| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Oct-22 16:10:45 |
| Detected languages |
English - United States
|
| CompanyName | Cristalix |
| FileDescription | Cristalix Bootstrap |
| FileVersion | 1.0.0.0 |
| InternalName | CristalixBootstrap |
| ProductName | Cristalix Bootstrap |
| ProductVersion | 1.0.0.0 |
| Suspicious | PEiD Signature: | HQR data file |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses known Diffie-Helman primes Uses known Mersenne Twister constants Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .qtmetad
Unusual section name found: .qtmimed |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 3/67 (Scanned on 2026-10-25 17:23:07) |
Ikarus:
Win32.SuspectCrc
Kaspersky: Trojan.Win32.Agent.xcfufi alibabacloud: Trojan:Win/Agent.xzjxQN |
| MD5 | e87f07b121d113acf0ae24b597806cb9 🔍 |
|---|---|
| SHA1 | 2413c9371f3fde2310f1e2ffcd384a54c486c8e1 🔍 |
| SHA256 | ff7ff431ec4acf18d8d2fcaab63664285ddff3ca60818bc9bedfb8c919d95ca6 🔍 |
| SHA3 | 5245223d5915dd927237ab2ad4adf42a4b753274711ee8626301748a261aad4d 🔍 |
| SSDeep | 393216:KxfFG68OlcWm3iDWNAj9lJcaslkpr/H1o2kJsv6tWKFdu9CYsCeVBZk:zAru22CeVBC 🔍 |
| Imports Hash | 264f02adeb10632afba286c84dddb85f 🔍 |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x128 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 10 |
| TimeDateStamp | 2025-Oct-22 16:10:45 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0xe64000 |
| SizeOfInitializedData | 0x802e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000DAFF08 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x166c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| MD5 | c6b726fb4e33d15d924ee34a79b34098 🔍 |
|---|---|
| SHA1 | 2285bee81ad97e8f5a3c201b9715c42f7f8b8955 🔍 |
| SHA256 | e52a4e61d457da448c4b13e06ebd683130bc861bc9dcc39af325b7700c7d30b4 🔍 |
| SHA3 | fc86f00a4745b3e42edd92058bd8fd4fd5020fb8483d46ee19a301fdf6a1ce18 🔍 |
| VirtualSize | 0xe63e8c |
| VirtualAddress | 0x1000 |
| SizeOfRawData | 0xe64000 |
| PointerToRawData | 0x400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
| Entropy | 6.58403 |
| MD5 | b1bd45e9b39be9573e3b51ef6c2fa025 🔍 |
|---|---|
| SHA1 | 493d122cceceda7d570ab6deeaf70abfac70b03f 🔍 |
| SHA256 | 731466ad333e7d1887d3cab20fffb979ef8c16bdd923340684d686296eae8e77 🔍 |
| SHA3 | 8ebeef5195544f370a9578f41d7d92506e023bb9280b4e6aff2e0c1c6185a26a 🔍 |
| VirtualSize | 0x633366 |
| VirtualAddress | 0xe65000 |
| SizeOfRawData | 0x633400 |
| PointerToRawData | 0xe64400 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.41059 |
| MD5 | 6be1043aa2afc6aeb3723b4940b09b10 🔍 |
|---|---|
| SHA1 | 3675d07b5f69cb67cf48fc74a59b1d2edaea3a28 🔍 |
| SHA256 | 5584332254cd17aea90ffc16f75e86de475049b2e972c05918b9ecc8d220db0c 🔍 |
| SHA3 | 1d6a8cc93f66689ffe145feccd31ffec8c2d750ca6bdedc338347fc00fda3e13 🔍 |
| VirtualSize | 0x89674 |
| VirtualAddress | 0x1499000 |
| SizeOfRawData | 0x71600 |
| PointerToRawData | 0x1497800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 4.00353 |
| MD5 | 00cde70b5a30bd5feb1dbfccfeca2e68 🔍 |
|---|---|
| SHA1 | 5b61081a11c89a7bffd4d35b8c7c01903212fd73 🔍 |
| SHA256 | ccf171dde61ba146d5c9503a55922903811b6a124b30582307ae26ebd06fcc85 🔍 |
| SHA3 | b85c05a6252cae0340095b8ef8330447cfaa4acbeb8f3771d3af938f5622afd5 🔍 |
| VirtualSize | 0xaef0c |
| VirtualAddress | 0x1523000 |
| SizeOfRawData | 0xaf000 |
| PointerToRawData | 0x1508e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 6.79627 |
| MD5 | 2bb74d481e64a8ff8a57a0fb24b734de 🔍 |
|---|---|
| SHA1 | 104e0dd9a03522012c8be8f06081df129a1c18a2 🔍 |
| SHA256 | c2361c5f5cf2778bd5c142aa089288393e2b57b23116ad67fefff7569b329c78 🔍 |
| SHA3 | 352d6374d8aad6dcf70aa58ef5790313e8f3bff0aa10bb0ed774904997db167b 🔍 |
| VirtualSize | 0x6b6 |
| VirtualAddress | 0x15d2000 |
| SizeOfRawData | 0x800 |
| PointerToRawData | 0x15b7e00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
|
| Entropy | 4.96679 |
| MD5 | fc2f14d81e335ad78fd3a2189af093b9 🔍 |
|---|---|
| SHA1 | 81dada1609afbd2548cfba58550fcf189d5c3e97 🔍 |
| SHA256 | 07ece48289db544c44faf74a6e85d8668adee8b0bbc7b702043079d3adab5556 🔍 |
| SHA3 | 28f0c6920ecef90ce15e23efc3452f4b442395bf45404d31fa5eb4a4832c0d91 🔍 |
| VirtualSize | 0x30 |
| VirtualAddress | 0x15d3000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x15b8600 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 0.247497 |
| MD5 | bf619eac0cdf3f68d496ea9344137e8b 🔍 |
|---|---|
| SHA1 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍 |
| SHA256 | 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍 |
| SHA3 | 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍 |
| VirtualSize | 0x100 |
| VirtualAddress | 0x15d4000 |
| SizeOfRawData | 0x200 |
| PointerToRawData | 0x15b8800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
| Entropy | 0 |
| MD5 | 2d32d357ab751ffbbb513570c6ee6986 🔍 |
|---|---|
| SHA1 | 20f70abb495b895ab71de8f8e293935362e636ca 🔍 |
| SHA256 | 882832c0f0571c8468d09f0d7d9ba05e4f48b1ad622292b5b0f8d2c5273b24ce 🔍 |
| SHA3 | c9b0c6df58d16855093fecaf615be068951aa9420d61552c3103635f3b498462 🔍 |
| VirtualSize | 0x4ece5 |
| VirtualAddress | 0x15d5000 |
| SizeOfRawData | 0x4ee00 |
| PointerToRawData | 0x15b8a00 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_SHARED
|
| Entropy | 7.998 |
| MD5 | 0179a0823c61a6f33b1009a87c95afd1 🔍 |
|---|---|
| SHA1 | e96e1cb85e69536f1bb9bb25697f593ff87834a2 🔍 |
| SHA256 | 27f7fc029af31153a47db4c21bfb51f3d5bb1db5505db6d32e0c5b7434c75fd9 🔍 |
| SHA3 | 790d1f0c2033a686149854020d36cf3784130da8b84c8eeb2dc0d3f2012fc876 🔍 |
| VirtualSize | 0x2c980 |
| VirtualAddress | 0x1624000 |
| SizeOfRawData | 0x2ca00 |
| PointerToRawData | 0x1607800 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
| Entropy | 4.13829 |
| MD5 | 97e717cdc8f3f533dcbedfc19fc614aa 🔍 |
|---|---|
| SHA1 | 17dd12a775ede8d301a547181f99c772d4cec5da 🔍 |
| SHA256 | e2ae7b4fb51d1f8d2d40ec486f2a3cf71bc3e8adf0051a55293be6100db1cda3 🔍 |
| SHA3 | f92bc4ca51a41118e6aec7dbd3e7185aff77110be05f48a3fe1bbb05592291bc 🔍 |
| VirtualSize | 0x1ad98 |
| VirtualAddress | 0x1651000 |
| SizeOfRawData | 0x1ae00 |
| PointerToRawData | 0x1634200 |
| PointerToRelocations | 0 |
| PointerToLineNumbers | 0 |
| NumberOfLineNumbers | 0 |
| NumberOfRelocations | 0 |
| Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
| Entropy | 5.48369 |
| USER32.dll |
SetCaretPos
ShowCaret HideCaret DestroyCaret CreateCaret IsWindowEnabled RegisterWindowMessageW GetKeyboardLayout RegisterClipboardFormatW ChangeClipboardChain SetClipboardViewer IsHungAppWindow LoadIconW EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow SetMenuItemInfoW GetMenuItemInfoW TrackPopupMenu RemoveMenu ModifyMenuW FindWindowA IsZoomed GetKeyState GetKeyboardState ToAscii AppendMenuW InsertMenuW DestroyMenu CreatePopupMenu CreateMenu DrawMenuBar SetMenu LoadImageW ToUnicode ChildWindowFromPointEx WindowFromPoint GetCursorPos GetFocus RegisterClassExW GetClassInfoW UnregisterPowerSettingNotification GetKeyboardLayoutList GetAncestor MonitorFromPoint DestroyIcon DestroyCursor GetWindow SetParent GetParent SetWindowLongW GetWindowLongW ScreenToClient ClientToScreen SetCursor AdjustWindowRectEx GetWindowTextW GetClientRect SetWindowTextW InvalidateRect SetWindowRgn GetUpdateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow GetMenu ReleaseCapture SetCapture GetCapture IsTouchWindow UnregisterTouchWindow RegisterTouchWindow SetFocus IsIconic MapVirtualKeyW TrackPopupMenuEx EnumDisplayDevicesW SetCursorPos GetCursor LoadCursorW CreateCursor CreateIconIndirect GetIconInfo GetCursorInfo GetClipboardFormatNameW TrackMouseEvent GetMessageExtraInfo GetAsyncKeyState GetTouchInputInfo GetSysColorBrush IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow FlashWindowEx SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow IsChild AttachThreadInput SendMessageW UpdateLayeredWindowIndirect GetDesktopWindow GetCaretBlinkTime MessageBeep IsWindow GetDoubleClickTime SystemParametersInfoW GetSysColor EnableMenuItem GetSystemMenu ReleaseDC GetDC MessageBoxW GetUserObjectInformationW GetProcessWindowStation CharNextExA SetWindowLongPtrW GetWindowLongPtrW KillTimer SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetWindowThreadProcessId CloseTouchInputHandle ChangeWindowMessageFilterEx GetWindowRect EnumWindows PostThreadMessageW PostMessageW DrawIconEx RealGetWindowClassW RegisterDeviceNotificationW RegisterPowerSettingNotification GetSystemMetrics UnregisterDeviceNotification |
|---|---|
| CRYPT32.dll |
CertAddCertificateContextToStore
CertCloseStore CertFindCertificateInStore CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateChain CertOpenStore CertGetCertificateChain CertFreeCertificateContext CertCreateCertificateContext |
| USERENV.dll |
GetUserProfileDirectoryW
|
| KERNEL32.dll |
FreeLibrary
GetModuleHandleExW FindFirstFileExW FindNextFileW OpenProcess LocalAlloc GlobalFree SetHandleInformation SetLastError GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualAlloc VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP RtlVirtualUnwind GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WTSGetActiveConsoleSessionId ExpandEnvironmentStringsW CheckRemoteDebuggerPresent GlobalAlloc GlobalUnlock GlobalLock GlobalSize lstrcmpW GetUserDefaultLangID CreateFileA GetFileSizeEx CreateFileMappingA InitializeCriticalSectionEx InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS ReleaseMutex CreateMutexA GetFileSize HeapAlloc HeapReAlloc HeapFree GetProcessHeap FindFirstChangeNotificationW OutputDebugStringW GetUserGeoID TryAcquireSRWLockExclusive SleepConditionVariableSRW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete SetFileAttributesW SetFileInformationByHandle AreFileApisANSI WakeAllConditionVariable GetStringTypeW EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetConsoleWindow CompareStringEx CloseHandle GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW SetFilePointer DuplicateHandle GetLastError ConnectNamedPipe CreateNamedPipeW WaitForSingleObject WaitForSingleObjectEx CreateEventW Sleep GetExitCodeProcess CreateProcessW GetProcAddress GetSystemTime GetLocalTime QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 SetEvent WaitForMultipleObjects SwitchToThread CreateThread GetCurrentThread GetGeoInfoW GetCurrentThreadId SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo GetCommandLineW GetCurrentProcessId RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExW ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA GetConsoleOutputCP SetStdHandle SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW SetEnvironmentVariableW IsValidCodePage GetOEMCP LocalFree GetModuleHandleW FormatMessageW GetFileAttributesExW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetFileAttributesW GetFileInformationByHandle HeapSize HeapQueryInformation WriteConsoleW FindCloseChangeNotification GetFullPathNameW GetLogicalDrives GetLongPathNameW RemoveDirectoryW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW SetErrorMode FindNextChangeNotification DeviceIoControl CopyFileW GetTimeZoneInformation WideCharToMultiByte MultiByteToWideChar GetUserPreferredUILanguages GetUserDefaultLCID GetCurrencyFormatW GetLocaleInfoW GetTimeFormatW GetDateFormatW GetModuleFileNameW GetStartupInfoW ResetEvent UnmapViewOfFile MapViewOfFile CreateFileMappingW WriteFile SetFilePointerEx SetEndOfFile ReadFile GetVolumeInformationW GetFileType GetDriveTypeW FlushFileBuffers LoadLibraryW GetSystemDirectoryW WriteFileEx SleepEx CancelIoEx PeekNamedPipe ReadFileEx RegisterWaitForSingleObject UnregisterWaitEx GetFileInformationByHandleEx SystemTimeToFileTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime MoveFileExW MoveFileW |
| GDI32.dll |
CreateRectRgn
DeleteObject CombineRgn BitBlt OffsetRgn SelectClipRgn SetLayout GetDeviceCaps CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC SelectObject CreateBitmap ChoosePixelFormat SetPixelFormat DescribePixelFormat GetPixelFormat SwapBuffers ExtTextOutW SetWorldTransform SetTextAlign SetTextColor SetGraphicsMode SetBkMode GetCharABCWidthsI GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsW GetTextFaceW GetTextMetricsW RemoveFontMemResourceEx AddFontMemResourceEx RemoveFontResourceExW AddFontResourceExW GetStockObject GetFontData EnumFontFamiliesExW CreateFontIndirectW GdiFlush GetRegionData CreateDIBSection GetDIBits GetObjectW GetBitmapBits |
| WINMM.dll |
timeKillEvent
timeSetEvent PlaySoundW |
| IMM32.dll |
ImmGetDefaultIMEWnd
ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetVirtualKey |
| ole32.dll |
OleSetClipboard
CoInitializeEx OleUninitialize OleInitialize RevokeDragDrop OleFlushClipboard CoLockObjectExternal CoInitialize CoTaskMemFree CoCreateInstance CoUninitialize CoCreateGuid OleIsCurrentClipboard DoDragDrop ReleaseStgMedium OleGetClipboard CoGetMalloc StringFromGUID2 RegisterDragDrop |
| OLEAUT32.dll |
SafeArrayPutElement
SafeArrayCreateVector SysAllocString SysFreeString |
| VERSION.dll |
GetFileVersionInfoSizeW
GetFileVersionInfoW VerQueryValueW |
| ADVAPI32.dll |
RegOpenKeyExW
RegQueryValueExW OpenProcessToken AccessCheck AllocateAndInitializeSid CopySid DuplicateToken FreeSid GetLengthSid GetTokenInformation MapGenericMask LookupAccountSidW GetEffectiveRightsFromAclW GetNamedSecurityInfoW BuildTrusteeWithSidW SystemFunction036 RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteKeyW CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegNotifyChangeKeyValue GetSidSubAuthorityCount GetSidSubAuthority RegSetValueExW RegFlushKey RegEnumValueW RegDeleteValueW RegCloseKey |
| SHELL32.dll |
SHGetMalloc
SHCreateItemFromIDList ShellExecuteW #727 SHGetStockIconInfo SHGetKnownFolderIDList SHGetKnownFolderPath SHCreateItemFromParsingName CommandLineToArgvW Shell_NotifyIconGetRect SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW SHGetFileInfoW |
| dwmapi.dll |
DwmSetWindowAttribute
DwmIsCompositionEnabled DwmGetWindowAttribute DwmEnableBlurBehindWindow |
| UxTheme.dll |
OpenThemeData
GetThemePartSize GetThemeColor GetThemeInt GetThemeEnumValue GetThemeMargins GetThemePropertyOrigin GetThemeTransitionDuration CloseThemeData #47 GetThemeBackgroundRegion IsThemeBackgroundPartiallyTransparent GetThemeBool SetWindowTheme IsThemeActive IsAppThemed GetCurrentThemeName |
| WTSAPI32.dll |
WTSFreeMemory
WTSQuerySessionInformationW |
| WS2_32.dll |
WSAGetLastError
setsockopt select listen htons getsockname getpeername closesocket bind __WSAFDIsSet getsockopt getnameinfo freeaddrinfo getaddrinfo ntohl htonl WSAAsyncSelect WSACleanup WSAStartup WSANtohs WSAAccept WSASocketW accept WSARecv shutdown socket ioctlsocket sendto recvfrom WSASetLastError getservbyname getservbyport gethostbyname gethostbyaddr WSASend inet_ntoa inet_addr WSASocketA send recv connect WSAConnect WSAHtonl WSAIoctl WSASendTo WSARecvFrom WSANtohl gethostname ntohs |
| IPHLPAPI.DLL |
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidW GetAdaptersAddresses ConvertInterfaceIndexToLuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToGuid |
| NETAPI32.dll |
NetApiBufferFree
NetShareEnum |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x468 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 5.20849 |
| MD5 | 045c382c39633d05ecf3fe22ec057885 🔍 |
| SHA1 | c607c6c13c0f5db04393480f92797b6a625b0152 🔍 |
| SHA256 | 239b7a5f07d0b8bb491b6516829a760ffca76e3db0e79aff395782cb3896c354 🔍 |
| SHA3 | e6c81bdea3351a3e3045426cf8ccd1df62c67fd7457342afc192451a68fb1a68 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x988 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.77676 |
| MD5 | b3f94abead07774b4c000ab68469c4dc 🔍 |
| SHA1 | fefef9de7bcc3e9084c0b03fefa64c70cb796c7c 🔍 |
| SHA256 | f34aab6d411532568d70e2d3dbfb919f12c43cef0dc5e2c5f6f87a101c7e097e 🔍 |
| SHA3 | c1aaa5a11fb44c5408cc3ef25f1cfb26b95c204f5943a39709da63e20e6b53d7 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.45566 |
| MD5 | 2d7f1a807d74f9ad5828ad8e10a9d188 🔍 |
| SHA1 | f5e968a13b35aedaf083d88921085f7151b1b613 🔍 |
| SHA256 | a40f3819150b573fcecae01de270a23a364a71e421cc866f3520f13949129eaf 🔍 |
| SHA3 | 2e52cc8f37a82d68134d4d84bea9a659bf6d191922895edcbd15f59c81cb1c7a 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x25a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.00456 |
| MD5 | bc6928976ab57019a532a63f56aeb131 🔍 |
| SHA1 | b51f20e46eb5c06d7f98aec83df71e7a9dfd38be 🔍 |
| SHA256 | a241a29bd219f61b7e6bf254fe93f5cef10e2b304ccfac6d2fce2c71ee72d332 🔍 |
| SHA3 | 44ac7f7d9788ff8ab311891d9d0332e24dbb68ca220a3d7dbe1e9b2385b53290 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4228 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.79862 |
| MD5 | 573a1ff2a6075bc749e1609f6b81d95c 🔍 |
| SHA1 | 13fa94417d448b82951270f0f43b45662054549d 🔍 |
| SHA256 | b9da73d2a487e3e44e034efaec697d0ef04e35b7e3a5b61b7df55bbe2481ea11 🔍 |
| SHA3 | 19e8e3814a416e8e81f31e139b11e3cfbc53decf9395f3e54a06e35ef416aaa0 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x5488 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.6623 |
| MD5 | 792aea7aabfd006dd7253356a215bd01 🔍 |
| SHA1 | 807932527d855ad6be5233a872eaa916f8f2e95e 🔍 |
| SHA256 | 0776f35cc3cfdce666d053887d8b3825aa97df1d99776fe8da43dfcc098c6121 🔍 |
| SHA3 | a7d82e3a69c25a864cce40816463bb810364b3b8aba23b67dffec4611a5c431a 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x94a8 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.52889 |
| MD5 | 1405029e671d29bb73e2c2cd28f7adfa 🔍 |
| SHA1 | 5da6ca4c53001e5e55e07affda3710a72de3b633 🔍 |
| SHA256 | 1448a52cc5412c55749852ef9d0ecdc8932a99032bb9857c70110b19d1b498c3 🔍 |
| SHA3 | cd7f0bac1ea87156f328e36cfffc69c4ba931ee41f907cbb6615b0506a06dff5 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x10828 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 2.86739 |
| MD5 | d55349635fdc91763ca2382d0d7106da 🔍 |
| SHA1 | 0e79bfb4d128ff1a51bbe7db114eb74a88c670b5 🔍 |
| SHA256 | bf39446ae6fed151a65223f9a8bec1285d4ce1a6c99550022059c4e30ae350a1 🔍 |
| SHA3 | 067ce3c9bf3387424439581dba6af0f7cd499111da0ec9659518c7e314bfd176 🔍 |
| Type |
RT_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x4aae |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 7.91626 |
| Detected Filetype | PNG graphic file |
| MD5 | 438948f7e85e07c0ad5705812d5b2fba 🔍 |
| SHA1 | c4752673f25b7d01fff264a5df2dd0f8831662e8 🔍 |
| SHA256 | 88b98629db1d537d4339a438a22788e99bcdfcd178533fcf04f0f142ffe831e2 🔍 |
| SHA3 | 7cd286ac910ce95ad74a5ede2858ed564becc99c01299fec48cf9751f91afc67 🔍 |
| Type |
RT_GROUP_ICON
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x84 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.03466 |
| Detected Filetype | Icon file |
| MD5 | 0e53c249183cd0ee14ab411587719e7e 🔍 |
| SHA1 | 6dd4da45f6c3dc13b145da58e56f6f88ecaf9956 🔍 |
| SHA256 | 6854c3d61db39be2308261a92689dedb52eed8639593a16824d11f142ca3338f 🔍 |
| SHA3 | a266fba105fb21a33999a2165dc1f3dd142ce67b6f438a0cb9f234a97d2e7350 🔍 |
| Type |
RT_VERSION
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x254 |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 3.2075 |
| MD5 | ebce8841d2fac1b1b7ec1d667e700912 🔍 |
| SHA1 | 3ed4b979222eeafcfd66cdefe1cb446455b781c6 🔍 |
| SHA256 | 17dd30959f67ad33ac6215a16004301a657d110ffb457e428b0241bdfe3fbff9 🔍 |
| SHA3 | 1d8a7c64ec7f76d3f62b1d4a8eebeaa21b33bb0f115899f98f534e6580cf7aa7 🔍 |
| Type |
RT_MANIFEST
|
|---|---|
| Language | English - United States |
| Codepage | UNKNOWN |
| Size | 0x17d |
| TimeDateStamp | 1980-Jan-01 00:00:00 |
| Entropy | 4.91161 |
| MD5 | 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍 |
| SHA1 | 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍 |
| SHA256 | 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍 |
| SHA3 | 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍 |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.0 |
| ProductVersion | 1.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Cristalix |
| FileDescription | Cristalix Bootstrap |
| FileVersion (#2) | 1.0.0.0 |
| InternalName | CristalixBootstrap |
| ProductName | Cristalix Bootstrap |
| ProductVersion (#2) | 1.0.0.0 |
| Resource LangID | English - United States |
|---|
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2025-Oct-22 16:10:45 |
| Version | 0.0 |
| SizeofData | 1128 |
| AddressOfRawData | 0x13c9390 |
| PointerToRawData | 0x13c8790 |
| StartAddressOfRawData | 0x1413c9840 |
|---|---|
| EndAddressOfRawData | 0x1413c9854 |
| AddressOfIndex | 0x141520788 |
| AddressOfCallbacks | 0x140e66658 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
| Callbacks | (EMPTY) |
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1414f8140 |
| XOR Key | 0x244df62a |
|---|---|
| Unmarked objects | 0 |
| C++ objects (33140) | 206 |
| ASM objects (33140) | 34 |
| 253 (35207) | 4 |
| C objects (35207) | 20 |
| ASM objects (35207) | 17 |
| C++ objects (35207) | 105 |
| Unmarked objects (#2) | 66 |
| C objects (35213) | 1294 |
| C objects (33140) | 57 |
| Imports (33140) | 37 |
| Total imports | 633 |
| C++ objects (35213) | 870 |
| Resource objects (35213) | 1 |
| 151 | 1 |
| Linker (35213) | 1 |
No comments yet.