26da82f7-Sandboxie-Classic-x64-v5[.]73[.]1[.]exe

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

26da82f7-Sandboxie-Classic-x64-v5.73.1.exe

IMPHASH ab6770b0a8635b9d92a5838920cfe770
SHA256 1106196a872f10aeb0379953d67491481cfd8c7f641dc78dabfd406284e1ec1d
MD5 86c41afd88bacccdf6ba2e0fa8290131
SHA1 1f737efbae02733156e748b29352e13ab37029c3
SHA512 0e3966b3cd1fe3896df7ca5c4a2e061d0370bfdc06cce6731298a808a23bcf7dcb873b14873b42f84cdf681bdd84490f8c5bb1d8605e268113ea8db0e1d88d0a
SSDEEP 49152:3l8n805wTMZi+FQDP4nAnpcW2wFIzovAExPP+kI2Juw10Qcly1zv2xsSpqeKdPQZ:3ARwAJWDQApeAIzxEMkhoSksSLKQfG4N
TLSH
T18BE5336A37D86402D95BCD723BD0D7FDF1383E91E884AA83A3A69B9B9A31F071D05141
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c6:c7:08:62:36:4b:a8:3e:f5:16:a0:4f:f6:e9:39:00:e7:90:08:0c:96:88:70:14:c2:2a:74:49:3f:da:bf:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

12879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA CreateDirectoryA lstrcmpiA GetTempPathA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject ExitProcess GetWindowsDirectoryA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 254c5ccbce59ad882f7f51d0bf760cabde8c88c5af84e13cc8ad77ba0361055c
MD5 046074d285897c008499f7f3ad5be114
SHA1 159040d616a056ee3498ec86debab58ef5036a55
SHA512 ab7436fda44e340dd5909ddec809c6b569a90d888529ef9320375e1aae7af85afcab8c1c1618551d3fe8d6ae727f7dca97aa8781b5555da759d501d2ccd749e1
SSDEEP 192:+Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijqK72dwF7dBEnbok:+GvdH4qMebzPY2Vijq+BEnbo
TLSH
T1CE623B51638888F3DBD6013EB4533707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/InstallType.ini

SHA256 a9a81ca9a2ebec41663e1da4e5d480e6eaf9bcbde266abb9a0770dc9118186b9
MD5 46d2e7e6d3d5ee061b5646df6834af33
SHA1 0a18c3a1ddb2cb56abac24c4bd378d3767065290
SHA512 e344d14d0cc9ef0bb893a821fbaa9ddfcb3d1987c32228ebdae0418b3f1bf7f83435e38f87593db4de0157d45345a9f72e6c1e7ca36a46d13b7e35577292237a
TLSH
T1F1F0318D5412D226C8B2A44628BB6A9637D038345E023CA6F67728C7AB8DCD25DEC589
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/KmdUtil.exe

IMPHASH 661671840b63d3a9bec233361ad4becb
SHA256 9f9818743dd3f2db77d50aabc28069d99d1124ddaa219773ac1ec300499f79e0
MD5 f39080039a4d55d33f8e91b935860133
SHA1 207a0309a498f43c35dd603ad7b4234239e88d58
SHA512 110a9c339c2371b5319437c0c0982dd3dbeec2a12e0fc59d2a9cc48aaf7ba3b90f35110a81b848128908051c27fcdb4db557b7009ad4c984cfdea4debe3360e0
SSDEEP 3072:3Be3ngbC8VzYk1bI1baRAOt8hBAt/Nxb1QEez/QvFi5Lw77tRNk:3Bm8Sk1mbcAOwmF0o777W
TLSH
T10E247C51B3E500F9E5A7C2398DA69601F672784507609BDF03A443BAEF23BD05E3DB62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

40:91:e3:51:1c:59:95:22:1d:8e:10:09:47:1d:8e:58:b5:bf:0a:09:bd:44:ac:13:ef:d9:a6:3e:cd:10:16:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

123976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\KmdUtil.pdb

ntdll

NtUnloadDriver RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlInitUnicodeString

psapi

EnumProcessModules GetModuleBaseNameW EnumProcesses

sbiedll

Sbie_snwprintf SbieApi_Ioctl SbieApi_Call SbieApi_GetVersion SbieApi_QueryConf SbieApi_GetHomePath SbieApi_LogMsgEx SbieApi_IsBoxEnabled

kernel32

GetModuleFileNameW LoadLibraryW LocalAlloc FormatMessageW CloseHandle GetCurrentProcess HeapAlloc HeapFree GetProcessHeap GetCurrentProcessId ExitProcess TerminateProcess ProcessIdToSessionId OpenProcess GetModuleHandleW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetFileType GetStartupInfoW FreeLibrary GetModuleHandleExW SetLastError FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect LoadLibraryExW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc RaiseException CreateFileW WriteConsoleW EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetLastError GetCommandLineW LocalFree QueryPerformanceCounter InitializeSListHead FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW Sleep FlsAlloc WideCharToMultiByte

user32

SendMessageW RegisterClassW GetMessageW MessageBoxW CreateWindowExW PostMessageW DefWindowProcW GetWindowLongW DestroyWindow ShowWindow SetFocus GetFocus GetWindowRect SystemParametersInfoW LoadIconW LoadCursorW GetWindow GetParent GetDesktopWindow DispatchMessageW

gdi32

CreateFontIndirectW GetStockObject

advapi32

AdjustTokenPrivileges CopySid GetAce GetSecurityDescriptorDacl SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW ConvertSidToStringSidW ConvertStringSidToSidW RegCreateKeyExW CloseServiceHandle LookupPrivilegeValueW RegDeleteKeyW OpenProcessToken StartServiceW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

CommandLineToArgvW

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/LangDLL.dll

IMPHASH 4e5f0ae8071ae04cdb537283701198ff
SHA256 09477d605677bea48019b896f068ce6c2e89004e5c5f0a86c0276db30c6515a6
MD5 4cdaaf5da900a8eaed090cd22b8f8781
SHA1 6c7d9cfd96e66d236b66b8d50d65083a0dbb1b11
SHA512 3797d59aeb908dcd66c63eca76cb2064416d3b66033dc687bc7a9c50e2979c42ac94773f54bc8ec45a9cd69c8056b83a2bca6efcd703f71a4b5f67e166f1e06d
SSDEEP 48:iV6HAvq8WeMPUptuM4Z+0x/ImnycNSCwVYOY4vnpXTHhHX/JvR0J/of5d2:2yplJ5ZbnycNSCwVYTwFB3ZR0Qd2
TLSH
T114C18677B3C149F9D6854633251373C3A7139E307359800F9B6712AE2924CAB9D6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SbieDll.dll

IMPHASH 9653a0368d5a565295016a975b84caf6
SHA256 ed9cbfc3f842aba56a55bd43717fdb2f9381c5b00451e059818007e20e1af349
MD5 bbb5da77540cbbe30d4821ec5c8be0ee
SHA1 a7f82f32a5bf8099e2f446d2551a7928693b2f0c
SHA512 c80d914eca6766e6b60564796a29d825479d118adee4a5758200f608d2ac6d4284ff345b9a2130de6dbfeaa9c8161f894170f50ff0d4039349888d71d4fbe38c
SSDEEP 12288:ku7uC3Uibha5FnD+r7uKUUqppSgTXJl2rWD8bqjDOl:buC3UOhaIWKDqppSgTrKWiAOl
TLSH
T106257D45F3F91298E97FC179CA639617EA7174881731DBCF01908A892F63FC26A3A315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

a0:ce:d6:e8:2e:0b:84:62:63:3b:ec:9d:33:87:5e:e7:82:b0:ae:0b:80:c3:6a:73:56:2d:b0:29:fb:02:d4:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDll.pdb

ntdll

RtlRestoreContext NtSetInformationJobObject NtAssignProcessToJobObject NtOpenJobObject NtCreateJobObject NtUnmapViewOfSection RtlEqualSid RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlCreateSecurityDescriptor NtAdjustPrivilegesToken RtlCaptureContext NtFilterToken NtDuplicateObject NtSetInformationToken NtOpenThread NtOpenProcess RtlConvertSidToUnicodeString RtlSetSaclSecurityDescriptor NtSetSecurityObject RtlNtStatusToDosError NtProtectVirtualMemory NtLoadDriver LdrQueryImageFileExecutionOptions LdrQueryProcessModuleInformation LdrUnloadDll LdrLoadDll NtYieldExecution NtNotifyChangeMultipleKeys NtNotifyChangeKey NtEnumerateValueKey NtQueryMultipleValueKey NtSaveKey NtLoadKey2 NtLoadKey NtDeleteKey NtSetInformationKey NtQueryKey NtImpersonateAnonymousToken NtImpersonateThread NtDuplicateToken NtQueryInformationToken NtQuerySection NtMapViewOfSection NtOpenSection NtCreateSection NtOpenSemaphore NtCreateSemaphore NtOpenMutant NtCreateMutant NtOpenTimer NtCreateTimer NtOpenKeyedEvent NtCreateKeyedEvent NtOpenEventPair NtCreateEventPair NtOpenEvent NtCreateEvent NtCreateSymbolicLinkObject NtImpersonateClientOfPort NtSecureConnectPort NtCreatePort NtQueryDirectoryObject NtCreateDirectoryObject RtlUnicodeStringToAnsiString NtOpenProcessToken RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitString NtQueryInformationProcess RtlSetThreadErrorMode RtlGetFullPathName_U RtlSetCurrentDirectory_U RtlGetCurrentDirectory_U RtlLengthSid RtlAddAccessAllowedAceEx RtlCreateAcl NtNotifyChangeDirectoryFile NtWaitForSingleObject NtQuerySymbolicLinkObject NtOpenSymbolicLinkObject RtlCompareUnicodeString NtQuerySystemInformation NtQueryVolumeInformationFile NtCreateNamedPipeFile NtCreateMailslotFile NtFsControlFile NtDeviceIoControlFile NtWriteFile NtReadFile NtDeleteFile NtSetInformationFile NtQueryFullAttributesFile NtQueryInformationFile NtQueryDirectoryFile NtOpenFile NtCreateFile NtOpenDirectoryObject RtlGetDaclSecurityDescriptor RtlSetDaclSecurityDescriptor NtQuerySecurityObject NtQueryObject RtlAddAce RtlGetAce RtlSelfRelativeToAbsoluteSD RtlLengthSecurityDescriptor RtlMakeSelfRelativeSD RtlGetControlSecurityDescriptor RtlValidSecurityDescriptor NtSetInformationProcess NtQueryAttributesFile NtAllocateVirtualMemory LdrGetProcedureAddress NtDeleteValueKey NtSetValueKey NtEnumerateKey NtCreateKey NtOpenKey NtQueryValueKey NtOpenThreadToken RtlInitUnicodeString NtRequestWaitReplyPort NtRegisterThreadTerminatePort NtConnectPort NtSetInformationThread NtClose NtQueryVirtualMemory NtReadVirtualMemory _strlwr __C_specific_handler memcpy memset _wcsicmp __chkstk strcmp wcslen _wcsnicmp towlower wcsstr wcscpy wcschr _itow memcmp memmove wcscmp wcscpy_s wcsncpy _wcslwr wcstol _wtoi wcsncmp strlen wcstoul wcsrchr iswctype _ultow strchr strncmp strcpy _stricmp wcsncpy_s tolower _wtoi64 strstr _strnicmp

kernel32

GlobalFree SetLocaleInfoW SetLocaleInfoA PostQueuedCompletionStatus EnumResourceNamesW FormatMessageW LoadLibraryExW GetVersionExW GetLongPathNameW GetFullPathNameW GetProcessId GetACP WinExec OpenProcess CreateProcessA TerminateProcess QueueUserWorkItem CreateFileA SizeofResource WriteProcessMemory ReadProcessMemory VirtualAllocEx GetUserDefaultLCID GetSystemDefaultLCID GetSystemDefaultLangID GetUserDefaultLangID GetUserDefaultUILanguage GetSystemDefaultUILanguage SetThreadExecutionState MapViewOfFile OpenFileMappingW CreateFileMappingW GetWindowsDirectoryW HeapDestroy HeapCreate SetThreadPriority GetExitCodeProcess OpenEventW RaiseException GlobalAddAtomW UnmapViewOfFile MapViewOfFileEx GetThreadTimes SleepEx GetTickCount64 DuplicateHandle FindResourceA FindResourceW LockResource LoadResource GlobalLock GlobalUnlock GlobalSize GetConsoleWindow SetConsoleTitleW SetConsoleTitleA GetConsoleTitleW GetConsoleTitleA AllocConsole GetStartupInfoW OpenThread WaitForMultipleObjects WideCharToMultiByte GetSystemInfo lstrcmpW GetSystemWindowsDirectoryW ReplaceFileW MoveFileWithProgressW MoveFileExW GetPrivateProfileStringW GetTickCount QueueUserAPC OpenMutexW CreateMutexW ReleaseMutex DeleteCriticalSection TryEnterCriticalSection GetFileSizeEx GetFileAttributesW DeleteFileW CreateDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsSetValue TlsGetValue TlsAlloc GetModuleHandleA ProcessIdToSessionId GetCurrentProcessId SetEvent Sleep OutputDebugStringW IsDebuggerPresent lstrcatW lstrcpyW GetModuleFileNameW CreateProcessW CreateThread ExitProcess LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetEnvironmentVariableW GetCommandLineW LocalFree LocalAlloc GetSystemTimeAsFileTime LoadLibraryW GetModuleHandleW FreeLibrary ExpandEnvironmentStringsW CreateEventW WaitForSingleObject GlobalAlloc GetProcAddress CloseHandle SetFilePointerEx ReadFile CreateFileW SetLastError VirtualQueryEx VirtualProtectEx VirtualQuery VirtualFree VirtualProtect GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc

File_GetName Key_GetName SbieApi_Call SbieApi_CheckInternetAccess SbieApi_DisableForceProcess SbieApi_EnumBoxes SbieApi_EnumBoxesEx SbieApi_EnumProcessEx SbieApi_GetBlockedDll SbieApi_GetFileName SbieApi_GetHomePath SbieApi_GetMessage SbieApi_GetUnmountHive SbieApi_GetVersion SbieApi_GetVersionEx SbieApi_HookTramp SbieApi_Ioctl SbieApi_IsBoxEnabled SbieApi_Log SbieApi_LogEx SbieApi_LogMsgEx SbieApi_LogMsgExt SbieApi_MonitorControl SbieApi_MonitorGetEx SbieApi_MonitorPut SbieApi_MonitorPut2 SbieApi_MonitorPut2Ex SbieApi_MonitorPutEx SbieApi_MonitorPutMsg SbieApi_OpenProcess SbieApi_ProcessExemptionControl SbieApi_QueryBoxPath SbieApi_QueryConf SbieApi_QueryConfBool SbieApi_QueryConfNumber SbieApi_QueryConfNumber64 SbieApi_QueryDrvInfo SbieApi_QueryPathList SbieApi_QueryProcess SbieApi_QueryProcessEx SbieApi_QueryProcessEx2 SbieApi_QueryProcessInfo SbieApi_QueryProcessInfoEx SbieApi_QueryProcessInfoStr SbieApi_QueryProcessPath SbieApi_ReloadConf SbieApi_SessionLeader SbieApi_SetUserName SbieApi_UpdateConf SbieApi_vLogEx SbieDll_AllocMem SbieDll_AssocQueryCommand SbieDll_AssocQueryProgram SbieDll_CallProxySvr SbieDll_CallServer SbieDll_CallServerQueue SbieDll_CheckPatternInList SbieDll_CheckProcessLocalSystem SbieDll_CheckStringInList SbieDll_CheckStringInListA SbieDll_ComCreateProxy SbieDll_ComCreateStub SbieDll_DeviceChange SbieDll_DisableCHPE SbieDll_DisableElevationHook SbieDll_ExpandAndRunProgram SbieDll_FindArgumentEnd SbieDll_FormatMessage SbieDll_FormatMessage0 SbieDll_FormatMessage1 SbieDll_FormatMessage2 SbieDll_FreeMem SbieDll_GetBorderColor SbieDll_GetDrivePath SbieDll_GetHandlePath SbieDll_GetLanguage SbieDll_GetPublicSD SbieDll_GetServiceRegistryValue SbieDll_GetSettingsForName SbieDll_GetSettingsForName_bool SbieDll_GetStartError SbieDll_GetStringForStringList SbieDll_GetStringsForStringList SbieDll_GetSysFunction SbieDll_GetTokenElevationType SbieDll_GetUserPathEx SbieDll_Hook SbieDll_HookInit SbieDll_InitPStore SbieDll_InjectLow SbieDll_InjectLow_InitHelper SbieDll_InjectLow_InitSyscalls SbieDll_InjectLow_SendHandle SbieDll_IsBoxedService SbieDll_IsDirectory SbieDll_IsDllSkipHook SbieDll_IsOpenCOM SbieDll_IsOpenClsid SbieDll_IsReservedFileName SbieDll_KillAll SbieDll_KillOne SbieDll_MatchImage SbieDll_MatchPathImpl SbieDll_Mount SbieDll_OpenProcess SbieDll_PortName SbieDll_QueryConf SbieDll_QueryFileAttributes SbieDll_QueueCreate SbieDll_QueueGetReq SbieDll_QueueGetRpl SbieDll_QueuePutReq SbieDll_QueuePutRpl SbieDll_RegisterDllCallback SbieDll_RunFromHome SbieDll_RunSandboxed SbieDll_RunStartExe SbieDll_SetFakeAdmin SbieDll_SetServiceRegistryValue SbieDll_StartBoxedService SbieDll_StartCOM SbieDll_StartSbieSvc SbieDll_TraceModule SbieDll_TranslateNtToDosPath SbieDll_UnHookModule SbieDll_Unmount SbieDll_UpdateConf Sbie_snprintf Sbie_snwprintf Scm_HookCloseServiceHandle Scm_HookControlService Scm_HookOpenServiceW Scm_HookQueryServiceStatus Scm_HookQueryServiceStatusEx Scm_HookSetServiceStatus Scm_HookStartServiceCtrlDispatcherW Scm_HookStartServiceW

Name

.text

Size

700KB

Virtual Size

699KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/SbieMsg.dll

SHA256 7ef43bf277730229088673b5888b1167ad12827480ebffe954bfd3d2f68aff14
MD5 31b12eaecfa75bb9ec7487cb8f602125
SHA1 9e7bf0aa6ddd0314242b3c60b3c34ea628344eab
SHA512 0947904d1c37aaf5b21a75e4f3b2671c9ac21a785bd719afb023a7737422847224cdf9f74e680619c8bf80b6ac89ec5dd7f74862f28e58b70299a87e2b401ead
SSDEEP 12288:TDKYk1o+cLvlSePy3k2ga62IVS6I85RXvPz/lksWULuhMl5QIuD:/41iSePnk6+6I85RXvPblkHf
TLSH
T1F9F5440767FA4118F6F3BB2169B542B15B7BBDD2AE3CC51C0285616D0CF1AA09D60BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

ad:21:d9:c6:47:f5:2f:3b:f4:a7:9a:cf:5c:69:5f:95:8c:99:c0:3b:84:b6:a2:22:8d:f0:fc:7f:3e:97:76:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieMsg.pdb

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 4ca5bf1beb4b802914c4d3e2f37861f6ba5ecf969cfeadf5855edf58f647a721
MD5 0ff5120f1afd0f295c2baa0f7192d3f8
SHA1 bde842d5d11005dcb4ff1d4ea97da31865477697
SHA512 e049ffd7aace8d136eee007ee4f8dbc2ae8f3dce79d1c633d9654392240f8215787df8a6d08085257db51f28ff2a8023a13333dda3ea7f9bdc8b9c57b605f0a0
SSDEEP 192:Xv+cJZE61KRWJQO6tFiUdK7ckD4k7l1XRBm0w+NiHi1nSJ:Xf6rtFRdbQ1W+fn8
TLSH
T17E225C5893E0C1F3E6A0853C18573A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Warning.ini

SHA256 74ee005ceb920094d99aa274ed37429efe439fbc10e9d238c78db4c836018a17
MD5 4d358b27a971751e0c517061c948d96a
SHA1 04b7bbc12f641edbcf8acb6eeb90508e0d6b810a
SHA512 753cae46b7fc94bea26fd479322395951eb64c6a1854bfc88182596a5babffae8fc51d1f36c70630ffa61abb514372f88c4063b50f7b33f9fd53f74f797e75f4
TLSH
T1B3E0ED8C94069137C47194462CB66AD737D03D245E0339B6F7761887EF88CD34DBD595
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

32/SbieDll.dll

IMPHASH dc286f5bfa0915bf75c670f92aa1a173
SHA256 c0764f66036b6f71233fb92eb48ca2fbfdcbd5a7dd8ffaa07be3c6851dc1df56
MD5 c29fbc3be7ffe35d331f14ebbc744b36
SHA1 6002544d86444def7c1da8bb745e942824442536
SHA512 93a2920b9ca495aeed5b768d60d54382db0334bc94e78bf66cb695c4604cf1c6b53caf690c9dc161e1bd50f5dd4bbfbd8e853be7aeaf9112b6d98268a009c986
SSDEEP 12288:+TqPYh3JABo84WWKRAaw3UsWvcT5grrlxepw+rmqHwkeI:++PIEQsAawElvcTqrlxuvHReI
TLSH
T1F3056C51F7E501A4F7F399B00ABFBB69583AF5044731D9CB00D8649A95236C1BE3A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

11:7c:07:1a:20:6e:75:ee:04:be:01:4d:8c:a1:b1:6f:6e:d6:90:a1:2a:53:c9:af:ec:ae:0a:44:1e:cf:5e:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\Win32\SbieRelease\SbieDll.pdb

ntdll

RtlUnwind NtSetInformationJobObject NtAssignProcessToJobObject NtOpenJobObject NtCreateJobObject NtUnmapViewOfSection RtlEqualSid RtlGetGroupSecurityDescriptor NtClose RtlGetOwnerSecurityDescriptor RtlCreateSecurityDescriptor NtAdjustPrivilegesToken NtFilterToken NtDuplicateObject NtSetInformationToken NtOpenThread NtOpenProcess RtlConvertSidToUnicodeString RtlSetSaclSecurityDescriptor NtSetSecurityObject NtQueryVirtualMemory RtlNtStatusToDosError NtLoadDriver LdrQueryImageFileExecutionOptions LdrQueryProcessModuleInformation LdrUnloadDll LdrLoadDll NtYieldExecution NtNotifyChangeMultipleKeys NtNotifyChangeKey NtEnumerateValueKey NtQueryMultipleValueKey NtSaveKey NtLoadKey2 NtLoadKey NtDeleteKey NtSetInformationKey NtQueryKey NtImpersonateAnonymousToken NtImpersonateThread NtDuplicateToken NtQueryInformationToken NtQuerySection NtMapViewOfSection NtOpenSection NtCreateSection NtOpenSemaphore NtCreateSemaphore NtOpenMutant NtCreateMutant NtOpenTimer NtCreateTimer NtOpenKeyedEvent NtCreateKeyedEvent NtOpenEventPair NtCreateEventPair NtOpenEvent NtCreateEvent NtCreateSymbolicLinkObject NtImpersonateClientOfPort NtSecureConnectPort NtCreatePort NtQueryDirectoryObject NtCreateDirectoryObject NtAllocateVirtualMemory RtlUnicodeStringToAnsiString NtOpenProcessToken RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitString NtQueryInformationProcess RtlSetThreadErrorMode RtlGetFullPathName_U RtlSetCurrentDirectory_U RtlGetCurrentDirectory_U RtlLengthSid RtlAddAccessAllowedAceEx RtlCreateAcl NtNotifyChangeDirectoryFile NtWaitForSingleObject NtQuerySymbolicLinkObject NtOpenSymbolicLinkObject RtlCompareUnicodeString NtQuerySystemInformation NtQueryVolumeInformationFile NtCreateNamedPipeFile NtCreateMailslotFile NtFsControlFile NtDeviceIoControlFile NtWriteFile NtReadFile NtDeleteFile NtSetInformationFile NtQueryFullAttributesFile NtQueryInformationFile NtQueryDirectoryFile NtOpenFile NtCreateFile NtOpenDirectoryObject RtlGetDaclSecurityDescriptor RtlSetDaclSecurityDescriptor NtQuerySecurityObject NtQueryObject RtlAddAce RtlGetAce RtlSelfRelativeToAbsoluteSD RtlLengthSecurityDescriptor RtlMakeSelfRelativeSD RtlGetControlSecurityDescriptor RtlValidSecurityDescriptor NtSetInformationProcess NtQueryAttributesFile NtProtectVirtualMemory LdrGetProcedureAddress NtDeleteValueKey NtSetValueKey NtEnumerateKey NtCreateKey NtOpenKey NtQueryValueKey NtOpenThreadToken RtlInitUnicodeString NtRequestWaitReplyPort NtRegisterThreadTerminatePort NtConnectPort NtSetInformationThread _strlwr memcpy memset _wcsicmp _chkstk _wcsnicmp towlower wcsstr wcschr _itow memmove wcscpy_s wcsncpy _wcslwr wcstol _wtoi wcsncmp _stricmp wcstoul wcsrchr _alldiv _allmul iswctype _ultow strchr strncmp _aulldiv wcsncpy_s tolower _wtoi64 strstr _strnicmp

kernel32

GlobalAlloc IsWow64Process SetLocaleInfoW SetLocaleInfoA PostQueuedCompletionStatus EnumResourceNamesW FormatMessageW LoadLibraryExW GetVersionExW GetLongPathNameW GetFullPathNameW GetProcessId GetACP WinExec OpenProcess CreateProcessA TerminateProcess QueueUserWorkItem CreateFileA SizeofResource WriteProcessMemory ReadProcessMemory GetUserDefaultLCID GetSystemDefaultLCID GetSystemDefaultLangID GetUserDefaultLangID GetUserDefaultUILanguage GetSystemDefaultUILanguage SetThreadExecutionState MapViewOfFile OpenFileMappingW CreateFileMappingW GetWindowsDirectoryW HeapDestroy HeapCreate SetThreadPriority GetExitCodeProcess OpenEventW RaiseException GlobalAddAtomW UnmapViewOfFile MapViewOfFileEx GetThreadTimes SleepEx GetTickCount64 DuplicateHandle FindResourceA FindResourceW LockResource LoadResource GlobalLock GlobalUnlock GlobalSize GetConsoleWindow SetConsoleTitleW SetConsoleTitleA GetConsoleTitleW GetConsoleTitleA AllocConsole GetStartupInfoW OpenThread WaitForMultipleObjects WideCharToMultiByte GetSystemInfo lstrcmpW ReplaceFileW MoveFileWithProgressW MoveFileExW GetPrivateProfileStringW GetSystemWindowsDirectoryW GetTickCount QueueUserAPC OpenMutexW CreateMutexW ReleaseMutex DeleteCriticalSection TryEnterCriticalSection GetFileSizeEx GetFileAttributesW DeleteFileW CreateDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsSetValue TlsGetValue TlsAlloc GetModuleHandleA ProcessIdToSessionId GetCurrentProcessId SetEvent Sleep OutputDebugStringW IsDebuggerPresent lstrcatW lstrcpyW GetModuleFileNameW CreateProcessW CreateThread ExitProcess LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetEnvironmentVariableW GetCommandLineW LocalFree LocalAlloc GetSystemTimeAsFileTime LoadLibraryW GetModuleHandleW FreeLibrary ExpandEnvironmentStringsW CreateEventW WaitForSingleObject GlobalFree GetProcAddress CloseHandle SetFilePointerEx ReadFile CreateFileW SetLastError VirtualQueryEx VirtualProtectEx VirtualQuery GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree

SbieApi_Call SbieApi_CheckInternetAccess SbieApi_DisableForceProcess SbieApi_EnumBoxes SbieApi_EnumProcessEx SbieApi_GetFileName SbieApi_GetHomePath SbieApi_GetMessage SbieApi_GetUnmountHive SbieApi_GetVersion SbieApi_GetVersionEx SbieApi_HookTramp SbieApi_IsBoxEnabled SbieApi_Log SbieApi_LogEx SbieApi_MonitorControl SbieApi_MonitorGetEx SbieApi_MonitorPut SbieApi_MonitorPut2 SbieApi_OpenProcess SbieApi_QueryBoxPath SbieApi_QueryConf SbieApi_QueryConfBool SbieApi_QueryDrvInfo SbieApi_QueryPathList SbieApi_QueryProcess SbieApi_QueryProcessEx SbieApi_QueryProcessInfo SbieApi_QueryProcessPath SbieApi_ReloadConf SbieApi_SessionLeader SbieApi_SetUserName SbieApi_UpdateConf SbieDll_AllocMem SbieDll_AssocQueryCommand SbieDll_AssocQueryProgram SbieDll_CallServer SbieDll_ComCreateProxy SbieDll_ComCreateStub SbieDll_DeviceChange SbieDll_DisableElevationHook SbieDll_ExpandAndRunProgram SbieDll_FormatMessage SbieDll_FormatMessage0 SbieDll_FormatMessage1 SbieDll_FormatMessage2 SbieDll_FreeMem SbieDll_GetDrivePath SbieDll_GetHandlePath SbieDll_GetLanguage SbieDll_GetServiceRegistryValue SbieDll_GetStartError SbieDll_GetTokenElevationType SbieDll_GetUserPathEx SbieDll_Hook SbieDll_InitPStore SbieDll_IsBoxedService SbieDll_IsDirectory SbieDll_IsOpenCOM SbieDll_IsOpenClsid SbieDll_KillAll SbieDll_KillOne SbieDll_Mount SbieDll_PortName SbieDll_QueueCreate SbieDll_QueueGetReq SbieDll_QueueGetRpl SbieDll_QueuePutReq SbieDll_QueuePutRpl SbieDll_RegisterDllCallback SbieDll_RunFromHome SbieDll_RunSandboxed SbieDll_SetServiceRegistryValue SbieDll_StartBoxedService SbieDll_StartCOM SbieDll_StartSbieSvc SbieDll_TranslateNtToDosPath SbieDll_Unmount SbieDll_UpdateConf Sbie_snprintf Sbie_snwprintf _File_GetName@20 _Key_GetName@20 _SbieApi_CheckInternetAccess@12 _SbieApi_DisableForceProcess@8 _SbieApi_EnumBoxes@8 _SbieApi_EnumBoxesEx@12 _SbieApi_EnumProcessEx@20 _SbieApi_GetBlockedDll@8 _SbieApi_GetFileName@16 _SbieApi_GetHomePath@16 _SbieApi_GetMessage@24 _SbieApi_GetUnmountHive@4 _SbieApi_GetVersion@4 _SbieApi_GetVersionEx@8 _SbieApi_HookTramp@8 _SbieApi_Ioctl@4 _SbieApi_IsBoxEnabled@4 _SbieApi_LogMsgEx@16 _SbieApi_LogMsgExt@12 _SbieApi_MonitorControl@8 _SbieApi_MonitorGetEx@16 _SbieApi_MonitorPut2@12 _SbieApi_MonitorPut2Ex@20 _SbieApi_MonitorPut@8 _SbieApi_MonitorPutEx@16 _SbieApi_MonitorPutMsg@8 _SbieApi_OpenProcess@8 _SbieApi_ProcessExemptionControl@16 _SbieApi_QueryBoxPath@28 _SbieApi_QueryConf@20 _SbieApi_QueryConfBool@12 _SbieApi_QueryConfNumber64@16 _SbieApi_QueryConfNumber@12 _SbieApi_QueryDrvInfo@12 _SbieApi_QueryPathList@20 _SbieApi_QueryProcess@20 _SbieApi_QueryProcessEx2@28 _SbieApi_QueryProcessEx@24 _SbieApi_QueryProcessInfo@8 _SbieApi_QueryProcessInfoEx@16 _SbieApi_QueryProcessInfoStr@16 _SbieApi_QueryProcessPath@28 _SbieApi_ReloadConf@8 _SbieApi_SessionLeader@8 _SbieApi_SetUserName@8 _SbieApi_UpdateConf@16 _SbieApi_vLogEx@16 _SbieDll_AllocMem@4 _SbieDll_AssocQueryCommand@4 _SbieDll_AssocQueryProgram@4 _SbieDll_CallProxySvr@20 _SbieDll_CallServer@4 _SbieDll_CallServerQueue@16 _SbieDll_CheckPatternInList@16 _SbieDll_CheckProcessLocalSystem@4 _SbieDll_CheckStringInList@12 _SbieDll_CheckStringInListA@12 _SbieDll_ComCreateProxy@16 _SbieDll_ComCreateStub@16 _SbieDll_DeviceChange@8 _SbieDll_DisableCHPE@0 _SbieDll_DisableElevationHook@0 _SbieDll_ExpandAndRunProgram@4 _SbieDll_FindArgumentEnd@4 _SbieDll_FormatMessage0@4 _SbieDll_FormatMessage1@8 _SbieDll_FormatMessage2@12 _SbieDll_FormatMessage@8 _SbieDll_FreeMem@4 _SbieDll_GetBorderColor@20 _SbieDll_GetDrivePath@4 _SbieDll_GetHandlePath@12 _SbieDll_GetLanguage@4 _SbieDll_GetPublicSD@0 _SbieDll_GetServiceRegistryValue@12 _SbieDll_GetSettingsForName@24 _SbieDll_GetSettingsForName_bool@16 _SbieDll_GetStartError@0 _SbieDll_GetStringForStringList@20 _SbieDll_GetStringsForStringList@24 _SbieDll_GetSysFunction@4 _SbieDll_GetTokenElevationType@0 _SbieDll_GetUserPathEx@4 _SbieDll_Hook@16 _SbieDll_HookInit@0 _SbieDll_InitPStore@0 _SbieDll_InjectLow@12 _SbieDll_InjectLow_InitHelper@0 _SbieDll_InjectLow_InitSyscalls@4 _SbieDll_InjectLow_SendHandle@4 _SbieDll_IsBoxedService@4 _SbieDll_IsDirectory@4 _SbieDll_IsDllSkipHook@4 _SbieDll_IsOpenCOM@0 _SbieDll_IsOpenClsid@12 _SbieDll_IsReservedFileName@4 _SbieDll_KillAll@8 _SbieDll_KillOne@4 _SbieDll_MatchImage@12 _SbieDll_MatchPathImpl@28 _SbieDll_Mount@12 _SbieDll_OpenProcess@8 _SbieDll_PortName@0 _SbieDll_QueryConf@20 _SbieDll_QueryFileAttributes@16 _SbieDll_QueueCreate@8 _SbieDll_QueueGetReq@24 _SbieDll_QueueGetRpl@16 _SbieDll_QueuePutReq@20 _SbieDll_QueuePutRpl@16 _SbieDll_RegisterDllCallback@4 _SbieDll_RunFromHome@16 _SbieDll_RunSandboxed@24 _SbieDll_RunStartExe@8 _SbieDll_SetFakeAdmin@4 _SbieDll_SetServiceRegistryValue@16 _SbieDll_StartBoxedService@8 _SbieDll_StartCOM@4 _SbieDll_StartSbieSvc@4 _SbieDll_TraceModule@4 _SbieDll_TranslateNtToDosPath@4 _SbieDll_UnHookModule@4 _SbieDll_Unmount@4 _SbieDll_UpdateConf@20 _Scm_HookCloseServiceHandle@4 _Scm_HookControlService@4 _Scm_HookOpenServiceW@4 _Scm_HookQueryServiceStatus@4 _Scm_HookQueryServiceStatusEx@4 _Scm_HookSetServiceStatus@4 _Scm_HookStartServiceCtrlDispatcherW@4 _Scm_HookStartServiceW@4

Name

.text

Size

603KB

Virtual Size

602KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

32/SbieSvc.exe

IMPHASH 604c74777e9dd1de866eaa7704ca092d
SHA256 4134107f87e6822322b7213d7718b32b5189ab7235f53d31aa3ae2e008f78507
MD5 18c8a5bbe4776cc8104caa748c05eedf
SHA1 e66c071c43c485860d717e7e7a48b81f538ac088
SHA512 9466c1a9b8eb798c2e94c75aa51c0190dbde76f0a3bebe2a8bad100c99a19f19a6b703f92837e882af6173b34e8f2f6186f258eb663368bb317da7b4dc1c831e
SSDEEP 6144:TtdMiJH5CnlnNO1agO8pkjwsIa2OnVauwhFp078oO7GvFKoOeEtc9d73ERLz5wTa:4nlnNO1a8dsIaxnjwhFpy8MO49d3ER/r
TLSH
T14F748F01FD41A03AD5A205305AA9FFBAA97DB8300B5474CBF3D44EBA5A306D1B73875B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

0b:de:06:3a:55:ce:d8:5b:2e:27:8e:14:5a:b1:83:51:07:b0:10:01:c3:66:4b:db:58:62:54:a2:17:73:36:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

164643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\Win32\SbieRelease\SbieSvc.pdb

sbiedll

_SbieDll_MatchPathImpl@28 _SbieDll_OpenProcess@8 _SbieDll_FormatMessage0@4 _SbieDll_GetLanguage@4 _SbieDll_FindArgumentEnd@4 _SbieDll_SetServiceRegistryValue@16 _SbieApi_SessionLeader@8 _SbieDll_CheckPatternInList@16 _SbieDll_CheckStringInList@12 _SbieApi_EnumBoxesEx@12 _SbieDll_GetPublicSD@0 _SbieApi_LogMsgExt@12 _SbieDll_DisableCHPE@0 _SbieDll_GetSettingsForName_bool@16 _SbieApi_CheckInternetAccess@12 _SbieDll_QueuePutRpl@16 _SbieDll_QueueGetReq@24 _SbieDll_QueueCreate@8 _SbieDll_FreeMem@4 _SbieDll_KillOne@4 _SbieApi_QueryConfNumber64@16 _SbieApi_QueryConfNumber@12 _SbieApi_QueryPathList@20 _SbieApi_GetHomePath@16 _SbieDll_GetStringsForStringList@24 _SbieDll_GetStringForStringList@20 _SbieDll_InjectLow@12 _SbieDll_InjectLow_InitSyscalls@4 _SbieDll_InjectLow_InitHelper@0 _SbieDll_PortName@0 _SbieDll_FormatMessage2@12 _SbieDll_GetServiceRegistryValue@12 _SbieDll_TranslateNtToDosPath@4 _SbieDll_RunStartExe@8 _SbieApi_GetUnmountHive@4 _SbieApi_SetUserName@8 _SbieApi_QueryConfBool@12 _SbieApi_QueryConf@20 _SbieApi_ReloadConf@8 _SbieApi_QueryDrvInfo@12 _SbieApi_EnumProcessEx@20 _SbieApi_QueryProcessPath@28 _SbieApi_QueryProcessEx2@28 _SbieApi_GetMessage@24 _SbieApi_GetVersionEx@8 SbieApi_Call _SbieDll_RunSandboxed@24 _SbieApi_IsBoxEnabled@4 _SbieDll_IsOpenClsid@12 _SbieDll_ComCreateStub@16 _SbieDll_RunFromHome@16 _SbieApi_QueryProcessInfoEx@16 _SbieApi_QueryProcessInfo@8 _SbieApi_QueryProcess@20 SbieApi_LogEx SbieApi_Log

ntdll

NtReplyWaitReceivePort NtRequestPort NtCreatePort NtUnloadKey NtOpenKey NtClose NtQueryInformationToken NtOpenProcessToken NtRequestWaitReplyPort RtlUnwind RtlInitUnicodeString NtLoadDriver RtlCreateVirtualAccountSid RtlSetDaclSecurityDescriptor NtCreateFile NtDuplicateObject NtOpenProcess NtResumeProcess NtSuspendProcess NtGetNextThread NtAdjustPrivilegesToken NtQueryInformationThread NtSetInformationProcess NtOpenDirectoryObject NtImpersonateClientOfPort NtAcceptConnectPort NtCompleteConnectPort NtConnectPort RtlNtStatusToDosError NtOpenFile NtLockVirtualMemory NtWriteVirtualMemory NtReadVirtualMemory NtDeleteFile NtFilterToken NtDuplicateToken NtOpenThreadToken NtSetInformationThread NtAllocateVirtualMemory RtlInitializeSid RtlSubAuthoritySid NtSetInformationToken NtQueryInformationProcess RtlCreateSecurityDescriptor NtLoadKey NtQuerySystemInformation NtWriteFile NtReadFile NtSetInformationFile

kernel32

VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetStringTypeW GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree EncodePointer InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable CreateFileW GetFileSizeEx ReadFile SetEndOfFile WriteFile CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap Sleep LCMapStringW WideCharToMultiByte HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateMutexW OpenMutexW CreateEventW OpenEventW WaitForMultipleObjects ExitProcess TerminateProcess CreateThread GetCurrentThread OpenProcess GetTickCount CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalFree GetEnvironmentVariableW SetCurrentDirectoryW GetFullPathNameW GetPrivateProfileStringW SetFilePointer SetLastError DeviceIoControl GetProcessTimes GetCurrentProcess GetCurrentProcessId SetThreadPriority TerminateThread GetLocalTime GetVersionExW VirtualAlloc VirtualFree LocalAlloc GetSystemWindowsDirectoryW DuplicateHandle ResetEvent QueueUserAPC GetCurrentThreadId OpenThread ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject TerminateJobObject SetInformationJobObject QueryInformationJobObject GetModuleHandleW GetProcAddress LoadLibraryW GlobalSize RegisterWaitForSingleObject UnregisterWait AllocConsole GetConsoleWindow GetConsoleProcessList OutputDebugStringW RaiseException InitializeCriticalSectionAndSpinCount GetCommandLineW GetSystemInfo GetFinalPathNameByHandleW DefineDosDeviceW GetLogicalDrives GetCompressedFileSizeW GetExitCodeProcess ResumeThread CreateProcessW CancelIo TlsAlloc TlsGetValue TlsSetValue SuspendThread WriteProcessMemory IsWow64Process GetModuleFileNameW GetModuleHandleA QueryFullProcessImageNameW QueueUserWorkItem DeleteFileW GetFileAttributesW SetFileAttributesW GetWindowsDirectoryW CopyFileW ReadProcessMemory MulDiv SleepEx AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SetStdHandle SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer MultiByteToWideChar WriteConsoleW

user32

GetMonitorInfoW EndPaint BeginPaint ShowWindow RegisterClassExW PackDDElParam GetRawInputDeviceInfoW GetRawInputDeviceInfoA UserHandleGrantAccess GetWindowInfo MonitorFromWindow ChangeDisplaySettingsExW ChangeDisplaySettingsExA GetIconInfo GetWindow GetWindowThreadProcessId GetClassNameW GetClassNameA EnumThreadWindows EnumWindows GetShellWindow FindWindowExW FindWindowExA FindWindowW FindWindowA EnumChildWindows GetParent GetDesktopWindow GetClassLongW GetClassLongA GetWindowLongW GetWindowLongA ClipCursor MapWindowPoints ScreenToClient ClientToScreen SetCursorPos GetWindowRect GetClientRect GetPropW GetPropA SetPropW ReleaseDC GetDC SetForegroundWindow IsWindowEnabled IsWindowUnicode KillTimer EnumClipboardFormats GetClipboardData SendMessageW wsprintfW GetMessageW DispatchMessageW SetTimer OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CreateDesktopW SetThreadDesktop GetThreadDesktop CreateWindowStationW SetProcessWindowStation GetProcessWindowStation SendMessageA GetClipboardSequenceNumber IsZoomed IsIconic PostMessageA SendMessageTimeoutW SendNotifyMessageA IsWindowVisible SetWindowPos DestroyWindow IsWindow CreateWindowExW RegisterClassW DefWindowProcW PostMessageW SendNotifyMessageW

advapi32

RegCloseKey LookupPrivilegeValueW LookupAccountSidW GetTokenInformation AdjustTokenPrivileges OpenProcessToken ConvertSidToStringSidW DuplicateTokenEx OpenThreadToken CreateProcessAsUserW RegOpenKeyExW RegQueryValueExW ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupAccountNameW LsaFreeMemory LsaManageSidNameMapping CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetTokenInformation SetSecurityInfo ControlService EnumServicesStatusExW StartServiceW OpenEventLogW ReportEventW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RevertToSelf SetThreadToken AddAccessAllowedAce DuplicateToken EqualSid GetLengthSid AllocateAndInitializeSid CheckTokenMembership FreeSid CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash EnumServicesStatusW QueryServiceConfigW QueryServiceConfig2W AccessCheck GetSecurityInfo

psapi

GetModuleFileNameExW GetProcessMemoryInfo GetModuleBaseNameW EnumProcessModules

ole32

CoSetProxyBlanket CoInitializeEx CoGetClassObject CoMarshalInterface CoUnmarshalInterface CoInitializeSecurity CoQueryProxyBlanket CoInitialize CoCopyProxy StringFromGUID2 CoTaskMemFree CoGetObject CoRegisterClassObject CoRevokeClassObject CreateStreamOnHGlobal

crypt32

CryptUnprotectData CryptProtectData

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

gdi32

TextOutW CreateSolidBrush CreateFontW SetBkColor GetMetaFileBitsEx GetDIBits DeleteDC CreateCompatibleDC SetTextColor SelectObject GetEnhMetaFileBits GetDeviceCaps

netapi32

NetUseAdd

wtsapi32

WTSQueryUserToken

rpcrt4

RpcMgmtEpEltInqBegin RpcMgmtEpEltInqNextW UuidFromStringW RpcStringFreeW RpcBindingToStringBindingW RpcMgmtEpEltInqDone

bcrypt

BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptFinishHash BCryptHashData BCryptCreateHash BCryptVerifySignature BCryptDestroyKey BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptGetProperty

Name

.text

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

KmdUtil.exe

IMPHASH 661671840b63d3a9bec233361ad4becb
SHA256 9f9818743dd3f2db77d50aabc28069d99d1124ddaa219773ac1ec300499f79e0
MD5 f39080039a4d55d33f8e91b935860133
SHA1 207a0309a498f43c35dd603ad7b4234239e88d58
SHA512 110a9c339c2371b5319437c0c0982dd3dbeec2a12e0fc59d2a9cc48aaf7ba3b90f35110a81b848128908051c27fcdb4db557b7009ad4c984cfdea4debe3360e0
SSDEEP 3072:3Be3ngbC8VzYk1bI1baRAOt8hBAt/Nxb1QEez/QvFi5Lw77tRNk:3Bm8Sk1mbcAOwmF0o777W
TLSH
T10E247C51B3E500F9E5A7C2398DA69601F672784507609BDF03A443BAEF23BD05E3DB62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

40:91:e3:51:1c:59:95:22:1d:8e:10:09:47:1d:8e:58:b5:bf:0a:09:bd:44:ac:13:ef:d9:a6:3e:cd:10:16:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

123976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\KmdUtil.pdb

ntdll

NtUnloadDriver RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlInitUnicodeString

psapi

EnumProcessModules GetModuleBaseNameW EnumProcesses

sbiedll

Sbie_snwprintf SbieApi_Ioctl SbieApi_Call SbieApi_GetVersion SbieApi_QueryConf SbieApi_GetHomePath SbieApi_LogMsgEx SbieApi_IsBoxEnabled

kernel32

GetModuleFileNameW LoadLibraryW LocalAlloc FormatMessageW CloseHandle GetCurrentProcess HeapAlloc HeapFree GetProcessHeap GetCurrentProcessId ExitProcess TerminateProcess ProcessIdToSessionId OpenProcess GetModuleHandleW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetFileType GetStartupInfoW FreeLibrary GetModuleHandleExW SetLastError FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualProtect LoadLibraryExW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc RaiseException CreateFileW WriteConsoleW EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetLastError GetCommandLineW LocalFree QueryPerformanceCounter InitializeSListHead FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW Sleep FlsAlloc WideCharToMultiByte

user32

SendMessageW RegisterClassW GetMessageW MessageBoxW CreateWindowExW PostMessageW DefWindowProcW GetWindowLongW DestroyWindow ShowWindow SetFocus GetFocus GetWindowRect SystemParametersInfoW LoadIconW LoadCursorW GetWindow GetParent GetDesktopWindow DispatchMessageW

gdi32

CreateFontIndirectW GetStockObject

advapi32

AdjustTokenPrivileges CopySid GetAce GetSecurityDescriptorDacl SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW ConvertSidToStringSidW ConvertStringSidToSidW RegCreateKeyExW CloseServiceHandle LookupPrivilegeValueW RegDeleteKeyW OpenProcessToken StartServiceW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

CommandLineToArgvW

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

LICENSE.TXT

SHA256 eaa2bd99272986eeeed20379af007aeb372de6ae469694cd25184c318e38fd09
MD5 37732dfef8890422ce1ce5caaa393241
SHA1 4a14ffdba59eaa555685d8bf5fbd2a0c5fce2341
SHA512 98f13d203102b8d003c348f95256fe3cf97bf3a4b4ab445106024d4f3530ae076929dcc25f2dc8573fea7f53f60c1ec1ef20a5156484bda5372cb8ea75582bf0
TLSH
T19A01F10E9441C3B7499011C27C4690CEE22BA75376DD80913409D30E8F26E3116A64DC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Manifest0.txt

SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

NSIS installer

installer

Manifest1.txt

SHA256 de0167798a89a4b80ec2ccb4cb4ab95bfe4da2e91666f27fb83dcb75c71206ac
MD5 1689ab6cf954209a1286a88c5ddee65a
SHA1 4028a3db74cc240643027cbb9946d3f03162f2ba
SHA512 aca0e04f607cf15ed8aeb707d6d6acb103278d2cd2fb27a3139904351c64a2c95f1857ee57c1d44cb3268bf07e1b112b91055427809a518fc1697872d048b7ec
TLSH
T148E0C0C1F15C976D975001931A73D41010BEAF1615BD45EC24C02AFB77077D284810B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Manifest2.txt

SHA256 55e7b42230dffab5e4f1a13476e888eea5850ec8ee121e23a7b1c48836299335
MD5 9bc1b27cc08b3673686fa4ecf793a278
SHA1 67b588168dc8c8667343443d0a23cac59cab234b
SHA512 0bd40ead34aa1fc40aa25f4c59068026724e7f7cf5dfa8f3142cea00fd5804ba9309f4e92db2e36a72c7ee15ca3d6a5fbf0700429347ebfcd650a1cb1ea557ed
TLSH
T155B01282915C4C22A4634F2382A4CC00F73123D244280548D8BB17630D10029078A111
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SandboxieBITS.exe

IMPHASH f0c700ba5c8f72c141b5b4f6527c636f
SHA256 6dc1eb5e2de39fb9ca6cf417a96b5785830f74f30c8942311c3e3606ea69446e
MD5 b4baf9a3c86dfdd560bd14381b23aacc
SHA1 995a6837e20b247d39360b8bb5d76e10ffa7e44b
SHA512 7121c39f3e8ae10ff901d37aa957cdaca698a6ba19bfe3e4076e7b159be0ada44da039d6ccbf8f8540d4d07f9e945b234e128b321318439952bf72ea4a8faf0b
SSDEEP 3072:47dU8hN2zKH3dy++12EeyXDAUd6REvSkNM:4qU24I12iXDAPSSMM
TLSH
T128D35A5763B530E4E5B68638C5958A659732BC714760ABAF03904E9B3F233E18D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

eb:00:cd:d2:33:11:df:47:db:25:4f:08:95:21:d3:b0:5d:4f:ed:b9:11:8f:98:ce:59:35:7b:23:1a:d6:ea:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

5832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieBITS.pdb

advapi32

OpenProcessToken DuplicateTokenEx LogonUserW StartServiceCtrlDispatcherW SetThreadToken

kernel32

SetEnvironmentVariableW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetVersionExW GetModuleHandleW GetProcAddress LoadLibraryW WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

user32

wsprintfW MessageBoxW

ole32

CoImpersonateClient

wtsapi32

WTSQueryUserToken

sbiedll

SbieDll_Hook

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SandboxieCrypto.exe

IMPHASH 9b3b2c4545104c2b880c29a09ee56527
SHA256 4f27776251975b6ecd61d79d7f9c1dc197eb3d591c41c997bf635421488f6ee5
MD5 5141feea1b2ea8b0cc7dbf8a4d94a441
SHA1 0da89ba503bde35eb161fc7e55c25fea7a690440
SHA512 5fde45ce7acd2a1c64a53d026c011677de4d07c292ec0099abf1c2a446db199bb18bd7bdee7814a2268079efff2f463b8df9774c5b273da1f7b3485fa58ea784
SSDEEP 3072:/6uAUPKVjwTlXBOj7U0ktOjmcUhrqE0KAnnAWa:CxQwklMjvktOjkcqAnA/
TLSH
T1E6F36B4773A530E9E4A78238C9A18A51E7727C714B608BDF03945F6A3F233D15E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

c2:d8:17:f1:a9:2a:aa:ed:75:b9:87:d7:5a:c0:8c:03:85:fb:d0:cd:da:64:7a:41:c5:d0:6f:84:e0:c5:e8:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

7608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieCrypto.pdb

sbiedll

Scm_HookSetServiceStatus SbieDll_Hook

ntdll

RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry

kernel32

GetStringTypeW SetStdHandle WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetEnvironmentVariableW CreateFileW CloseHandle DuplicateHandle GetLastError SetLastError HeapAlloc FlsAlloc GetProcessHeap SetEvent WaitForSingleObject CreateMutexW OpenMutexW CreateEventW OpenEventW GetCurrentProcessId GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue GetWindowsDirectoryW GetVersionExW GetModuleHandleW GetProcAddress LoadLibraryW FreeEnvironmentStringsW FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect HeapFree TerminateProcess HeapReAlloc HeapSize SetFilePointerEx LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess GetEnvironmentStringsW IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte

advapi32

GetTokenInformation DuplicateToken AccessCheckByType OpenProcessToken SetThreadToken StartServiceCtrlDispatcherW

user32

MessageBoxW wsprintfW

Name

.text

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SandboxieDcomLaunch.exe

IMPHASH 4543964e61d1f881518eb06bc0032492
SHA256 62d54ba2f7e969218f283766092c29cf05842692f5d1ce5103c8506c96903a18
MD5 3cec0ec95b03ca70e6a71f3e8c7d06c5
SHA1 c0c6d62c131a1c3e7805a6c58186e66b7ca4d073
SHA512 295dc637348a02ba33cdacf87e3f210593e8b05a3c810532bedac07983d8bded1aa3adad5789a6b692df9344d97c7498bf56671a3dd75c76c5a12cf9ef6e3702
SSDEEP 3072:ZaZjwp0VatzbZPdjUvDE3RIJN9078Vl/0TH:lmot5BYDEICwlcTH
TLSH
T144046B4772E430E5E1778638C9A28A55A7737C750B609BDF03A44B6A3F233C19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

3f:4b:ba:6a:5c:f3:59:da:7c:89:a0:9b:64:6f:4f:30:fb:10:eb:43:ac:b4:4c:1d:23:68:8f:ea:13:62:3a:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

9736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieDcomLaunch.pdb

sbiedll

SbieApi_EnumProcessEx SbieApi_OpenProcess SbieDll_Hook SbieDll_IsBoxedService SbieDll_StartBoxedService SbieDll_CheckProcessLocalSystem Scm_HookSetServiceStatus Scm_HookStartServiceCtrlDispatcherW Scm_HookOpenServiceW Scm_HookStartServiceW Scm_HookCloseServiceHandle Scm_HookControlService SbieApi_QueryProcess Scm_HookQueryServiceStatus Scm_HookQueryServiceStatusEx

kernel32

HeapReAlloc HeapSize SetFilePointerEx LCMapStringW SetEnvironmentVariableW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap FlushFileBuffers WaitForSingleObject CreateEventW OpenEventW GetCurrentProcessId ExitProcess CreateThread GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue OpenProcess GetVersionExW GetModuleHandleW GetProcAddress LoadLibraryW GetConsoleOutputCP GetConsoleMode CreateFileW WriteConsoleW SetEvent GetSystemTimeAsFileTime VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW

advapi32

QueryServiceStatusEx GetTokenInformation DuplicateToken AccessCheckByType OpenProcessToken SetThreadToken StartServiceCtrlDispatcherW

ntdll

NtOpenKey RtlAdjustPrivilege NtQueryValueKey NtQueryInformationProcess NtClose RtlInitUnicodeString

user32

wsprintfW MessageBoxW

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SandboxieRpcSs.exe

IMPHASH fe15ced9430728b9bc913a569a20640f
SHA256 be98d853ff1126ea62576f2541cbb9ac59d268064298ec6310dc32068b0a9efe
MD5 5dc2e46ce9e1379fb68ec7062ee9ed6b
SHA1 770efdeffbb44cca6498fb845e876fd3159a0424
SHA512 c7b2a1851dab5bc3480a9c0d8f1025bcf4167bf8502423167464fb33c35cb262920dddc01c031c1a96346047df2c307c2515737f3d97906e34d7def10b64c1ab
SSDEEP 3072:0uyRJco2JjgMzvp8CgLrpqrnXUDd+Hc24wBDjxhP:0FRG5JgMPYrpsnkWpHPP
TLSH
T11D145C47B2A520E5E0738638C9A28656E7777C3217219BDF03A04A773F237C16D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

90:0c:c0:dc:f0:22:14:1f:21:79:38:2e:81:ab:ff:b2:f7:59:0e:7f:6a:57:f7:0f:58:0f:a1:d8:3d:5b:f5:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

20456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieRpcSs.pdb

sbiedll

SbieDll_QueuePutRpl SbieDll_QueueGetReq SbieDll_QueueCreate SbieDll_FreeMem SbieApi_Log Scm_HookControlService Scm_HookStartServiceW Scm_HookQueryServiceStatus Scm_HookQueryServiceStatusEx Scm_HookCloseServiceHandle Scm_HookOpenServiceW Scm_HookStartServiceCtrlDispatcherW Scm_HookSetServiceStatus SbieDll_IsDllSkipHook SbieDll_CheckProcessLocalSystem SbieDll_IsBoxedService SbieDll_IsOpenCOM SbieDll_CallServer SbieDll_Hook SbieApi_OpenProcess SbieDll_ExpandAndRunProgram SbieDll_StartBoxedService SbieDll_KillAll SbieApi_QueryConfBool SbieApi_QueryConf SbieApi_EnumProcessEx SbieApi_QueryProcess SbieApi_QueryProcessInfo

ws2_32

listen bind gethostbyname gethostname WSAStartup WSASetLastError WSASocketW

advapi32

StartServiceCtrlDispatcherW QueryServiceStatusEx RegQueryValueExW RegOpenKeyExW GetTokenInformation DuplicateToken AccessCheckByType OpenThreadToken OpenProcessToken SetThreadToken

kernel32

IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetModuleHandleExW GetModuleFileNameW WriteFile GetStdHandle RtlPcToFileHeader GetACP EncodePointer LoadLibraryExW FreeLibrary TlsFree WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle RaiseException GetModuleHandleW CloseHandle HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW GetProcessTimes ExitProcess CreateThread OpenProcess GetSystemTimeAsFileTime RegisterWaitForSingleObject UnregisterWait SetEnvironmentVariableW GetLastError SetLastError CreateMutexW OpenMutexW OpenEventW GetCurrentProcessId GetCurrentThreadId SetThreadPriority ResumeThread TlsAlloc TlsGetValue TlsSetValue GetVersionExW CreateFileMappingW GetProcAddress LoadLibraryW Sleep GlobalAlloc GlobalUnlock GlobalLock GlobalFree InitializeCriticalSectionAndSpinCount SetFilePointerEx LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx GetStringTypeW

ntdll

RtlInitUnicodeString NtQueryValueKey RtlAdjustPrivilege NtYieldExecution NtUnmapViewOfSection NtMapViewOfSection NtClose NtOpenKey

user32

MessageBoxW wsprintfW GetWindowThreadProcessId EnumWindows GetWindowLongW CreateWindowExW RegisterClassW DefWindowProcW DispatchMessageW GetMessageW

Name

.text

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SandboxieWUAU.exe

IMPHASH bd44ca28e98520c9b39364a0f704ad14
SHA256 4ca0e55719f41189e64aa084fc50be3a70b02a2a4e116c00f90c27b3e39bab75
MD5 7e38a16621129005759d5cae30d3ccf4
SHA1 30f2b3f5a3dc49290c6d706b79154d8c071cb346
SHA512 6c202fbc804798a5e3be70b2ffb469cda4891cc92e41132f001a47da786f915f8bedb8574daf6617c836b731f05c0a886dfba21f0e3243130d59946776eec233
SSDEEP 3072:z/0IrDWcxB2jC3L8+D4U/v8tzfPLBAbo44WuqR:z8UDO68+Dpv85LB7OFR
TLSH
T1A3D35A6763A530F8E0678678C4A58A559772BC754B609BEF03A04E5B3F233D14D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

b5:2f:bc:e0:d2:37:c6:c9:a7:1e:1f:63:64:c3:ef:9b:23:15:63:a9:35:02:1a:15:98:b6:f6:b3:d0:b7:80:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SandboxieWUAU.pdb

sbiedll

SbieDll_Hook SbieApi_EnumProcessEx SbieApi_QueryProcess

ntdll

RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry

kernel32

InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc VirtualProtect GetStringTypeW WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP EnterCriticalSection FlushFileBuffers HeapReAlloc HeapSize HeapFree SetLastError GetCurrentThreadId GetVersionExW GetLastError CloseHandle LoadLibraryW HeapAlloc GetProcAddress GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW SetStdHandle SetFilePointerEx LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FreeEnvironmentStringsW LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW

Name

.text

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SbieCtrl.exe

IMPHASH 2de86f283a0190e6916772ddff4306af
SHA256 8852001665cd2a591f85b4f707419f4769a2a505ebcaca04302acf6dbd3b1ff8
MD5 4b013ecbcb22c43e488ca4cde0a3e825
SHA1 d2b19f024533a6fdb0f643c1fee6324ad4cbda4a
SHA512 3be3900bc8d8d480e8ace4f0e3e7f01c33be0cc681970acfc442030db100685c2188a9c1699e05e7af1ba12c5d31708f3fe460bd6264350c211eb45f7ea987c9
SSDEEP 49152:FqqpDe5vUwRe/7GCyVVgYxodVniU6Ltr5sJFu+yNgdo7N1kgbLMnCV1y4Fijn:RoHtaFuBZX1bUGbijn
TLSH
T1F4F56B8962BC00DCD5A6E079C517453FF6F1B843473287DF40699B9A2F3B6A20E7A361
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

56:44:38:b1:f1:e9:17:22:5d:73:01:c1:5a:54:03:75:0a:25:a6:6d:1d:95:d9:b1:e9:5f:28:ad:32:06:ad:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

2130912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieCtrl.pdb

sbiedll

SbieDll_UpdateConf SbieDll_GetTokenElevationType SbieDll_KillOne SbieDll_DeviceChange SbieApi_ReloadConf SbieApi_SessionLeader SbieApi_MonitorGetEx SbieApi_MonitorControl SbieApi_ProcessExemptionControl SbieApi_GetMessage SbieDll_FreeMem SbieDll_CallServer SbieDll_GetStartError SbieDll_StartSbieSvc SbieApi_GetVersionEx SbieDll_IsReservedFileName SbieApi_EnumProcessEx SbieApi_QueryProcessInfo SbieApi_QueryProcessEx SbieDll_TranslateNtToDosPath SbieDll_GetUserPathEx SbieDll_GetDrivePath SbieDll_QueryFileAttributes SbieApi_QueryConfBool SbieApi_QueryConf SbieApi_GetFileName SbieApi_QueryBoxPath SbieDll_KillAll SbieApi_IsBoxEnabled SbieApi_EnumBoxesEx SbieDll_GetBorderColor SbieApi_DisableForceProcess SbieApi_Log SbieApi_QueryDrvInfo SbieApi_GetHomePath SbieApi_Call SbieDll_RunFromHome SbieDll_GetLanguage SbieDll_FormatMessage2 SbieDll_FormatMessage1 SbieDll_FormatMessage0 SbieDll_FormatMessage

ntdll

RtlUnwindEx VerSetConditionMask NtOpenKey NtQueryDirectoryObject NtOpenDirectoryObject NtClose RtlInitUnicodeString NtQueryDirectoryFile NtCreateFile RtlPcToFileHeader

psapi

GetModuleFileNameExW

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpReadData WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpSetOption WinHttpConnect

kernel32

GetUserDefaultUILanguage FindResourceExW GetCurrentDirectoryW FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle GetCurrentProcess lstrcmpiW lstrcpyW SetErrorMode FileTimeToLocalFileTime GetFileAttributesExW SystemTimeToTzSpecificLocalTime VerifyVersionInfoW GetTickCount64 GetProfileIntW SearchPathW GetTempFileNameW GetStringTypeW InitializeCriticalSectionEx GetCPInfo ReleaseSRWLockExclusive FileTimeToSystemTime WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemDefaultUILanguage IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation LoadResource LockResource SizeofResource FindResourceW DecodePointer GetLastError HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LocalFree CloseHandle LocalAlloc FormatMessageW GlobalAlloc GlobalFree CreateFileW ReadFile WriteFile GetTempPathW GetTickCount GetVersionExW GetLocaleInfoW GlobalFlags TerminateProcess OutputDebugStringW RaiseException ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA HeapQueryInformation GetSystemInfo VirtualAlloc VirtualQuery QueryPerformanceFrequency SetStdHandle GetFileType GetStdHandle FlsAlloc FlsGetValue FlsSetValue LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetCurrentThread GlobalGetAtomNameW lstrcmpA ResumeThread SuspendThread SetThreadPriority SetEvent VirtualProtect CompareStringW QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW GetModuleHandleExW GetSystemDirectoryW EncodePointer OutputDebugStringA SetLastError OpenProcess GetProcessTimes LCIDToLocaleName WaitForMultipleObjects CreateEventW CopyFileW UnmapViewOfFile MapViewOfFile CreateFileMappingW DeleteFileW GetDriveTypeW CreateThread ExpandEnvironmentStringsW MoveFileW RemoveDirectoryW FindNextFileW FindFirstFileW FindClose CreateDirectoryW FreeLibrary GetModuleFileNameW GetSystemTimeAsFileTime OpenEventW WaitForSingleObject ProcessIdToSessionId OpenMutexW CreateMutexW GetShortPathNameW FlsFree LCMapStringW SetCurrentDirectoryW GetCommandLineW GetSystemWindowsDirectoryW GetModuleHandleA GetProcAddress GlobalUnlock GetModuleHandleW GetCurrentProcessId GlobalSize GetFileSizeEx Sleep MulDiv GetWindowsDirectoryW GetFileTime LoadLibraryW GetCurrentThreadId GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GlobalLock AcquireSRWLockExclusive

user32

GetWindowRgn CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect CharUpperBuffW GetDoubleClickTime CopyAcceleratorTableW DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyExW IsCharLowerW GetKeyboardLayout WaitMessage PostThreadMessageW GetComboBoxInfo UpdateLayeredWindow DrawIcon FrameRect CopyIcon SetCursorPos IsZoomed DrawFrameControl DrawEdge EnumDisplayMonitors NotifyWinEvent HideCaret EnableScrollBar MessageBeep DrawFocusRect GetNextDlgGroupItem LockWindowUpdate GetMenuDefaultItem TrackMouseEvent CharUpperW SetParent GetSystemMenu UnionRect SendDlgItemMessageA CopyImage RealChildWindowFromPoint ShowOwnedPopups ReuseDDElParam UnpackDDElParam SetRectEmpty InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW BringWindowToTop DestroyMenu MapVirtualKeyW GetKeyNameTextW MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowTextW SendDlgItemMessageW CheckDlgButton SetDlgItemTextW GetDlgItemInt SetDlgItemInt WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongPtrW EqualRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect TrackPopupMenu SetMenu GetMenu GetCapture GetDlgItem SetWindowPlacement GetWindowPlacement IsChild GetClassInfoExW GetClassInfoW RegisterClassW GetMessageTime GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem GetLastActivePopup IsWindowEnabled IntersectRect InflateRect FillRect RemoveMenu GetMenuState GetMenuStringW EnumWindows GetSysColorBrush IsWindow GetIconInfo CreateIconIndirect LoadImageW MonitorFromRect MonitorFromPoint SetMenuDefaultItem ModifyMenuW AppendMenuW InsertMenuW GetMenuItemID CreatePopupMenu SetFocus PostQuitMessage LoadMenuW GetActiveWindow RegisterWindowMessageW IsRectEmpty TabbedTextOutW GrayStringW DrawTextExW SystemParametersInfoW DrawStateW DrawTextW GetMenuItemRect SetMenuItemInfoW GetMenuItemInfoW DeleteMenu GetMenuItemCount IsMenu GetMessagePos GetMessageW DrawIconEx FindWindowExW SetForegroundWindow GetDlgCtrlID IsIconic InvalidateRect DestroyCursor LoadBitmapW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows PtInRect OffsetRect SetRect InvertRect SetCursor GetWindowDC ReleaseCapture SetCapture CallWindowProcW DestroyIcon ClientToScreen GetSubMenu EnableMenuItem GetKeyState GetFocus IsClipboardFormatAvailable EmptyClipboard SetClipboardData GetWindow RegisterClipboardFormatW GetTitleBarInfo GetMonitorInfoW MonitorFromWindow LoadIconW GetWindowThreadProcessId FindWindowW SetClassLongPtrW WindowFromPoint GetCursorPos SetWindowRgn GetForegroundWindow GetSystemMetrics SetWindowPos SetLayeredWindowAttributes DestroyWindow EnumThreadWindows FlashWindowEx CopyRect GetSysColor EndPaint BeginPaint KillTimer SetTimer ScreenToClient GetClipboardData CloseClipboard OpenClipboard wsprintfW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW UpdateWindow MoveWindow ShowWindow CreateWindowExW MessageBoxW MsgWaitForMultipleObjects PeekMessageW DispatchMessageW TranslateMessage UnregisterClassW LoadCursorW GetClassNameW GetParent GetDesktopWindow GetWindowRect GetClientRect EnableWindow IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos RegisterClassExW DefWindowProcW PostMessageW SendMessageW ReleaseDC GetDC SetActiveWindow

gdi32

CreateBitmap CreateHatchBrush ExcludeClipRect MoveToEx SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx GetObjectType ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect SetRectRgn DPtoLP EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo CreateDCW StretchBlt CreateDIBSection SetDIBColorTable Polygon Polyline CreateRoundRectRgn LPtoDP GetRgnBox OffsetRgn FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW CopyMetaFileW CreatePatternBrush GetDeviceCaps GetStockObject GetTextExtentPoint32W PatBlt SelectObject GetTextMetricsW DeleteDC BitBlt CreateCompatibleBitmap CreateCompatibleDC GetBkColor GetTextColor CreateSolidBrush DeleteObject CreatePolygonRgn CreateFontIndirectW SetPixel GetObjectW CombineRgn CreateEllipticRgn CreateRectRgn Ellipse GetPixel Rectangle SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor CreatePen Escape GetClipBox GetCurrentObject PtVisible RectVisible SetTextColor TextOutW RoundRect ExtTextOutW SelectPalette ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx

msimg32

TransparentBlt AlphaBlend

comdlg32

GetOpenFileNameW ChooseColorW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

EnumServicesStatusW OpenEventLogW ReadEventLogW GetUserNameW RegCloseKey RegEnumValueW RegOpenKeyW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryValueW RegEnumKeyW OpenSCManagerW CloseEventLog CloseServiceHandle RegNotifyChangeKeyValue RegEnumKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW

shell32

SHBrowseForFolderW SHGetFileInfoW ShellExecuteExW Shell_NotifyIconW DragQueryFileW DragAcceptFiles ord165 SHGetFolderPathW ExtractIconExW DragFinish SHGetSpecialFolderLocation SHFileOperationW SHAppBarMessage SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comctl32

_TrackMouseEvent ImageList_Draw ImageList_GetIcon ImageList_GetImageCount ImageList_ReplaceIcon ImageList_SetBkColor ImageList_Remove ImageList_GetIconSize ImageList_GetImageInfo

shlwapi

PathFindExtensionW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW PathIsUNCW PathFindFileNameW UrlEscapeW PathFileExistsW

uxtheme

CloseThemeData OpenThemeData DrawThemeBackground GetThemeSysColor GetWindowTheme GetCurrentThemeName GetThemeColor IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemePartSize DrawThemeText DrawThemeParentBackground

ole32

OleDuplicateData ReleaseStgMedium CoUninitialize CoCreateGuid CoDisconnectObject CoInitializeEx CreateStreamOnHGlobal DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleLockRunning CoTaskMemAlloc CoInitialize CoCreateInstance GetRunningObjectTable CreateClassMoniker OleSetContainedObject OleCreate OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator CoTaskMemFree

oleaut32

VarBstrFromDate VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime LoadTypeLi VariantChangeType SysAllocStringLen SysAllocStringByteLen SysStringLen SysFreeString VariantClear VariantInit SysAllocString

gdiplus

GdipFree GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipGetImageWidth GdiplusShutdown GdipImageGetFrameDimensionsList GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipAlloc GdipGetPropertyItemSize GdipImageGetFrameCount GdipCreateHBITMAPFromBitmap GdipSetInterpolationMode GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageGraphicsContext GdiplusStartup GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdipGetPropertyItem GdipImageSelectActiveFrame

ws2_32

ntohl

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

684KB

Virtual Size

684KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SbieCtrl.exe.sig

SHA256 6d7af296b67a23820036f1e8add97173de78dfecb7aab9f944c4c855f5186960
MD5 0fd8f772a25106cf2e423633b29a4351
SHA1 8c757006780e9a93bc1b548ee892f5914c388935
SHA512 a6185cf196531618463f70f18b30dbef98a2adb39d14798c11cf860c4ac510e1cab1a2b96e3f854c3363482b4424f91ba69cd33364fd55eaee806b8066139a2a
TLSH
T19EA0220C22C0EA038B0800033F033C03C0028A802002CACA2288200808C233002F0022
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SbieDll.dll

IMPHASH 9653a0368d5a565295016a975b84caf6
SHA256 ed9cbfc3f842aba56a55bd43717fdb2f9381c5b00451e059818007e20e1af349
MD5 bbb5da77540cbbe30d4821ec5c8be0ee
SHA1 a7f82f32a5bf8099e2f446d2551a7928693b2f0c
SHA512 c80d914eca6766e6b60564796a29d825479d118adee4a5758200f608d2ac6d4284ff345b9a2130de6dbfeaa9c8161f894170f50ff0d4039349888d71d4fbe38c
SSDEEP 12288:ku7uC3Uibha5FnD+r7uKUUqppSgTXJl2rWD8bqjDOl:buC3UOhaIWKDqppSgTrKWiAOl
TLSH
T106257D45F3F91298E97FC179CA639617EA7174881731DBCF01908A892F63FC26A3A315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

a0:ce:d6:e8:2e:0b:84:62:63:3b:ec:9d:33:87:5e:e7:82:b0:ae:0b:80:c3:6a:73:56:2d:b0:29:fb:02:d4:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDll.pdb

ntdll

RtlRestoreContext NtSetInformationJobObject NtAssignProcessToJobObject NtOpenJobObject NtCreateJobObject NtUnmapViewOfSection RtlEqualSid RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlCreateSecurityDescriptor NtAdjustPrivilegesToken RtlCaptureContext NtFilterToken NtDuplicateObject NtSetInformationToken NtOpenThread NtOpenProcess RtlConvertSidToUnicodeString RtlSetSaclSecurityDescriptor NtSetSecurityObject RtlNtStatusToDosError NtProtectVirtualMemory NtLoadDriver LdrQueryImageFileExecutionOptions LdrQueryProcessModuleInformation LdrUnloadDll LdrLoadDll NtYieldExecution NtNotifyChangeMultipleKeys NtNotifyChangeKey NtEnumerateValueKey NtQueryMultipleValueKey NtSaveKey NtLoadKey2 NtLoadKey NtDeleteKey NtSetInformationKey NtQueryKey NtImpersonateAnonymousToken NtImpersonateThread NtDuplicateToken NtQueryInformationToken NtQuerySection NtMapViewOfSection NtOpenSection NtCreateSection NtOpenSemaphore NtCreateSemaphore NtOpenMutant NtCreateMutant NtOpenTimer NtCreateTimer NtOpenKeyedEvent NtCreateKeyedEvent NtOpenEventPair NtCreateEventPair NtOpenEvent NtCreateEvent NtCreateSymbolicLinkObject NtImpersonateClientOfPort NtSecureConnectPort NtCreatePort NtQueryDirectoryObject NtCreateDirectoryObject RtlUnicodeStringToAnsiString NtOpenProcessToken RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitString NtQueryInformationProcess RtlSetThreadErrorMode RtlGetFullPathName_U RtlSetCurrentDirectory_U RtlGetCurrentDirectory_U RtlLengthSid RtlAddAccessAllowedAceEx RtlCreateAcl NtNotifyChangeDirectoryFile NtWaitForSingleObject NtQuerySymbolicLinkObject NtOpenSymbolicLinkObject RtlCompareUnicodeString NtQuerySystemInformation NtQueryVolumeInformationFile NtCreateNamedPipeFile NtCreateMailslotFile NtFsControlFile NtDeviceIoControlFile NtWriteFile NtReadFile NtDeleteFile NtSetInformationFile NtQueryFullAttributesFile NtQueryInformationFile NtQueryDirectoryFile NtOpenFile NtCreateFile NtOpenDirectoryObject RtlGetDaclSecurityDescriptor RtlSetDaclSecurityDescriptor NtQuerySecurityObject NtQueryObject RtlAddAce RtlGetAce RtlSelfRelativeToAbsoluteSD RtlLengthSecurityDescriptor RtlMakeSelfRelativeSD RtlGetControlSecurityDescriptor RtlValidSecurityDescriptor NtSetInformationProcess NtQueryAttributesFile NtAllocateVirtualMemory LdrGetProcedureAddress NtDeleteValueKey NtSetValueKey NtEnumerateKey NtCreateKey NtOpenKey NtQueryValueKey NtOpenThreadToken RtlInitUnicodeString NtRequestWaitReplyPort NtRegisterThreadTerminatePort NtConnectPort NtSetInformationThread NtClose NtQueryVirtualMemory NtReadVirtualMemory _strlwr __C_specific_handler memcpy memset _wcsicmp __chkstk strcmp wcslen _wcsnicmp towlower wcsstr wcscpy wcschr _itow memcmp memmove wcscmp wcscpy_s wcsncpy _wcslwr wcstol _wtoi wcsncmp strlen wcstoul wcsrchr iswctype _ultow strchr strncmp strcpy _stricmp wcsncpy_s tolower _wtoi64 strstr _strnicmp

kernel32

GlobalFree SetLocaleInfoW SetLocaleInfoA PostQueuedCompletionStatus EnumResourceNamesW FormatMessageW LoadLibraryExW GetVersionExW GetLongPathNameW GetFullPathNameW GetProcessId GetACP WinExec OpenProcess CreateProcessA TerminateProcess QueueUserWorkItem CreateFileA SizeofResource WriteProcessMemory ReadProcessMemory VirtualAllocEx GetUserDefaultLCID GetSystemDefaultLCID GetSystemDefaultLangID GetUserDefaultLangID GetUserDefaultUILanguage GetSystemDefaultUILanguage SetThreadExecutionState MapViewOfFile OpenFileMappingW CreateFileMappingW GetWindowsDirectoryW HeapDestroy HeapCreate SetThreadPriority GetExitCodeProcess OpenEventW RaiseException GlobalAddAtomW UnmapViewOfFile MapViewOfFileEx GetThreadTimes SleepEx GetTickCount64 DuplicateHandle FindResourceA FindResourceW LockResource LoadResource GlobalLock GlobalUnlock GlobalSize GetConsoleWindow SetConsoleTitleW SetConsoleTitleA GetConsoleTitleW GetConsoleTitleA AllocConsole GetStartupInfoW OpenThread WaitForMultipleObjects WideCharToMultiByte GetSystemInfo lstrcmpW GetSystemWindowsDirectoryW ReplaceFileW MoveFileWithProgressW MoveFileExW GetPrivateProfileStringW GetTickCount QueueUserAPC OpenMutexW CreateMutexW ReleaseMutex DeleteCriticalSection TryEnterCriticalSection GetFileSizeEx GetFileAttributesW DeleteFileW CreateDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsSetValue TlsGetValue TlsAlloc GetModuleHandleA ProcessIdToSessionId GetCurrentProcessId SetEvent Sleep OutputDebugStringW IsDebuggerPresent lstrcatW lstrcpyW GetModuleFileNameW CreateProcessW CreateThread ExitProcess LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetEnvironmentVariableW GetCommandLineW LocalFree LocalAlloc GetSystemTimeAsFileTime LoadLibraryW GetModuleHandleW FreeLibrary ExpandEnvironmentStringsW CreateEventW WaitForSingleObject GlobalAlloc GetProcAddress CloseHandle SetFilePointerEx ReadFile CreateFileW SetLastError VirtualQueryEx VirtualProtectEx VirtualQuery VirtualFree VirtualProtect GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc

File_GetName Key_GetName SbieApi_Call SbieApi_CheckInternetAccess SbieApi_DisableForceProcess SbieApi_EnumBoxes SbieApi_EnumBoxesEx SbieApi_EnumProcessEx SbieApi_GetBlockedDll SbieApi_GetFileName SbieApi_GetHomePath SbieApi_GetMessage SbieApi_GetUnmountHive SbieApi_GetVersion SbieApi_GetVersionEx SbieApi_HookTramp SbieApi_Ioctl SbieApi_IsBoxEnabled SbieApi_Log SbieApi_LogEx SbieApi_LogMsgEx SbieApi_LogMsgExt SbieApi_MonitorControl SbieApi_MonitorGetEx SbieApi_MonitorPut SbieApi_MonitorPut2 SbieApi_MonitorPut2Ex SbieApi_MonitorPutEx SbieApi_MonitorPutMsg SbieApi_OpenProcess SbieApi_ProcessExemptionControl SbieApi_QueryBoxPath SbieApi_QueryConf SbieApi_QueryConfBool SbieApi_QueryConfNumber SbieApi_QueryConfNumber64 SbieApi_QueryDrvInfo SbieApi_QueryPathList SbieApi_QueryProcess SbieApi_QueryProcessEx SbieApi_QueryProcessEx2 SbieApi_QueryProcessInfo SbieApi_QueryProcessInfoEx SbieApi_QueryProcessInfoStr SbieApi_QueryProcessPath SbieApi_ReloadConf SbieApi_SessionLeader SbieApi_SetUserName SbieApi_UpdateConf SbieApi_vLogEx SbieDll_AllocMem SbieDll_AssocQueryCommand SbieDll_AssocQueryProgram SbieDll_CallProxySvr SbieDll_CallServer SbieDll_CallServerQueue SbieDll_CheckPatternInList SbieDll_CheckProcessLocalSystem SbieDll_CheckStringInList SbieDll_CheckStringInListA SbieDll_ComCreateProxy SbieDll_ComCreateStub SbieDll_DeviceChange SbieDll_DisableCHPE SbieDll_DisableElevationHook SbieDll_ExpandAndRunProgram SbieDll_FindArgumentEnd SbieDll_FormatMessage SbieDll_FormatMessage0 SbieDll_FormatMessage1 SbieDll_FormatMessage2 SbieDll_FreeMem SbieDll_GetBorderColor SbieDll_GetDrivePath SbieDll_GetHandlePath SbieDll_GetLanguage SbieDll_GetPublicSD SbieDll_GetServiceRegistryValue SbieDll_GetSettingsForName SbieDll_GetSettingsForName_bool SbieDll_GetStartError SbieDll_GetStringForStringList SbieDll_GetStringsForStringList SbieDll_GetSysFunction SbieDll_GetTokenElevationType SbieDll_GetUserPathEx SbieDll_Hook SbieDll_HookInit SbieDll_InitPStore SbieDll_InjectLow SbieDll_InjectLow_InitHelper SbieDll_InjectLow_InitSyscalls SbieDll_InjectLow_SendHandle SbieDll_IsBoxedService SbieDll_IsDirectory SbieDll_IsDllSkipHook SbieDll_IsOpenCOM SbieDll_IsOpenClsid SbieDll_IsReservedFileName SbieDll_KillAll SbieDll_KillOne SbieDll_MatchImage SbieDll_MatchPathImpl SbieDll_Mount SbieDll_OpenProcess SbieDll_PortName SbieDll_QueryConf SbieDll_QueryFileAttributes SbieDll_QueueCreate SbieDll_QueueGetReq SbieDll_QueueGetRpl SbieDll_QueuePutReq SbieDll_QueuePutRpl SbieDll_RegisterDllCallback SbieDll_RunFromHome SbieDll_RunSandboxed SbieDll_RunStartExe SbieDll_SetFakeAdmin SbieDll_SetServiceRegistryValue SbieDll_StartBoxedService SbieDll_StartCOM SbieDll_StartSbieSvc SbieDll_TraceModule SbieDll_TranslateNtToDosPath SbieDll_UnHookModule SbieDll_Unmount SbieDll_UpdateConf Sbie_snprintf Sbie_snwprintf Scm_HookCloseServiceHandle Scm_HookControlService Scm_HookOpenServiceW Scm_HookQueryServiceStatus Scm_HookQueryServiceStatusEx Scm_HookSetServiceStatus Scm_HookStartServiceCtrlDispatcherW Scm_HookStartServiceW

Name

.text

Size

700KB

Virtual Size

699KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SbieDrv.sys

IMPHASH c88b388d95da391ac4bbb5d54c34b8da
SHA256 2cb5b724f61a9a8b24fff01e172d60433880caab9665d5b4bfc0108f89a29d5d
MD5 89a07845587d7ecc8ac977d1e326cf36
SHA1 abfcb65fb1e0cad4564a12ea6e4273c4441ff821
SHA512 e4131b07e76f61f46e2b6bfda88f50ad013c6fae9a258c21f940cee00dd787c8832d7ef4f7261b129b153339a74e57c62cd926db51bfb31f2109a2b569d1cff3
SSDEEP 6144:0Geps0ckbDqeygE5Qv9ZRVS+AO4nluWYwC3/i:0GefAMlhlt4nluWu3K
TLSH
T1BB446D55F2E419E8F5B7D17DCAA68513EBB2B8062721C6CF03B085492F23BD1B939352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

NSIS installer

installer

Digest

23:39:44:e8:74:e1:3e:5a:10:66:d6:49:b4:43:0f:8d:e6:5c:f1:86:88:c0:9f:5f:9f:a5:01:2e:72:42:ba:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 11, 2026

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:84:96:86:ae:df:b4:b6:63:76:00:00:00:00:00:84

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2026 - May 11, 2027

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

251648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieDrv.pdb

ntoskrnl.exe

ExAcquireResourceSharedLite ZwCreateFile ZwClose ZwQueryDirectoryFile ZwYieldExecution _itow towlower KeInitializeEvent KeSetEvent KeWaitForSingleObject IoGetCurrentProcess RtlConvertSidToUnicodeString SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken ZwQueryInformationFile ZwCreateSection ZwMapViewOfSection ZwUnmapViewOfSection strcmp MmGetSystemRoutineAddress RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor RtlGetVersion KeDelayExecutionThread PsGetVersion ZwOpenKey ZwQueryValueKey RtlCreateAcl RtlAddAce RtlAddAccessAllowedAceEx RtlSetSaclSecurityDescriptor ZwSetInformationFile ZwWriteFile IoCreateFileSpecifyDeviceObjectHint NtClose ObOpenObjectByPointer strlen IoFileObjectType ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject PsGetProcessWin32WindowStation ExWindowStationObjectType MmProbeAndLockPages MmProtectMdlSystemAddress MmMapLockedPagesSpecifyCache IoAllocateMdl IoIs32bitProcess ZwWaitForSingleObject ZwUnloadKey wcsncpy_s _wcslwr KeBugCheckEx ExInitializeResourceLite ExDeleteResourceLite IoCreateFile ZwReadFile wcstoul _wtoi KeEnterCriticalRegion KeLeaveCriticalRegion ZwCreateDirectoryObject SeSinglePrivilegeCheck PsGetCurrentThreadId PsGetProcessId ZwDuplicateObject ZwOpenDirectoryObject ZwSetSecurityObject ZwCreateSymbolicLinkObject wcscmp PsProcessType PsLookupProcessByProcessId ObReferenceObjectByName ZwQueryDirectoryObject LpcRequestPort CmUnRegisterCallback PsCreateSystemThread PsTerminateSystemThread ZwCreateKey RtlUnicodeStringToInteger RtlInitializeSid RtlSubAuthoritySid RtlLengthSid RtlAddAccessAllowedAce ObQueryNameString ZwOpenProcessTokenEx ZwSetInformationToken ZwLoadKey ObOpenObjectByName PsThreadType IoAllocateErrorLogEntry IoWriteErrorLogEntry PsGetThreadProcessId PsGetThreadProcess RtlInt64ToUnicodeString PsSetCreateProcessNotifyRoutineEx PsSetLoadImageNotifyRoutine PsRemoveLoadImageNotifyRoutine PsGetProcessCreateTimeQuadPart PsSetThreadHardErrorsAreDisabled _ultow_s ZwTerminateProcess SeQuerySessionIdToken PsDereferenceImpersonationToken PsReferenceImpersonationToken PsGetProcessSessionId ZwQueryInformationProcess ZwSetInformationProcess SeTokenObjectType KeStackAttachProcess KeUnstackDetachProcess PsGetProcessPeb ZwOpenProcess RtlEqualUnicodeString ZwQueryInformationToken PsGetProcessJob SeTokenIsAdmin MmIsAddressValid NtDeviceIoControlFile PsImpersonateClient PsGetProcessWin32Process ZwQuerySystemInformation PsSetCreateThreadNotifyRoutine PsRemoveCreateThreadNotifyRoutine PsGetThreadId SeTokenType ZwDuplicateToken ZwOpenThreadToken ZwOpenProcessToken SeTokenImpersonationLevel PsGetProcessExitProcessCalled DbgPrintEx ZwDeviceIoControlFile RtlEqualSid _stricmp RtlQueryRegistryValues RtlWalkFrameChain RtlSetOwnerSecurityDescriptor PsGetProcessImageFileName PsIsProtectedProcess strchr RtlUnicodeToUTF8N RtlTimeFieldsToTime SeLocateProcessImageName _wtol ZwQueryInstallUILanguage KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock RtlUnicodeToMultiByteN SeFilterToken PsGetCurrentProcessId ObfDereferenceObject ObfReferenceObject ObReferenceObjectByHandle IoDeleteDevice IoCreateDevice IofCompleteRequest ExGetPreviousMode ExReleaseResourceLite _wcsnicmp _wcsicmp wcsrchr RtlFreeUnicodeString RtlCompareUnicodeString wcschr LpcPortObjectType wcslen wcscpy ZwSetValueKey __C_specific_handler ExAcquireResourceExclusiveLite ProbeForWrite ExRaiseStatus ProbeForRead ExFreePoolWithTag ExAllocatePoolWithTag KfRaiseIrql KeLowerIrql KeGetCurrentIrql DbgPrint RtlInitUnicodeString wcsncpy wcsstr wcsncmp RtlAnsiCharToUnicodeChar

hal

KeQueryPerformanceCounter

fltmgr.sys

FltRegisterFilter FltUnregisterFilter FltStartFiltering FltGetFileNameInformationUnsafe FltGetFileNameInformation FltReleaseFileNameInformation FltSetCallbackDataDirty

ksecdd.sys

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptVerifySignature BCryptDestroyKey BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider

fwpkclnt.sys

FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpsCalloutRegister1 FwpmBfeStateUnsubscribeChanges0 FwpmEngineOpen0 FwpmEngineClose0 FwpmTransactionBegin0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmSubLayerAdd0 FwpmCalloutAdd0 FwpsCalloutUnregisterById0 FwpmFilterAdd0

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INITDATA

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

340B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SbieIni.exe

IMPHASH 94254da014f36d726a008e0dd1f2b1af
SHA256 26cfdea0d62ae26c86d24abf32345ba89a7617508268be9b80a54f2feca8c297
MD5 705d27e6e872bad40874173a269a7da3
SHA1 aa3625356ca4feaa7ef412280594702e4d2f84e1
SHA512 5e420c9521ebf33c47000d0ca165602527c5e4996066dd02cbd8b778522ab0ce81d6e11fcf57391cd22d6ef774b97b61a8bf4550f2524ff75b02a7060c2da803
SSDEEP 3072:Axhvozd4XWq2bxIEV88Sw3i7L44RGxszTekUcdr9J:Anud4XWqgVOw3igsRfJ
TLSH
T116F34A5773E130E5E1B79638C8654606EB72B8761B709BDF03A482792F232D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

19:46:a7:e5:ee:1b:e6:3d:25:74:ad:c8:9b:9e:23:13:b0:f9:91:14:95:46:95:b9:e4:5e:76:20:33:92:24:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

9184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieIni.pdb

sbiedll

SbieDll_UpdateConf SbieApi_UpdateConf SbieApi_QueryConf SbieDll_TranslateNtToDosPath SbieApi_EnumBoxesEx SbieApi_IsBoxEnabled

kernel32

HeapReAlloc HeapSize WriteConsoleW SetFilePointerEx GetFileSizeEx GetCommandLineW HeapAlloc GetProcessHeap ExitProcess GetConsoleOutputCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetModuleHandleExW GetCommandLineA HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType CreateFileW CloseHandle GetConsoleMode SetConsoleMode ReadConsoleInputW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers

Name

.text

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SbieMsg.dll

SHA256 7ef43bf277730229088673b5888b1167ad12827480ebffe954bfd3d2f68aff14
MD5 31b12eaecfa75bb9ec7487cb8f602125
SHA1 9e7bf0aa6ddd0314242b3c60b3c34ea628344eab
SHA512 0947904d1c37aaf5b21a75e4f3b2671c9ac21a785bd719afb023a7737422847224cdf9f74e680619c8bf80b6ac89ec5dd7f74862f28e58b70299a87e2b401ead
SSDEEP 12288:TDKYk1o+cLvlSePy3k2ga62IVS6I85RXvPz/lksWULuhMl5QIuD:/41iSePnk6+6I85RXvPblkHf
TLSH
T1F9F5440767FA4118F6F3BB2169B542B15B7BBDD2AE3CC51C0285616D0CF1AA09D60BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

ad:21:d9:c6:47:f5:2f:3b:f4:a7:9a:cf:5c:69:5f:95:8c:99:c0:3b:84:b6:a2:22:8d:f0:fc:7f:3e:97:76:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieMsg.pdb

SbieSvc.exe

IMPHASH 123c1b435dcf2b51a033d9026d98759c
SHA256 a5a638a189f42d1b5c6cc34736497442a2b8f22657afb749bfe3f5042d70a61a
MD5 7d58228d368f52ea3ae0ebda2d90f41c
SHA1 237648ba2e47e65261560c14b19f66cdd1640a0b
SHA512 0efaf26ca7886a0d38e68b239733f3fe3fbb4d0939657abbe65d8861163f1b42ad9dd4812641b383bed3453ea595a6b1547f4e2d56e5426902d909385af49e90
SSDEEP 6144:mmEISK2sZVav/WY7Bi7xPTu0MzBJ9UkeaXeEpR1yXtZkm858SJ1YjqfPuowaGufy:7fZsapTaaoynTqzw7Wbo
TLSH
T11AA47E16E3A500F9E16BC238CA93D903EA76784557A0EACF4374DAB51F23BD15A3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

08:86:07:b2:1b:fc:ac:05:ed:82:3a:f4:e5:79:76:73:d1:ad:97:36:1b:cb:95:98:bd:ff:13:ab:cb:61:ca:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

195392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SbieSvc.pdb

sbiedll

SbieApi_QueryProcessInfo SbieApi_QueryProcess SbieApi_QueryProcessPath SbieApi_QueryProcessEx2 SbieApi_GetMessage SbieApi_GetVersionEx SbieApi_Call SbieDll_RunSandboxed SbieApi_EnumProcessEx SbieApi_QueryDrvInfo SbieApi_ReloadConf SbieApi_QueryConf SbieApi_QueryConfBool SbieApi_IsBoxEnabled SbieDll_IsOpenClsid SbieDll_ComCreateStub SbieDll_RunFromHome SbieApi_QueryProcessInfoEx SbieApi_SetUserName SbieApi_GetUnmountHive SbieDll_RunStartExe SbieDll_TranslateNtToDosPath SbieDll_GetServiceRegistryValue SbieDll_FormatMessage2 SbieDll_PortName SbieDll_InjectLow_InitHelper SbieDll_InjectLow_InitSyscalls SbieDll_InjectLow SbieDll_GetStringForStringList SbieDll_GetStringsForStringList SbieApi_GetHomePath SbieApi_QueryPathList SbieApi_QueryConfNumber SbieApi_QueryConfNumber64 SbieDll_KillOne SbieDll_FreeMem SbieDll_QueueCreate SbieDll_QueueGetReq SbieDll_QueuePutRpl SbieApi_CheckInternetAccess SbieDll_GetSettingsForName_bool SbieDll_DisableCHPE SbieApi_LogMsgExt SbieDll_GetPublicSD SbieApi_EnumBoxesEx SbieDll_CheckStringInList SbieDll_CheckPatternInList SbieApi_SessionLeader SbieDll_SetServiceRegistryValue SbieDll_FindArgumentEnd SbieDll_GetLanguage SbieDll_FormatMessage0 SbieDll_OpenProcess SbieDll_MatchPathImpl SbieApi_Log SbieApi_LogEx

ntdll

RtlCreateVirtualAccountSid NtLoadDriver NtOpenProcessToken RtlInitUnicodeString NtReplyWaitReceivePort NtRequestPort NtCreatePort NtUnloadKey NtOpenKey NtClose RtlSetDaclSecurityDescriptor RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx NtCreateFile NtSetInformationFile NtQueryInformationToken NtReadFile NtDuplicateObject NtOpenProcess NtResumeProcess NtSuspendProcess NtGetNextThread NtAdjustPrivilegesToken NtQueryInformationThread NtSetInformationProcess NtOpenDirectoryObject NtImpersonateClientOfPort NtCompleteConnectPort NtAcceptConnectPort NtRequestWaitReplyPort NtConnectPort RtlNtStatusToDosError NtOpenFile NtLockVirtualMemory NtWriteVirtualMemory NtReadVirtualMemory NtDeleteFile NtFilterToken NtDuplicateToken NtOpenThreadToken NtSetInformationThread NtAllocateVirtualMemory RtlInitializeSid RtlSubAuthoritySid NtSetInformationToken NtQueryInformationProcess RtlCreateSecurityDescriptor NtLoadKey NtQuerySystemInformation NtQueryKey NtWriteFile

kernel32

VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetStringTypeW GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree EncodePointer InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable CreateFileW GetFileSizeEx ReadFile SetEndOfFile WriteFile CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap MultiByteToWideChar WideCharToMultiByte HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateMutexW OpenMutexW CreateEventW OpenEventW WaitForMultipleObjects ExitProcess TerminateProcess CreateThread GetCurrentThread OpenProcess GetTickCount CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalFree GetEnvironmentVariableW SetCurrentDirectoryW GetFullPathNameW GetPrivateProfileStringW SetFilePointer SetLastError DeviceIoControl GetProcessTimes GetCurrentProcess GetCurrentProcessId SetThreadPriority TerminateThread GetLocalTime GetVersionExW VirtualAlloc VirtualFree LocalAlloc GetSystemWindowsDirectoryW DuplicateHandle ResetEvent QueueUserAPC GetCurrentThreadId OpenThread ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject TerminateJobObject SetInformationJobObject QueryInformationJobObject GetModuleHandleW GetProcAddress LoadLibraryW GlobalSize RegisterWaitForSingleObject UnregisterWait AllocConsole GetConsoleWindow GetConsoleProcessList OutputDebugStringW RaiseException InitializeCriticalSectionAndSpinCount GetCommandLineW GetSystemInfo GetFinalPathNameByHandleW DefineDosDeviceW GetLogicalDrives GetCompressedFileSizeW GetExitCodeProcess ResumeThread CreateProcessW CancelIo TlsAlloc TlsGetValue TlsSetValue SuspendThread WriteProcessMemory IsWow64Process GetModuleFileNameW QueryFullProcessImageNameW QueueUserWorkItem DeleteFileW GetFileAttributesW SetFileAttributesW GetWindowsDirectoryW CopyFileW ReadProcessMemory MulDiv SleepEx LCMapStringW SetStdHandle SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep AcquireSRWLockExclusive

user32

SetProcessWindowStation CreateWindowStationW GetThreadDesktop SetThreadDesktop CreateDesktopW EmptyClipboard SendMessageA CloseClipboard OpenClipboard SetTimer DispatchMessageW GetMessageW wsprintfW SendMessageW GetProcessWindowStation SendMessageTimeoutW SendNotifyMessageA SendNotifyMessageW PostMessageA PostMessageW GetMonitorInfoW EndPaint BeginPaint ShowWindow RegisterClassExW PackDDElParam GetRawInputDeviceInfoW GetRawInputDeviceInfoA UserHandleGrantAccess GetWindowInfo MonitorFromWindow ChangeDisplaySettingsExW ChangeDisplaySettingsExA GetIconInfo GetWindow GetWindowThreadProcessId GetClassNameW GetClassNameA EnumThreadWindows EnumWindows GetShellWindow FindWindowExW FindWindowExA FindWindowW FindWindowA EnumChildWindows GetParent GetDesktopWindow GetClassLongPtrW GetClassLongPtrA GetClassLongW GetClassLongA GetWindowLongPtrW GetWindowLongPtrA GetWindowLongW GetWindowLongA ClipCursor MapWindowPoints ScreenToClient ClientToScreen SetCursorPos GetWindowRect GetClientRect GetPropW GetPropA SetPropW ReleaseDC GetDC SetForegroundWindow IsWindowEnabled IsWindowUnicode KillTimer EnumClipboardFormats GetClipboardData GetClipboardSequenceNumber IsZoomed IsIconic IsWindowVisible SetWindowPos DestroyWindow IsWindow CreateWindowExW RegisterClassW SetClipboardData DefWindowProcW

advapi32

CreateProcessAsUserW OpenServiceW OpenSCManagerW CloseServiceHandle LsaManageSidNameMapping LsaFreeMemory LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW LookupAccountSidW GetTokenInformation OpenThreadToken DuplicateTokenEx ConvertSidToStringSidW OpenProcessToken AdjustTokenPrivileges RegOpenUserClassesRoot GetSecurityInfo AccessCheck QueryServiceConfig2W QueryServiceConfigW EnumServicesStatusW CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextW FreeSid CheckTokenMembership AllocateAndInitializeSid GetLengthSid EqualSid DuplicateToken AddAccessAllowedAce SetThreadToken RevertToSelf StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW OpenEventLogW StartServiceW EnumServicesStatusExW ControlService SetSecurityInfo SetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorSacl RegOpenCurrentUser QueryServiceStatusEx

psapi

GetModuleBaseNameW GetProcessMemoryInfo GetModuleFileNameExW EnumProcessModules

ole32

CoInitializeEx CoGetClassObject CoMarshalInterface CoUnmarshalInterface CoInitializeSecurity CoQueryProxyBlanket CoSetProxyBlanket CreateStreamOnHGlobal StringFromGUID2 CoTaskMemFree CoGetObject CoRegisterClassObject CoRevokeClassObject CoInitialize CoCopyProxy

crypt32

CryptProtectData CryptUnprotectData

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

gdi32

SetTextColor SetBkColor SelectObject TextOutW CreateCompatibleDC DeleteDC GetDIBits GetMetaFileBitsEx GetEnhMetaFileBits CreateFontW GetDeviceCaps CreateSolidBrush

netapi32

NetUseAdd

wtsapi32

WTSQueryUserToken

rpcrt4

RpcMgmtEpEltInqNextW RpcMgmtEpEltInqDone RpcMgmtEpEltInqBegin UuidFromStringW RpcStringFreeW RpcBindingToStringBindingW

bcrypt

BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptDestroyKey BCryptCreateHash BCryptVerifySignature BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptGetProperty BCryptOpenAlgorithmProvider

Name

.text

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SbieSvc.exe.sig

SHA256 b50c52ca6a6be4178945ea0188ead547928e7ec7f1ede03a8479799d68c4ae2a
MD5 d9281cbdc1b617d061dc67565642c3ab
SHA1 23a85d257b5f2100c88b9ed316811b8ec2be8cce
SHA512 1583d0aba30907dc080cbabf7f05097bebab4e0535bd2742382aa204f861a14a6a50901902b53aa49cf71c2316a04da4443cb18e91b151cc19e3762a1f44cc69
TLSH
T1E5A022BA0F82000E00EC0280F000808C08C02B8BF03A80002C0C8CA0EF3000A2338CB0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SboxHostDll.dll

IMPHASH d88cbb85b0954ade7a8cf3bc807bea82
SHA256 df2e68f444b4148f62c0180f3f9bd2ada4ef787d7ad822f75e9b6c55062de048
MD5 cb3ecdf3d1bffbfc3ac722adca33ed64
SHA1 f4dec658552f183d0f7ac5d0de78bff1cfcc20a9
SHA512 d662b027bd09b54309b748542516cffb08d31d12e9c031b745d53b20d21c9552d7bb16ec62ac7fe3380b3f02593d76605370424404cd6442f9eef72909e421a8
SSDEEP 3072:Qv8AfCAWLbopHxwnLK0dL1AHdiPs3fuT1chwqluJ:QUUCpLswLKQpAhup6fk
TLSH
T189E36B97B2E4007BE17B8239C4971A06E7B6B8511B61EBEF0764025A5F233D09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

02:3b:41:ed:b1:9e:ac:c0:2a:54:db:0b:0d:90:1f:45:09:af:1e:e6:98:2f:90:2a:f7:5a:e7:5d:8f:a1:15:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

14412

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\SboxHostDll.pdb

sbiedll

SbieApi_QueryProcessInfo SbieDll_Hook

psapi

EnumProcesses

kernel32

GetModuleHandleW CreateMutexW CloseHandle GetProcessId HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetLastError lstrcmpiW GetModuleFileNameW OpenProcess GetProcAddress InitializeCriticalSectionAndSpinCount DeleteCriticalSection IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection SetFilePointerEx GetConsoleMode CreateFileW WriteConsoleW LocalFree InterlockedFlushSList GetConsoleOutputCP WriteFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery ExitProcess GetModuleHandleExW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle GetFileType GetStringTypeW SetStdHandle FlushFileBuffers

advapi32

GetTokenInformation IsValidSid GetLengthSid CopySid ConvertSidToStringSidW

userenv

UnloadUserProfile

Name

.text

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Start.exe

IMPHASH a298b4de7e56a33e21b00439e666e96a
SHA256 6c45f19a953f1294e949ce0c51be4f7550fc7f8561b85a50a58cab055e418fd2
MD5 067f870de2937defcd9bb97db5e0f6cd
SHA1 18f0cf3df099a19c749b25b111e6101319d82569
SHA512 13d8aaa2cf0cbe0b763f2a8264918b054a665167611b6291d83046baa1a766fad0acbf3085cea0a07be1c335e49acca8687a666397b570225ec3673da23347d5
SSDEEP 6144:2ayB99Qhj/o4ItMNIHUk4wDKiThXyQYCV8RsOr:RyZSjCtMMdoAXyQLV8r
TLSH
T17D74AE04A7A14CF6ED6B853CC9938512EB727C514760DACB03A09DAB7F236D1AE3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

cd:87:a5:3d:22:2b:5f:ed:4d:f7:b9:24:d6:2c:87:7e:88:b0:92:60:03:69:96:b2:45:6e:bf:42:46:08:ac:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

152040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\Sandboxie\Bin\x64\SbieRelease\Start.pdb

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind NtTerminateThread RtlPcToFileHeader NtTerminateProcess NtQueryInformationProcess NtOpenKey RtlNtStatusToDosError RtlInitUnicodeString NtSetInformationFile NtQueryInformationFile NtCreateFile NtClose

user32

SetForegroundWindow KillTimer SetTimer SetDlgItemTextW GetDlgItem EndDialog DialogBoxIndirectParamW DialogBoxParamW SetWindowPos MoveWindow SendMessageW GetWindowRect ScreenToClient GetWindowLongPtrW FillRect MessageBoxW GetClientRect EndPaint BeginPaint OpenDesktopW GetDC UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW GetDesktopWindow IsDialogMessageW LoadImageW CallWindowProcW SendDlgItemMessageW SetFocus EnableWindow SetPropW GetPropW ClientToScreen wsprintfW ExitWindowsEx DestroyIcon CreateMenu CreatePopupMenu DestroyMenu GetMenuItemCount TrackPopupMenu GetMenuInfo SetMenuInfo InsertMenuItemW GetSysColorBrush DrawIconEx IsWindowEnabled GetWindowTextW MapWindowPoints GetWindowLongW SetWindowLongW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW PostQuitMessage UnregisterClassW RegisterClassExW GetAsyncKeyState DrawTextW AllowSetForegroundWindow SetCursor LoadCursorW SetWindowTextW SetWindowLongPtrW RegisterClassW DefWindowProcW GetThreadDesktop CloseDesktop SetThreadDesktop SwitchDesktop ReleaseDC

shell32

SHBindToParent ShellExecuteW ExtractAssociatedIconW ExtractIconW SHGetSpecialFolderPathW ExtractIconExW SHGetFolderPathW ShellExecuteExW

shlwapi

SHAutoComplete PathFileExistsW AssocQueryStringW StrStrIW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalFree InitializeSListHead LoadLibraryW WriteConsoleW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle SetFilePointerEx WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleHandleExW LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetFileAttributesExW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException QueryFullProcessImageNameW FormatMessageW MulDiv GetProcAddress ReadProcessMemory GetVersionExW OpenProcess GetProcessId GetLastError WriteFile CloseHandle WaitForSingleObject CreateThread GetCurrentThreadId GetModuleHandleW HeapAlloc HeapFree GetProcessHeap GetTickCount LocalFree GetCurrentProcessId GetStartupInfoW ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetLastError HeapCreate HeapDestroy CreateEventW Sleep ExitProcess GetExitCodeProcess CreateProcessW ProcessIdToSessionId GetSystemTimeAsFileTime GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetFullPathNameW GetSystemWindowsDirectoryW CreateFileW GetLogicalDrives HeapReAlloc OpenFileMappingW MapViewOfFile UnmapViewOfFile GetStdHandle GetCommandLineW SetCurrentDirectoryW GetCurrentDirectoryW QueryPerformanceCounter

gdi32

CreateFontW PatBlt CreateCompatibleBitmap CreateDIBSection SelectObject DeleteObject DeleteDC CreateSolidBrush BitBlt CreateCompatibleDC GetDeviceCaps SetBkColor SetTextColor

sbiedll

SbieApi_QueryDrvInfo File_GetName Key_GetName SbieDll_SetFakeAdmin SbieDll_StartCOM SbieDll_CallServer SbieDll_RunSandboxed SbieDll_FormatMessage2 SbieDll_FormatMessage SbieDll_GetTokenElevationType SbieDll_Unmount SbieDll_Mount SbieDll_KillAll SbieDll_GetLanguage SbieDll_GetStartError SbieDll_StartSbieSvc SbieDll_RunStartExe SbieDll_GetSysFunction SbieApi_IsBoxEnabled SbieApi_ReloadConf SbieApi_DisableForceProcess SbieApi_GetHomePath SbieDll_InitPStore SbieApi_QueryProcessInfo SbieDll_GetHandlePath SbieDll_IsDirectory SbieDll_IsReservedFileName SbieDll_TranslateNtToDosPath SbieApi_EnumBoxes SbieApi_EnumProcessEx SbieApi_QueryBoxPath SbieApi_QueryConf SbieApi_QueryProcess SbieDll_FreeMem SbieDll_CallServerQueue SbieDll_FormatMessage1 SbieDll_FormatMessage0 SbieApi_QueryConfBool SbieApi_Call SbieApi_EnumBoxesEx

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CreateStreamOnHGlobal

advapi32

RegOpenKeyExW RegQueryValueExW RegEnumValueW RegCloseKey

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

gdiplus

GdipDisposeImage GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdiplusStartup

Name

.text

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Start.exe.sig

SHA256 a56683845a3c8a15ee65f6bad4d888f862d407ed4363af49e92160168068f6fc
MD5 cda0b75f6c81163fdcfae02935065973
SHA1 ee0ce838664f0429f44f1937ca3f81e7cdba5952
SHA512 fd374449a932dfbff2ccc845aa41891f2c16da97317143bc6698508ea9a58ea4b2e0eaf5df24f4c9ee2b5b3773a416749be8eeff345c27b7a253ccc964696382
TLSH
T13CA0028B5735140111D99EB03E7156041F5D505C2D7DB66F1E812AAB2E591F24256848
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Templates.ini

SHA256 c1bb8c91c18f653b2ff0af7c64d9919d6671502a3e4c27be3342f73f2ba4f776
MD5 a7e3c7e83646fd0bdd518a46d6b8fa99
SHA1 ad354afa4797b3ff6f06a910b0a8d9d21651e153
SHA512 44d14e775408e22fe420e565522f4e4b7b529fb69f76f8686a742e814518b710051779b2c4d58d2e95e78311920b5de107599cd41fbe5889a130ab13e308e8f6
SSDEEP 3072:Po/qgtb4frWAVEsFfo7UQD75u/ZURnhT8E80VGzKN79+1msECsSk/kMte7BQCmSW:Q/ttb4frWAVEsFfo7UQD75u/ZURnhT88
TLSH
T1F6E3A85F479FC150D0FA33D4960169BB318F98A9D9C6D0037489ECB8779BC9612AE38B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

UpdUtil.exe

IMPHASH 6c8e62c440907261d05f8b182a13d418
SHA256 a6ddbd45d91f2e65e78fe8cdc52beddae498c92c0aecac8d08ed3633d182b2ad
MD5 c1fe4471d98c8916281d633cd3473f2c
SHA1 46b5e5653fa72b5ca6aabe92ca58ca16b78be9fd
SHA512 b75078c6a540a2dac3e88f3b46d4d0cd1860837e9c33e49a10699a0bdca302704cc528f895d360a43acc55c070ab5bbbc9506771074d9e6009c65e2fc19d1634
SSDEEP 3072:VGT4XR4jOtIpw/CpFEu2+pW6HTkpBeESXqEBh8LPJ/bTvWpmSfu:8TCR4jO4w/CpKiDHQpBeESkefu
TLSH
T1E9045C26A6A901B6D167D578CE864903FB727C468731D6DF07C196F10F27AE0BE3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

ee:8f:5b:fa:ba:82:1d:05:33:f1:9c:1a:cc:69:02:56:90:40:4d:f1:f4:30:34:26:1c:7f:48:39:31:46:45:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 26, 2026

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=202406244E,CN=NOVASYNC LABS PTE. LTD.,O=NOVASYNC LABS PTE. LTD.,STREET=10 Selegie Road\, #01-45\, Selegie House,L=SINGAPORE,ST=SINGAPORE,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2c:96:9d:99:aa:cc:37:36:56:e1:db:00

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 3, 2026 - Feb 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

110968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Sandboxie\Sandboxie\SandboxieTools\x64\Release\UpdUtil.pdb

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlInitUnicodeString NtOpenFile NtDeviceIoControlFile NtQuerySystemInformationEx NtCreateFile NtClose NtReadFile NtWriteFile

bcrypt

BCryptCreateHash BCryptFinishHash BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptDestroyHash BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptVerifySignature

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpCloseHandle

kernel32

GetModuleHandleW GetStartupInfoW IsDebuggerPresent QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent AllocConsole GetEnvironmentStringsW CopyFileW CreateProcessW MoveFileExW LocalFree GetWindowsDirectoryW GetNativeSystemInfo CloseHandle DeleteFileW GetUserDefaultLCID AttachConsole Sleep LCIDToLocaleName FreeEnvironmentStringsW CreateFileW FindFirstFileA FindNextFileA GetFullPathNameA FindClose GetFileAttributesW GetVersionExW GetModuleHandleA GetLastError GetProcAddress GetFileSizeEx CreateDirectoryW ReadFile GetCurrentProcess RemoveDirectoryW GetModuleFileNameW SetFilePointer GetTempPathW WaitForSingleObject LocalAlloc

advapi32

RegOpenKeyExW InitializeAcl SetNamedSecurityInfoW RegCloseKey RegQueryValueExW

shell32

ShellExecuteExW CommandLineToArgvW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

msvcp140

?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strchr wcsrchr __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset memcmp memcpy memmove

api-ms-win-crt-heap-l1-1-0

free malloc realloc _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

wcstok _wcsdup _wcsnicmp strncpy_s toupper _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _c_exit _register_thread_local_exe_atexit_callback terminate _exit _initterm_e _initterm _get_wide_winmain_command_line exit _initialize_wide_environment _set_errno _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _configure_wide_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vswprintf freopen __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

whatsnew.html

SHA256 52d602a2f601447f002ac12d5f2160d68e9fb0480d608b6df352c1ad91973825
MD5 1e22ef93595ee8ae48628143940639b5
SHA1 0877bc5998746c6699c726cf74a2b43d4eba0f46
SHA512 18940994cc9bda12147bec0a1b5d1e7cb5c5fde73468a5b056bab574db1b7e3786d5d9ddbfae9fdb7d66ca9b82ecd73514f10e8efb2079ce7722e6823a4a1895
SSDEEP 1536:q+7nxsj07A4n0czlBpNyCxC/ooBe71ZL/qcrp+7PrNMg:1nxso7Ln0cRNyCEE77qc0
TLSH
T1CF53E10252003D6701A380E676F79BEFB4A01784B397E169977C376FF185D8A2C1DAAC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

26da82f7-Sandboxie-Classic-x64-v5.73.1.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/InstallType.ini

$PLUGINSDIR/KmdUtil.exe

ntdll

psapi

sbiedll

kernel32

user32

gdi32

advapi32

shell32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/SbieDll.dll

ntdll

kernel32

generic

$PLUGINSDIR/SbieMsg.dll

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/Warning.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

32/SbieDll.dll

ntdll

kernel32

generic

32/SbieSvc.exe

sbiedll

ntdll

kernel32

user32

advapi32

psapi

ole32

crypt32

userenv

gdi32

netapi32

wtsapi32

rpcrt4

bcrypt

generic

KmdUtil.exe

ntdll

psapi

sbiedll

kernel32

user32

gdi32

advapi32