Magpie_v0[.]10[.]3[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Magpie_v0.10.3.rar
Size

5.4MB
MD5

301c45b5cf02bf0f6d4a4b282edea8cb
SHA1

514bbde35ad7e0805c2d5548419e749755b3683d
SHA256

e981603939478f21c1171e32d33beb695034c82ef25abbbd38ccc0fa6baa5bec
SHA512

ef29ea44548c6661653234b1ab01305744de4d52352cb11e69f2a9cd99939d6d8d53f179b1976e2e1d4de51b2b567972c60e29cea99c118cfaf3bf0213cf358e
SSDEEP

98304:k7q6UEJc+a3Wx+qwdrCCSiHT4GAfrt23A9IZApqfarAgjx8mN55Zm0:vxErshlSc0h+m4gjCEZm0

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Magpie_v0.10.3/Magpie.App.dll
unpack001/Magpie_v0.10.3/Magpie.Core.dll
unpack001/Magpie_v0.10.3/Magpie.exe
unpack001/Magpie_v0.10.3/Updater.exe

Files

Magpie_v0.10.3.rar
.rar
Magpie_v0.10.3/Magpie.App.dll
.dll windows:6 windows x64

1f6b6143a63fea86317241e35d84a20d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
CloseHandle
OpenProcess
GetProcAddress
LoadLibraryExW
QueryFullProcessImageNameW
CreateDirectoryW
GetModuleHandleW
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
GetModuleFileNameW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteFileW
GetCurrentDirectoryW
GetApplicationUserModelId
FindFirstFileExW
FindNextFileW
FindClose
ParseApplicationUserModelId
FindPackagesByPackageFamily
GetPackagePathByFullName
GetEnvironmentVariableW
CompareStringEx
MoveFileExW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LCMapStringEx
CloseThreadpoolTimer
OutputDebugStringW
SetThreadpoolTimer
CreateThreadpoolTimer
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileW
CreateFileW
GetLocaleInfoEx
LocalFree
RaiseException
RtlPcToFileHeader
GetStringTypeW
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
GetCurrentProcessId
Sleep
SwitchToThread
WaitForSingleObjectEx
FormatMessageA
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentThreadId
TrySubmitThreadpoolCallback
RtlVirtualUnwind
LoadLibraryW
FormatMessageW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
HeapAlloc
TerminateProcess
HeapFree
GetProcessHeap
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateEventW
RtlUnwindEx
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
RtlUnwind

ole32

CoGetApartmentType
CoGetObjectContext
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoAllowSetForegroundWindow
PropVariantClear
CoTaskMemFree

oleaut32

VariantClear
SysAllocStringLen
VariantInit
SysStringLen
SysFreeString
SysAllocString
SetErrorInfo
GetErrorInfo

user32

DestroyIcon
SendMessageW
UnhookWindowsHookEx
GetKeyboardLayout
ToUnicodeEx
MapVirtualKeyExW
ShowWindow
BringWindowToTop
UnregisterHotKey
AttachThreadInput
DestroyWindow
DefWindowProcW
CreateWindowExW
RegisterClassExW
GetCursorPos
PostMessageW
EnumChildWindows
SetWindowLongPtrW
SetWindowsHookExW
RegisterHotKey
GetForegroundWindow
SetForegroundWindow
CallNextHookEx
GetWindowPlacement
GetWindowThreadProcessId
GetAsyncKeyState
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
GetWindowLongPtrW
SendInput
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
EnumWindows
IsWindowVisible
IsWindow
SetWindowPos
GetWindow
GetClassLongPtrW
GetIconInfo
ReleaseDC
GetDC

gdi32

DeleteObject
GetDIBits
GetObjectW

magpie.core

?ToggleOverlay@MagRuntime@Core@Magpie@@QEAAXXZ
?HwndSrc@MagRuntime@Core@Magpie@@QEBAPEAUHWND__@@XZ
?IsRunningChanged@MagRuntime@Core@Magpie@@QEAA?AUevent_token@winrt@@AEBU?$delegate@_N@5@@Z
??0MagRuntime@Core@Magpie@@QEAA@XZ
?Run@MagRuntime@Core@Magpie@@QEAAXPEAUHWND__@@AEBUMagOptions@23@@Z
?Stop@MagRuntime@Core@Magpie@@QEAAXXZ
?Compile@EffectCompiler@Core@Magpie@@SAIAEAUEffectDesc@23@IPEBV?$flat_hash_map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MUHash@?$StringHashEqT@_W@priv@phmap@@UEq@456@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@M@std@@@2@@phmap@@@Z
??1MagRuntime@Core@Magpie@@QEAA@XZ
?IsRunning@MagRuntime@Core@Magpie@@QEBA_NXZ

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
CheckTokenMembership

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

dxgi

CreateDXGIFactory1

api-ms-win-crt-runtime-l1-1-0

_errno
_seh_filter_dll
_cexit
_invalid_parameter_noinfo_noreturn
terminate
_configure_narrow_argv
abort
_crt_atexit
_invalid_parameter_noinfo
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_initterm_e
_register_onexit_function
_initterm

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc
calloc
_callnewh

api-ms-win-crt-locale-l1-1-0

setlocale
localeconv
___lc_codepage_func
_unlock_locales
_lock_locales
___lc_locale_name_func
___mb_cur_max_func
__pctype_func
___lc_collate_cp_func

api-ms-win-crt-stdio-l1-1-0

fread
_filelength
_wfopen_s
_fseeki64
_ftelli64
fclose
fwrite
__stdio_common_vsnprintf_s
_fileno

api-ms-win-crt-math-l1-1-0

lround
round
lroundf
_dclass
_fdclass
_ldclass
ceil
_dsign

api-ms-win-crt-time-l1-1-0

_mktime64
_utime64

api-ms-win-crt-filesystem-l1-1-0

_wmkdir

api-ms-win-crt-string-l1-1-0

_wcsdup
wcsnlen
iswspace
towlower
wcscat_s
strcpy_s
strncpy_s
wcsncmp

api-ms-win-crt-convert-l1-1-0

wcstol

dwmapi

DwmGetWindowAttribute

shell32

SHCreateItemFromParsingName
ord6
SHGetKnownFolderPath
SHGetPropertyStoreForWindow
SHGetFolderPathW
SHOpenFolderAndSelectItems
SHParseDisplayName
ShellExecuteExW

comctl32

ord380
ord345

shlwapi

PathIsSameRootW
PathCombineW
PathIsRelativeW
SHCreateStreamOnFileEx
PathRelativePathToW
ord487

bcp47mrm

GetDistanceOfClosestLanguageInList

Exports

Exports

DllGetActivationFactory
VSDesignerCanUnloadNow
VSDesignerDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Magpie_v0.10.3/Magpie.Core.dll
.dll windows:6 windows x64

f3ce8b4cadafbf8cc39b3054761a6b65

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
ReadFile
CreateDirectoryW
GetModuleHandleW
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SetLastError
LoadLibraryW
WaitForSingleObject
CreateThread
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FindFirstFileExW
DeleteFileW
FindNextFileW
FindClose
OpenMutexW
ReleaseMutex
GetThreadId
GetFileInformationByHandleEx
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
QueryFullProcessImageNameW
GetSystemTimeAsFileTime
GetLocaleInfoEx
CloseHandle
InitializeCriticalSectionEx
OutputDebugStringW
EnterCriticalSection
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeThread
SwitchToThread
CreateFile2
LoadLibraryExW
GetProcAddress
OpenProcess
LCMapStringEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
RtlUnwind
GetProcessHeap
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
GetLastError
GetCurrentProcessId
Sleep
HeapFree
HeapAlloc
GetCurrentThreadId
FormatMessageW
LeaveCriticalSection

user32

GetWindowThreadProcessId
GetWindowPlacement
GetClientRect
ClientToScreen
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
BringWindowToTop
ShowWindow
ClipCursor
GetCursorPos
SendInput
SetWindowPos
PtInRect
EmptyClipboard
GetClipboardData
GetWindowLongPtrW
ScreenToClient
SetClipboardData
CloseClipboard
OpenClipboard
IntersectRect
EnableWindow
GetClassNameW
GetWindowRect
GetDpiForWindow
SetLayeredWindowAttributes
CreateWindowExW
EnumWindows
FindWindowW
GetSystemMetrics
EnumDisplayMonitors
GetCursorInfo
SystemParametersInfoW
SetCursorPos
MonitorFromPoint
GetIconInfo
GetDC
ReleaseDC
SetWindowLongPtrW
IsChild
GetWindowLongW
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
SetWindowDisplayAffinity
GetDCEx
EnumChildWindows
WaitMessage
GetWindow
PostThreadMessageW
GetCapture
UnionRect
RegisterClassExW
ChildWindowFromPointEx
PeekMessageW
DestroyWindow
GetGUIThreadInfo
IsWindow
SetCapture
ReleaseCapture
DefWindowProcW
CallNextHookEx
PostMessageW
SetWindowsHookExW
GetMessageW
WindowFromPoint
TranslateMessage
DispatchMessageW
UnhookWindowsHookEx
LoadCursorW

gdi32

GetStockObject
BitBlt
GetDCOrgEx
GetObjectType
GetCurrentObject
GetDIBits
GetObjectW
DeleteObject

shell32

SHQueryUserNotificationState
SHGetKnownFolderPath

ole32

CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitializeEx

oleaut32

SysStringLen
SysAllocString
SetErrorInfo
SysFreeString
GetErrorInfo

d3d11

CreateDirect3D11DeviceFromDXGIDevice
D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3dcompiler_47

D3DCompile
D3DCreateBlob

coremessaging

CreateDispatcherQueueController

api-ms-win-crt-runtime-l1-1-0

_errno
abort
_beginthreadex
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_initterm
terminate
_cexit
_execute_onexit_table
_crt_atexit
_initterm_e

api-ms-win-crt-heap-l1-1-0

realloc
calloc
malloc
_callnewh
free

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func
__pctype_func
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
_unlock_locales
_lock_locales
setlocale
localeconv

api-ms-win-crt-stdio-l1-1-0

fseek
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fread
_filelength
_wfopen_s
ungetc
__stdio_common_vfprintf
fwrite
fflush
fclose
fgetc
__acrt_iob_func
_fileno
fputc
__stdio_common_vsnprintf_s
setvbuf
_fseeki64
_wfopen
fsetpos
fgetpos
_get_stream_buffer_pointers

api-ms-win-crt-math-l1-1-0

atan2
tan
asin
acos
tanh
_fdclass
ldexp
log2f
lroundf
cosh
_ldclass
frexp
exp
floor
log
fmodf
log10
pow
powf
sqrtf
acosf
sin
sinh
ceilf
cosf
sinf
cos
_dsign
lround
sqrt
atan
_dclass
logf

api-ms-win-crt-time-l1-1-0

_Gettnames
_Wcsftime
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_Getdays
_Strftime

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-string-l1-1-0

tolower
islower
_wcsdup
isupper
iswspace
isspace
isalpha
__strncnt
wcsnlen
isalnum
towlower
strcspn
strncpy
strcpy_s
strcmp
strncmp
toupper
wcsncmp

api-ms-win-crt-convert-l1-1-0

strtof
atof
strtod

api-ms-win-crt-utility-l1-1-0

qsort

dwmapi

DwmSetWindowAttribute
DwmGetWindowAttribute

magnification

MagShowSystemCursor
MagInitialize

imm32

ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext

Exports

Exports

??0MagRuntime@Core@Magpie@@QEAA@XZ
??1MagRuntime@Core@Magpie@@QEAA@XZ
??4EffectCompiler@Core@Magpie@@QEAAAEAU012@$$QEAU012@@Z
??4EffectCompiler@Core@Magpie@@QEAAAEAU012@AEBU012@@Z
??4LoggerHelper@Core@Magpie@@QEAAAEAU012@$$QEAU012@@Z
??4LoggerHelper@Core@Magpie@@QEAAAEAU012@AEBU012@@Z
?Compile@EffectCompiler@Core@Magpie@@SAIAEAUEffectDesc@23@IPEBV?$flat_hash_map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@MUHash@?$StringHashEqT@_W@priv@phmap@@UEq@456@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@M@std@@@2@@phmap@@@Z
?HwndSrc@MagRuntime@Core@Magpie@@QEBAPEAUHWND__@@XZ
?Initialize@LoggerHelper@Core@Magpie@@SAXAEAVLogger@@@Z
?IsRunning@MagRuntime@Core@Magpie@@QEBA_NXZ
?IsRunningChanged@MagRuntime@Core@Magpie@@QEAA?AUevent_token@winrt@@AEBU?$delegate@_N@5@@Z
?IsRunningChanged@MagRuntime@Core@Magpie@@QEAA?AVEventRevoker@WinRTUtils@@Uauto_revoke_t@winrt@@AEBU?$delegate@_N@7@@Z
?IsRunningChanged@MagRuntime@Core@Magpie@@QEAAXAEBUevent_token@winrt@@@Z
?Run@MagRuntime@Core@Magpie@@QEAAXPEAUHWND__@@AEBUMagOptions@23@@Z
?Stop@MagRuntime@Core@Magpie@@QEAAXXZ
?ToggleOverlay@MagRuntime@Core@Magpie@@QEAAXXZ
?VERSION@EffectCompiler@Core@Magpie@@2IB
?_EnsureDispatcherQueue@MagRuntime@Core@Magpie@@AEBAXXZ
?_MagWindThreadProc@MagRuntime@Core@Magpie@@AEAAXXZ
?__autoclassinit2@MagRuntime@Core@Magpie@@QEAAX_K@Z

Sections

.text
Size: 1012KB - Virtual size: 1012KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Magpie_v0.10.3/Magpie.exe
.exe windows:6 windows x64

811faee112d6fbb0fbfa804fd87b7c3b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteConsoleA
WriteFile
GetStdHandle
GetConsoleMode
MultiByteToWideChar
CloseHandle
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
SetCurrentDirectoryW
HeapSetInformation
LoadLibraryW
CreateMutexW
WaitForSingleObject
ReleaseMutex
TlsGetValue
TlsAlloc
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
GetConsoleScreenBufferInfo
GetCurrentProcessId
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SleepConditionVariableSRW
WakeAllConditionVariable
SetConsoleTextAttribute
OutputDebugStringW
SetEvent
GetLastError
Sleep
GetCurrentThreadId
GetDynamicTimeZoneInformation
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionAndSpinCount
GetFileAttributesA
TlsFree
FreeLibrary
RtlUnwind
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
TrySubmitThreadpoolCallback
TlsSetValue

user32

GetClientRect
ClientToScreen
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
BringWindowToTop
ShowWindow
LoadIconW
LoadCursorW
RegisterClassExW
MonitorFromWindow
GetMonitorInfoW
SetWindowPos
GetWindowThreadProcessId
CreateWindowExW
SetLayeredWindowAttributes
IsIconic
SetMenuItemInfoW
GetSystemMenu
SetMenuDefaultItem
TrackPopupMenu
PostMessageW
SetWindowLongPtrW
GetWindowLongPtrW
DefWindowProcW
ScreenToClient
GetWindowPlacement
PtInRect
SendMessageW
TrackMouseEvent
GetCursorPos
WindowFromPoint
SetWindowPlacement
RegisterWindowMessageW
SetCapture
DispatchMessageW
TranslateMessage
GetAncestor
PostQuitMessage
ChangeWindowMessageFilter
GetMessageW
ReleaseCapture
TrackPopupMenuEx
AppendMenuW
CreatePopupMenu
DestroyIcon
DestroyWindow
DestroyMenu
IsWindowVisible
IsZoomed
GetWindowLongW
AdjustWindowRectExForDpi
UpdateWindow
InvalidateRect
SetClassLongPtrW
GetKeyState
SetFocus
EndPaint
FillRect
BeginPaint
GetWindowRect
GetDpiForWindow
GetSystemMetricsForDpi

gdi32

CreateSolidBrush
GetStockObject
DeleteObject

advapi32

CheckTokenMembership
CreateWellKnownSid

shell32

ShellExecuteExW
SHAppBarMessage
Shell_NotifyIconW

ole32

CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoGetObjectContext
CoInitializeEx

oleaut32

SysAllocString
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString

magpie.core

?Initialize@LoggerHelper@Core@Magpie@@SAXAEAVLogger@@@Z

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_seh_filter_exe
_initialize_onexit_table
_errno
_invalid_parameter_noinfo
_set_app_type
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_wide_environment
_beginthreadex
_get_wide_winmain_command_line
_initterm
_exit
exit
abort
terminate
_initterm_e
_cexit

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-locale-l1-1-0

__pctype_func
___lc_codepage_func
_configthreadlocale
___lc_locale_name_func
_unlock_locales
_lock_locales
setlocale
localeconv
___mb_cur_max_func

api-ms-win-crt-stdio-l1-1-0

_fileno
__p__commode
fwrite
_set_fmode
fflush
fclose
_filelengthi64
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsnprintf_s
_fsopen

api-ms-win-crt-math-l1-1-0

lround
lroundf
__setusermatherr
_ldclass
_dclass
_fdclass
_dsign

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir
remove
rename

api-ms-win-crt-string-l1-1-0

isdigit
wcsncmp
strcpy_s
iswspace
wcscpy_s

dwmapi

DwmExtendFrameIntoClientArea
DwmSetWindowAttribute

comctl32

ord380

uxtheme

BeginBufferedPaint
EndBufferedPaint
BufferedPaintSetAlpha
BufferedPaintInit

Sections

.text
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Magpie_v0.10.3/Microsoft.UI.Xaml.dll
.dll windows:6 windows x64

d497f1f24ff0944f7900befb2156cd9b

Code Sign

33:00:00:02:d0:e7:eb:7c:2e:f6:ce:23:e1:00:00:00:00:02:d0
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:35:c1:27:00:ac:d3:f5:ce:00:b9:11:12:26:b5:f1:b0:c3:9d:cc:0e:9e:a7:80:df:4f:3a:16:40:ac:79:ce
Signer

Actual PE Digest

7a:35:c1:27:00:ac:d3:f5:ce:00:b9:11:12:26:b5:f1:b0:c3:9d:cc:0e:9e:a7:80:df:4f:3a:16:40:ac:79:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoGetObjectContext
CoGetApartmentType
CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventW
WaitForSingleObject

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExW

oleaut32

GetErrorInfo
SysFreeString
SafeArrayCreateVector
SetErrorInfo
SysAllocString
SysStringLen
SafeArrayPutElement

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

d2d1

ord1

api-ms-win-crt-runtime-l1-1-0

_initterm
terminate
_wassert
_cexit
_invalid_parameter_noinfo_noreturn
_errno
_invalid_parameter_noinfo
abort
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-string-l1-1-0

wcsnlen
strcpy_s
_wcsdup
wcsncmp
_wcsicmp
towupper
iswspace

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul
wcstol
wcstof

api-ms-win-crt-math-l1-1-0

atan2
_fdclass
ceilf
cos
nextafterf
floor
floorf
round
pow
roundf
ceil
sin
_dclass
sqrt

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
_callnewh
realloc

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CompareStringEx
LCMapStringEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
SwitchToThread
WaitForSingleObjectEx
InitOnceBeginInitialize
InitOnceComplete
RaiseException
RtlPcToFileHeader
GetStringTypeW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
ResetEvent
RtlCaptureContext
InitializeSListHead
GetCurrentProcessId
RtlLookupFunctionEntry
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-crt-locale-l1-1-0

setlocale
_lock_locales
_unlock_locales
___lc_locale_name_func
___lc_codepage_func
___mb_cur_max_func
__pctype_func
___lc_collate_cp_func

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllMain
SendTelemetryOnSuspend

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Magpie_v0.10.3/Updater.exe
.exe windows:6 windows x64

f5a5b3921d9a89df52b13c0337b68715

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameW
SetCurrentDirectoryW
CreateMutexW
WaitForSingleObject
CloseHandle
DeleteFileW
Sleep
FindFirstFileExW
MoveFileExW
CreateDirectoryW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileAttributesW
WideCharToMultiByte
RtlUnwind
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindFirstFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetLastError
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue

shell32

ShellExecuteExW

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_initialize_wide_environment
_get_wide_winmain_command_line
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_set_app_type
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_crt_atexit
abort
_configure_wide_argv
_seh_filter_exe
terminate

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Magpie_v0.10.3/effects/ACNet.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_3D_AA_Upscale_US.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_3D_Upscale_US.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Denoise_Bilateral_Mean.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Denoise_Bilateral_Median.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Denoise_Bilateral_Mode.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_L.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_M.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_Soft_L.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_Soft_M.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_Soft_UL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_Soft_VL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_UL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Restore_VL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Thin_HQ.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_Denoise_L.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_Denoise_S.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_Denoise_UL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_Denoise_VL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_GAN_x2_S.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_L.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_S.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_UL.hlsl
Magpie_v0.10.3/effects/Anime4K/Anime4K_Upscale_VL.hlsl
Magpie_v0.10.3/effects/Bicubic.hlsl
Magpie_v0.10.3/effects/Bilinear.hlsl
Magpie_v0.10.3/effects/CAS/CAS.hlsl
Magpie_v0.10.3/effects/CAS/CAS_Scaling.hlsl
Magpie_v0.10.3/effects/CRT/CRT_Easymode.hlsl
Magpie_v0.10.3/effects/CRT/CRT_Geom.hlsl
Magpie_v0.10.3/effects/CRT/CRT_Hyllian.hlsl
Magpie_v0.10.3/effects/CRT/CRT_Lottes.hlsl
Magpie_v0.10.3/effects/CRT/GTU_v050.hlsl
Magpie_v0.10.3/effects/Deband.hlsl
Magpie_v0.10.3/effects/FSR/FSR_EASU.hlsl
Magpie_v0.10.3/effects/FSR/FSR_RCAS.hlsl
Magpie_v0.10.3/effects/FSRCNNX/FSRCNNX.hlsl
Magpie_v0.10.3/effects/FSRCNNX/FSRCNNX_LineArt.hlsl
Magpie_v0.10.3/effects/FXAA/FXAA.hlsli
Magpie_v0.10.3/effects/FXAA/FXAA_High.hlsl
Magpie_v0.10.3/effects/FXAA/FXAA_Medium.hlsl
Magpie_v0.10.3/effects/FXAA/FXAA_Ultra.hlsl
Magpie_v0.10.3/effects/ImageAdjustment.hlsl
Magpie_v0.10.3/effects/Jinc.hlsl
Magpie_v0.10.3/effects/Lanczos.hlsl
Magpie_v0.10.3/effects/NIS/Coef_Scale.dds
Magpie_v0.10.3/effects/NIS/Coef_USM.dds
Magpie_v0.10.3/effects/NIS/NIS.hlsl
Magpie_v0.10.3/effects/NIS/NVSharpen.hlsl
Magpie_v0.10.3/effects/NNEDI3/NNEDI3_nns16_win8x4.hlsl
Magpie_v0.10.3/effects/NNEDI3/NNEDI3_nns64_win8x6.hlsl
Magpie_v0.10.3/effects/Nearest.hlsl
Magpie_v0.10.3/effects/Pixel Art/MMPX.hlsl
Magpie_v0.10.3/effects/Pixel Art/Pixellate.hlsl
Magpie_v0.10.3/effects/Pixel Art/SharpBilinear.hlsl
Magpie_v0.10.3/effects/RAVU/RAVU_Lite_R3.hlsl
Magpie_v0.10.3/effects/RAVU/RAVU_Lite_R3_Weights.dds
Magpie_v0.10.3/effects/RAVU/RAVU_Zoom_R3.hlsl
Magpie_v0.10.3/effects/RAVU/RAVU_Zoom_R3_Weights.dds
Magpie_v0.10.3/effects/SMAA/AreaTex.dds
Magpie_v0.10.3/effects/SMAA/SMAA.hlsli
Magpie_v0.10.3/effects/SMAA/SMAA_High.hlsl
Magpie_v0.10.3/effects/SMAA/SMAA_Low.hlsl
Magpie_v0.10.3/effects/SMAA/SMAA_Medium.hlsl
Magpie_v0.10.3/effects/SMAA/SMAA_Ultra.hlsl
Magpie_v0.10.3/effects/SMAA/SearchTex.dds
Magpie_v0.10.3/effects/SSimDownscaler.hlsl
Magpie_v0.10.3/effects/Sharpen/AdaptiveSharpen.hlsl
Magpie_v0.10.3/effects/Sharpen/FineSharp.hlsl
Magpie_v0.10.3/effects/Sharpen/LCAS.hlsl
Magpie_v0.10.3/effects/Sharpen/LumaSharpen.hlsl
Magpie_v0.10.3/effects/xBRZ/xBRZ_2x.hlsl
Magpie_v0.10.3/effects/xBRZ/xBRZ_3x.hlsl
Magpie_v0.10.3/effects/xBRZ/xBRZ_4x.hlsl
Magpie_v0.10.3/effects/xBRZ/xBRZ_5x.hlsl
Magpie_v0.10.3/effects/xBRZ/xBRZ_6x.hlsl
Magpie_v0.10.3/effects/xBRZ/xBRZ_Freescale.hlsl
Magpie_v0.10.3/resources.pri

Sharing

General

Malware Config

Signatures

Files

1f6b6143a63fea86317241e35d84a20d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

oleaut32

user32

gdi32

magpie.core

api-ms-win-security-base-l1-1-0

api-ms-win-core-version-l1-1-0

dxgi

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

dwmapi

shell32

comctl32

shlwapi

bcp47mrm

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 268KB - Virtual size: 268KB

.data Size: 14KB - Virtual size: 23KB

.pdata Size: 58KB - Virtual size: 58KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 12KB - Virtual size: 11KB

f3ce8b4cadafbf8cc39b3054761a6b65

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

d3d11

dxgi

d3dcompiler_47

coremessaging

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

dwmapi

magnification

imm32

Exports

Exports

Sections

.text Size: 1012KB - Virtual size: 1012KB

.rdata Size: 216KB - Virtual size: 215KB

.data Size: 8KB - Virtual size: 58KB

.pdata Size: 42KB - Virtual size: 42KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 268KB - Virtual size: 268KB

.data
Size: 14KB - Virtual size: 23KB

.pdata
Size: 58KB - Virtual size: 58KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 1012KB - Virtual size: 1012KB

.rdata
Size: 216KB - Virtual size: 215KB

.data
Size: 8KB - Virtual size: 58KB

.pdata
Size: 42KB - Virtual size: 42KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 209KB - Virtual size: 208KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 2KB - Virtual size: 8KB

.pdata
Size: 11KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 82KB - Virtual size: 82KB

.reloc
Size: 2KB - Virtual size: 1KB

33:00:00:02:d0:e7:eb:7c:2e:f6:ce:23:e1:00:00:00:00:02:d0
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

7a:35:c1:27:00:ac:d3:f5:ce:00:b9:11:12:26:b5:f1:b0:c3:9d:cc:0e:9e:a7:80:df:4f:3a:16:40:ac:79:ce
Signer