess
GetWindowsDirectoryA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
LoadLibraryExA
GetModuleHandleA
MultiByteToWideChar
FreeLibrary

user32

GetWindowRect
EnableMenuItem
GetSystemMenu
ScreenToClient
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
PostQuitMessage
RegisterClassA
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
OpenClipboard
TrackPopupMenu
SendMessageTimeoutA
GetDC
LoadImageA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
SetWindowLongA
EmptyClipboard
SetTimer
CreateDialogParamA
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

738dc9bb91549f627cf1953c2000e1d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryA
MultiByteToWideChar
SetCurrentDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock

user32

GetDlgCtrlID
CloseClipboard
GetClipboardData
MapWindowPoints
LoadCursorA
GetClientRect
SetWindowRgn
LoadIconA
GetWindowLongA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
SetCursor
PtInRect
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
EnableMenuItem
DrawTextA
GetSystemMenu
OpenClipboard
LoadImageA

gdi32

SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectA

shell32

SHGetPathFromIDListA
ShellExecuteA
SHBrowseForFolderA
SHGetDesktopFolder

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallType.ini
$PLUGINSDIR/KmdUtil.exe
.exe windows:6 windows x64 arch:x64

e74127d0470ed67341494767b56b1a47

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:25:ac:de:45:13:88:fd:56:ed:39:df:e1:63:dc:ec:ad:23:79:1d:a8:61:4a:30:6b:7a:bd:c4:2d:b7:99:e3
Signer

Actual PE Digest

5e:25:ac:de:45:13:88:fd:56:ed:39:df:e1:63:dc:ec:ad:23:79:1d:a8:61:4a:30:6b:7a:bd:c4:2d:b7:99:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\KmdUtil.pdb

Imports

ntdll

NtUnloadDriver
RtlUnwindEx
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

sbiedll

Sbie_snwprintf
SbieApi_Ioctl
SbieApi_Call
SbieApi_GetVersion
SbieApi_QueryConf
SbieApi_GetHomePath
SbieApi_LogMsgEx
SbieApi_IsBoxEnabled

kernel32

GetModuleFileNameW
LoadLibraryW
LocalAlloc
FormatMessageW
CloseHandle
GetCurrentProcess
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
ExitProcess
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetFileType
GetStartupInfoW
FreeLibrary
GetModuleHandleExW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LoadLibraryExW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
RaiseException
CreateFileW
WriteConsoleW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
GetCommandLineW
LocalFree
QueryPerformanceCounter
InitializeSListHead
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
Sleep

user32

SendMessageW
RegisterClassW
GetMessageW
MessageBoxW
CreateWindowExW
PostMessageW
DefWindowProcW
GetWindowLongW
DestroyWindow
ShowWindow
SetFocus
GetFocus
GetWindowRect
SystemParametersInfoW
LoadIconW
LoadCursorW
GetWindow
GetParent
GetDesktopWindow
DispatchMessageW

gdi32

CreateFontIndirectW
GetStockObject

advapi32

AdjustTokenPrivileges
CopySid
GetAce
GetSecurityDescriptorDacl
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertSidToStringSidW
ConvertStringSidToSidW
RegCreateKeyExW
CloseServiceHandle
LookupPrivilegeValueW
RegDeleteKeyW
OpenProcessToken
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
RegSetValueExW
RegOpenKeyExW
RegCloseKey

shell32

CommandLineToArgvW

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

4e5f0ae8071ae04cdb537283701198ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetACP
GlobalFree
GetModuleHandleA
lstrcpynA
lstrcmpA
MulDiv
GlobalAlloc
lstrlenA
lstrcpyA

user32

SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetWindowTextA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

DeleteObject
CreateFontIndirectA
GetDeviceCaps

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SbieDll.dll
.dll windows:6 windows x64 arch:x64

a61d116fd856ef74efe05cf35aeef3cc

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:2d:6a:8e:bd:61:04:40:84:9b:d6:b6:6e:c8:20:ea:2a:4f:7e:e7:03:31:e2:a6:cc:99:83:6e:de:a3:26:87
Signer

Actual PE Digest

13:2d:6a:8e:bd:61:04:40:84:9b:d6:b6:6e:c8:20:ea:2a:4f:7e:e7:03:31:e2:a6:cc:99:83:6e:de:a3:26:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDll.pdb

Imports

ntdll

RtlRestoreContext
NtSetInformationJobObject
RtlCaptureContext
NtAssignProcessToJobObject
NtOpenJobObject
NtCreateJobObject
NtUnmapViewOfSection
NtMapViewOfSection
RtlEqualSid
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
NtAdjustPrivilegesToken
NtFilterToken
NtDuplicateObject
NtSetInformationToken
NtOpenThread
NtOpenProcess
RtlConvertSidToUnicodeString
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtQuerySecurityObject
RtlNtStatusToDosError
NtProtectVirtualMemory
NtLoadDriver
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrUnloadDll
LdrLoadDll
NtYieldExecution
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtSaveKey
NtLoadKey2
NtLoadKey
NtDeleteKey
NtSetInformationKey
NtQueryKey
NtImpersonateAnonymousToken
NtImpersonateThread
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenSection
NtCreateSection
NtOpenSemaphore
NtCreateSemaphore
NtOpenMutant
NtCreateMutant
NtOpenEvent
NtCreateEvent
NtCreateSymbolicLinkObject
NtImpersonateClientOfPort
NtSecureConnectPort
NtCreatePort
NtQueryDirectoryObject
NtCreateDirectoryObject
RtlUnicodeStringToAnsiString
NtOpenProcessToken
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
NtQueryInformationProcess
NtSetInformationThread
RtlSetThreadErrorMode
RtlGetFullPathName_U
RtlSetCurrentDirectory_U
RtlGetCurrentDirectory_U
NtNotifyChangeDirectoryFile
NtWaitForSingleObject
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlCompareUnicodeString
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
NtDeviceIoControlFile
NtWriteFile
NtReadFile
NtDeleteFile
NtSetInformationFile
NtQueryFullAttributesFile
NtQueryAttributesFile
NtQueryInformationFile
NtQueryDirectoryFile
NtOpenFile
NtCreateFile
NtOpenDirectoryObject
NtQueryObject
NtSetInformationProcess
NtAllocateVirtualMemory
LdrGetProcedureAddress
NtDeleteValueKey
NtSetValueKey
NtEnumerateKey
NtCreateKey
NtOpenKey
NtQueryValueKey
RtlInitUnicodeString
NtRequestWaitReplyPort
NtRegisterThreadTerminatePort
NtConnectPort
NtClose
NtQueryVirtualMemory
NtReadVirtualMemory
_strlwr
__C_specific_handler
memcpy
memset
_wcsicmp
__chkstk
_wcsnicmp
towlower
wcsstr
wcschr
_itow
memmove
wcscpy_s
wcsncpy
_wcslwr
wcstol
_wtoi
wcsncmp
memcmp
wcstoul
wcsrchr
_ultow
_wtoi64
strchr
strncmp
wcsncpy_s
tolower
wcstombs
iswctype
strstr
_strnicmp

kernel32

FreeLibrary
SetLocaleInfoW
SetLocaleInfoA
PostQueuedCompletionStatus
EnumResourceNamesW
FormatMessageW
LoadLibraryExW
GetVersionExW
GetLongPathNameW
GetFullPathNameW
WinExec
OpenProcess
CreateProcessA
TerminateProcess
QueueUserWorkItem
CreateFileA
SizeofResource
WriteProcessMemory
ReadProcessMemory
VirtualAllocEx
DuplicateHandle
GetProcessId
GetUserDefaultLCID
GetSystemDefaultLCID
GetSystemDefaultLangID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SetThreadExecutionState
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetWindowsDirectoryW
HeapDestroy
HeapCreate
SetThreadPriority
GetExitCodeProcess
OpenEventW
DeleteCriticalSection
RaiseException
GlobalAddAtomW
UnmapViewOfFile
MapViewOfFileEx
GetThreadTimes
SleepEx
GetTickCount64
FindResourceA
FindResourceW
LockResource
LoadResource
GlobalLock
GlobalUnlock
GlobalSize
GetConsoleWindow
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleTitleA
AllocConsole
GetStartupInfoW
OpenThread
WaitForMultipleObjects
WideCharToMultiByte
GetSystemInfo
lstrcmpW
GetSystemWindowsDirectoryW
ReplaceFileW
MoveFileWithProgressW
MoveFileExW
GetPrivateProfileStringW
GetTickCount
QueueUserAPC
OpenMutexW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
GetFileSizeEx
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetEnvironmentVariableW
GetEnvironmentStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleA
ProcessIdToSessionId
GetCurrentProcessId
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
OutputDebugStringW
IsDebuggerPresent
GetModuleFileNameW
CreateProcessW
CreateThread
ExitProcess
SetEnvironmentVariableW
GetCommandLineW
LocalFree
LocalAlloc
GetSystemTimeAsFileTime
LoadLibraryW
GetModuleHandleW
ExpandEnvironmentStringsW
CreateEventW
WaitForSingleObject
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualProtectEx
VirtualQueryEx
SetLastError
CreateFileW
ReadFile
SetFilePointerEx
CloseHandle
GetProcAddress
GlobalAlloc
GlobalFree

Exports

Exports

File_GetName
Key_GetName
SbieApi_Call
SbieApi_CheckInternetAccess
SbieApi_DisableForceProcess
SbieApi_EnumBoxes
SbieApi_EnumBoxesEx
SbieApi_EnumProcessEx
SbieApi_GetBlockedDll
SbieApi_GetFileName
SbieApi_GetHomePath
SbieApi_GetMessage
SbieApi_GetUnmountHive
SbieApi_GetVersion
SbieApi_GetVersionEx
SbieApi_HookTramp
SbieApi_Ioctl
SbieApi_IsBoxEnabled
SbieApi_Log
SbieApi_LogEx
SbieApi_LogMsgEx
SbieApi_LogMsgExt
SbieApi_MonitorControl
SbieApi_MonitorGetEx
SbieApi_MonitorPut
SbieApi_MonitorPut2
SbieApi_MonitorPut2Ex
SbieApi_MonitorPutMsg
SbieApi_OpenProcess
SbieApi_ProcessExemptionControl
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieApi_QueryConfBool
SbieApi_QueryConfNumber
SbieApi_QueryConfNumber64
SbieApi_QueryDrvInfo
SbieApi_QueryPathList
SbieApi_QueryProcess
SbieApi_QueryProcessEx
SbieApi_QueryProcessEx2
SbieApi_QueryProcessInfo
SbieApi_QueryProcessInfoEx
SbieApi_QueryProcessInfoStr
SbieApi_QueryProcessPath
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_SetUserName
SbieApi_vLogEx
SbieDll_AssocQueryCommand
SbieDll_AssocQueryProgram
SbieDll_CallServer
SbieDll_CallServerQueue
SbieDll_CheckPatternInList
SbieDll_CheckProcessLocalSystem
SbieDll_CheckStringInList
SbieDll_CheckStringInListA
SbieDll_ComCreateProxy
SbieDll_ComCreateStub
SbieDll_DeviceChange
SbieDll_DisableCHPE
SbieDll_DisableElevationHook
SbieDll_ExpandAndRunProgram
SbieDll_FindArgumentEnd
SbieDll_FormatMessage
SbieDll_FormatMessage0
SbieDll_FormatMessage1
SbieDll_FormatMessage2
SbieDll_FreeMem
SbieDll_GetBorderColor
SbieDll_GetDrivePath
SbieDll_GetHandlePath
SbieDll_GetLanguage
SbieDll_GetPublicSD
SbieDll_GetServiceRegistryValue
SbieDll_GetSettingsForName
SbieDll_GetSettingsForName_bool
SbieDll_GetStartError
SbieDll_GetStringForStringList
SbieDll_GetStringsForStringList
SbieDll_GetSysFunction
SbieDll_GetTokenElevationType
SbieDll_GetUserPathEx
SbieDll_Hook
SbieDll_HookInit
SbieDll_InitPStore
SbieDll_InjectLow
SbieDll_InjectLow_InitHelper
SbieDll_InjectLow_InitSyscalls
SbieDll_InjectLow_SendHandle
SbieDll_IsBoxedService
SbieDll_IsDirectory
SbieDll_IsDllSkipHook
SbieDll_IsOpenCOM
SbieDll_IsOpenClsid
SbieDll_IsReservedFileName
SbieDll_KillAll
SbieDll_KillOne
SbieDll_MatchImage
SbieDll_MatchPathImpl
SbieDll_Mount
SbieDll_OpenProcess
SbieDll_PortName
SbieDll_QueryConf
SbieDll_QueryFileAttributes
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueueGetRpl
SbieDll_QueuePutReq
SbieDll_QueuePutRpl
SbieDll_RegisterDllCallback
SbieDll_RunFromHome
SbieDll_RunSandboxed
SbieDll_RunStartExe
SbieDll_SetFakeAdmin
SbieDll_StartBoxedService
SbieDll_StartCOM
SbieDll_StartSbieSvc
SbieDll_TraceModule
SbieDll_TranslateNtToDosPath
SbieDll_UnHookModule
SbieDll_Unmount
SbieDll_UpdateConf
Sbie_snprintf
Sbie_snwprintf
Scm_HookCloseServiceHandle
Scm_HookControlService
Scm_HookOpenServiceW
Scm_HookQueryServiceStatus
Scm_HookQueryServiceStatusEx
Scm_HookSetServiceStatus
Scm_HookStartServiceCtrlDispatcherW
Scm_HookStartServiceW

Sections

.text
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SbieMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:f7:fb:40:5c:82:d9:66:ff:6b:05:0a:98:18:f9:8b:74:ab:4b:68:1c:8f:de:58:3b:a6:5b:8b:2c:3c:d0:6c
Signer

Actual PE Digest

3b:f7:fb:40:5c:82:d9:66:ff:6b:05:0a:98:18:f9:8b:74:ab:4b:68:1c:8f:de:58:3b:a6:5b:8b:2c:3c:d0:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

f2ac1ab587d5531d5f1bf76c094aef4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalAlloc
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 510B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Warning.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
32/SbieDll.dll
.dll windows:6 windows x86 arch:x86

1d2395fb8aa00dc8c62b513301b5f6d5

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:11:29:ef:6b:39:7a:86:b9:70:22:8c:1e:48:d8:88:8e:42:1a:28:4a:ce:75:48:8b:df:25:fc:8f:e2:00:13
Signer

Actual PE Digest

15:11:29:ef:6b:39:7a:86:b9:70:22:8c:1e:48:d8:88:8e:42:1a:28:4a:ce:75:48:8b:df:25:fc:8f:e2:00:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\Win32\SbieRelease\SbieDll.pdb

Imports

ntdll

RtlUnwind
NtSetInformationJobObject
NtClose
NtAssignProcessToJobObject
NtOpenJobObject
NtCreateJobObject
NtUnmapViewOfSection
NtMapViewOfSection
RtlEqualSid
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
NtAdjustPrivilegesToken
NtFilterToken
NtDuplicateObject
NtSetInformationToken
NtOpenThread
NtOpenProcess
RtlConvertSidToUnicodeString
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtQuerySecurityObject
NtQueryVirtualMemory
RtlNtStatusToDosError
NtLoadDriver
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrUnloadDll
LdrLoadDll
NtYieldExecution
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtSaveKey
NtLoadKey2
NtLoadKey
NtDeleteKey
NtSetInformationKey
NtQueryKey
NtImpersonateAnonymousToken
NtImpersonateThread
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenSection
NtCreateSection
NtOpenSemaphore
NtCreateSemaphore
NtOpenMutant
NtCreateMutant
NtOpenEvent
NtCreateEvent
NtCreateSymbolicLinkObject
NtImpersonateClientOfPort
NtSecureConnectPort
NtCreatePort
NtQueryDirectoryObject
NtCreateDirectoryObject
NtAllocateVirtualMemory
RtlUnicodeStringToAnsiString
NtOpenProcessToken
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
NtQueryInformationProcess
NtSetInformationThread
RtlSetThreadErrorMode
RtlGetFullPathName_U
RtlSetCurrentDirectory_U
RtlGetCurrentDirectory_U
NtNotifyChangeDirectoryFile
NtWaitForSingleObject
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlCompareUnicodeString
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
NtDeviceIoControlFile
NtWriteFile
NtReadFile
NtDeleteFile
NtSetInformationFile
NtQueryFullAttributesFile
NtQueryAttributesFile
NtQueryInformationFile
NtQueryDirectoryFile
NtOpenFile
NtCreateFile
NtOpenDirectoryObject
NtQueryObject
NtSetInformationProcess
NtProtectVirtualMemory
LdrGetProcedureAddress
NtDeleteValueKey
NtSetValueKey
NtEnumerateKey
NtCreateKey
NtOpenKey
NtQueryValueKey
RtlInitUnicodeString
NtRequestWaitReplyPort
NtRegisterThreadTerminatePort
NtConnectPort
_strlwr
memcpy
memset
_wcsicmp
_chkstk
_wcsnicmp
towlower
wcsstr
wcschr
_itow
memmove
wcscpy_s
wcsncpy
_wcslwr
wcstol
_wtoi
wcsncmp
_stricmp
wcstoul
wcsrchr
_alldiv
_allmul
_ultow
_wtoi64
strchr
strncmp
wcsncpy_s
_aulldiv
tolower
iswctype
wcstombs
strstr
_strnicmp

kernel32

LoadLibraryW
IsWow64Process
SetLocaleInfoW
SetLocaleInfoA
PostQueuedCompletionStatus
EnumResourceNamesW
FormatMessageW
LoadLibraryExW
GetVersionExW
GetLongPathNameW
GetFullPathNameW
WinExec
OpenProcess
CreateProcessA
TerminateProcess
QueueUserWorkItem
CreateFileA
SizeofResource
WriteProcessMemory
ReadProcessMemory
DuplicateHandle
GetProcessId
GetUserDefaultLCID
GetSystemDefaultLCID
GetSystemDefaultLangID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SetThreadExecutionState
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetWindowsDirectoryW
HeapDestroy
HeapCreate
SetThreadPriority
GetExitCodeProcess
OpenEventW
DeleteCriticalSection
RaiseException
GlobalAddAtomW
UnmapViewOfFile
MapViewOfFileEx
GetThreadTimes
SleepEx
GetTickCount64
FindResourceA
FindResourceW
LockResource
LoadResource
GlobalLock
GlobalUnlock
GlobalSize
GetConsoleWindow
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleTitleA
AllocConsole
GetStartupInfoW
OpenThread
WaitForMultipleObjects
WideCharToMultiByte
GetSystemInfo
lstrcmpW
ReplaceFileW
MoveFileWithProgressW
MoveFileExW
GetPrivateProfileStringW
GetSystemWindowsDirectoryW
GetTickCount
QueueUserAPC
OpenMutexW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
GetFileSizeEx
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetEnvironmentVariableW
GetEnvironmentStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleA
ProcessIdToSessionId
GetCurrentProcessId
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
OutputDebugStringW
IsDebuggerPresent
GetModuleFileNameW
CreateProcessW
CreateThread
ExitProcess
SetEnvironmentVariableW
GetCommandLineW
LocalFree
LocalAlloc
GetSystemTimeAsFileTime
GetModuleHandleW
FreeLibrary
ExpandEnvironmentStringsW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualProtectEx
VirtualQueryEx
SetLastError
CreateFileW
ReadFile
SetFilePointerEx
CloseHandle
GetProcAddress
GlobalAlloc
GlobalFree
WaitForSingleObject
CreateEventW

Exports

Exports

SbieApi_Call
SbieApi_CheckInternetAccess
SbieApi_DisableForceProcess
SbieApi_EnumBoxes
SbieApi_EnumProcessEx
SbieApi_GetFileName
SbieApi_GetHomePath
SbieApi_GetMessage
SbieApi_GetUnmountHive
SbieApi_GetVersion
SbieApi_GetVersionEx
SbieApi_HookTramp
SbieApi_IsBoxEnabled
SbieApi_Log
SbieApi_LogEx
SbieApi_MonitorControl
SbieApi_MonitorGetEx
SbieApi_MonitorPut
SbieApi_MonitorPut2
SbieApi_OpenProcess
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieApi_QueryConfBool
SbieApi_QueryDrvInfo
SbieApi_QueryPathList
SbieApi_QueryProcess
SbieApi_QueryProcessEx
SbieApi_QueryProcessInfo
SbieApi_QueryProcessPath
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_SetUserName
SbieDll_AssocQueryCommand
SbieDll_AssocQueryProgram
SbieDll_CallServer
SbieDll_ComCreateProxy
SbieDll_ComCreateStub
SbieDll_DeviceChange
SbieDll_DisableElevationHook
SbieDll_ExpandAndRunProgram
SbieDll_FormatMessage
SbieDll_FormatMessage0
SbieDll_FormatMessage1
SbieDll_FormatMessage2
SbieDll_FreeMem
SbieDll_GetDrivePath
SbieDll_GetHandlePath
SbieDll_GetLanguage
SbieDll_GetServiceRegistryValue
SbieDll_GetStartError
SbieDll_GetTokenElevationType
SbieDll_GetUserPathEx
SbieDll_Hook
SbieDll_InitPStore
SbieDll_IsBoxedService
SbieDll_IsDirectory
SbieDll_IsOpenCOM
SbieDll_IsOpenClsid
SbieDll_KillAll
SbieDll_KillOne
SbieDll_Mount
SbieDll_PortName
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueueGetRpl
SbieDll_QueuePutReq
SbieDll_QueuePutRpl
SbieDll_RegisterDllCallback
SbieDll_RunFromHome
SbieDll_RunSandboxed
SbieDll_StartBoxedService
SbieDll_StartCOM
SbieDll_StartSbieSvc
SbieDll_TranslateNtToDosPath
SbieDll_Unmount
SbieDll_UpdateConf
Sbie_snprintf
Sbie_snwprintf
_File_GetName@20
_Key_GetName@20
_SbieApi_CheckInternetAccess@12
_SbieApi_DisableForceProcess@8
_SbieApi_EnumBoxes@8
_SbieApi_EnumBoxesEx@12
_SbieApi_EnumProcessEx@20
_SbieApi_GetBlockedDll@8
_SbieApi_GetFileName@16
_SbieApi_GetHomePath@16
_SbieApi_GetMessage@24
_SbieApi_GetUnmountHive@4
_SbieApi_GetVersion@4
_SbieApi_GetVersionEx@8
_SbieApi_HookTramp@8
_SbieApi_Ioctl@4
_SbieApi_IsBoxEnabled@4
_SbieApi_LogMsgEx@16
_SbieApi_LogMsgExt@12
_SbieApi_MonitorControl@8
_SbieApi_MonitorGetEx@16
_SbieApi_MonitorPut2@12
_SbieApi_MonitorPut2Ex@20
_SbieApi_MonitorPut@8
_SbieApi_MonitorPutMsg@8
_SbieApi_OpenProcess@8
_SbieApi_ProcessExemptionControl@16
_SbieApi_QueryBoxPath@28
_SbieApi_QueryConf@20
_SbieApi_QueryConfBool@12
_SbieApi_QueryConfNumber64@16
_SbieApi_QueryConfNumber@12
_SbieApi_QueryDrvInfo@12
_SbieApi_QueryPathList@20
_SbieApi_QueryProcess@20
_SbieApi_QueryProcessEx2@28
_SbieApi_QueryProcessEx@24
_SbieApi_QueryProcessInfo@8
_SbieApi_QueryProcessInfoEx@16
_SbieApi_QueryProcessInfoStr@16
_SbieApi_QueryProcessPath@28
_SbieApi_ReloadConf@8
_SbieApi_SessionLeader@8
_SbieApi_SetUserName@8
_SbieApi_vLogEx@16
_SbieDll_AssocQueryCommand@4
_SbieDll_AssocQueryProgram@4
_SbieDll_CallServer@4
_SbieDll_CallServerQueue@16
_SbieDll_CheckPatternInList@16
_SbieDll_CheckProcessLocalSystem@4
_SbieDll_CheckStringInList@12
_SbieDll_CheckStringInListA@12
_SbieDll_ComCreateProxy@16
_SbieDll_ComCreateStub@16
_SbieDll_DeviceChange@8
_SbieDll_DisableCHPE@0
_SbieDll_DisableElevationHook@0
_SbieDll_ExpandAndRunProgram@4
_SbieDll_FindArgumentEnd@4
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieDll_FormatMessage2@12
_SbieDll_FormatMessage@8
_SbieDll_FreeMem@4
_SbieDll_GetBorderColor@16
_SbieDll_GetDrivePath@4
_SbieDll_GetHandlePath@12
_SbieDll_GetLanguage@4
_SbieDll_GetPublicSD@0
_SbieDll_GetServiceRegistryValue@12
_SbieDll_GetSettingsForName@24
_SbieDll_GetSettingsForName_bool@16
_SbieDll_GetStartError@0
_SbieDll_GetStringForStringList@20
_SbieDll_GetStringsForStringList@24
_SbieDll_GetSysFunction@4
_SbieDll_GetTokenElevationType@0
_SbieDll_GetUserPathEx@4
_SbieDll_Hook@16
_SbieDll_HookInit@0
_SbieDll_InitPStore@0
_SbieDll_InjectLow@12
_SbieDll_InjectLow_InitHelper@0
_SbieDll_InjectLow_InitSyscalls@4
_SbieDll_InjectLow_SendHandle@4
_SbieDll_IsBoxedService@4
_SbieDll_IsDirectory@4
_SbieDll_IsDllSkipHook@4
_SbieDll_IsOpenCOM@0
_SbieDll_IsOpenClsid@12
_SbieDll_IsReservedFileName@4
_SbieDll_KillAll@8
_SbieDll_KillOne@4
_SbieDll_MatchImage@12
_SbieDll_MatchPathImpl@28
_SbieDll_Mount@12
_SbieDll_OpenProcess@8
_SbieDll_PortName@0
_SbieDll_QueryConf@20
_SbieDll_QueryFileAttributes@16
_SbieDll_QueueCreate@8
_SbieDll_QueueGetReq@24
_SbieDll_QueueGetRpl@16
_SbieDll_QueuePutReq@20
_SbieDll_QueuePutRpl@16
_SbieDll_RegisterDllCallback@4
_SbieDll_RunFromHome@16
_SbieDll_RunSandboxed@24
_SbieDll_RunStartExe@8
_SbieDll_SetFakeAdmin@4
_SbieDll_StartBoxedService@8
_SbieDll_StartCOM@4
_SbieDll_StartSbieSvc@4
_SbieDll_TraceModule@4
_SbieDll_TranslateNtToDosPath@4
_SbieDll_UnHookModule@4
_SbieDll_Unmount@4
_SbieDll_UpdateConf@20
_Scm_HookCloseServiceHandle@4
_Scm_HookControlService@4
_Scm_HookOpenServiceW@4
_Scm_HookQueryServiceStatus@4
_Scm_HookQueryServiceStatusEx@4
_Scm_HookSetServiceStatus@4
_Scm_HookStartServiceCtrlDispatcherW@4
_Scm_HookStartServiceW@4

Sections

.text
Size: 533KB - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
32/SbieSvc.exe
.exe windows:6 windows x86 arch:x86

6e1cb7cadf091cb4ef46fb9126d2ded2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:45:70:09:9c:7b:3f:5f:ac:44:f6:2a:e1:79:f9:05:e5:d7:27:ba:4c:fd:a8:32:df:d4:61:ed:fa:c6:6c:b8
Signer

Actual PE Digest

52:45:70:09:9c:7b:3f:5f:ac:44:f6:2a:e1:79:f9:05:e5:d7:27:ba:4c:fd:a8:32:df:d4:61:ed:fa:c6:6c:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\Win32\SbieRelease\SbieSvc.pdb

Imports

sbiedll

_SbieDll_FormatMessage0@4
_SbieDll_GetLanguage@4
_SbieApi_OpenProcess@8
_SbieDll_FindArgumentEnd@4
_SbieApi_ReloadConf@8
_SbieApi_SessionLeader@8
_SbieDll_CheckPatternInList@16
_SbieDll_CheckStringInList@12
_SbieApi_EnumBoxesEx@12
_SbieDll_GetPublicSD@0
_SbieApi_LogMsgExt@12
_SbieDll_DisableCHPE@0
_SbieDll_GetSettingsForName_bool@16
_SbieApi_CheckInternetAccess@12
_SbieDll_QueuePutRpl@16
_SbieDll_QueueGetReq@24
_SbieDll_QueueCreate@8
_SbieDll_FreeMem@4
SbieApi_Log
_SbieApi_QueryConfNumber64@16
_SbieApi_QueryConfNumber@12
_SbieApi_QueryPathList@20
_SbieApi_GetHomePath@16
_SbieDll_GetStringsForStringList@24
_SbieDll_GetStringForStringList@20
_SbieDll_InjectLow@12
_SbieDll_InjectLow_InitSyscalls@4
_SbieDll_InjectLow_InitHelper@0
_SbieDll_PortName@0
_SbieDll_FormatMessage2@12
_SbieDll_GetServiceRegistryValue@12
_SbieDll_TranslateNtToDosPath@4
_SbieDll_RunStartExe@8
_SbieApi_GetUnmountHive@4
_SbieApi_SetUserName@8
_SbieApi_QueryConfBool@12
_SbieApi_QueryConf@20
_SbieApi_EnumProcessEx@20
_SbieApi_QueryProcessPath@28
_SbieApi_QueryProcessInfo@8
_SbieApi_QueryProcessEx2@28
_SbieApi_GetMessage@24
_SbieApi_GetVersionEx@8
SbieApi_Call
_SbieDll_RunSandboxed@24
_SbieApi_IsBoxEnabled@4
_SbieDll_IsOpenClsid@12
_SbieDll_ComCreateStub@16
_SbieDll_RunFromHome@16
_SbieApi_QueryProcess@20
SbieApi_LogEx
_SbieDll_KillOne@4

ntdll

NtCreateFile
RtlSetDaclSecurityDescriptor
NtSetInformationFile
NtDuplicateObject
NtOpenProcess
RtlCreateVirtualAccountSid
NtLoadDriver
RtlInitUnicodeString
NtReplyWaitReceivePort
NtRequestPort
NtCreatePort
NtUnloadKey
NtOpenKey
NtClose
NtAcceptConnectPort
RtlUnwind
NtResumeProcess
NtSuspendProcess
NtGetNextThread
NtAdjustPrivilegesToken
NtReadVirtualMemory
NtQueryInformationThread
NtSetInformationProcess
NtOpenDirectoryObject
NtReadFile
NtCompleteConnectPort
NtImpersonateClientOfPort
NtRequestWaitReplyPort
NtConnectPort
RtlNtStatusToDosError
NtOpenFile
NtDeleteFile
NtQueryObject
NtFilterToken
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenProcessToken
NtSetInformationThread
NtAllocateVirtualMemory
RtlInitializeSid
RtlSubAuthoritySid
NtSetInformationToken
NtQueryInformationProcess
RtlCreateSecurityDescriptor
NtLoadKey
NtQuerySystemInformation
NtWriteFile

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStringTypeW
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
EncodePointer
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WaitForSingleObjectEx
LCMapStringW
CloseHandle
GetLastError
HeapCreate
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
OpenMutexW
CreateEventW
OpenEventW
Sleep
WaitForMultipleObjects
ExitProcess
TerminateProcess
CreateThread
GetCurrentThread
GetTickCount
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LocalFree
GetEnvironmentVariableW
SetCurrentDirectoryW
GetFullPathNameW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
WriteFile
SetLastError
DeviceIoControl
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
SetThreadPriority
TerminateThread
OpenProcess
GetLocalTime
GetVersionExW
VirtualAlloc
VirtualFree
LocalAlloc
GetSystemWindowsDirectoryW
DuplicateHandle
ResetEvent
QueueUserAPC
GetCurrentThreadId
OpenThread
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
TerminateJobObject
SetInformationJobObject
QueryInformationJobObject
GetModuleHandleW
GetProcAddress
LoadLibraryW
GlobalSize
RegisterWaitForSingleObject
UnregisterWait
AllocConsole
GetConsoleWindow
GetConsoleProcessList
GetFileSizeEx
OutputDebugStringW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineW
GetSystemInfo
GetFinalPathNameByHandleW
DefineDosDeviceW
GetLogicalDrives
GetCompressedFileSizeW
GetExitCodeProcess
CreateProcessW
CancelIo
TlsAlloc
TlsGetValue
TlsSetValue
SuspendThread
ResumeThread
WriteProcessMemory
IsWow64Process
GetModuleFileNameW
GetModuleHandleA
QueryFullProcessImageNameW
QueueUserWorkItem
DeleteFileW
GetFileAttributesW
ReadFile
SetEndOfFile
SetFileAttributesW
GetWindowsDirectoryW
CopyFileW
MultiByteToWideChar
WideCharToMultiByte
ReadProcessMemory
MulDiv
SetStdHandle
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
DeleteCriticalSection
WriteConsoleW

user32

GetMonitorInfoW
EndPaint
BeginPaint
ShowWindow
RegisterClassExW
PackDDElParam
GetRawInputDeviceInfoW
GetRawInputDeviceInfoA
UserHandleGrantAccess
GetWindowInfo
MonitorFromWindow
ChangeDisplaySettingsExW
ChangeDisplaySettingsExA
GetIconInfo
GetWindow
GetWindowThreadProcessId
GetClassNameW
GetClassNameA
EnumThreadWindows
EnumWindows
GetShellWindow
FindWindowExW
FindWindowExA
FindWindowW
FindWindowA
EnumChildWindows
GetParent
GetDesktopWindow
GetClassLongW
GetClassLongA
GetWindowLongW
GetWindowLongA
ClipCursor
MapWindowPoints
ScreenToClient
ClientToScreen
SetCursorPos
GetWindowRect
GetClientRect
GetPropW
GetPropA
SetPropW
ReleaseDC
GetDC
SetForegroundWindow
IsWindowEnabled
IsWindowUnicode
KillTimer
EnumClipboardFormats
GetClipboardData
GetClipboardSequenceNumber
IsZoomed
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
SendMessageW
wsprintfW
GetMessageW
DispatchMessageW
SetTimer
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
CreateDesktopW
SetThreadDesktop
GetThreadDesktop
CreateWindowStationW
SetProcessWindowStation
GetProcessWindowStation
SendMessageA
RegisterClassW
DefWindowProcW
PostMessageW
SendNotifyMessageA
SendMessageTimeoutW
SendNotifyMessageW
PostMessageA

advapi32

CreateProcessAsUserW
OpenThreadToken
DuplicateTokenEx
OpenProcessToken
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidW
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
LsaFreeMemory
LsaManageSidNameMapping
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetTokenInformation
SetSecurityInfo
ControlService
EnumServicesStatusExW
StartServiceW
OpenEventLogW
ReportEventW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RevertToSelf
SetThreadToken
AddAccessAllowedAce
DuplicateToken
EqualSid
GetLengthSid
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
EnumServicesStatusW
QueryServiceConfigW
QueryServiceConfig2W
AccessCheck
GetSecurityInfo

psapi

GetModuleBaseNameW
GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcessModules

ole32

CoSetProxyBlanket
CoInitializeEx
CoGetClassObject
CoMarshalInterface
CoUnmarshalInterface
CoInitializeSecurity
CoQueryProxyBlanket
CoInitialize
CoCopyProxy
StringFromGUID2
CoTaskMemFree
CoGetObject
CoRegisterClassObject
CoRevokeClassObject
CreateStreamOnHGlobal

crypt32

CryptProtectData
CryptUnprotectData

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

GetEnhMetaFileBits
SetBkColor
GetDeviceCaps
DeleteDC
CreateCompatibleDC
TextOutW
SetTextColor
GetMetaFileBitsEx
CreateFontW
SelectObject
GetDIBits
CreateSolidBrush

netapi32

NetUseAdd

wtsapi32

WTSQueryUserToken

rpcrt4

RpcBindingToStringBindingW
RpcMgmtEpEltInqBegin
UuidFromStringW
RpcStringFreeW
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqDone

bcrypt

BCryptHashData
BCryptCreateHash
BCryptVerifySignature
BCryptFinishHash
BCryptImportKeyPair
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptDestroyHash

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KmdUtil.exe
.exe windows:6 windows x64 arch:x64

e74127d0470ed67341494767b56b1a47

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:25:ac:de:45:13:88:fd:56:ed:39:df:e1:63:dc:ec:ad:23:79:1d:a8:61:4a:30:6b:7a:bd:c4:2d:b7:99:e3
Signer

Actual PE Digest

5e:25:ac:de:45:13:88:fd:56:ed:39:df:e1:63:dc:ec:ad:23:79:1d:a8:61:4a:30:6b:7a:bd:c4:2d:b7:99:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\KmdUtil.pdb

Imports

ntdll

NtUnloadDriver
RtlUnwindEx
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

sbiedll

Sbie_snwprintf
SbieApi_Ioctl
SbieApi_Call
SbieApi_GetVersion
SbieApi_QueryConf
SbieApi_GetHomePath
SbieApi_LogMsgEx
SbieApi_IsBoxEnabled

kernel32

GetModuleFileNameW
LoadLibraryW
LocalAlloc
FormatMessageW
CloseHandle
GetCurrentProcess
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
ExitProcess
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetFileType
GetStartupInfoW
FreeLibrary
GetModuleHandleExW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LoadLibraryExW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
RaiseException
CreateFileW
WriteConsoleW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
GetCommandLineW
LocalFree
QueryPerformanceCounter
InitializeSListHead
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
Sleep

user32

SendMessageW
RegisterClassW
GetMessageW
MessageBoxW
CreateWindowExW
PostMessageW
DefWindowProcW
GetWindowLongW
DestroyWindow
ShowWindow
SetFocus
GetFocus
GetWindowRect
SystemParametersInfoW
LoadIconW
LoadCursorW
GetWindow
GetParent
GetDesktopWindow
DispatchMessageW

gdi32

CreateFontIndirectW
GetStockObject

advapi32

AdjustTokenPrivileges
CopySid
GetAce
GetSecurityDescriptorDacl
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertSidToStringSidW
ConvertStringSidToSidW
RegCreateKeyExW
CloseServiceHandle
LookupPrivilegeValueW
RegDeleteKeyW
OpenProcessToken
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
RegSetValueExW
RegOpenKeyExW
RegCloseKey

shell32

CommandLineToArgvW

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LICENSE.TXT
Manifest0.txt
Manifest1.txt
.xml
Manifest2.txt
.xml
SandboxieBITS.exe
.exe windows:6 windows x64 arch:x64

638852d7c037bf7162e16ab0228390a1

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:d4:1d:e1:0f:4a:9e:be:f7:ec:81:23:5e:a9:73:54:e4:86:79:0a:d3:52:f0:cd:bb:24:3e:51:84:3e:da:f4
Signer

Actual PE Digest

00:d4:1d:e1:0f:4a:9e:be:f7:ec:81:23:5e:a9:73:54:e4:86:79:0a:d3:52:f0:cd:bb:24:3e:51:84:3e:da:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieBITS.pdb

Imports

advapi32

OpenProcessToken
DuplicateTokenEx
LogonUserW
StartServiceCtrlDispatcherW
SetThreadToken

kernel32

SetEnvironmentVariableW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
GetProcAddress
LoadLibraryW
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte

user32

wsprintfW
MessageBoxW

ole32

CoImpersonateClient

wtsapi32

WTSQueryUserToken

sbiedll

SbieDll_Hook

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieCrypto.exe
.exe windows:6 windows x64 arch:x64

d5475f378d32354f204d0d4edab1d0a7

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:a5:14:0b:db:35:44:2f:3a:1f:44:b3:94:f7:ae:cd:c2:08:a3:71:00:73:e0:be:1a:fa:50:c0:5f:87:a0:b1
Signer

Actual PE Digest

5d:a5:14:0b:db:35:44:2f:3a:1f:44:b3:94:f7:ae:cd:c2:08:a3:71:00:73:e0:be:1a:fa:50:c0:5f:87:a0:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieCrypto.pdb

Imports

sbiedll

Scm_HookSetServiceStatus
SbieDll_Hook

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry

kernel32

GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetEnvironmentVariableW
CreateFileW
CloseHandle
DuplicateHandle
GetLastError
SetLastError
HeapAlloc
GetProcessHeap
SetEvent
WaitForSingleObject
CreateMutexW
OpenMutexW
CreateEventW
OpenEventW
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
GetWindowsDirectoryW
GetVersionExW
GetModuleHandleW
GetProcAddress
LoadLibraryW
MultiByteToWideChar
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
HeapFree
InitializeSListHead
HeapReAlloc
HeapSize
SetFilePointerEx
LCMapStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCommandLineW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA

advapi32

GetTokenInformation
DuplicateToken
AccessCheckByType
OpenProcessToken
SetThreadToken
StartServiceCtrlDispatcherW

user32

MessageBoxW
wsprintfW

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieDcomLaunch.exe
.exe windows:6 windows x64 arch:x64

0db19bedabde32da20ac4effc284cd85

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:7d:25:cc:4c:a1:03:31:34:1f:72:48:f3:f3:e6:e0:67:7a:34:20:97:bc:67:c3:64:1f:a8:8d:df:04:1c:3e
Signer

Actual PE Digest

0e:7d:25:cc:4c:a1:03:31:34:1f:72:48:f3:f3:e6:e0:67:7a:34:20:97:bc:67:c3:64:1f:a8:8d:df:04:1c:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieDcomLaunch.pdb

Imports

sbiedll

SbieApi_EnumProcessEx
SbieDll_Hook
SbieDll_IsBoxedService
SbieDll_StartBoxedService
Scm_HookSetServiceStatus
Scm_HookStartServiceCtrlDispatcherW
Scm_HookOpenServiceW
Scm_HookStartServiceW
Scm_HookCloseServiceHandle
Scm_HookControlService
SbieApi_QueryProcess
Scm_HookQueryServiceStatus
Scm_HookQueryServiceStatusEx

kernel32

HeapReAlloc
HeapSize
SetFilePointerEx
LCMapStringW
SetEnvironmentVariableW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
FlushFileBuffers
WaitForSingleObject
CreateEventW
OpenEventW
GetCurrentProcessId
ExitProcess
CreateThread
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
OpenProcess
GetVersionExW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetConsoleOutputCP
GetConsoleMode
CreateFileW
WriteConsoleW
SetEvent
SetUnhandledExceptionFilter
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle

advapi32

QueryServiceStatusEx
GetTokenInformation
DuplicateToken
AccessCheckByType
OpenProcessToken
SetThreadToken
StartServiceCtrlDispatcherW

ntdll

NtOpenKey
RtlAdjustPrivilege
NtQueryValueKey
NtQueryInformationProcess
NtClose
RtlInitUnicodeString

user32

wsprintfW
MessageBoxW

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieRpcSs.exe
.exe windows:6 windows x64 arch:x64

312e30bdd2621c0ef2c6e2aa693e291b

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:73:bc:e6:37:30:56:72:46:f4:61:49:c5:f7:a3:fd:72:5e:61:d7:4b:29:71:e7:fd:3d:3a:17:15:05:fd:6e
Signer

Actual PE Digest

62:73:bc:e6:37:30:56:72:46:f4:61:49:c5:f7:a3:fd:72:5e:61:d7:4b:29:71:e7:fd:3d:3a:17:15:05:fd:6e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieRpcSs.pdb

Imports

sbiedll

SbieDll_QueuePutRpl
SbieDll_QueueGetReq
SbieDll_QueueCreate
SbieDll_FreeMem
SbieApi_Log
Scm_HookControlService
Scm_HookStartServiceW
Scm_HookQueryServiceStatus
Scm_HookQueryServiceStatusEx
Scm_HookCloseServiceHandle
Scm_HookOpenServiceW
Scm_HookStartServiceCtrlDispatcherW
Scm_HookSetServiceStatus
SbieDll_IsDllSkipHook
SbieDll_IsBoxedService
SbieDll_IsOpenCOM
SbieDll_CallServer
SbieDll_Hook
SbieDll_ExpandAndRunProgram
SbieDll_StartBoxedService
SbieDll_KillAll
SbieApi_QueryConfBool
SbieApi_QueryConf
SbieApi_EnumProcessEx
SbieApi_QueryProcess
SbieApi_QueryProcessInfo

ws2_32

listen
bind
gethostbyname
gethostname
WSAStartup
WSASetLastError
WSASocketW

advapi32

StartServiceCtrlDispatcherW
QueryServiceStatusEx
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
DuplicateToken
AccessCheckByType
OpenThreadToken
OpenProcessToken
SetThreadToken

kernel32

FindClose
GetFileType
GetModuleHandleExW
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
WriteFile
GetStdHandle
RtlPcToFileHeader
RaiseException
FindFirstFileExW
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
EncodePointer
GetModuleHandleW
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
GetProcessTimes
ExitProcess
CreateThread
OpenProcess
GetSystemTimeAsFileTime
RegisterWaitForSingleObject
UnregisterWait
SetEnvironmentVariableW
GetLastError
SetLastError
CreateMutexW
OpenMutexW
OpenEventW
GetCurrentProcessId
GetCurrentThreadId
SetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
GetVersionExW
CreateFileMappingW
GetProcAddress
LoadLibraryW
Sleep
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
SetFilePointerEx
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
QueryPerformanceCounter
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
GetEnvironmentStringsW

ntdll

RtlInitUnicodeString
NtQueryValueKey
RtlAdjustPrivilege
NtYieldExecution
NtUnmapViewOfSection
NtMapViewOfSection
NtOpenKey
NtClose

user32

MessageBoxW
wsprintfW
GetWindowThreadProcessId
EnumWindows
GetWindowLongW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
GetMessageW

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SandboxieWUAU.exe
.exe windows:6 windows x64 arch:x64

56493b98a1e53add4f09af2e5ead93ec

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:d6:fb:e6:0f:7f:56:52:ab:80:81:73:36:18:73:94:8b:25:37:45:c9:09:95:b9:5e:27:bc:ce:32:12:50:24
Signer

Actual PE Digest

a0:d6:fb:e6:0f:7f:56:52:ab:80:81:73:36:18:73:94:8b:25:37:45:c9:09:95:b9:5e:27:bc:ce:32:12:50:24

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieWUAU.pdb

Imports

sbiedll

SbieDll_Hook
SbieApi_EnumProcessEx
SbieApi_QueryProcess

ntdll

RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry

kernel32

FlsSetValue
FlsGetValue
FlsAlloc
FlsFree
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleOutputCP
GetStringTypeW
EnterCriticalSection
FlushFileBuffers
HeapReAlloc
HeapSize
HeapFree
SetLastError
GetCurrentThreadId
GetVersionExW
GetLastError
CloseHandle
LoadLibraryW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
SetFilePointerEx
LCMapStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieCtrl.exe
.exe windows:6 windows x64 arch:x64

6ce98a41349a1ffa8aad92af3b0577c5

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:33:1d:7e:62:a8:d8:ed:9d:5d:23:05:ab:a6:97:e1:56:f1:49:53:8a:de:b0:49:7b:31:f7:5e:0f:26:a7:30
Signer

Actual PE Digest

31:33:1d:7e:62:a8:d8:ed:9d:5d:23:05:ab:a6:97:e1:56:f1:49:53:8a:de:b0:49:7b:31:f7:5e:0f:26:a7:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieCtrl.pdb

Imports

sbiedll

SbieDll_UpdateConf
SbieDll_GetTokenElevationType
SbieDll_KillOne
SbieDll_DeviceChange
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_MonitorGetEx
SbieApi_MonitorControl
SbieApi_ProcessExemptionControl
SbieApi_GetMessage
SbieDll_FreeMem
SbieDll_CallServer
SbieDll_GetStartError
SbieDll_StartSbieSvc
SbieApi_GetVersionEx
SbieDll_IsReservedFileName
SbieApi_EnumProcessEx
SbieApi_QueryProcessInfo
SbieApi_QueryProcessEx
SbieDll_TranslateNtToDosPath
SbieDll_GetUserPathEx
SbieDll_GetDrivePath
SbieDll_QueryFileAttributes
SbieApi_QueryConfBool
SbieApi_QueryConf
SbieApi_GetFileName
SbieApi_QueryBoxPath
SbieDll_KillAll
SbieApi_IsBoxEnabled
SbieApi_EnumBoxesEx
SbieDll_GetBorderColor
SbieApi_DisableForceProcess
SbieApi_Log
SbieApi_GetHomePath
SbieApi_Call
SbieDll_RunFromHome
SbieDll_GetLanguage
SbieDll_FormatMessage2
SbieDll_FormatMessage1
SbieDll_FormatMessage0
SbieDll_FormatMessage

ntdll

RtlUnwindEx
VerSetConditionMask
NtOpenKey
NtQueryDirectoryObject
NtOpenDirectoryObject
NtClose
RtlInitUnicodeString
NtQueryDirectoryFile
NtCreateFile
RtlPcToFileHeader

psapi

GetModuleFileNameExW

winhttp

WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest
WinHttpSetOption
WinHttpConnect

kernel32

GetUserDefaultUILanguage
FindResourceExW
GetCurrentDirectoryW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
GetCurrentProcess
lstrcmpiW
lstrcpyW
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
VerifyVersionInfoW
GetProfileIntW
SearchPathW
GetTempFileNameW
GetStringTypeW
InitializeCriticalSectionEx
GetCPInfo
FileTimeToSystemTime
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemDefaultUILanguage
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
LoadResource
LockResource
SizeofResource
FindResourceW
DecodePointer
RaiseException
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LocalFree
CloseHandle
LocalAlloc
FormatMessageW
GlobalAlloc
GlobalFree
CreateFileW
WriteFile
GetTempPathW
GlobalUnlock
GlobalLock
GetLocaleInfoW
GlobalFlags
QueryPerformanceCounter
OutputDebugStringW
ExitProcess
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
HeapQueryInformation
GetSystemInfo
VirtualAlloc
VirtualQuery
QueryPerformanceFrequency
SetStdHandle
GetFileType
GetStdHandle
FlsAlloc
FlsGetValue
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentThread
GlobalGetAtomNameW
lstrcmpA
ResumeThread
SuspendThread
SetThreadPriority
SetEvent
VirtualProtect
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleExW
GetSystemDirectoryW
EncodePointer
OutputDebugStringA
SetLastError
OpenProcess
GetProcessTimes
LCIDToLocaleName
GetModuleHandleA
WaitForMultipleObjects
CreateEventW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DeleteFileW
GetDriveTypeW
CreateThread
ExpandEnvironmentStringsW
MoveFileW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
FreeLibrary
GetModuleFileNameW
GetSystemTimeAsFileTime
OpenEventW
WaitForSingleObject
ProcessIdToSessionId
OpenMutexW
CreateMutexW
FlsSetValue
FlsFree
LCMapStringW
GetShortPathNameW
SetCurrentDirectoryW
GetCommandLineW
WideCharToMultiByte
GetTickCount
GetFileAttributesW
GetSystemWindowsDirectoryW
GetVersionExW
GetModuleHandleW
GetCurrentProcessId
GlobalSize
ReadFile
GetFileSizeEx
Sleep
MulDiv
GetWindowsDirectoryW
GetFileTime
MultiByteToWideChar
LoadLibraryW
GetProcAddress
GetCurrentThreadId
ResetEvent

user32

GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
CharUpperBuffW
GetDoubleClickTime
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetComboBoxInfo
UpdateLayeredWindow
DrawIcon
FrameRect
CopyIcon
SetCursorPos
IsZoomed
DrawFrameControl
DrawEdge
EnumDisplayMonitors
NotifyWinEvent
HideCaret
EnableScrollBar
MessageBeep
DrawFocusRect
GetNextDlgGroupItem
LockWindowUpdate
GetMenuDefaultItem
TrackMouseEvent
CharUpperW
SetParent
GetSystemMenu
UnionRect
SendDlgItemMessageA
CopyImage
RealChildWindowFromPoint
ShowOwnedPopups
ReuseDDElParam
UnpackDDElParam
SetRectEmpty
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
DestroyMenu
MapVirtualKeyW
GetKeyNameTextW
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
SendDlgItemMessageW
CheckDlgButton
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
WinHelpW
GetScrollInfo
SetScrollInfo
GetTopWindow
GetClassLongPtrW
EqualRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetDlgItem
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetMessageTime
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetLastActivePopup
IsWindowEnabled
IntersectRect
InflateRect
FillRect
RemoveMenu
GetMenuState
GetMenuStringW
EnumWindows
GetSysColorBrush
IsWindow
GetIconInfo
CreateIconIndirect
LoadImageW
MonitorFromRect
MonitorFromPoint
SetMenuDefaultItem
ModifyMenuW
AppendMenuW
InsertMenuW
GetMenuItemID
CreatePopupMenu
SetFocus
PostQuitMessage
LoadMenuW
GetActiveWindow
RegisterWindowMessageW
wsprintfW
IsRectEmpty
TabbedTextOutW
GrayStringW
DrawTextExW
SystemParametersInfoW
DrawStateW
DrawTextW
GetMenuItemRect
SetMenuItemInfoW
GetMenuItemInfoW
DeleteMenu
GetMenuItemCount
IsMenu
GetMessagePos
GetMessageW
DrawIconEx
FindWindowExW
SetForegroundWindow
GetDlgCtrlID
IsIconic
InvalidateRect
DestroyCursor
LoadBitmapW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnumChildWindows
PtInRect
OffsetRect
SetRect
InvertRect
SetCursor
GetWindowDC
ReleaseCapture
SetCapture
CallWindowProcW
DestroyIcon
ClientToScreen
GetSubMenu
EnableMenuItem
GetKeyState
GetFocus
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
GetWindow
RegisterClipboardFormatW
GetTitleBarInfo
GetMonitorInfoW
MonitorFromWindow
LoadIconW
GetWindowThreadProcessId
FindWindowW
SetClassLongPtrW
WindowFromPoint
GetCursorPos
SetWindowRgn
GetForegroundWindow
GetSystemMetrics
SetWindowPos
SetLayeredWindowAttributes
DestroyWindow
EnumThreadWindows
FlashWindowEx
CopyRect
GetSysColor
EndPaint
BeginPaint
KillTimer
SetTimer
ScreenToClient
GetClipboardData
CloseClipboard
OpenClipboard
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
UpdateWindow
MoveWindow
ShowWindow
CreateWindowExW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
TranslateMessage
UnregisterClassW
LoadCursorW
GetClassNameW
GetParent
GetDesktopWindow
GetWindowRect
GetClientRect
EnableWindow
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
ReleaseDC
GetDC
ValidateRect

gdi32

CreateBitmap
CreateHatchBrush
ExcludeClipRect
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
SetRectRgn
DPtoLP
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateDCW
StretchBlt
CreateDIBSection
SetDIBColorTable
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
GetRgnBox
OffsetRgn
ExtTextOutW
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CopyMetaFileW
CreatePatternBrush
TextOutW
GetDeviceCaps
GetStockObject
GetTextExtentPoint32W
PatBlt
SelectObject
GetTextMetricsW
DeleteDC
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetBkColor
GetTextColor
CreateSolidBrush
DeleteObject
CreatePolygonRgn
CreateFontIndirectW
SetPixel
GetObjectW
CombineRgn
CreateEllipticRgn
CreateRectRgn
Ellipse
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
GetPixel
Rectangle
CreatePen
Escape
GetClipBox
GetCurrentObject
PtVisible
RectVisible
RoundRect
SetTextColor
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetObjectType

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetOpenFileNameW
ChooseColorW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

EnumServicesStatusW
OpenEventLogW
ReadEventLogW
GetUserNameW
RegCloseKey
RegEnumValueW
RegOpenKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueW
RegEnumKeyW
OpenSCManagerW
CloseEventLog
CloseServiceHandle
RegNotifyChangeKeyValue
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteExW
Shell_NotifyIconW
DragQueryFileW
DragAcceptFiles
ord165
SHGetFolderPathW
ExtractIconExW
DragFinish
SHGetSpecialFolderLocation
SHFileOperationW
SHAppBarMessage
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comctl32

_TrackMouseEvent
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Remove
ImageList_GetIconSize
ImageList_GetImageInfo

shlwapi

PathFindExtensionW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
PathIsUNCW
PathFindFileNameW
UrlEscapeW
PathFileExistsW

uxtheme

CloseThemeData
OpenThemeData
DrawThemeBackground
GetThemeSysColor
GetWindowTheme
GetCurrentThemeName
GetThemeColor
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
DrawThemeText
DrawThemeParentBackground

ole32

OleDuplicateData
ReleaseStgMedium
CoUninitialize
CoCreateGuid
CoDisconnectObject
CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
CoTaskMemAlloc
CoInitialize
CoCreateInstance
GetRunningObjectTable
CreateClassMoniker
OleSetContainedObject
OleCreate
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoTaskMemFree

oleaut32

VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantClear
VariantInit
SysAllocString

gdiplus

GdiplusShutdown
GdipAlloc
GdipFree
GdipLoadImageFromStream
GdipCloneImage
GdipImageGetFrameDimensionsList
GdipGetImageHeight
GdipDisposeImage
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHBITMAPFromBitmap
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdiplusStartup
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize

ws2_32

ntohl

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 678KB - Virtual size: 678KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieCtrl.exe.sig
SbieDll.dll
.dll windows:6 windows x64 arch:x64

a61d116fd856ef74efe05cf35aeef3cc

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:2d:6a:8e:bd:61:04:40:84:9b:d6:b6:6e:c8:20:ea:2a:4f:7e:e7:03:31:e2:a6:cc:99:83:6e:de:a3:26:87
Signer

Actual PE Digest

13:2d:6a:8e:bd:61:04:40:84:9b:d6:b6:6e:c8:20:ea:2a:4f:7e:e7:03:31:e2:a6:cc:99:83:6e:de:a3:26:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDll.pdb

Imports

ntdll

RtlRestoreContext
NtSetInformationJobObject
RtlCaptureContext
NtAssignProcessToJobObject
NtOpenJobObject
NtCreateJobObject
NtUnmapViewOfSection
NtMapViewOfSection
RtlEqualSid
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
NtAdjustPrivilegesToken
NtFilterToken
NtDuplicateObject
NtSetInformationToken
NtOpenThread
NtOpenProcess
RtlConvertSidToUnicodeString
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtSetSecurityObject
NtQuerySecurityObject
RtlNtStatusToDosError
NtProtectVirtualMemory
NtLoadDriver
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrUnloadDll
LdrLoadDll
NtYieldExecution
NtNotifyChangeMultipleKeys
NtNotifyChangeKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtSaveKey
NtLoadKey2
NtLoadKey
NtDeleteKey
NtSetInformationKey
NtQueryKey
NtImpersonateAnonymousToken
NtImpersonateThread
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenSection
NtCreateSection
NtOpenSemaphore
NtCreateSemaphore
NtOpenMutant
NtCreateMutant
NtOpenEvent
NtCreateEvent
NtCreateSymbolicLinkObject
NtImpersonateClientOfPort
NtSecureConnectPort
NtCreatePort
NtQueryDirectoryObject
NtCreateDirectoryObject
RtlUnicodeStringToAnsiString
NtOpenProcessToken
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
NtQueryInformationProcess
NtSetInformationThread
RtlSetThreadErrorMode
RtlGetFullPathName_U
RtlSetCurrentDirectory_U
RtlGetCurrentDirectory_U
NtNotifyChangeDirectoryFile
NtWaitForSingleObject
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlCompareUnicodeString
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
NtDeviceIoControlFile
NtWriteFile
NtReadFile
NtDeleteFile
NtSetInformationFile
NtQueryFullAttributesFile
NtQueryAttributesFile
NtQueryInformationFile
NtQueryDirectoryFile
NtOpenFile
NtCreateFile
NtOpenDirectoryObject
NtQueryObject
NtSetInformationProcess
NtAllocateVirtualMemory
LdrGetProcedureAddress
NtDeleteValueKey
NtSetValueKey
NtEnumerateKey
NtCreateKey
NtOpenKey
NtQueryValueKey
RtlInitUnicodeString
NtRequestWaitReplyPort
NtRegisterThreadTerminatePort
NtConnectPort
NtClose
NtQueryVirtualMemory
NtReadVirtualMemory
_strlwr
__C_specific_handler
memcpy
memset
_wcsicmp
__chkstk
_wcsnicmp
towlower
wcsstr
wcschr
_itow
memmove
wcscpy_s
wcsncpy
_wcslwr
wcstol
_wtoi
wcsncmp
memcmp
wcstoul
wcsrchr
_ultow
_wtoi64
strchr
strncmp
wcsncpy_s
tolower
wcstombs
iswctype
strstr
_strnicmp

kernel32

FreeLibrary
SetLocaleInfoW
SetLocaleInfoA
PostQueuedCompletionStatus
EnumResourceNamesW
FormatMessageW
LoadLibraryExW
GetVersionExW
GetLongPathNameW
GetFullPathNameW
WinExec
OpenProcess
CreateProcessA
TerminateProcess
QueueUserWorkItem
CreateFileA
SizeofResource
WriteProcessMemory
ReadProcessMemory
VirtualAllocEx
DuplicateHandle
GetProcessId
GetUserDefaultLCID
GetSystemDefaultLCID
GetSystemDefaultLangID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SetThreadExecutionState
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetWindowsDirectoryW
HeapDestroy
HeapCreate
SetThreadPriority
GetExitCodeProcess
OpenEventW
DeleteCriticalSection
RaiseException
GlobalAddAtomW
UnmapViewOfFile
MapViewOfFileEx
GetThreadTimes
SleepEx
GetTickCount64
FindResourceA
FindResourceW
LockResource
LoadResource
GlobalLock
GlobalUnlock
GlobalSize
GetConsoleWindow
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleTitleA
AllocConsole
GetStartupInfoW
OpenThread
WaitForMultipleObjects
WideCharToMultiByte
GetSystemInfo
lstrcmpW
GetSystemWindowsDirectoryW
ReplaceFileW
MoveFileWithProgressW
MoveFileExW
GetPrivateProfileStringW
GetTickCount
QueueUserAPC
OpenMutexW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
GetFileSizeEx
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetEnvironmentVariableW
GetEnvironmentStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleHandleA
ProcessIdToSessionId
GetCurrentProcessId
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
OutputDebugStringW
IsDebuggerPresent
GetModuleFileNameW
CreateProcessW
CreateThread
ExitProcess
SetEnvironmentVariableW
GetCommandLineW
LocalFree
LocalAlloc
GetSystemTimeAsFileTime
LoadLibraryW
GetModuleHandleW
ExpandEnvironmentStringsW
CreateEventW
WaitForSingleObject
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualProtectEx
VirtualQueryEx
SetLastError
CreateFileW
ReadFile
SetFilePointerEx
CloseHandle
GetProcAddress
GlobalAlloc
GlobalFree

Exports

Exports

File_GetName
Key_GetName
SbieApi_Call
SbieApi_CheckInternetAccess
SbieApi_DisableForceProcess
SbieApi_EnumBoxes
SbieApi_EnumBoxesEx
SbieApi_EnumProcessEx
SbieApi_GetBlockedDll
SbieApi_GetFileName
SbieApi_GetHomePath
SbieApi_GetMessage
SbieApi_GetUnmountHive
SbieApi_GetVersion
SbieApi_GetVersionEx
SbieApi_HookTramp
SbieApi_Ioctl
SbieApi_IsBoxEnabled
SbieApi_Log
SbieApi_LogEx
SbieApi_LogMsgEx
SbieApi_LogMsgExt
SbieApi_MonitorControl
SbieApi_MonitorGetEx
SbieApi_MonitorPut
SbieApi_MonitorPut2
SbieApi_MonitorPut2Ex
SbieApi_MonitorPutMsg
SbieApi_OpenProcess
SbieApi_ProcessExemptionControl
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieApi_QueryConfBool
SbieApi_QueryConfNumber
SbieApi_QueryConfNumber64
SbieApi_QueryDrvInfo
SbieApi_QueryPathList
SbieApi_QueryProcess
SbieApi_QueryProcessEx
SbieApi_QueryProcessEx2
SbieApi_QueryProcessInfo
SbieApi_QueryProcessInfoEx
SbieApi_QueryProcessInfoStr
SbieApi_QueryProcessPath
SbieApi_ReloadConf
SbieApi_SessionLeader
SbieApi_SetUserName
SbieApi_vLogEx
SbieDll_AssocQueryCommand
SbieDll_AssocQueryProgram
SbieDll_CallServer
SbieDll_CallServerQueue
SbieDll_CheckPatternInList
SbieDll_CheckProcessLocalSystem
SbieDll_CheckStringInList
SbieDll_CheckStringInListA
SbieDll_ComCreateProxy
SbieDll_ComCreateStub
SbieDll_DeviceChange
SbieDll_DisableCHPE
SbieDll_DisableElevationHook
SbieDll_ExpandAndRunProgram
SbieDll_FindArgumentEnd
SbieDll_FormatMessage
SbieDll_FormatMessage0
SbieDll_FormatMessage1
SbieDll_FormatMessage2
SbieDll_FreeMem
SbieDll_GetBorderColor
SbieDll_GetDrivePath
SbieDll_GetHandlePath
SbieDll_GetLanguage
SbieDll_GetPublicSD
SbieDll_GetServiceRegistryValue
SbieDll_GetSettingsForName
SbieDll_GetSettingsForName_bool
SbieDll_GetStartError
SbieDll_GetStringForStringList
SbieDll_GetStringsForStringList
SbieDll_GetSysFunction
SbieDll_GetTokenElevationType
SbieDll_GetUserPathEx
SbieDll_Hook
SbieDll_HookInit
SbieDll_InitPStore
SbieDll_InjectLow
SbieDll_InjectLow_InitHelper
SbieDll_InjectLow_InitSyscalls
SbieDll_InjectLow_SendHandle
SbieDll_IsBoxedService
SbieDll_IsDirectory
SbieDll_IsDllSkipHook
SbieDll_IsOpenCOM
SbieDll_IsOpenClsid
SbieDll_IsReservedFileName
SbieDll_KillAll
SbieDll_KillOne
SbieDll_MatchImage
SbieDll_MatchPathImpl
SbieDll_Mount
SbieDll_OpenProcess
SbieDll_PortName
SbieDll_QueryConf
SbieDll_QueryFileAttributes
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueueGetRpl
SbieDll_QueuePutReq
SbieDll_QueuePutRpl
SbieDll_RegisterDllCallback
SbieDll_RunFromHome
SbieDll_RunSandboxed
SbieDll_RunStartExe
SbieDll_SetFakeAdmin
SbieDll_StartBoxedService
SbieDll_StartCOM
SbieDll_StartSbieSvc
SbieDll_TraceModule
SbieDll_TranslateNtToDosPath
SbieDll_UnHookModule
SbieDll_Unmount
SbieDll_UpdateConf
Sbie_snprintf
Sbie_snwprintf
Scm_HookCloseServiceHandle
Scm_HookControlService
Scm_HookOpenServiceW
Scm_HookQueryServiceStatus
Scm_HookQueryServiceStatusEx
Scm_HookSetServiceStatus
Scm_HookStartServiceCtrlDispatcherW
Scm_HookStartServiceW

Sections

.text
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieDrv.sys
.sys windows:10 windows x64 arch:x64

6731eb8604e84ccc40abd577f14854ed

Code Sign

33:00:00:00:68:64:82:c2:f9:11:1a:c8:76:00:00:00:00:00:68
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-01-2024 20:09

Not After

10-01-2025 20:09

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-10-2014 20:31

Not After

15-10-2029 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:e1:ff:ce:8e:57:db:eb:b7:2a:d6:d0:83:c4:ce:74:7c:15:d7:68:fe:97:e9:de:3e:f1:80:93:51:77:7a:9c
Signer

Actual PE Digest

26:e1:ff:ce:8e:57:db:eb:b7:2a:d6:d0:83:c4:ce:74:7c:15:d7:68:fe:97:e9:de:3e:f1:80:93:51:77:7a:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDrv.pdb

Imports

ntoskrnl.exe

KeSetEvent
KeWaitForSingleObject
IoGetCurrentProcess
RtlConvertSidToUnicodeString
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
ZwCreateFile
ZwQueryInformationFile
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
wcsrchr
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlGetVersion
KeDelayExecutionThread
PsGetVersion
ZwOpenKey
ZwQueryValueKey
RtlCreateAcl
RtlAddAce
RtlAddAccessAllowedAceEx
RtlSetSaclSecurityDescriptor
DbgPrint
ZwSetInformationFile
ZwWriteFile
IoCreateFileSpecifyDeviceObjectHint
NtClose
ObOpenObjectByPointer
IoFileObjectType
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
PsGetProcessWin32WindowStation
ExWindowStationObjectType
MmProbeAndLockPages
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoIs32bitProcess
ZwWaitForSingleObject
ZwUnloadKey
wcsncpy_s
_wcslwr
KeBugCheckEx
ExInitializeResourceLite
ExDeleteResourceLite
IoCreateFile
ZwReadFile
wcstoul
_wtoi
KeEnterCriticalRegion
KeLeaveCriticalRegion
ZwCreateDirectoryObject
SeSinglePrivilegeCheck
PsGetCurrentThreadId
PsGetProcessId
ZwDuplicateObject
ZwOpenDirectoryObject
ZwSetSecurityObject
ZwCreateSymbolicLinkObject
wcscmp
PsProcessType
PsLookupProcessByProcessId
ObReferenceObjectByName
ZwQueryDirectoryObject
wcsstr
CmUnRegisterCallback
LpcPortObjectType
ZwCreateKey
ZwSetValueKey
ObQueryNameString
KeInitializeEvent
ZwSetInformationToken
ZwLoadKey
ObOpenObjectByName
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
PsGetThreadProcessId
PsGetThreadProcess
PsThreadType
RtlInt64ToUnicodeString
PsSetCreateProcessNotifyRoutineEx
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessCreateTimeQuadPart
PsSetThreadHardErrorsAreDisabled
_ultow_s
ZwTerminateProcess
SeQuerySessionIdToken
PsDereferenceImpersonationToken
PsReferenceImpersonationToken
PsGetProcessSessionId
SeTokenObjectType
KeStackAttachProcess
KeUnstackDetachProcess
PsGetProcessPeb
ZwOpenProcess
RtlLengthSid
ZwQueryInformationProcess
PsCreateSystemThread
PsTerminateSystemThread
PsGetProcessJob
SeTokenIsAdmin
ZwQueryInformationToken
MmIsAddressValid
NtDeviceIoControlFile
PsImpersonateClient
ZwQuerySystemInformation
strcmp
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsGetThreadId
SeTokenType
ZwDuplicateToken
ZwOpenThreadToken
ZwOpenProcessToken
SeTokenImpersonationLevel
PsGetProcessExitProcessCalled
ZwDeviceIoControlFile
RtlEqualSid
RtlSubAuthoritySid
RtlAddAccessAllowedAce
ZwSetInformationProcess
_stricmp
RtlQueryRegistryValues
RtlWalkFrameChain
PsGetProcessImageFileName
PsIsProtectedProcess
strchr
RtlUnicodeToUTF8N
RtlTimeFieldsToTime
ExSystemTimeToLocalTime
SeLocateProcessImageName
_wtol
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlUnicodeToMultiByteN
__C_specific_handler
LpcRequestPort
SeFilterToken
PsGetCurrentProcessId
ObfDereferenceObject
ObfReferenceObject
ObReferenceObjectByHandle
IoDeleteDevice
IoCreateDevice
towlower
_itow
ZwYieldExecution
ExAcquireResourceSharedLite
RtlUnicodeStringToInteger
_wcsnicmp
_wcsicmp
RtlFreeUnicodeString
RtlCompareUnicodeString
ZwOpenProcessTokenEx
wcschr
IofCompleteRequest
ExGetPreviousMode
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ProbeForWrite
ExRaiseStatus
ProbeForRead
ExFreePoolWithTag
ExAllocatePoolWithTag
KeGetCurrentIrql
RtlInitUnicodeString
wcsncpy
MmGetSystemRoutineAddress
wcsncmp
RtlAnsiCharToUnicodeChar

hal

KeQueryPerformanceCounter

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation

ksecdd.sys

BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptVerifySignature
BCryptDestroyKey
BCryptImportKeyPair
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider

fwpkclnt.sys

FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsCalloutUnregisterById0
FwpsCalloutRegister1
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmSubLayerAdd0
FwpmCalloutAdd0
FwpmBfeStateGet0
FwpmFilterAdd0

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INITDATA
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieIni.exe
.exe windows:6 windows x64 arch:x64

c6b4c0a653d9af9924d9046d8c1e0bad

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:7e:10:72:1f:ef:31:c5:50:1b:8b:7f:24:95:78:5e:ca:1d:1c:9b:4f:1a:94:96:be:94:09:64:52:fe:33:45
Signer

Actual PE Digest

70:7e:10:72:1f:ef:31:c5:50:1b:8b:7f:24:95:78:5e:ca:1d:1c:9b:4f:1a:94:96:be:94:09:64:52:fe:33:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieIni.pdb

Imports

sbiedll

SbieDll_UpdateConf
SbieApi_QueryConf
SbieDll_TranslateNtToDosPath
SbieApi_EnumBoxesEx
SbieApi_IsBoxEnabled

kernel32

GetCommandLineA
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
GetCommandLineW
HeapAlloc
GetProcessHeap
ExitProcess
GetFileSizeEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileType
CreateFileW
CloseHandle
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieMsg.dll
.dll windows:6 windows x64 arch:x64

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:f7:fb:40:5c:82:d9:66:ff:6b:05:0a:98:18:f9:8b:74:ab:4b:68:1c:8f:de:58:3b:a6:5b:8b:2c:3c:d0:6c
Signer

Actual PE Digest

3b:f7:fb:40:5c:82:d9:66:ff:6b:05:0a:98:18:f9:8b:74:ab:4b:68:1c:8f:de:58:3b:a6:5b:8b:2c:3c:d0:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieMsg.pdb

Sections

.rdata
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SbieSvc.exe
.exe windows:6 windows x64 arch:x64

19ebe835a45909554b656ae2debb82b9

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:f9:95:d6:36:29:1b:9a:be:7d:4a:cc:58:61:86:3c:ad:32:10:ec:81:1d:08:bf:55:d7:1e:c4:e1:00:2f:b6
Signer

Actual PE Digest

be:f9:95:d6:36:29:1b:9a:be:7d:4a:cc:58:61:86:3c:ad:32:10:ec:81:1d:08:bf:55:d7:1e:c4:e1:00:2f:b6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieSvc.pdb

Imports

sbiedll

SbieApi_EnumProcessEx
SbieApi_QueryProcessPath
SbieApi_QueryProcessInfo
SbieApi_QueryProcessEx2
SbieApi_GetMessage
SbieApi_GetVersionEx
SbieApi_Call
SbieDll_RunSandboxed
SbieApi_IsBoxEnabled
SbieDll_IsOpenClsid
SbieDll_ComCreateStub
SbieDll_RunFromHome
SbieApi_QueryConfBool
SbieApi_SetUserName
SbieApi_GetUnmountHive
SbieDll_RunStartExe
SbieDll_TranslateNtToDosPath
SbieApi_QueryProcess
SbieDll_FormatMessage2
SbieDll_PortName
SbieDll_InjectLow_InitHelper
SbieDll_InjectLow_InitSyscalls
SbieDll_InjectLow
SbieDll_GetStringForStringList
SbieDll_GetStringsForStringList
SbieApi_GetHomePath
SbieApi_QueryPathList
SbieApi_QueryConfNumber
SbieApi_QueryConfNumber64
SbieDll_KillOne
SbieDll_FreeMem
SbieDll_QueueCreate
SbieDll_QueueGetReq
SbieDll_QueuePutRpl
SbieApi_CheckInternetAccess
SbieDll_GetSettingsForName_bool
SbieDll_DisableCHPE
SbieApi_LogMsgExt
SbieDll_GetPublicSD
SbieApi_EnumBoxesEx
SbieDll_CheckStringInList
SbieDll_CheckPatternInList
SbieApi_SessionLeader
SbieApi_ReloadConf
SbieDll_FindArgumentEnd
SbieApi_OpenProcess
SbieDll_GetLanguage
SbieDll_FormatMessage0
SbieApi_QueryConf
SbieDll_GetServiceRegistryValue
SbieApi_LogEx
SbieApi_Log

ntdll

NtSetInformationFile
NtReadFile
NtWriteFile
NtCreateFile
NtQueryKey
RtlSetDaclSecurityDescriptor
RtlCreateVirtualAccountSid
NtLoadDriver
RtlInitUnicodeString
NtReplyWaitReceivePort
NtRequestPort
NtCreatePort
NtUnloadKey
NtOpenKey
NtClose
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
NtDuplicateObject
NtOpenProcess
NtResumeProcess
NtSuspendProcess
NtGetNextThread
NtAdjustPrivilegesToken
NtReadVirtualMemory
NtQueryInformationThread
NtSetInformationProcess
NtOpenDirectoryObject
NtImpersonateClientOfPort
NtCompleteConnectPort
NtAcceptConnectPort
NtRequestWaitReplyPort
NtConnectPort
RtlNtStatusToDosError
NtOpenFile
NtDeleteFile
NtQueryObject
NtFilterToken
NtDuplicateToken
NtQueryInformationToken
NtOpenThreadToken
NtOpenProcessToken
NtSetInformationThread
NtAllocateVirtualMemory
RtlInitializeSid
RtlSubAuthoritySid
NtSetInformationToken
NtQueryInformationProcess
RtlCreateSecurityDescriptor
NtLoadKey
NtQuerySystemInformation

kernel32

FlsSetValue
FlsGetValue
FlsAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStringTypeW
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
GetLastError
HeapCreate
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
OpenMutexW
CreateEventW
OpenEventW
Sleep
WaitForMultipleObjects
ExitProcess
TerminateProcess
CreateThread
GetCurrentThread
GetTickCount
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LocalFree
GetEnvironmentVariableW
SetCurrentDirectoryW
GetFullPathNameW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
WriteFile
SetLastError
DeviceIoControl
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
SetThreadPriority
TerminateThread
OpenProcess
GetLocalTime
GetVersionExW
VirtualAlloc
VirtualFree
LocalAlloc
GetSystemWindowsDirectoryW
DuplicateHandle
ResetEvent
QueueUserAPC
GetCurrentThreadId
OpenThread
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
TerminateJobObject
SetInformationJobObject
QueryInformationJobObject
GetModuleHandleW
GetProcAddress
LoadLibraryW
GlobalSize
RegisterWaitForSingleObject
UnregisterWait
AllocConsole
GetConsoleWindow
GetConsoleProcessList
GetFileSizeEx
OutputDebugStringW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineW
GetSystemInfo
GetFinalPathNameByHandleW
DefineDosDeviceW
GetLogicalDrives
GetCompressedFileSizeW
GetExitCodeProcess
CreateProcessW
CancelIo
TlsAlloc
TlsGetValue
TlsSetValue
SuspendThread
ResumeThread
WriteProcessMemory
IsWow64Process
GetModuleFileNameW
QueryFullProcessImageNameW
QueueUserWorkItem
DeleteFileW
GetFileAttributesW
ReadFile
SetEndOfFile
SetFileAttributesW
GetWindowsDirectoryW
CopyFileW
MultiByteToWideChar
WideCharToMultiByte
ReadProcessMemory
MulDiv
LCMapStringW
SetStdHandle
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
FlsFree
DeleteCriticalSection

user32

EndPaint
SendMessageTimeoutW
SendMessageW
SendMessageA
GetProcessWindowStation
SetProcessWindowStation
CreateWindowStationW
GetThreadDesktop
BeginPaint
CreateDesktopW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetTimer
DispatchMessageW
GetMessageW
wsprintfW
ShowWindow
RegisterClassExW
GetMonitorInfoW
PackDDElParam
GetRawInputDeviceInfoW
GetRawInputDeviceInfoA
UserHandleGrantAccess
GetWindowInfo
MonitorFromWindow
ChangeDisplaySettingsExW
ChangeDisplaySettingsExA
GetIconInfo
GetWindow
GetWindowThreadProcessId
GetClassNameW
GetClassNameA
EnumThreadWindows
EnumWindows
GetShellWindow
FindWindowExW
FindWindowExA
FindWindowW
FindWindowA
EnumChildWindows
GetParent
GetDesktopWindow
GetClassLongPtrW
GetClassLongPtrA
GetClassLongW
GetClassLongA
GetWindowLongPtrW
GetWindowLongPtrA
GetWindowLongW
GetWindowLongA
ClipCursor
MapWindowPoints
ScreenToClient
ClientToScreen
SetCursorPos
GetWindowRect
GetClientRect
GetPropW
GetPropA
SetPropW
ReleaseDC
GetDC
SetForegroundWindow
IsWindowEnabled
IsWindowUnicode
KillTimer
EnumClipboardFormats
GetClipboardData
GetClipboardSequenceNumber
IsZoomed
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PostMessageW
PostMessageA
SendNotifyMessageW
SetThreadDesktop
SendNotifyMessageA

advapi32

CreateProcessAsUserW
OpenSCManagerW
CloseServiceHandle
LsaManageSidNameMapping
LsaFreeMemory
LookupAccountNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
GetSecurityInfo
AccessCheck
QueryServiceConfig2W
QueryServiceConfigW
EnumServicesStatusW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetLengthSid
EqualSid
DuplicateToken
AddAccessAllowedAce
SetThreadToken
RevertToSelf
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
ReportEventW
OpenEventLogW
StartServiceW
EnumServicesStatusExW
ControlService
SetSecurityInfo
SetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
RegOpenCurrentUser
RegOpenUserClassesRoot
QueryServiceStatusEx
DuplicateTokenEx
OpenServiceW

psapi

GetModuleBaseNameW
GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcessModules

ole32

CoInitializeEx
CoGetClassObject
CoMarshalInterface
CoUnmarshalInterface
CoInitializeSecurity
CoQueryProxyBlanket
CoSetProxyBlanket
CreateStreamOnHGlobal
StringFromGUID2
CoTaskMemFree
CoGetObject
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoCopyProxy

crypt32

CryptUnprotectData
CryptProtectData

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

CreateSolidBrush
SelectObject
TextOutW
SetTextColor
SetBkColor
CreateFontW
GetDeviceCaps
GetMetaFileBitsEx
GetDIBits
DeleteDC
CreateCompatibleDC
GetEnhMetaFileBits

netapi32

NetUseAdd

wtsapi32

WTSQueryUserToken

rpcrt4

UuidFromStringW
RpcStringFreeW
RpcBindingToStringBindingW
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
RpcMgmtEpEltInqDone

bcrypt

BCryptCreateHash
BCryptVerifySignature
BCryptHashData
BCryptImportKeyPair
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptDestroyKey

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieSvc.exe.sig
SboxHostDll.dll
.dll windows:6 windows x64 arch:x64

2c0f64a1270ea0aebe3f33b34754c5f1

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:6b:dd:16:18:64:95:dc:0a:5e:99:b2:1e:c9:29:ab:54:af:7a:93:cd:2c:de:f7:c8:13:ab:bc:a9:c6:81:15
Signer

Actual PE Digest

60:6b:dd:16:18:64:95:dc:0a:5e:99:b2:1e:c9:29:ab:54:af:7a:93:cd:2c:de:f7:c8:13:ab:bc:a9:c6:81:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SboxHostDll.pdb

Imports

sbiedll

SbieApi_QueryProcessInfo
SbieDll_Hook

psapi

EnumProcesses

kernel32

GetModuleHandleW
CreateMutexW
CloseHandle
GetProcessId
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetLastError
lstrcmpiW
GetModuleFileNameW
OpenProcess
GetProcAddress
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetFilePointerEx
GetConsoleMode
CreateFileW
WriteConsoleW
LocalFree
SetLastError
GetConsoleOutputCP
WriteFile
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers

advapi32

GetTokenInformation
IsValidSid
GetLengthSid
CopySid
ConvertSidToStringSidW

userenv

UnloadUserProfile

Exports

Exports

InjectDllMain

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Start.exe
.exe windows:6 windows x64 arch:x64

7dd4bd51b4f1f548f8579ba4ab75dc67

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:e1:64:32:2f:4e:2c:4f:cd:7a:62:07:01:97:18:60:bf:08:75:6b:7e:a1:67:f4:8b:af:a4:55:5d:a0:ad:08
Signer

Actual PE Digest

b4:e1:64:32:2f:4e:2c:4f:cd:7a:62:07:01:97:18:60:bf:08:75:6b:7e:a1:67:f4:8b:af:a4:55:5d:a0:ad:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\Start.pdb

Imports

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
NtTerminateThread
NtTerminateProcess
NtQueryInformationProcess
NtOpenKey
RtlNtStatusToDosError
RtlInitUnicodeString
NtSetInformationFile
NtQueryInformationFile
NtCreateFile
NtClose

user32

GetWindowRect
GetClientRect
SetWindowTextW
SetForegroundWindow
KillTimer
GetDesktopWindow
LoadImageW
SetDlgItemTextW
GetDlgItem
EndDialog
SendMessageW
DialogBoxParamW
CallWindowProcW
CreateWindowExW
DestroyWindow
SendDlgItemMessageW
SetFocus
EnableWindow
AllowSetForegroundWindow
GetSystemMetrics
SetPropW
GetPropW
MessageBoxW
ClientToScreen
GetWindowLongPtrW
SetWindowLongPtrW
wsprintfW
ExitWindowsEx
DestroyIcon
DefWindowProcW
RegisterClassW
CreateMenu
CreatePopupMenu
DestroyMenu
GetMenuItemCount
TrackPopupMenu
GetMenuInfo
SetMenuInfo
InsertMenuItemW
GetDC
GetSysColorBrush
DrawIconEx
IsWindowEnabled
GetWindowTextW
MapWindowPoints
GetWindowLongW
SetWindowLongW
GetMessageW
PostThreadMessageW
GetAsyncKeyState
ScreenToClient
SetTimer
SetWindowPos
MoveWindow
ShowWindow
DialogBoxIndirectParamW

shell32

SHBindToParent
ShellExecuteW
ExtractAssociatedIconW
ExtractIconW
ExtractIconExW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW

shlwapi

PathFileExistsW
SHAutoComplete
AssocQueryStringW
StrStrIW

kernel32

LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadResource
GlobalFree
QueryPerformanceCounter
InitializeSListHead
LoadLibraryW
WriteConsoleW
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
SetFilePointerEx
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetModuleHandleExW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
GetFileAttributesExW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
QueryFullProcessImageNameW
FormatMessageW
GetProcAddress
GetVersionExW
OpenProcess
GetProcessId
HeapAlloc
HeapFree
GetProcessHeap
GetTickCount
GetModuleHandleW
LocalFree
GetCurrentProcessId
GetStartupInfoW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
CloseHandle
SetLastError
HeapCreate
HeapDestroy
WaitForSingleObject
CreateEventW
Sleep
ExitProcess
GetExitCodeProcess
CreateThread
CreateProcessW
ProcessIdToSessionId
GetSystemTimeAsFileTime
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetFileAttributesW
GetFullPathNameW
GetSystemWindowsDirectoryW
CreateFileW
GetLogicalDrives
HeapReAlloc
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetStdHandle
GetCommandLineW
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetLastError
GetCurrentThreadId
FindFirstFileExW

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
SelectObject

sbiedll

SbieApi_QueryProcess
File_GetName
Key_GetName
SbieDll_SetFakeAdmin
SbieDll_StartCOM
SbieDll_CallServer
SbieDll_RunSandboxed
SbieDll_FormatMessage
SbieDll_GetTokenElevationType
SbieDll_Unmount
SbieDll_Mount
SbieDll_KillAll
SbieDll_GetLanguage
SbieDll_GetStartError
SbieDll_StartSbieSvc
SbieDll_RunStartExe
SbieDll_GetSysFunction
SbieApi_IsBoxEnabled
SbieApi_ReloadConf
SbieApi_DisableForceProcess
SbieApi_GetHomePath
SbieDll_InitPStore
SbieApi_QueryProcessInfo
SbieDll_GetHandlePath
SbieDll_IsDirectory
SbieDll_IsReservedFileName
SbieDll_TranslateNtToDosPath
SbieApi_EnumBoxes
SbieApi_EnumProcessEx
SbieApi_QueryBoxPath
SbieApi_QueryConf
SbieDll_FreeMem
SbieDll_CallServerQueue
SbieDll_FormatMessage1
SbieDll_FormatMessage0
SbieApi_QueryConfBool
SbieApi_Call
SbieApi_EnumBoxesEx

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal

advapi32

RegEnumValueW

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

gdiplus

GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipDisposeImage

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Start.exe.sig
Templates.ini
UpdUtil.exe
.exe windows:6 windows x64 arch:x64

3792137109807bfef8745bcbd54f161a

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31-10-2023 15:56

Not After

30-11-2026 15:56

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederösterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:7b:d5:4e:9f:03:a9:b7:26:95:04:c1:72:42:b1:b1:79:5e:6b:bd:e8:40:25:63:76:32:2c:d2:c8:a1:09:53
Signer

Actual PE Digest

98:7b:d5:4e:9f:03:a9:b7:26:95:04:c1:72:42:b1:b1:79:5e:6b:bd:e8:40:25:63:76:32:2c:d2:c8:a1:09:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Sandboxie\Sandboxie\SandboxieTools\x64\Release\UpdUtil.pdb

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtQuerySystemInformationEx
NtCreateFile
NtClose
NtReadFile
NtWriteFile

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptImportKeyPair
BCryptHashData
BCryptFinishHash
BCryptCreateHash
BCryptGetProperty
BCryptVerifySignature
BCryptDestroyKey

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpConnect
WinHttpSendRequest

kernel32

QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
AllocConsole
GetEnvironmentStringsW
CreateProcessW
MoveFileExW
LocalFree
GetNativeSystemInfo
CloseHandle
DeleteFileW
GetUserDefaultLCID
AttachConsole
Sleep
LCIDToLocaleName
FreeEnvironmentStringsW
CreateFileW
LocalAlloc
WaitForSingleObject
GetTempPathW
FindFirstFileA
FindNextFileA
GetFullPathNameA
FindClose
GetFileAttributesW
GetVersionExW
GetModuleHandleA
GetLastError
GetProcAddress
GetFileSizeEx
CreateDirectoryW
GetCurrentProcessId
GetCurrentProcess
RemoveDirectoryW
GetModuleFileNameW
SetFilePointer
ReadFile

advapi32

RegCloseKey
SetNamedSecurityInfoW
InitializeAcl
RegOpenKeyExW
RegQueryValueExW

shell32

CommandLineToArgvW
ShellExecuteExW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

msvcp140

?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy
__std_exception_copy
__std_terminate
strchr
wcsrchr
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
memcpy
memmove

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
realloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp
toupper
wcstok
_wcsdup
strncpy_s
_wcsnicmp

api-ms-win-crt-runtime-l1-1-0

_set_errno
_get_wide_winmain_command_line
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
_initialize_wide_environment
exit
_configure_wide_argv
terminate
_c_exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_exit
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
_set_fmode
__stdio_common_vswprintf
__acrt_iob_func
freopen
__p__commode

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
whatsnew.html
.html

Sharing

General

Malware Config

Signatures

Files

ab6770b0a8635b9d92a5838920cfe770

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f1:74:73:3d:a6:03:76:ae:9c:00:97:75:64:bd:dd:e9:80:12:ca:80:46:bb:b1:39:87:7f:43:d5:6e:e0:c3:eeSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 108KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 29KB - Virtual size: 28KB

738dc9bb91549f627cf1953c2000e1d6

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

e74127d0470ed67341494767b56b1a47

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5e:25:ac:de:45:13:88:fd:56:ed:39:df:e1:63:dc:ec:ad:23:79:1d:a8:61:4a:30:6b:7a:bd:c4:2d:b7:99:e3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f1:74:73:3d:a6:03:76:ae:9c:00:97:75:64:bd:dd:e9:80:12:ca:80:46:bb:b1:39:87:7f:43:d5:6e:e0:c3:ee
Signer

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 108KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 29KB - Virtual size: 28KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5e:25:ac:de:45:13:88:fd:56:ed:39:df:e1:63:dc:ec:ad:23:79:1d:a8:61:4a:30:6b:7a:bd:c4:2d:b7:99:e3
Signer

.text
Size: 135KB - Virtual size: 135KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 6KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 320B

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

30:e4:c5:b0:c5:d7:7d:c1:5f:fa:ca:77
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

13:2d:6a:8e:bd:61:04:40:84:9b:d6:b6:6e:c8:20:ea:2a:4f:7e:e7:03:31:e2:a6:cc:99:83:6e:de:a3:26:87
Signer

.text
Size: 636KB - Virtual size: 635KB

.rdata
Size: 171KB - Virtual size: 171KB

.data
Size: 5KB - Virtual size: 16KB

.pdata
Size: 30KB - Virtual size: 30KB

.idata
Size: 12KB - Virtual size: 11KB

.detourd
Size: 512B - Virtual size: 284B

.detourc
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 5KB - Virtual size: 4KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate