Bootstrapper_v3.9.7.zip
- SHA256 00b7b56969bea2edc4737715c6c3217d6852aee2fb5eadc054b860fb1942a372
Overview
overview
10Static
static
5Bootstrapp....7.zip
windows10-2004-x64
1Bootstrapp....7.zip
windows11-ltsc_2024-x64
1Boostrappe...hi.pak
windows10-2004-x64
3Boostrappe...hi.pak
windows11-ltsc_2024-x64
3Boostrappe...th.pak
windows10-2004-x64
3Boostrappe...th.pak
windows11-ltsc_2024-x64
3Boostrappe...tr.pak
windows10-2004-x64
3Boostrappe...tr.pak
windows11-ltsc_2024-x64
3Boostrappe...uk.pak
windows10-2004-x64
3Boostrappe...uk.pak
windows11-ltsc_2024-x64
8Boostrappe...ur.pak
windows10-2004-x64
3Boostrappe...ur.pak
windows11-ltsc_2024-x64
3Boostrappe...vi.pak
windows10-2004-x64
3Boostrappe...vi.pak
windows11-ltsc_2024-x64
3Boostrappe...CN.pak
windows10-2004-x64
3Boostrappe...CN.pak
windows11-ltsc_2024-x64
3Boostrappe...TW.pak
windows10-2004-x64
3Boostrappe...TW.pak
windows11-ltsc_2024-x64
3Boostrappe...vi.pak
windows10-2004-x64
3Boostrappe...vi.pak
windows11-ltsc_2024-x64
3Boostrappe...d.json
windows10-2004-x64
3Boostrappe...d.json
windows11-ltsc_2024-x64
3Boostrappe...nt.dll
windows10-2004-x64
8Boostrappe...nt.dll
windows11-ltsc_2024-x64
10Boostrappe...le.txt
windows10-2004-x64
1Boostrappe...le.txt
windows11-ltsc_2024-x64
1Boostrappe...tefile
windows10-2004-x64
1Boostrappe...tefile
windows11-ltsc_2024-x64
1Boostrappe...le.txt
windows10-2004-x64
1Boostrappe...le.txt
windows11-ltsc_2024-x64
1Boostrappe..._FE.iy
windows10-2004-x64
3Boostrappe..._FE.iy
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Bootstrapper_v3.9.7.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bootstrapper_v3.9.7.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Boostrapper_v3.9.3/locales/hi.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Boostrapper_v3.9.3/locales/hi.pak
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Boostrapper_v3.9.3/locales/locales/th.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
Boostrapper_v3.9.3/locales/locales/th.pak
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Boostrapper_v3.9.3/locales/locales/tr.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
Boostrapper_v3.9.3/locales/locales/tr.pak
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Boostrapper_v3.9.3/locales/locales/uk.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Boostrapper_v3.9.3/locales/locales/uk.pak
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral11
Sample
Boostrapper_v3.9.3/locales/locales/ur.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Boostrapper_v3.9.3/locales/locales/ur.pak
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Boostrapper_v3.9.3/locales/locales/vi.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
Boostrapper_v3.9.3/locales/locales/vi.pak
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Boostrapper_v3.9.3/locales/locales/zh-CN.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
Boostrapper_v3.9.3/locales/locales/zh-CN.pak
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
Boostrapper_v3.9.3/locales/locales/zh-TW.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
Boostrapper_v3.9.3/locales/locales/zh-TW.pak
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
Boostrapper_v3.9.3/locales/resources/vi.pak
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
Boostrapper_v3.9.3/locales/resources/vi.pak
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
Boostrapper_v3.9.3/locales/resources/vk_swiftshader_icd.json
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
Boostrapper_v3.9.3/locales/resources/vk_swiftshader_icd.json
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
Boostrapper_v3.9.3/mpclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral24
Sample
Boostrapper_v3.9.3/mpclient.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral25
Sample
Boostrapper_v3.9.3/workspace/.tests/readfile.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Boostrapper_v3.9.3/workspace/.tests/readfile.txt
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
Boostrapper_v3.9.3/workspace/.tests/writefile
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Boostrapper_v3.9.3/workspace/.tests/writefile
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Boostrapper_v3.9.3/workspace/.tests/writefile.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
Boostrapper_v3.9.3/workspace/.tests/writefile.txt
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
Boostrapper_v3.9.3/workspace/IY_FE.iy
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
Boostrapper_v3.9.3/workspace/IY_FE.iy
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Bootstrapper_v3.9.7.zip
- Size 3.1MB
- Sample260620-mya8psev3l
- SHA256 00b7b56969bea2edc4737715c6c3217d6852aee2fb5eadc054b860fb1942a372
- MD5 403e66086ea3053e989c4b5a18f2e2b1
- SHA1 b40f719d97b1d9a1b2bbbfe1e3e64c36e5eb2ded
- SHA512 39bf186c1e792a57c9bffdfba110429aeb01f230b97a29458944ce02e5b3574af98ec499bb305a2ef47338325ee8282af45efd15d90c23363fd7d656ead3f779
- SSDEEP 98304:ZmONhQ1ff4wdQr/8rUw8xPxfz23YDEXuYIpyxxYdM3xrY1:ZmOLQ1fMr/Zw8N5KhuYIpyzF39Y1
- TLSH T11DE533BCA98166E6D013327A91C12E8AC36AAFF0D8F1DA6CC446A25F0C51C0FDFA7555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/Boostrapper_v3.9.3/mpclient.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Boostrapper_v3.9.3/mpclient.dll
File Explorer
-
Bootstrapper_v3.9.7.zip.zip 3.1MB
-
Boostrapper_v3.9.3/locales/hi.pak787KB
-
Boostrapper_v3.9.3/locales/locales/th.pak704KB
-
Boostrapper_v3.9.3/locales/locales/tr.pak357KB
-
Boostrapper_v3.9.3/locales/locales/uk.pak605KB
-
Boostrapper_v3.9.3/locales/locales/ur.pak532KB
-
Boostrapper_v3.9.3/locales/locales/vi.pak424KB
-
Boostrapper_v3.9.3/locales/locales/zh-CN.pak308KB
-
Boostrapper_v3.9.3/locales/locales/zh-TW.pak305KB
-
Boostrapper_v3.9.3/locales/resources/vi.pak424KB
-
Boostrapper_v3.9.3/locales/resources/vk_swiftshader_icd.json106B
-
Boostrapper_v3.9.3/mpclient.dll.dll 3.7MB
-
Boostrapper_v3.9.3/workspace/.tests/readfile.txt7B
-
Boostrapper_v3.9.3/workspace/.tests/writefile7B
-
Boostrapper_v3.9.3/workspace/.tests/writefile.txt7B
-
Boostrapper_v3.9.3/workspace/IY_FE.iy539B
-
Boostrapper_v3.9.3/Вооstaрреr.exe.exe 683KB
Boostrapper_v3.9.3/locales/hi.pak
- SHA256 eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5
- MD5 1185163466551aacae45329c93e92a91
- SHA1 0dcbfed274934991966ce666d6d941cfe8366323
- SHA512 6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606
- SSDEEP 3072:4m//Yxz8BS65Ob5EeQzFc67R7dk5Sv34QAEm5dmLrsoe4GR3doInN8edYbOqGPt5:rYZ895O9ExFlReg5R5HQO4
- TLSH T11805180CEBBEF3B55DEC3C8A32890D37D59D3674A3E9521348D5B3DB9844CB4146A2A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/th.pak
- SHA256 4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336
- MD5 85f59bf2f1167e34ab2b666608805420
- SHA1 f0d8e8fc644c15c52c5f9d3419f88e6072799736
- SHA512 86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd
- SSDEEP 12288:kCoJR/3RMVqsUs5Uv/cLRflrj87rS6DotyeuLADu7Kle9don7j9Fo09XAyFHPL4i:poH25p5p
- TLSH T142E44BB33247D9D479441B5B262A7789673DAE693F73F8E00489215A73F071A8422EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/tr.pak
- SHA256 5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366
- MD5 da4c47bef469c086cdb7e5b74310304a
- SHA1 9f0569659eb21261003a232d5d92d3aae8d47b7a
- SHA512 55c745cd8d0aba6f4a2454c494b80eb4cc74f733771e7279b9033d52716551a85154e9eb31eebe17dce05ba71e0213e581c4b98b59a6b88aa8b9569c411e397a
- SSDEEP 6144:GqgGhItL0rKiPxTcQXKVSIOD7rB/78GgeD58/D+iMi1AxZE9VwiBsJm7:JhIN/i5TTmUrZ7f58/5
- TLSH T1FE740A8178EF382C8BB9278FD2E50626F99F0766F331E4469A169636774674703F620C
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/uk.pak
- SHA256 3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a
- MD5 229325584cd98c8408f7fc5c5603c6de
- SHA1 dd31356ede30833a138fc3a6b8838cef89344a00
- SHA512 3b57f57649877700f03aee73bc6e6e863ad65ec7c13b9851a3fc7e5d06d11ea154ce087d0a64dc689cfc55aca9eb6492154c9eb18130f6d17b8d94ac8c37a6df
- SSDEEP 12288:c5cHmNYribnlyvk7KQ0N1nteW51B3IjNtE6TxLNiXEFqIDV2:c5cP+kT552Ef
- TLSH T10BD488B19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF28F20248A3C71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/ur.pak
- SHA256 06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81
- MD5 6310a289e55b1022f12b4f3cc29fe831
- SHA1 150d81ec8db4d9aec6c0e83e5577dcb7f1956b38
- SHA512 acb538fce25486e6a01401aa0e9204a6f519cd1dfbca48663d6142e1fb6280bab271dfd2b4c5ddc858de6920805e539b791c48eddcad124d0aae298d479dcf48
- SSDEEP 12288:K6Du8PzOYzXPyn+jAcMR5RQEA2WzRbQYrkuvco/9NjjFpvUu:cYiD59WZ
- TLSH T115C410D1E6BC92B25A21D92780E33C34CB635F13D34BF286E56106C54E9A1136F6DE3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/vi.pak
- SHA256 f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017
- MD5 1b1b14f542bb4a9f014d1801fb2e4007
- SHA1 0f56c35b2515fc92690126c54d57aa763a5c3288
- SHA512 3e98c44ad74d905fee06851eab16576f6261a15336f1c1f625f646af725988b75957ed89c16876ec6127150e2b28778a5b65f897b9540ad1e4cec98be705cde7
- SSDEEP 12288:PJnzrvsPgnzj0VyK1wSMTgG9lt5uEHziW+UH6JziV1ZH:xnzTsPgnzj0VySwSG1n5/TiW+UaliV1N
- TLSH T1A094861216E0702680AC553EC5CE540E6FCAE42FF7808FE57FE4297576221A56F21BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/zh-CN.pak
- SHA256 97fe793b325d0c27669f62235bd157c51a3e1aeaffba30e7fe028c9d64939c5f
- MD5 32b1659c7abe8a01a702e46c69f0a3ce
- SHA1 43eba1f94417109834f25006a81653bf635ce9a0
- SHA512 72b932cb9e19788a67a1a7beaea0b9b076af0a5f1c568f9d2d6e8653d3c9fd4bc17db1a39db1f12b8184112b8e67125f443b8b2b60f31e62e16ef9c6a8e2c4a6
- SSDEEP 6144:ZdzIbmDPgQyQ74nqKm0YnHrYE85UN6RregFlo:DEm8QunqKRYnHx85UN6Rr4
- TLSH T18D647EE900FDBDEC054640902724617E7980620BF667AFB77ED244ED27A2F9E0757A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/locales/zh-TW.pak
- SHA256 280ba35171dfb6a54efb13fc4ddedc13a0283a9a6eebff4c15275767beb4ba77
- MD5 14f3f547a54713f91251b38459a096b5
- SHA1 02ac592a2eb4a7c6631dad5aae83726ef9c33ec0
- SHA512 0ad8c6a6eb0dcbcbbf6f9e114c93bc2cf6004dfa9ad7b68dba31c2a9856c0a56acb66507f65b1823434b1ad362c1ac812b72c254e5329a2858e888a761f45ec1
- SSDEEP 6144:c0oQX1m/Xs2eI7uhvxO4/x5wuznWMc/9yJTl:cQX1m6IaxO4/x5wuzWZ/u
- TLSH T151646CA608FFDEEE0901F884B3C9462F7C8B742CDD377637FC4918992E76A541A5214A
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/resources/vi.pak
- SHA256 f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017
- MD5 1b1b14f542bb4a9f014d1801fb2e4007
- SHA1 0f56c35b2515fc92690126c54d57aa763a5c3288
- SHA512 3e98c44ad74d905fee06851eab16576f6261a15336f1c1f625f646af725988b75957ed89c16876ec6127150e2b28778a5b65f897b9540ad1e4cec98be705cde7
- SSDEEP 12288:PJnzrvsPgnzj0VyK1wSMTgG9lt5uEHziW+UH6JziV1ZH:xnzTsPgnzj0VySwSG1n5/TiW+UaliV1N
- TLSH T1A094861216E0702680AC553EC5CE540E6FCAE42FF7808FE57FE4297576221A56F21BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Boostrapper_v3.9.3/locales/resources/vk_swiftshader_icd.json
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
Boostrapper_v3.9.3/mpclient.dll
- IMPHASH d8b31f8c03e0c76ff245ed05a15ffe6c
- SHA256 bcb39f99cc8599ef6828599ced2e627998c6777c8792693fce8a0d999e8ce033
- MD5 6a7ee10febe8c58b0db1a2007b5aecde
- SHA1 725e0630f3131d9e9ef1442fb3012acefa4b4246
- SHA512 3ee3789ebde82ba9a4d55d82f72d13578ff698497de7495c97af0b42d86253460ceea534102864b5a3cf4d18b46c78f618e130b2cb706b2dd711a34e7d01c1a9
- SSDEEP 49152:R4Sbr8UAeu2fj8Vd8Oy+iAFC59SNtrxP1Y4ct43LAhaRe:RsyRgz8OFOCXPKvy3LAgRe
- TLSH T1D2068D03EDD15CAAD15AA33288B74692BB3DBC461B2237D32A50B2793F7B3D06935750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7a:52:bc:9c:a2:ca:ac:e9:45:83:fd:31:f2:81:f3:3b:d1:c2:72:38
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=grind.su,O=nkl4G1QBNNPUI,L=q6c5j7c,ST=NoO6XM4o,C=US
Chains
Jun 19, 2026
CN=grind.su,O=nkl4G1QBNNPUI,L=q6c5j7c,ST=NoO6XM4o,C=US
Subject
CN=grind.su,O=nkl4G1QBNNPUI,L=q6c5j7c,ST=NoO6XM4o,C=US
Serial Number
70:b6:ef:0b:f7:f8:1a:87
Issuer
CN=grind.su,O=nkl4G1QBNNPUI,L=q6c5j7c,ST=NoO6XM4o,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth
Timespan
Jun 20, 2026 - Jun 20, 2027
Minor OS version
1
Major OS version
6
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
strerror
strlen
strncmp
vfprintf
wcslen
MpAllocMemory
MpClientUtilExportFunctions
MpConfigClose
MpConfigGetValue
MpConfigGetValueAlloc
MpConfigInitialize
MpConfigOpen
MpConfigRegisterForNotifications
MpConfigSetValue
MpConfigUninitialize
MpConfigUnregisterNotifications
MpFreeMemory
_cgo_dummy_export
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
297KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Boostrapper_v3.9.3/workspace/.tests/readfile.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Boostrapper_v3.9.3/workspace/.tests/writefile
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Boostrapper_v3.9.3/workspace/.tests/writefile.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
Boostrapper_v3.9.3/workspace/IY_FE.iy
- SHA256 73bb58ba5b81960caf5a8e66675cc89b5761b77db99c6ceb9435f7211d400452
- MD5 291d5636a434c4f1ceb0f3f776c2a51f
- SHA1 ae287e08f71c522a72812f0dace94b8ffb569341
- SHA512 7dab8034f85aef1b2b7a86cc8220ebdbb95a3f083d1565e1cff38414367aa69fc597a11aaba11dbef411e13fbfb285855d9c46ae59738f6e88c22dd55c81a743
- TLSH T1F7F02B6E530C0ABAC0515260D63531BFC6FF4EB73020D855A5BC1D6D13EAEA24E70903
- MD5 SHA1 SHA512 TLSH
Boostrapper_v3.9.3/Вооstaрреr.exe
- IMPHASH 7a6da7c5d1116b706b7932d3f11a50c9
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b5:4a:2b:77:f5:94:37:43:7c:5b:64:08:db:b0:59:cc:3d:1c:db:be:4a:3b:94:26:c5:c8:55:bf:49:e9:8a:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2023
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:51:99:0a:2a:60:f6:35:67:60:00:00:00:00:04:51
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 8, 2023 - Aug 7, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d4:e4:e9:03:2f:c0:ac:69:ac:00:01:00:00:01:d4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
21472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MpDlpService.pdb
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
RegCloseKey
GetSecurityDescriptorSacl
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
CopySid
FreeSid
CheckTokenMembership
EventUnregister
EventRegister
EventWriteTransfer
ChangeServiceConfig2W
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus
NotifyServiceStatusChangeW
StartServiceW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
OpenProcessToken
ChangeServiceConfigW
QueryServiceConfigW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
GetTokenInformation
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
kernel32
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RaiseException
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
DebugBreak
GetFileAttributesW
WaitForSingleObject
GetTickCount64
OutputDebugStringW
FormatMessageW
GetProcessTimes
ProcessIdToSessionId
LoadLibraryW
GetFileInformationByHandle
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ExpandEnvironmentStringsW
QueryDosDeviceW
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
OpenSemaphoreW
CreateMutexExW
GetProcessHeap
CompareFileTime
lstrcmpW
DeleteFileW
FindClose
OpenProcess
SleepEx
CreateFileW
LocalFree
GetDriveTypeW
DeleteTimerQueueTimer
LCMapStringW
UnregisterWaitEx
MultiByteToWideChar
WideCharToMultiByte
FormatMessageA
GetModuleFileNameW
GetSystemDirectoryW
HeapSetInformation
CreateProcessW
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
CreateTimerQueueTimer
FindNextFileW
WriteFile
RegisterWaitForSingleObject
SetEnvironmentVariableW
SetFilePointerEx
LoadLibraryExW
FileTimeToSystemTime
GetLocalTime
GetSystemTime
DeviceIoControl
HeapAlloc
GetFinalPathNameByHandleW
WriteConsoleW
SetEndOfFile
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
CompareStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
ExitProcess
GetStdHandle
GetCPInfo
LCMapStringEx
DecodePointer
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
SetErrorMode
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetStringTypeW
VirtualLock
mpclient
MpConfigUninitialize
MpClientUtilExportFunctions
MpFreeMemory
MpAllocMemory
MpConfigRegisterForNotifications
MpConfigGetValue
MpConfigOpen
MpConfigUnregisterNotifications
MpConfigClose
MpConfigGetValueAlloc
MpConfigSetValue
MpConfigInitialize
wtsapi32
WTSQueryUserToken
ntdll
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
NtQueryInformationProcess
RtlGetVersion
crypt32
CertVerifyCertificateChainPolicy
ole32
CreateBindCtx
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
rpcrt4
RpcImpersonateClient
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingInqAuthClientW
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerUseProtseqW
RpcRevertToSelf
RpcServerInqBindings
RpcEpRegisterW
RpcServerRegisterIfEx
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIf
NdrServerCallAll
NdrServerCall2
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserW
wintrust
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
urlmon
MkParseDisplayNameEx
Name
.text
Size
464KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=260, version=32595,
count=229, id=261, version=32595,
count=23, id=259, version=32595,
count=31, id=257, version=32595,
count=434, id=1, productName=Unmarked objects,
count=10, id=126, version=50727,
count=175, id=265, version=32595,
count=1, id=255, version=32595,
count=1, id=258, version=32595,