OmniControl_3[.]5[.]0_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OmniControl_3.5.0_x64-setup.exe
Size 44.1MB
Sample261107-vbrk6set7p
SHA256 918957971b32e91cfddec8c4e763e72cb3816cdd4d4c6e27c98b256b0ba2f799
MD5 2cdae05428a7d31ad1d397a3d39f2d3f
SHA1 169b9eeb663eb70cad86af06fe1d8a5f827c265a
SHA512 e2646e90befdf4afcd657b9252ee77a4398ac70d46c88b691a992ec425cf659e82e9b98279b22c0a8ad2c4d33d441b66895091d78288f4fa8b7ba0ac39bfbe70
SSDEEP 786432:mPZ1+bu6VG9s0NltKhaY0SBamY0WaenUI2QZiBVZ485FI4H3IqhusP2SooNzKK:mf+bOs0NMaYh4dUI5ZwVZ485FIa5hxPP
TLSH
T140A733E0D4B153D3D3EAABF00076BDF46B5353668A21C8CA65E47CE6A93D0C73D560A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
OmniControl_3.5.0_x64-setup.exe
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/OmniRemoteHost.exe
unpack001/omnicontrol.exe

File Explorer

OmniControl_3.5.0_x64-setup.exe

.exe 44.1MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-header.bmp

33KB
$PLUGINSDIR/modern-wizard.bmp

201KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.7MB
OmniRemoteHost.exe

.exe 6.0MB
THIRD_PARTY_NOTICES.md

4KB
omnicontrol.exe

.exe 63.1MB
remote-play/HOST-LICENSES.txt

34KB
remote-play/HOST-SOURCE-OFFER.txt

2KB
remote-play/HOST-THIRD-PARTY-NOTICES.txt

31KB

OmniControl_3.5.0_x64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 918957971b32e91cfddec8c4e763e72cb3816cdd4d4c6e27c98b256b0ba2f799
MD5 2cdae05428a7d31ad1d397a3d39f2d3f
SHA1 169b9eeb663eb70cad86af06fe1d8a5f827c265a
SHA512 e2646e90befdf4afcd657b9252ee77a4398ac70d46c88b691a992ec425cf659e82e9b98279b22c0a8ad2c4d33d441b66895091d78288f4fa8b7ba0ac39bfbe70
SSDEEP 786432:mPZ1+bu6VG9s0NltKhaY0SBamY0WaenUI2QZiBVZ485FI4H3IqhusP2SooNzKK:mf+bOs0NMaYh4dUI5ZwVZ485FIa5hxPP
TLSH
T140A733E0D4B153D3D3EAABF00076BDF46B5353668A21C8CA65E47CE6A93D0C73D560A8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 17debf797a6c737959bc588236e897936ffac1af5f7e515e674ab32f9edfe719
MD5 8ee098f5969d3395c0ed113bc91f36b3
SHA1 8f6eda8bfeea599d3f0a2d818ad57defeba17a4e
SHA512 5ff8fb0b9c12e8e605601aa34e43f31af17473a037e95934888c6054c426bbc0e804d9068c3e3582cb0b02f1aa4cb293f108a96d6b0562c70a0402bda6c3b9fe
SSDEEP 49152:xiGu3I5VuJhf/tw0rMc0wBTlcjT7p3z+I6BurP:xi45cr9wm87p3Sor
TLSH
T15685220876E04031F1F32E315AF089B16A7DBC658F765ADF63815E285E38AC2E235767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

8d:36:f6:80:ed:ad:15:bf:73:94:54:cf:aa:d8:08:70:ab:b4:b0:22:67:46:db:6f:2e:36:85:31:a4:3c:8d:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Nov 6, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

8d:36:f6:80:ed:ad:15:bf:73:94:54:cf:aa:d8:08:70:ab:b4:b0:22:67:46:db:6f:2e:36:85:31:a4:3c:8d:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 28, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

OmniRemoteHost.exe

IMPHASH 30d7f7535c846bd856a7f4facb99a2c9
SHA256 da5b4e910ca2ee7792401a99ce597e387d8d0783a6fd8a09d3099adf01defa0f
MD5 b8b1c1cacea57416e54166a10c39ae1a
SHA1 fc95522bb28c6ae33bad7a389c46c39493f7d70e
SHA512 208dd6834172a154d9c04dcf8ddf0de3be1c8630b0e3c6c3f23c6e385ca471f642cd420e2ee0a2cdc62afbf72d3f34256c08ac791b8343e84a155de064da371d
SSDEEP 49152:JOrWxyXHoSNdt9Ndt9Ndt9NdBLbr7Lbr7Lbr7LbX2Q0TRGtlqSBllVwASOpLmkZC:8rW8fpBXTuKwygg42cgV4yJ+GGXj
TLSH
T148569D69B6BC00E9D46AC9B8C3865223E771B49507B027DF1A6486F51F63AE02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4510748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

OmniRemoteHost.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

winmm

timeBeginPeriod timeEndPeriod

wsock32

ntohs shutdown accept listen WSAStartup closesocket ntohl recv select connect getsockname bind htonl socket send setsockopt sendto recvfrom getpeername inet_ntoa WSASetLastError WSACleanup ioctlsocket __WSAFDIsSet getservbyname gethostbyname inet_addr gethostbyaddr getservbyport getsockopt htons WSAGetLastError

ws2_32

WSAEnumNetworkEvents WSAIoctl inet_pton WSAWaitForMultipleEvents WSAEventSelect WSASetEvent WSACloseEvent getaddrinfo WSACreateEvent freeaddrinfo WSAResetEvent inet_ntop getnameinfo

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersInfo

crypt32

CertOpenSystemStoreW CertAddCertificateContextToStore CryptQueryObject CertFreeCertificateChain CertFreeCertificateChainEngine CertAddStoreToCollection CertCreateCertificateChainEngine CertGetCertificateChain CertGetNameStringA CryptDecodeObjectEx CertFindExtension CryptStringToBinaryA PFXImportCertStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CertEnumCertificatesInStore

advapi32

CryptGetHashParam CryptHashData CryptAcquireContextA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW

kernel32

HeapReAlloc SetFileTime SetFileInformationByHandle ReadConsoleW ReadConsoleA SetConsoleMode RtlLookupFunctionEntry RtlCaptureContext GetSystemTimePreciseAsFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetCommandLineW lstrlenW ExitProcess SwitchToThread CreateMutexA ReleaseMutex GetModuleFileNameW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetFullPathNameW FindFirstFileW GetConsoleMode GetFileSizeEx CreateFileA FindNextFileW CloseHandle GetCurrentThread SetThreadInformation SetThreadPriority SetEvent GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceFrequency QueryPerformanceCounter CreateEventW SetUnhandledExceptionFilter OpenProcess GetLastError AcquireSRWLockExclusive ReleaseSRWLockExclusive LocalFree GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObject ReadFile GetOverlappedResult WriteFile CreateFileW GetNamedPipeClientProcessId DisconnectNamedPipe ConnectNamedPipe WaitForMultipleObjects CancelIoEx CreateNamedPipeW CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeConditionVariable SleepConditionVariableCS WakeConditionVariable FormatMessageA GetProcessHeap HeapAlloc HeapFree FormatMessageW SetLastError GetStdHandle GetFileType GetProcAddress MultiByteToWideChar RtlVirtualUnwind InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemTimeAsFileTime SleepEx GetModuleHandleA LoadLibraryA GetSystemDirectoryA FreeLibrary InitializeCriticalSectionEx GetTickCount Sleep DeleteFileW GetLongPathNameW GetTempFileNameW GetTempPathW LocalAlloc WideCharToMultiByte SetWaitableTimer CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeCriticalSectionAndSpinCount ReleaseSemaphore CreateSemaphoreA VirtualFree GetEnvironmentVariableW GetACP GetExitCodeThread GetEnvironmentVariableA MoveFileExA VerSetConditionMask VerifyVersionInfoW WaitForSingleObjectEx GetVersion GetHandleInformation GetQueuedCompletionStatusEx InitOnceExecuteOnce GetTickCount64 SetFileCompletionNotificationModes LoadLibraryW GetSystemTime SystemTimeToFileTime FindClose

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

memset memcmp strchr memcpy memmove strstr memchr wcsstr _CxxThrowException __C_specific_handler __current_exception __current_exception_context __CxxFrameHandler3 strrchr

api-ms-win-crt-math-l1-1-0

acos log pow log10 round cos sqrt _fdopen floor exp __setusermatherr

api-ms-win-crt-string-l1-1-0

strncpy_s strcat_s strcpy_s wcscmp isxdigit _memicmp strpbrk wcslen strspn isdigit isspace _strdup _strnicmp strtok strncpy strncmp _stricmp strcpy strcmp strcspn strlen tolower

api-ms-win-crt-heap-l1-1-0

_aligned_malloc _aligned_free calloc free realloc malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf _close ftell __stdio_common_vfprintf feof fseek __stdio_common_vswprintf __p__commode __acrt_iob_func fflush fgets _fileno _get_osfhandle _setmode puts fputc fread ferror fwrite fputs __stdio_common_vsprintf_s fclose _fseeki64 _open __stdio_common_vsscanf _wfopen fopen

api-ms-win-crt-utility-l1-1-0

qsort srand

api-ms-win-crt-convert-l1-1-0

strtol wcstombs strtoll strtod strtoull strtoul atoi

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _c_exit abort _set_abort_behavior exit __sys_nerr __sys_errlist _seh_filter_exe _register_thread_local_exe_atexit_callback _cexit _set_app_type __p___argv _register_onexit_function strerror _errno _exit _beginthreadex raise _beginthread strerror_s __p___argc signal terminate _getpid _configure_narrow_argv _initterm_e _initterm _get_initial_narrow_environment _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 _gmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _unlink _stat64 _fstat64

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

omnicontrol.exe

IMPHASH 0c86e88da04d0d5e3a9ca7c3e5b076e5
SHA256 2569595539c28392ba776e0a2ee64ba8086c0251e12e1642933e02ad8ad3423b
MD5 b0c07e4699f567efadba426046f50560
SHA1 cd2b2b82634834d3e5a7b756978352b97eabf391
SHA512 fa29adeb60b1d5c4a2f47bb00e412c62e64185fe458c6d90a549576a62855883b20403772405934fb27918e4a03afb45fb411cb1c3b759defe470076cd752a63
SSDEEP 1572864:3EFfXz5KPw671DT9qggmlCm+DL4KXthGb:0z0Pw679BjgmwZ5Xt
TLSH
T19AE7AE157A5F99ACD49BC87083478A734E2130DB0A36B9BF44C452393F7ABF46B29319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23833104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

omnicontrol.pdb

kernel32

WaitForMultipleObjects SetFilePointerEx EncodePointer PowerSetRequest PowerClearRequest PowerCreateRequest GetProcessId GetNamedPipeServerProcessId CreateWaitableTimerExW ReleaseMutex CreateMutexW SetEvent MoveFileExW GetCurrentProcess TlsSetValue QueryPerformanceCounter HeapReAlloc RtlUnwindEx SetHandleInformation InitializeSListHead DuplicateHandle CreateEventW DeviceIoControl RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx CreateMutexA WideCharToMultiByte MultiByteToWideChar WriteFileEx SleepEx ReadFileEx FormatMessageW SetUnhandledExceptionFilter UnhandledExceptionFilter lstrlenW GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CancelIo TerminateProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW SetWaitableTimer CreateSymbolicLinkW GetCurrentProcessId FlushFileBuffers QueryFullProcessImageNameW OpenProcess Process32NextW GetCurrentThread Process32FirstW CreateToolhelp32Snapshot AreFileApisANSI SetThreadStackGuarantee GetQueuedCompletionStatusEx SetThreadPriority FindNextFileW RaiseException WaitForSingleObject QueryPerformanceFrequency GetUserDefaultUILanguage GetSystemInfo LoadLibraryExA RtlPcToFileHeader SetThreadInformation PostQueuedCompletionStatus ReadFile GetTickCount64 GetModuleHandleA GetProcAddress OutputDebugStringA GetLastError Sleep DeleteCriticalSection ResetEvent CreateEventA OutputDebugStringW InitializeCriticalSectionAndSpinCount IsDebuggerPresent GetOverlappedResult LocalFree CreateIoCompletionPort GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GlobalUnlock SetFileCompletionNotificationModes AcquireSRWLockExclusive WriteFile ReleaseSRWLockExclusive TlsGetValue GlobalLock GlobalSize CancelIoEx LCIDToLocaleName CreateThread TlsAlloc IsProcessorFeaturePresent GetFileAttributesExW CreateFileW FindClose GetExitCodeProcess GetStdHandle GetConsoleMode GetConsoleOutputCP PeekNamedPipe WriteConsoleW SwitchToThread AddVectoredExceptionHandler FindFirstFileW RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW SetEnvironmentVariableW HeapAlloc CloseHandle HeapFree LoadLibraryA GetLocaleInfoEx FormatMessageA TlsFree GetModuleHandleW CopyFileExW LoadLibraryW GetLocalTime GetSystemTimePreciseAsFileTime LoadLibraryExW FreeLibrary GetCurrentThreadId GetProcessHeap

advapi32

EventUnregister EventWriteTransfer RegOpenKeyExW OpenProcessToken GetTokenInformation RegEnumKeyExW RegQueryValueExW RegDeleteTreeW RegDeleteValueW RegSetValueExW RegCloseKey EventSetInformation RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW EventRegister SystemFunction036 RegEnumValueW RegGetValueW GetSidSubAuthorityCount GetSidSubAuthority

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtReadFile NtOpenFile RtlGetVersion RtlNtStatusToDosError NtCreateNamedPipeFile

user32

GetWindowTextW EnumWindows VkKeyScanW UnregisterHotKey FindWindowW DrawMenuBar GetMenu DestroyAcceleratorTable DestroyMenu TranslateAcceleratorW GetUpdateRect ValidateRect ChangeWindowMessageFilterEx CreateAcceleratorTableW CloseClipboard GetClipboardData OpenClipboard GetKeyState DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplaySettingsW GetWindow SetWindowRgn GetDpiForWindow ShowWindowAsync GetKeyboardState AdjustWindowRectExForDpi EndPaint BeginPaint SetFocus SetMenuItemInfoW EnumChildWindows DispatchMessageA GetMessageA AdjustWindowRect MapVirtualKeyExW GetKeyboardLayout RegisterHotKey GetMenuItemInfoW SetPropW DefWindowProcW GetAncestor WindowFromPoint RegisterWindowMessageA FindWindowExW ClipCursor EnableMenuItem GetDC ReleaseDC ToUnicodeEx CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId CheckMenuItem GetRawInputDeviceInfoW GetRawInputDeviceList GetRawInputBuffer GetRawInputData KillTimer GetMessageW SetTimer RegisterClassW InsertMenuW AppendMenuW RemoveMenu SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW CreateIcon DispatchMessageW TranslateMessage PeekMessageW SetCursor LoadCursorW GetWindowTextLengthW CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture GetMonitorInfoW MonitorFromRect GetWindowLongW ScreenToClient GetParent SetWindowLongPtrW GetAsyncKeyState GetSystemMenu SetWindowDisplayAffinity RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW SetCursorPos InvalidateRgn SetWindowPos UpdateWindow InvalidateRect SetWindowLongW MapVirtualKeyW GetForegroundWindow FlashWindowEx IsWindowEnabled MonitorFromPoint GetWindowLongPtrW EnumDisplayMonitors IsIconic IsWindowVisible EnableWindow RegisterRawInputDevices RedrawWindow SetWindowTextW ShowCursor SetParent DrawIconEx GetClipCursor MsgWaitForMultipleObjectsEx IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos DrawTextW GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo FillRect SendMessageW SendInput ShowWindow PostQuitMessage PostMessageW GetActiveWindow SystemParametersInfoA SetMenu CreatePopupMenu CreateMenu DestroyIcon PostThreadMessageW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

recv recvfrom sendto accept send listen connect shutdown getsockopt WSAStartup WSACleanup WSADuplicateSocketW getsockname WSAGetLastError getpeername closesocket bind WSAIoctl setsockopt ioctlsocket WSASocketW getaddrinfo freeaddrinfo WSASend

comctl32

DefSubclassProc TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass

gdi32

DeleteObject CreateRectRgn CreateSolidBrush SetBkMode BitBlt CombineRgn SelectObject GetDeviceCaps CreateDIBSection CreateCompatibleDC DeleteDC SetTextColor

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ole32

PropVariantClear OleInitialize CoInitializeEx RegisterDragDrop CoIncrementMTAUsage CoUninitialize CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree RevokeDragDrop

oleaut32

GetErrorInfo SysStringLen SetErrorInfo VariantClear SysFreeString

shell32

DragQueryFileW DragFinish Shell_NotifyIconW ShellExecuteW SHGetKnownFolderPath SHCreateItemFromParsingName SHAppBarMessage Shell_NotifyIconGetRect ShellExecuteExW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmGetCompositionTimingInfo DwmEnableBlurBehindWindow

cfgmgr32

CM_Locate_DevNodeW CM_Get_DevNode_Status CM_Get_Parent CM_Get_Device_ID_Size CM_Get_DevNode_Registry_PropertyW CM_Get_Device_IDW

xinput1_4

XInputGetState XInputSetState

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

winmm

timeEndPeriod timeBeginPeriod

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CryptUnprotectData CertOpenStore CertFreeCertificateChain CertAddEncodedCertificateToStore CryptProtectData CertFreeCertificateContext CertSetCertificateContextProperty CertCloseStore CertCreateCertificateChainEngine

dxgi

CreateDXGIFactory1 CreateDXGIFactory2

d3d11

D3D11CreateDevice

shlwapi

SHCreateMemStream

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

imm32

ImmAssociateContextEx ImmReleaseContext ImmGetContext ImmNotifyIME

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW

bcrypt

BCryptGenRandom

powrprof

PowerRegisterSuspendResumeNotification

api-ms-win-crt-string-l1-1-0

strncpy strlen strcmp _wcsicmp wcslen wcscmp wcsncmp strcpy_s towupper strncmp wcsncpy _wcsdup

api-ms-win-crt-math-l1-1-0

expf truncf powf atan2 _hypot trunc floor round floorf ceilf rintf rint sinf cosf roundf sin fmodf atan2f asinf fmod pow log2 exp fabs sqrt acos log log10 cos _dtest modf _finite ceil __setusermatherr _isnan

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free calloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _c_exit _exit exit _initterm_e _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _seh_filter_exe terminate _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _register_onexit_function abort _set_abort_behavior _crt_atexit _set_app_type _invoke_watson _wassert

api-ms-win-crt-stdio-l1-1-0

_set_fmode _get_stream_buffer_pointers fclose fflush fgetc fgetpos fputc __stdio_common_vfprintf fread fsetpos _fseeki64 fwrite setvbuf __acrt_iob_func __stdio_common_vswprintf __stdio_common_vsscanf __p__commode __stdio_common_vsprintf ungetc

api-ms-win-crt-utility-l1-1-0

abs

api-ms-win-crt-convert-l1-1-0

atoi _wtoi _ultow_s wcstol

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Cnd_signal ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z _Cnd_broadcast _Cnd_wait ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??7ios_base@std@@QEBA_NXZ

Sharing

General

Malware Config

Signatures

File Explorer

OmniControl_3.5.0_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

OmniRemoteHost.exe

api-ms-win-core-synch-l1-2-0

winmm

wsock32

ws2_32

bcrypt

iphlpapi

crypt32

advapi32

user32

kernel32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic

THIRD_PARTY_NOTICES.md

omnicontrol.exe

kernel32

advapi32

bcryptprimitives