Magpie-v0[.]11[.]0-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Magpie-v0.11.0-x64.zip
Size

9.5MB
MD5

98268d36b29d7fded87a9f8d589e8376
SHA1

b8541f1ddae31c3ad503c33e4aca7ad63fa8fff2
SHA256

a959382c40b78cb06fdf7d9d9abf03be463a4e8b56e409b7aabb456e2c2f258d
SHA512

a236a8294b5658f0599090cb337ccf06198d409b7907fe3652e1da813979ae23a27baf375024031e9e00a04784c4cea54610473cbece33a569a0489abbc01399
SSDEEP

196608:NdKRgtQyKrOi/ukwdsyogzXpa6SgMgj41qAAXtlEdh5LhbD:NYRyQgilAsyoypXK4P059

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Magpie.App.dll
unpack001/Magpie.exe
unpack001/Updater.exe

Files

Magpie-v0.11.0-x64.zip
.zip
Magpie.App.dll
.dll windows:6 windows x64 arch:x64

de1cd40764dba21dbc5b1e7ec7fff1fe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\Magpie\Magpie\publish\x64\Magpie.App.pdb

Imports

kernel32

QueryFullProcessImageNameW
K32GetModuleFileNameExW
GetModuleFileNameW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
FindStringOrdinal
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFullPathNameW
GetApplicationUserModelId
FindClose
FindFirstFileExW
FindNextFileW
GetPackagePathByFullName
ParseApplicationUserModelId
FindPackagesByPackageFamily
GetEnvironmentVariableW
Sleep
CompareStringEx
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
HeapAlloc
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
DebugBreak
RemoveDirectoryW
SetFileInformationByHandle
SetFileAttributesW
GetFileInformationByHandleEx
CreateFileW
FindFirstFileW
LocalAlloc
WriteFile
MoveFileExW
DecodePointer
EncodePointer
CloseThreadpoolTimer
SetLastError
SetThreadpoolTimer
CreateThreadpoolTimer
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
IsProcessorFeaturePresent
RaiseException
RtlPcToFileHeader
GetStringTypeW
GetExitCodeThread
SwitchToThread
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
ResolveDelayLoadedAPI
DelayLoadFailureHook
LeaveCriticalSection
DeleteCriticalSection
LCMapStringEx
GetCPInfo
LocalFree
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
GetLocaleInfoEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
SubmitThreadpoolWork
CreateThreadpoolWork
GetModuleHandleW
ReadFile
GetFileSize
CreateFile2
LoadLibraryExW
GetProcAddress
OpenProcess
CloseHandle
FormatMessageW
GetCurrentThreadId
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringW
IsDebuggerPresent
SetThreadpoolTimerEx
TrySubmitThreadpoolCallback
GetLastError

ole32

CoInitializeEx
CoGetObjectContext
RoGetAgileReference
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
CoAllowSetForegroundWindow
PropVariantClear
CoGetApartmentType

oleaut32

SetErrorInfo
SysStringLen
GetErrorInfo
SysFreeString
SysAllocString
SysAllocStringLen
VariantClear
VariantInit

user32

SendInput
CallNextHookEx
RegisterHotKey
DestroyWindow
DefWindowProcW
UnregisterHotKey
GetDC
GetIconInfo
SetWindowsHookExW
GetClassLongPtrW
GetCursorPos
GetWindow
IsWindowVisible
EnumWindows
GetSystemMetrics
PostThreadMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjectsEx
IsWindow
GetGUIThreadInfo
CreateWindowExW
RegisterClassExW
ReleaseDC
PostMessageW
UnhookWindowsHookEx
MonitorFromPoint
GetDpiForWindow
SetWindowLongPtrW
GetWindowLongPtrW
DestroyIcon
SendMessageW
GetAsyncKeyState
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
EnableWindow
GetDCEx
MonitorFromRect
GetKeyboardLayout
FindWindowW
GetWindowLongW
GetClassNameW
IsChild
GetWindowTextLengthW
GetWindowTextW
GetWindowRgn
ToUnicodeEx
ChildWindowFromPointEx
PtInRect
GetCursorInfo
ClipCursor
SetCursorPos
EnumDisplaySettingsW
GetMessageW
SetPropW
SetWindowDisplayAffinity
GetPropW
SetWindowPos
SetLayeredWindowAttributes
EnumChildWindows
LoadCursorW
UnionRect
GetWindowThreadProcessId
GetWindowPlacement
GetClientRect
RegisterWindowMessageW
ClientToScreen
MonitorFromWindow
GetMonitorInfoW
WaitMessage
MapVirtualKeyExW
IntersectRect
GetWindowRgnBox
GetWindowRect
OffsetRect
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
BringWindowToTop
ShowWindow

gdi32

GetStockObject
BitBlt
GetDCOrgEx
GetObjectType
GetCurrentObject
GetDIBits
CreateRectRgn
PtInRegion
GetObjectW
DeleteObject

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
CheckTokenMembership
GetTokenInformation
GetSidSubAuthority
CreateWellKnownSid

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathAllocCombine
PathCchSkipRoot

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-core-processthreads-l1-1-0

GetThreadId
OpenProcessToken

dxgi

CreateDXGIFactory1
CreateDXGIFactory2

bcrypt

BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData

coremessaging

CreateDispatcherQueueController

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW
EnumDisplayMonitors

api-ms-win-mm-time-l1-1-0

timeEndPeriod
timeBeginPeriod

api-ms-win-core-synch-l1-1-0

CreateWaitableTimerExW
CreateEventExW
SetWaitableTimerEx
OpenMutexW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

d3d11

D3D11CreateDevice
CreateDirect3D11DeviceFromDXGIDevice

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_initterm
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_register_onexit_function
terminate
_beginthreadex
abort
_invalid_parameter_noinfo
_errno
_initterm_e

api-ms-win-crt-math-l1-1-0

cosh
cos
atan2
atan
asin
_ldclass
_dclass
log2f
frexp
powf
pow
exp
log
sinf
ceilf
acosf
sqrtf
fmodf
cosf
round
lround
lroundf
floor
_dsign
log10
sin
sinh
sqrt
tan
tanh
_fdclass
ceil
logf
acos

api-ms-win-crt-heap-l1-1-0

_callnewh
realloc
malloc
calloc
free

api-ms-win-crt-string-l1-1-0

wcscat_s
wcsncmp
isdigit
isalpha
isalnum
toupper
strncpy
strcmp
iswspace
strncmp
strcpy_s
towlower
islower
_wcsdup
isupper
tolower
__strncnt
strncpy_s
wcsnlen
isspace
strcspn

api-ms-win-crt-stdio-l1-1-0

setvbuf
_ftelli64
_fseeki64
ungetc
fsetpos
fgetpos
fgetc
fputc
__stdio_common_vswprintf
_get_stream_buffer_pointers
__stdio_common_vsscanf
__stdio_common_vfprintf
ftell
fflush
_wfopen
__acrt_iob_func
_wfopen_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
_fileno
_filelength
fread
fseek
fwrite
fclose

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func
__pctype_func
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
_unlock_locales
_lock_locales
setlocale
localeconv

api-ms-win-crt-convert-l1-1-0

atof
strtof
strtod
wcstol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_wmkdir
_unlock_file
_lock_file

api-ms-win-crt-time-l1-1-0

_Strftime
_Gettnames
_Wcsftime
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_mktime64
_utime64
_Getdays

dwmapi

DwmSetWindowAttribute
DwmGetWindowAttribute

shell32

SHOpenFolderAndSelectItems
SHParseDisplayName
SHGetKnownFolderPath
SHGetPropertyStoreForWindow
ShellExecuteExW
SHQueryUserNotificationState
ord6
SHCreateItemFromParsingName

comctl32

ord345
ord380

shlwapi

PathRelativePathToW
PathIsSameRootW
ord487
PathIsRelativeW
SHCreateStreamOnFileEx

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

bcp47mrm

GetDistanceOfClosestLanguageInList

imm32

ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmSetCompositionWindow

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
RoTransformError

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Magpie.exe
.exe windows:6 windows x64 arch:x64

a77876cbf812116386a4bb0ed07a2c12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Magpie\Magpie\publish\x64\Magpie.pdb

Imports

kernel32

GetModuleHandleW
LocalFree
SetLastError
K32GetModuleFileNameExW
GetModuleFileNameW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
HeapAlloc
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
DebugBreak
SetCurrentDirectoryW
HeapSetInformation
GetFileAttributesW
CreateFileW
CreateDirectoryW
FindStringOrdinal
CopyFileW
Sleep
DeleteFileW
RemoveDirectoryW
SetFileInformationByHandle
FindNextFileW
SetFileAttributesW
GetFileInformationByHandleEx
FindClose
FindFirstFileW
GetFullPathNameW
LocalAlloc
SetProcessInformation
GetCurrentProcess
GetDynamicTimeZoneInformation
GetStdHandle
WriteFile
GetConsoleMode
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReleaseSRWLockExclusive
LoadLibraryExW
WakeConditionVariable
GetProcAddress
OpenProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
QueryPerformanceFrequency
SwitchToThread
GetExitCodeThread
RtlPcToFileHeader
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
TrySubmitThreadpoolCallback
AcquireSRWLockExclusive
CloseHandle
FormatMessageW
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringW
IsDebuggerPresent
TryAcquireSRWLockExclusive
GetLastError

user32

DestroyWindow
DestroyIcon
CreatePopupMenu
AppendMenuW
RegisterWindowMessageW
IsZoomed
DestroyMenu
FindWindowW
GetMessageW
DispatchMessageW
TranslateMessage
GetAncestor
TrackPopupMenuEx
GetWindowThreadProcessId
GetWindowPlacement
GetClientRect
ClientToScreen
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
BringWindowToTop
PostQuitMessage
ChangeWindowMessageFilter
AdjustWindowRectExForDpi
UpdateWindow
InvalidateRect
SetClassLongPtrW
GetKeyState
EndPaint
ShowWindow
FillRect
BeginPaint
IsWindowVisible
GetDpiForWindow
GetSystemMetricsForDpi
MoveWindow
ReleaseCapture
SetCapture
WindowFromPoint
GetCursorPos
TrackMouseEvent
SendMessageW
ScreenToClient
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
MonitorFromPoint
PostMessageW
TrackPopupMenu
SetMenuDefaultItem
GetSystemMenu
PtInRect
SetMenuItemInfoW
IsIconic
SetLayeredWindowAttributes
CreateWindowExW
SetWindowPlacement
SetWindowPos
RegisterClassExW
LoadCursorW
LoadIconW
GetWindowLongW

gdi32

GetStockObject
DeleteObject
CreateSolidBrush

advapi32

CreateWellKnownSid
CheckTokenMembership

shell32

SHGetKnownFolderPath
Shell_NotifyIconW
SHAppBarMessage
ShellExecuteExW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoGetObjectContext

oleaut32

SysFreeString
SetErrorInfo
GetErrorInfo
SysStringLen

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathCchSkipRoot
PathAllocCombine
PathCchRemoveFileSpec

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExA

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
abort
_set_app_type
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_c_exit
_invalid_parameter_noinfo_noreturn
_initterm_e
_register_onexit_function
_errno
_beginthreadex
terminate
_cexit
_crt_atexit
exit
_exit
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

ceilf
_dclass
_fdclass
__setusermatherr
_ldclass
_dsign
lroundf

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
_callnewh
malloc
calloc

api-ms-win-crt-string-l1-1-0

isdigit
strcpy_s
wcscpy_s
wcsncmp
iswspace

api-ms-win-crt-stdio-l1-1-0

_wfopen_s
__stdio_common_vswprintf
_fileno
fwrite
fclose
_set_fmode
__acrt_iob_func
_fsopen
__stdio_common_vfprintf
_filelengthi64
fflush
__p__commode

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
rename
remove
_mkdir

api-ms-win-crt-locale-l1-1-0

setlocale
___lc_codepage_func
localeconv
_lock_locales
___lc_locale_name_func
__pctype_func
___mb_cur_max_func
_unlock_locales
_configthreadlocale

dwmapi

DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
DwmGetWindowAttribute

comctl32

ord380

uxtheme

BufferedPaintInit
BeginBufferedPaint
EndBufferedPaint
BufferedPaintSetAlpha

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoFailFastWithErrorContext

Sections

.text
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.UI.Xaml.dll
.dll windows:6 windows x64 arch:x64

cd2511fe0afac31e49793c33a75ecb68

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:57:92:12:54:9b:38:ac:c1:21:72:00:13:a5:bc:10:c0:77:a1:7c:c8:79:7d:6e:56:d8:9f:2d:74:7e:94:14
Signer

Actual PE Digest

df:57:92:12:54:9b:38:ac:c1:21:72:00:13:a5:bc:10:c0:77:a1:7c:c8:79:7d:6e:56:d8:9f:2d:74:7e:94:14

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\BuildOutput\Release\x64\Microsoft.UI.Xaml\Microsoft.UI.Xaml.pdb

Imports

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoGetObjectContext
CoGetApartmentType
CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
SetEvent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExW

oleaut32

GetErrorInfo
SysFreeString
SafeArrayCreateVector
SetErrorInfo
SysAllocString
SysStringLen
SafeArrayPutElement

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

d2d1

ord1

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_initterm_e
_errno
terminate
_wassert
_invalid_parameter_noinfo_noreturn
abort
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit

api-ms-win-crt-string-l1-1-0

wcsnlen
strcpy_s
_wcsicmp
_wcsdup
towupper
iswspace
wcsncmp

api-ms-win-crt-convert-l1-1-0

wcstol
wcstof
_wtoi
wcstoul

api-ms-win-crt-math-l1-1-0

round
ceil
_fdclass
cos
floor
nextafterf
floorf
_dclass
pow
sqrt
roundf
atan2
sin
ceilf

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

calloc
malloc
realloc
_callnewh
free

kernel32

GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
InitOnceBeginInitialize
InitOnceComplete
RaiseException
RtlPcToFileHeader
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId
RtlVirtualUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-crt-locale-l1-1-0

_unlock_locales
setlocale
__pctype_func
_lock_locales
___lc_locale_name_func
___lc_codepage_func
___lc_collate_cp_func
___mb_cur_max_func

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllMain
SendTelemetryOnSuspend

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TouchHelper.exe
.exe windows:6 windows x64 arch:x64

2fcfb2bda5868ad426a8daa7379a39cc

Code Sign

78:5b:8c:61:43:7b:a1:ae:44:4e:ab:f4:0b:ca:63:01
Certificate

Issuer

CN=Magpie

Not Before

24/04/2024, 03:55

Not After

24/04/2124, 04:05

Subject

CN=Magpie

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e4:89:2a:bd:a3:86:bb:67:40:1c:ce:d9:23:64:72:6f:96:65:be:64:06:5f:5a:6b:77:80:62:bd:9c:2d:3f:45
Signer

Actual PE Digest

e4:89:2a:bd:a3:86:bb:67:40:1c:ce:d9:23:64:72:6f:96:65:be:64:06:5f:5a:6b:77:80:62:bd:9c:2d:3f:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Magpie\Magpie\publish\x64\TouchHelper.pdb

Imports

magnification

MagUninitialize
MagInitialize
MagSetInputTransform

kernel32

GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlPcToFileHeader
GetLastError
CloseHandle
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
SetLastError
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
OpenSemaphoreW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
GetCurrentProcess
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
EncodePointer
RtlUnwindEx
InitializeSListHead
RtlVirtualUnwind
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry

user32

GetPropW
PostMessageW
DestroyWindow
RegisterWindowMessageW
ChangeWindowMessageFilterEx
MsgWaitForMultipleObjectsEx
DispatchMessageW
PeekMessageW
IsWindowVisible
FindWindowW
CreateWindowExW
RegisterClassExW
MessageBoxW
DefWindowProcW
PostQuitMessage

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswprintf

api-ms-win-crt-runtime-l1-1-0

_cexit
_seh_filter_exe
_set_app_type
_crt_atexit
_initialize_onexit_table
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_invalid_parameter_noinfo
terminate
_errno
abort
_register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
calloc

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Updater.exe
.exe windows:6 windows x64 arch:x64

71118cd394c0ed811860c40b57593c0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\Magpie\Magpie\publish\x64\Updater.pdb

Imports

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchRemoveFileSpec

kernel32

SetUnhandledExceptionFilter
EncodePointer
LoadLibraryExW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
SetCurrentDirectoryW
DeleteFileW
Sleep
FindClose
FindFirstFileExW
MoveFileExW
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
SetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
GetFileInformationByHandleEx
CreateFileW
LocalFree
FindFirstFileW
GetFullPathNameW
LocalAlloc
K32GetModuleFileNameExW
GetModuleFileNameW
WideCharToMultiByte
RaiseException
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
RtlPcToFileHeader
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx

shell32

ShellExecuteExW

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_errno
_set_app_type
_cexit
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_invalid_parameter_noinfo
abort
terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
calloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
effects/ACNet.hlsl
effects/Anime4K/Anime4K_3D_AA_Upscale_US.hlsl
effects/Anime4K/Anime4K_3D_Upscale_US.hlsl
effects/Anime4K/Anime4K_Denoise_Bilateral_Mean.hlsl
effects/Anime4K/Anime4K_Denoise_Bilateral_Median.hlsl
effects/Anime4K/Anime4K_Denoise_Bilateral_Mode.hlsl
effects/Anime4K/Anime4K_Restore_L.hlsl
effects/Anime4K/Anime4K_Restore_M.hlsl
effects/Anime4K/Anime4K_Restore_S.hlsl
effects/Anime4K/Anime4K_Restore_Soft_L.hlsl
effects/Anime4K/Anime4K_Restore_Soft_M.hlsl
effects/Anime4K/Anime4K_Restore_Soft_S.hlsl
effects/Anime4K/Anime4K_Restore_Soft_UL.hlsl
effects/Anime4K/Anime4K_Restore_Soft_VL.hlsl
effects/Anime4K/Anime4K_Restore_UL.hlsl
effects/Anime4K/Anime4K_Restore_VL.hlsl
effects/Anime4K/Anime4K_Thin_HQ.hlsl
effects/Anime4K/Anime4K_Upscale_Denoise_L.hlsl
effects/Anime4K/Anime4K_Upscale_Denoise_S.hlsl
effects/Anime4K/Anime4K_Upscale_Denoise_UL.hlsl
effects/Anime4K/Anime4K_Upscale_Denoise_VL.hlsl
effects/Anime4K/Anime4K_Upscale_GAN_x2_M.hlsl
effects/Anime4K/Anime4K_Upscale_GAN_x2_S.hlsl
effects/Anime4K/Anime4K_Upscale_GAN_x3_L.hlsl
effects/Anime4K/Anime4K_Upscale_L.hlsl
effects/Anime4K/Anime4K_Upscale_S.hlsl
effects/Anime4K/Anime4K_Upscale_UL.hlsl
effects/Anime4K/Anime4K_Upscale_VL.hlsl
effects/Bicubic.hlsl
effects/Bilinear.hlsl
effects/CAS/CAS.hlsl
effects/CAS/CAS_Scaling.hlsl
effects/CRT/CRT_Easymode.hlsl
effects/CRT/CRT_Geom.hlsl
effects/CRT/CRT_Hyllian.hlsl
effects/CRT/CRT_Lottes.hlsl
effects/CRT/GTU_v050.hlsl
effects/CuNNy/CuNNy-16x16C-NVL-DN.hlsl
effects/CuNNy/CuNNy-16x16C-NVL.hlsl
effects/CuNNy/CuNNy-2x4C-NVL-DN.hlsl
effects/CuNNy/CuNNy-2x4C-NVL.hlsl
effects/CuNNy/CuNNy-3x4C-NVL-DN.hlsl
effects/CuNNy/CuNNy-3x4C-NVL.hlsl
effects/CuNNy/CuNNy-4x16C-NVL-DN.hlsl
effects/CuNNy/CuNNy-4x16C-NVL.hlsl
effects/CuNNy/CuNNy-4x4C-NVL-DN.hlsl
effects/CuNNy/CuNNy-4x4C-NVL.hlsl
effects/CuNNy/CuNNy-4x8C-NVL-DN.hlsl
effects/CuNNy/CuNNy-4x8C-NVL.hlsl
effects/CuNNy/CuNNy-6x8C-NVL-DN.hlsl
effects/CuNNy/CuNNy-6x8C-NVL.hlsl
effects/CuNNy/CuNNy-8x16C-NVL-DN.hlsl
effects/CuNNy/CuNNy-8x16C-NVL.hlsl
effects/CuNNy/CuNNy-8x4C-NVL-DN.hlsl
effects/CuNNy/CuNNy-8x4C-NVL.hlsl
effects/CuNNy/CuNNy-8x8C-NVL-DN.hlsl
effects/CuNNy/CuNNy-8x8C-NVL.hlsl
effects/Deband.hlsl
effects/FSR/FSR_EASU.hlsl
effects/FSR/FSR_RCAS.hlsl
effects/FSRCNNX/FSRCNNX.hlsl
effects/FSRCNNX/FSRCNNX_LineArt.hlsl
effects/FXAA/FXAA.hlsli
effects/FXAA/FXAA_High.hlsl
effects/FXAA/FXAA_Medium.hlsl
effects/FXAA/FXAA_Ultra.hlsl
effects/ImageAdjustment.hlsl
effects/Jinc.hlsl
effects/Lanczos.hlsl
effects/NIS/Coef_Scale.dds
effects/NIS/Coef_USM.dds
effects/NIS/NIS.hlsl
effects/NIS/NVSharpen.hlsl
effects/NNEDI3/NNEDI3_nns128_win8x4.hlsl
effects/NNEDI3/NNEDI3_nns128_win8x6.hlsl
effects/NNEDI3/NNEDI3_nns16_win8x4.hlsl
effects/NNEDI3/NNEDI3_nns16_win8x6.hlsl
effects/NNEDI3/NNEDI3_nns256_win8x4.hlsl
effects/NNEDI3/NNEDI3_nns256_win8x6.hlsl
effects/NNEDI3/NNEDI3_nns32_win8x4.hlsl
effects/NNEDI3/NNEDI3_nns32_win8x6.hlsl
effects/NNEDI3/NNEDI3_nns64_win8x4.hlsl
effects/NNEDI3/NNEDI3_nns64_win8x6.hlsl
effects/NNEDI3/prescalers.hlsli
effects/Nearest.hlsl
effects/Pixel Art/MMPX.hlsl
effects/Pixel Art/Pixellate.hlsl
effects/Pixel Art/SharpBilinear.hlsl
effects/RAVU/RAVU_3x_R2.hlsl
effects/RAVU/RAVU_3x_R2_RGB.hlsl
effects/RAVU/RAVU_3x_R3.hlsl
effects/RAVU/RAVU_3x_R3_RGB.hlsl
effects/RAVU/RAVU_3x_R4.hlsl
effects/RAVU/RAVU_3x_R4_RGB.hlsl
effects/RAVU/RAVU_Lite_AR_R2.hlsl
effects/RAVU/RAVU_Lite_AR_R3.hlsl
effects/RAVU/RAVU_Lite_AR_R4.hlsl
effects/RAVU/RAVU_Lite_R2.hlsl
effects/RAVU/RAVU_Lite_R3.hlsl
effects/RAVU/RAVU_Lite_R4.hlsl
effects/RAVU/RAVU_R2.hlsl
effects/RAVU/RAVU_R2_RGB.hlsl
effects/RAVU/RAVU_R3.hlsl
effects/RAVU/RAVU_R3_RGB.hlsl
effects/RAVU/RAVU_R4.hlsl
effects/RAVU/RAVU_R4_RGB.hlsl
effects/RAVU/RAVU_Zoom_AR_R2.hlsl
effects/RAVU/RAVU_Zoom_AR_R2_RGB.hlsl
effects/RAVU/RAVU_Zoom_AR_R3.hlsl
effects/RAVU/RAVU_Zoom_AR_R3_RGB.hlsl
effects/RAVU/RAVU_Zoom_R2.hlsl
effects/RAVU/RAVU_Zoom_R2_RGB.hlsl
effects/RAVU/RAVU_Zoom_R3.hlsl
effects/RAVU/RAVU_Zoom_R3_RGB.hlsl
effects/RAVU/prescalers.hlsli
effects/RAVU/ravu_3x_lut2_f16.dds
effects/RAVU/ravu_3x_lut3_f16.dds
effects/RAVU/ravu_3x_lut4_f16.dds
effects/RAVU/ravu_lite_lut2_f16.dds
effects/RAVU/ravu_lite_lut3_f16.dds
effects/RAVU/ravu_lite_lut4_f16.dds
effects/RAVU/ravu_lut2_f16.dds
effects/RAVU/ravu_lut3_f16.dds
effects/RAVU/ravu_lut4_f16.dds
effects/RAVU/ravu_zoom_lut2_ar_f16.dds
effects/RAVU/ravu_zoom_lut2_f16.dds
effects/RAVU/ravu_zoom_lut3_ar_f16.dds
effects/RAVU/ravu_zoom_lut3_f16.dds
effects/SMAA/AreaTex.dds
effects/SMAA/SMAA.hlsli
effects/SMAA/SMAA_High.hlsl
effects/SMAA/SMAA_Low.hlsl
effects/SMAA/SMAA_Medium.hlsl
effects/SMAA/SMAA_Ultra.hlsl
effects/SMAA/SearchTex.dds
effects/SSimDownscaler.hlsl
effects/Sharpen/AdaptiveSharpen.hlsl
effects/Sharpen/FineSharp.hlsl
effects/Sharpen/LCAS.hlsl
effects/Sharpen/LumaSharpen.hlsl
effects/xBRZ/xBRZ_2x.hlsl
effects/xBRZ/xBRZ_3x.hlsl
effects/xBRZ/xBRZ_4x.hlsl
effects/xBRZ/xBRZ_5x.hlsl
effects/xBRZ/xBRZ_6x.hlsl
effects/xBRZ/xBRZ_Freescale.hlsl
resources.pri

Sharing

General

Malware Config

Signatures

Files

de1cd40764dba21dbc5b1e7ec7fff1fe

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

user32

gdi32

api-ms-win-security-base-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-processthreads-l1-1-0

dxgi

bcrypt

coremessaging

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

d3d11

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

dwmapi

shell32

comctl32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

bcp47mrm

imm32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 436KB - Virtual size: 436KB

.data Size: 20KB - Virtual size: 91KB

.pdata Size: 97KB - Virtual size: 97KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 14KB - Virtual size: 14KB

a77876cbf812116386a4bb0ed07a2c12

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

api-ms-win-core-path-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 436KB - Virtual size: 436KB

.data
Size: 20KB - Virtual size: 91KB

.pdata
Size: 97KB - Virtual size: 97KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 14KB - Virtual size: 14KB

.text
Size: 266KB - Virtual size: 265KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 12KB - Virtual size: 18KB

.pdata
Size: 16KB - Virtual size: 16KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 89KB - Virtual size: 89KB

.reloc
Size: 2KB - Virtual size: 1KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

df:57:92:12:54:9b:38:ac:c1:21:72:00:13:a5:bc:10:c0:77:a1:7c:c8:79:7d:6e:56:d8:9f:2d:74:7e:94:14
Signer

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB