filename | bootstrapper.exe | |
---|---|---|
size | 877056 (0xd6200) | |
md5 | 277eff8d23f1e171ba4bb6518de41d72 | |
type | PE32 executable (console) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x118 |
Rich Header
lib id | version | times used |
---|---|---|
259 | 26715 | 23 |
261 | 26715 | 206 |
260 | 26715 | 24 |
199 | 41118 | 6 |
260 | 28427 | 18 |
259 | 28427 | 26 |
261 | 28427 | 150 |
261 | 28105 | 34 |
260 | 28105 | 105 |
257 | 26715 | 15 |
1 | 0 | 246 |
265 | 28614 | 6 |
255 | 28614 | 1 |
151 | 0 | 1 |
258 | 28614 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
Data Directory
TLS
raw start | raw end | index | callbks | zero fill | flags | |
---|---|---|---|---|---|---|
0x4b66f4 | 0x4b66fc | 0x4bec20 | 0x499458 | 0 | 0x300000 |
type | name | size | cp | |
---|---|---|---|---|
ICON | #1 | 1128 | 0 | |
ICON | #2 | 2440 | 0 | |
ICON | #3 | 4264 | 0 | |
ICON | #4 | 9640 | 0 | |
ICON | #5 | 62693 | 0 | |
GROUP_ICON | #101 | 76 | 0 | |
MANIFEST | #1 | 381 | 0 |
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.dll | 692 | GetProcessHeap | |
KERNEL32.dll | 1300 | SetEnvironmentVariableW | |
KERNEL32.dll | 426 | FreeEnvironmentStringsW | |
KERNEL32.dll | 567 | GetEnvironmentStringsW | |
KERNEL32.dll | 663 | GetOEMCP | |
KERNEL32.dll | 434 | GetACP | |
KERNEL32.dll | 907 | IsValidCodePage | |
KERNEL32.dll | 782 | GetTimeZoneInformation | |
KERNEL32.dll | 846 | HeapSize | |
KERNEL32.dll | 1354 | SetStdHandle | |
KERNEL32.dll | 844 | HeapReAlloc | |
KERNEL32.dll | 221 | CreatePipe | |
KERNEL32.dll | 1553 | WriteConsoleW | |
KERNEL32.dll | 340 | EnumSystemLocalesW | |
KERNEL32.dll | 786 | GetUserDefaultLCID | |
KERNEL32.dll | 909 | IsValidLocale | |
KERNEL32.dll | 415 | FlushFileBuffers | |
KERNEL32.dll | 841 | HeapFree | |
KERNEL32.dll | 837 | HeapAlloc | |
KERNEL32.dll | 490 | GetConsoleCP | |
KERNEL32.dll | 1136 | ReadConsoleW | |
KERNEL32.dll | 508 | GetConsoleMode | |
KERNEL32.dll | 471 | GetCommandLineW | |
KERNEL32.dll | 470 | GetCommandLineA | |
KERNEL32.dll | 1554 | WriteFile | |
KERNEL32.dll | 350 | ExitProcess | |
KERNEL32.dll | 631 | GetModuleHandleExW | |
KERNEL32.dll | 351 | ExitThread | |
KERNEL32.dll | 362 | FileTimeToSystemTime | |
KERNEL32.dll | 1417 | SystemTimeToTzSpecificLocalTime | |
KERNEL32.dll | 559 | GetDriveTypeW | |
KERNEL32.dll | 229 | CreateProcessW | |
KERNEL32.dll | 1122 | RaiseException | |
KERNEL32.dll | 1235 | RtlUnwind | |
KERNEL32.dll | 1495 | WaitForSingleObject | |
KERNEL32.dll | 1284 | SetConsoleTitleW | |
KERNEL32.dll | 422 | FormatMessageA | |
KERNEL32.dll | 975 | LocalFree | |
KERNEL32.dll | 134 | CloseHandle | |
KERNEL32.dll | 195 | CreateFileA | |
KERNEL32.dll | 609 | GetLastError | |
KERNEL32.dll | 796 | GetVolumeInformationA | |
KERNEL32.dll | 1555 | WriteFileEx | |
KERNEL32.dll | 722 | GetStdHandle | |
KERNEL32.dll | 1282 | SetConsoleTextAttribute | |
KERNEL32.dll | 514 | GetConsoleScreenBufferInfo | |
KERNEL32.dll | 1501 | WaitNamedPipeA | |
KERNEL32.dll | 572 | GetExitCodeProcess | |
KERNEL32.dll | 1339 | SetNamedPipeHandleState | |
KERNEL32.dll | 305 | EnterCriticalSection | |
KERNEL32.dll | 957 | LeaveCriticalSection | |
KERNEL32.dll | 864 | InitializeCriticalSectionEx | |
KERNEL32.dll | 272 | DeleteCriticalSection | |
KERNEL32.dll | 1408 | SleepEx | |
KERNEL32.dll | 1473 | VerSetConditionMask | |
KERNEL32.dll | 1102 | QueryPerformanceFrequency | |
KERNEL32.dll | 735 | GetSystemDirectoryA | |
KERNEL32.dll | 427 | FreeLibrary | |
KERNEL32.dll | 629 | GetModuleHandleA | |
KERNEL32.dll | 686 | GetProcAddress | |
KERNEL32.dll | 961 | LoadLibraryA | |
KERNEL32.dll | 1476 | VerifyVersionInfoA | |
KERNEL32.dll | 1405 | Sleep | |
KERNEL32.dll | 1101 | QueryPerformanceCounter | |
KERNEL32.dll | 775 | GetTickCount | |
KERNEL32.dll | 1496 | WaitForSingleObjectEx | |
KERNEL32.dll | 353 | ExpandEnvironmentStringsA | |
KERNEL32.dll | 590 | GetFileType | |
KERNEL32.dll | 1139 | ReadFile | |
KERNEL32.dll | 1058 | PeekNamedPipe | |
KERNEL32.dll | 1493 | WaitForMultipleObjects | |
KERNEL32.dll | 1330 | SetLastError | |
KERNEL32.dll | 588 | GetFileSizeEx | |
KERNEL32.dll | 1007 | MultiByteToWideChar | |
KERNEL32.dll | 1534 | WideCharToMultiByte | |
KERNEL32.dll | 539 | GetCurrentThread | |
KERNEL32.dll | 773 | GetThreadTimes | |
KERNEL32.dll | 529 | GetCurrentDirectoryW | |
KERNEL32.dll | 203 | CreateFileW | |
KERNEL32.dll | 277 | DeleteFileW | |
KERNEL32.dll | 373 | FindClose | |
KERNEL32.dll | 379 | FindFirstFileExW | |
KERNEL32.dll | 396 | FindNextFileW | |
KERNEL32.dll | 578 | GetFileAttributesExW | |
KERNEL32.dll | 583 | GetFileInformationByHandle | |
KERNEL32.dll | 601 | GetFullPathNameW | |
KERNEL32.dll | 1209 | RemoveDirectoryW | |
KERNEL32.dll | 1296 | SetEndOfFile | |
KERNEL32.dll | 1315 | SetFilePointerEx | |
KERNEL32.dll | 35 | AreFileApisANSI | |
KERNEL32.dll | 632 | GetModuleHandleW | |
KERNEL32.dll | 1000 | MoveFileExW | |
KERNEL32.dll | 423 | FormatMessageW | |
KERNEL32.dll | 1415 | SwitchToThread | |
KERNEL32.dll | 540 | GetCurrentThreadId | |
KERNEL32.dll | 863 | InitializeCriticalSectionAndSpinCount | |
KERNEL32.dll | 191 | CreateEventW | |
KERNEL32.dll | 1438 | TlsAlloc | |
KERNEL32.dll | 1440 | TlsGetValue | |
KERNEL32.dll | 1441 | TlsSetValue | |
KERNEL32.dll | 1439 | TlsFree | |
KERNEL32.dll | 745 | GetSystemTimeAsFileTime | |
KERNEL32.dll | 301 | EncodePointer | |
KERNEL32.dll | 265 | DecodePointer | |
KERNEL32.dll | 155 | CompareStringW | |
KERNEL32.dll | 945 | LCMapStringW | |
KERNEL32.dll | 613 | GetLocaleInfoW | |
KERNEL32.dll | 727 | GetStringTypeW | |
KERNEL32.dll | 449 | GetCPInfo | |
KERNEL32.dll | 1453 | UnhandledExceptionFilter | |
KERNEL32.dll | 1389 | SetUnhandledExceptionFilter | |
KERNEL32.dll | 535 | GetCurrentProcess | |
KERNEL32.dll | 1420 | TerminateProcess | |
KERNEL32.dll | 902 | IsProcessorFeaturePresent | |
KERNEL32.dll | 1302 | SetEvent | |
KERNEL32.dll | 1222 | ResetEvent | |
KERNEL32.dll | 867 | InitializeSListHead | |
KERNEL32.dll | 895 | IsDebuggerPresent | |
KERNEL32.dll | 720 | GetStartupInfoW | |
KERNEL32.dll | 536 | GetCurrentProcessId | |
KERNEL32.dll | 243 | CreateThread | |
KERNEL32.dll | 428 | FreeLibraryAndExitThread | |
KERNEL32.dll | 628 | GetModuleFileNameW | |
KERNEL32.dll | 963 | LoadLibraryExW | |
KERNEL32.dll | 299 | DuplicateHandle | |
USER32.dll | 499 | GetWindowThreadProcessId | |
USER32.dll | 273 | FindWindowA | |
ADVAPI32.dll | 193 | CryptAcquireContextA | |
ADVAPI32.dll | 213 | CryptGetHashParam | |
ADVAPI32.dll | 210 | CryptGenRandom | |
ADVAPI32.dll | 196 | CryptCreateHash | |
ADVAPI32.dll | 217 | CryptHashData | |
ADVAPI32.dll | 315 | GetCurrentHwProfileA | |
ADVAPI32.dll | 199 | CryptDestroyHash | |
ADVAPI32.dll | 200 | CryptDestroyKey | |
ADVAPI32.dll | 219 | CryptImportKey | |
ADVAPI32.dll | 203 | CryptEncrypt | |
ADVAPI32.dll | 220 | CryptReleaseContext | |
WS2_32.dll | 17 | ||
WS2_32.dll | 10 | ||
WS2_32.dll | 150 | getaddrinfo | |
WS2_32.dll | 57 | ||
WS2_32.dll | 8 | ||
WS2_32.dll | 1 | ||
WS2_32.dll | 18 | ||
WS2_32.dll | 151 | ||
WS2_32.dll | 116 | ||
WS2_32.dll | 115 | ||
WS2_32.dll | 58 | WSAIoctl | |
WS2_32.dll | 112 | ||
WS2_32.dll | 21 | ||
WS2_32.dll | 15 | ||
WS2_32.dll | 9 | ||
WS2_32.dll | 7 | ||
WS2_32.dll | 6 | ||
WS2_32.dll | 5 | ||
WS2_32.dll | 4 | ||
WS2_32.dll | 2 | ||
WS2_32.dll | 16 | ||
WS2_32.dll | 23 | ||
WS2_32.dll | 111 | ||
WS2_32.dll | 19 | ||
WS2_32.dll | 3 | ||
WS2_32.dll | 14 | ||
WS2_32.dll | 20 | ||
WS2_32.dll | 13 | ||
WS2_32.dll | 149 | freeaddrinfo | |
WLDAP32.dll | 35 | ||
WLDAP32.dll | 33 | ||
WLDAP32.dll | 32 | ||
WLDAP32.dll | 27 | ||
WLDAP32.dll | 26 | ||
WLDAP32.dll | 22 | ||
WLDAP32.dll | 79 | ||
WLDAP32.dll | 50 | ||
WLDAP32.dll | 45 | ||
WLDAP32.dll | 60 | ||
WLDAP32.dll | 211 | ||
WLDAP32.dll | 46 | ||
WLDAP32.dll | 217 | ||
WLDAP32.dll | 143 | ||
WLDAP32.dll | 30 | ||
WLDAP32.dll | 41 | ||
WLDAP32.dll | 200 | ||
WLDAP32.dll | 301 | ||
CRYPT32.dll | 53 | CertFindCertificateInStore | |
CRYPT32.dll | 64 | CertFreeCertificateContext | |
CRYPT32.dll | 227 | CryptStringToBinaryA | |
CRYPT32.dll | 4 | CertAddCertificateContextToStore | |
CRYPT32.dll | 74 | CertGetNameStringA | |
CRYPT32.dll | 44 | CertEnumCertificatesInStore | |
CRYPT32.dll | 18 | CertCloseStore | |
CRYPT32.dll | 200 | CryptQueryObject | |
CRYPT32.dll | 27 | CertCreateCertificateChainEngine | |
CRYPT32.dll | 62 | CertFreeCertificateChainEngine | |
CRYPT32.dll | 69 | CertGetCertificateChain | |
CRYPT32.dll | 89 | CertOpenStore | |
CRYPT32.dll | 61 | CertFreeCertificateChain | |
Normaliz.dll | IdnToAscii |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0xbec20