pysilon | SaladBootstrapper (1)[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

SaladBootstrapper (1).zip
Size

68.7MB
MD5

8f0ce7846e7b4d560fad2c0dc164a648
SHA1

9de242408d37f54deda72501acaa750f0d14058e
SHA256

0f8ddaa2bc8e8fbf2d12d88e76a80b8aa5b671c28c3e6c9271dbbe646fd3ff0e
SHA512

dff795447f06d1b922dd92e6c6b7b566909996f8e0134af1a2f2e2b252f7e4305208db771ae0625b17d9f4df71e0ed4122689e8a1610c2b6ed48535b40364a95
SSDEEP

786432:8VyJowM7W8788m1Nu6BYdBU+dSYCxeDLkVhXkT6fR:g7Wb8muaYdBR1Lknkm

Score

10^/10

pyinstaller pysilon

Malware Config

Signatures

Detect Pysilon 1 IoCs

resource	yara_rule
static1/unpack002/source_prepared.pyc	pysilon

Pysilon family
pysilon

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/SaladBootstrapper/Salad2.1.exe	pyinstaller

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl
static1/unpack001/SaladBootstrapper/bin/Salad.dll	embeds_openssl

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SaladBootstrapper/Salad.dll
unpack001/SaladBootstrapper/Salad2.1.exe
unpack001/SaladBootstrapper/bin/Salad.dll
unpack001/SaladBootstrapper/xxhash.dll
unpack001/SaladBootstrapper/zstd.dll

Files

SaladBootstrapper (1).zip
.zip
SaladBootstrapper/Salad.dll
.dll windows:6 windows x64 arch:x64

12a9ce968f1a98b80da3deb780350fa5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\rizve\Desktop\Projects\Xeno\build\Release\net8.0-windows\Xeno.pdb

Imports

kernel32

UnmapViewOfFile
GlobalAlloc
GlobalFree
CloseHandle
FreeConsole
CreateFileMappingFromApp
GlobalLock
MapViewOfFileFromApp
GlobalUnlock
AllocConsole
SizeofResource
GetModuleHandleExW
GetProcessId
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
K32GetProcessMemoryInfo
QueryFullProcessImageNameA
LockResource
Process32FirstW
LoadResource
FindResourceW
VirtualProtectEx
VirtualAllocEx
VirtualQueryEx
TerminateProcess
GetModuleFileNameW
LoadLibraryA
GetCurrentProcessId
GetExitCodeProcess
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
FormatMessageA
LocalFree
WideCharToMultiByte
SetConsoleTitleA
GetFileSizeEx
MultiByteToWideChar
GetFileInformationByHandleEx
CopyFileW
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateFile2
GetModuleFileNameA
QueryPerformanceCounter
GetProcAddress

user32

OpenClipboard
GetWindowThreadProcessId
keybd_event
SetClipboardData
EmptyClipboard
CloseClipboard
MapVirtualKeyW
SetForegroundWindow
EnumWindows
GetForegroundWindow

advapi32

GetCurrentHwProfileW

ole32

CoCreateGuid

libcrypto-3-x64

EVP_DigestFinal_ex
X509_get_ext_d2i
BIO_ctrl
OPENSSL_thread_stop
X509_STORE_free
X509_NAME_get_text_by_NID
EVP_MD_CTX_new
d2i_X509
X509_STORE_add_cert
OPENSSL_sk_num
X509_get_subject_name
EVP_md5
EVP_sha256
EVP_DigestUpdate
GENERAL_NAMES_free
EVP_MD_CTX_free
EVP_DigestInit_ex
OPENSSL_sk_value
ASN1_STRING_get0_data
EVP_sha512
BIO_new_socket
X509_free
ASN1_STRING_length

libssl-3-x64

SSL_peek
SSL_get_error
SSL_shutdown
OPENSSL_init_ssl
SSL_free
SSL_CTX_get_cert_store
SSL_CTX_set_default_verify_paths
SSL_new
SSL_CTX_free
SSL_CTX_ctrl
SSL_CTX_set_cert_store
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_new
SSL_write
SSL_get_verify_result
TLS_client_method
SSL_CTX_set_default_passwd_cb_userdata
SSL_ctrl
SSL_set_bio
SSL_connect
SSL_pending
SSL_read
SSL_set_verify
SSL_CTX_load_verify_locations
SSL_get1_peer_certificate

xxhash

XXH32

zstd

ZSTD_compress
ZSTD_getErrorName
ZSTD_decompress
ZSTD_compressBound
ZSTD_isError
ZSTD_maxCLevel

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
_Thrd_detach
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Cnd_signal
_Thrd_hardware_concurrency
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
_Strxfrm
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Cnd_wait
_Thrd_id
_Query_perf_counter
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

ws2_32

listen
shutdown
select
WSAAccept
bind
__WSAFDIsSet
WSACleanup
WSAGetLastError
WSASocketW
closesocket
setsockopt
getnameinfo
ioctlsocket
inet_pton
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove
memcmp
memcpy
memchr
__std_type_info_destroy_list
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
wcsrchr
strchr
__std_terminate
_purecall
__std_exception_copy
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

system
terminate
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
abort
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_beginthreadex
_initterm_e
_initterm

api-ms-win-crt-math-l1-1-0

sin
sinh
sqrt
tan
log
fmod
floor
pow
asin
round
ldexp
ceil
log2
atan
tanh
ceilf
cos
atan2
cosh
acos
exp
log10
_dsign

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
strtoll
strtod
strtoull
atoi

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
realloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fsetpos
ungetc
fread
setvbuf
fgetpos
fwrite
fputc
_get_stream_buffer_pointers
freopen_s
fgetc
_fseeki64
fclose
fflush
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

strncmp
strspn
isdigit
strcpy_s
_wcsicmp
strcmp
strnlen

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_unlock_file
_lock_file

api-ms-win-crt-locale-l1-1-0

localeconv
___lc_codepage_func

Exports

Exports

Compilable
Execute
GetClients
Initialize

Sections

.text
Size: 615KB - Virtual size: 615KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SaladBootstrapper/Salad2.1.exe
.exe windows:6 windows x64 arch:x64

72c4e339b7af8ab1ed2eb3821c98713a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
discord_token_grabber.pyc
get_cookies.pyc
misc.pyc
passwords_grabber.pyc
source_prepared.pyc
SaladBootstrapper/SaladBootstrapper.pdb
SaladBootstrapper/bin/Monaco.html
.html .js polyglot
SaladBootstrapper/bin/Salad.dll
.dll windows:6 windows x64 arch:x64

9e17feafd9e32ed7cb877d6739c852c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

setsockopt
ioctlsocket
freeaddrinfo
recv
connect
socket
send
getaddrinfo
select
closesocket
__WSAFDIsSet
WSAStartup
gethostname
WSAResetEvent
WSAIoctl
sendto
getpeername
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
htons
htonl
gethostbyname
ntohs
shutdown
recvfrom
listen
getsockopt
getsockname
bind
accept
inet_ntop
inet_pton
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSASetLastError
WSACleanup
WSAGetLastError

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptDecodeObjectEx
CertOpenStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreW
CryptStringToBinaryW
PFXImportCertStore
CertFindCertificateInStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension

advapi32

CryptAcquireContextW
GetCurrentHwProfileA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey

user32

GetAsyncKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
keybd_event
CallNextHookEx
GetSystemMetrics
MapVirtualKeyA
MessageBoxA
mouse_event
FindWindowA
ClientToScreen
GetForegroundWindow
GetClientRect

kernel32

RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
GetConsoleCP
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
DeleteFileW
SetStdHandle
SetEndOfFile
IsValidCodePage
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
RtlPcToFileHeader
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
GetFileInformationByHandleEx
CopyFileW
GetOEMCP
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetLocaleInfoEx
LocalFree
FormatMessageA
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
GetProcAddress
MultiByteToWideChar
GlobalAlloc
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
VerSetConditionMask
FreeLibrary
Process32First
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
CreateToolhelp32Snapshot
Sleep
GetLastError
OpenMutexA
Process32Next
CloseHandle
ExitProcess
RaiseException
GetSystemTimeAsFileTime
FindClose
FindFirstFileW
FindNextFileW
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
RtlVirtualUnwind
SetLastError
InitializeSRWLock
RtlUnwind
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
GetModuleHandleExW
GetCurrentProcessId
GetEnvironmentVariableW
VirtualFree
GetACP
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
GetExitCodeThread
CreateSemaphoreA
LoadLibraryW
GetSystemTime
SystemTimeToFileTime
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SleepEx
InitializeCriticalSectionEx
GetSystemDirectoryW
GetEnvironmentVariableA
GetTickCount
FormatMessageW
MoveFileExW
VerifyVersionInfoW
ReadFile
PeekNamedPipe
WaitForMultipleObjects
WaitForSingleObjectEx
CreateFileW
GetFileSizeEx
WakeAllConditionVariable
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
InitializeSListHead
HeapSize
WriteConsoleW
AreFileApisANSI
ReleaseSRWLockExclusive

oleaut32

VariantClear

bcrypt

BCryptGenRandom

Exports

Exports

NextHook

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SaladBootstrapper/bin/tabs.json
SaladBootstrapper/bin/vs/base/worker/workerMain.js
.js
SaladBootstrapper/bin/vs/basic-languages/bat/bat.js
SaladBootstrapper/bin/vs/basic-languages/coffee/coffee.js
SaladBootstrapper/bin/vs/basic-languages/cpp/cpp.js
SaladBootstrapper/bin/vs/basic-languages/csharp/csharp.js
SaladBootstrapper/bin/vs/basic-languages/csp/csp.js
SaladBootstrapper/bin/vs/basic-languages/css/css.js
SaladBootstrapper/bin/vs/basic-languages/dockerfile/dockerfile.js
SaladBootstrapper/bin/vs/basic-languages/fsharp/fsharp.js
SaladBootstrapper/bin/vs/basic-languages/go/go.js
SaladBootstrapper/bin/vs/basic-languages/handlebars/handlebars.js
.js
SaladBootstrapper/bin/vs/basic-languages/html/html.js
.js
SaladBootstrapper/bin/vs/basic-languages/ini/ini.js
SaladBootstrapper/bin/vs/basic-languages/java/java.js
SaladBootstrapper/bin/vs/basic-languages/less/less.js
SaladBootstrapper/bin/vs/basic-languages/lua/lua.js
SaladBootstrapper/bin/vs/basic-languages/markdown/markdown.js
.js
SaladBootstrapper/bin/vs/basic-languages/msdax/msdax.js
SaladBootstrapper/bin/vs/basic-languages/mysql/mysql.js
SaladBootstrapper/bin/vs/basic-languages/objective-c/objective-c.js
SaladBootstrapper/bin/vs/basic-languages/pgsql/pgsql.js
SaladBootstrapper/bin/vs/basic-languages/php/php.js
SaladBootstrapper/bin/vs/basic-languages/postiats/postiats.js
SaladBootstrapper/bin/vs/basic-languages/powershell/powershell.js
SaladBootstrapper/bin/vs/basic-languages/pug/pug.js
SaladBootstrapper/bin/vs/basic-languages/python/python.js
SaladBootstrapper/bin/vs/basic-languages/r/r.js
SaladBootstrapper/bin/vs/basic-languages/razor/razor.js
.js
SaladBootstrapper/bin/vs/basic-languages/redis/redis.js
SaladBootstrapper/bin/vs/basic-languages/redshift/redshift.js
SaladBootstrapper/bin/vs/basic-languages/ruby/ruby.js
SaladBootstrapper/bin/vs/basic-languages/rust/rust.js
SaladBootstrapper/bin/vs/basic-languages/sb/sb.js
SaladBootstrapper/bin/vs/basic-languages/scss/scss.js
SaladBootstrapper/bin/vs/basic-languages/solidity/solidity.js
SaladBootstrapper/bin/vs/basic-languages/sql/sql.js
SaladBootstrapper/bin/vs/basic-languages/st/st.js
SaladBootstrapper/bin/vs/basic-languages/swift/swift.js
SaladBootstrapper/bin/vs/basic-languages/vb/vb.js
SaladBootstrapper/bin/vs/basic-languages/xml/xml.js
SaladBootstrapper/bin/vs/basic-languages/yaml/yaml.js
SaladBootstrapper/bin/vs/editor/contrib/suggest/media/String_16x.svg
SaladBootstrapper/bin/vs/editor/contrib/suggest/media/String_inverse_16x.svg
SaladBootstrapper/bin/vs/editor/editor.main.css
SaladBootstrapper/bin/vs/editor/editor.main.js
.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.de.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.es.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.fr.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.it.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.ja.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.ko.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.ru.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.zh-cn.js
SaladBootstrapper/bin/vs/editor/editor.main.nls.zh-tw.js
SaladBootstrapper/bin/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
SaladBootstrapper/bin/vs/language/css/cssMode.js
.js
SaladBootstrapper/bin/vs/language/css/cssWorker.js
.js
SaladBootstrapper/bin/vs/language/html/htmlMode.js
.js
SaladBootstrapper/bin/vs/language/html/htmlWorker.js
.js
SaladBootstrapper/bin/vs/language/json/jsonMode.js
.js
SaladBootstrapper/bin/vs/language/json/jsonWorker.js
.js
SaladBootstrapper/bin/vs/language/typescript/lib/typescriptServices.js
.js
SaladBootstrapper/bin/vs/language/typescript/tsMode.js
.js
SaladBootstrapper/bin/vs/language/typescript/tsWorker.js
.js
SaladBootstrapper/bin/vs/loader.js
.js
SaladBootstrapper/dependenciescheck.bat
SaladBootstrapper/tabs.json
SaladBootstrapper/xxhash.dll
.dll windows:6 windows x64 arch:x64

fba6b233846a2ea5e6907e23b2de9a26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\rizve\Desktop\xxhs\vcpkg\buildtrees\xxhash\x64-windows-rel\xxhash.pdb

Imports

vcruntime140

memcpy
__std_type_info_destroy_list
__C_specific_handler
memset

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table
_initialize_narrow_environment

kernel32

GetCurrentThreadId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
RtlCaptureContext
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess

Exports

Exports

XXH128
XXH128_canonicalFromHash
XXH128_cmp
XXH128_hashFromCanonical
XXH128_isEqual
XXH32
XXH32_canonicalFromHash
XXH32_copyState
XXH32_createState
XXH32_digest
XXH32_freeState
XXH32_hashFromCanonical
XXH32_reset
XXH32_update
XXH3_128bits
XXH3_128bits_digest
XXH3_128bits_reset
XXH3_128bits_reset_withSecret
XXH3_128bits_reset_withSecretandSeed
XXH3_128bits_reset_withSeed
XXH3_128bits_update
XXH3_128bits_withSecret
XXH3_128bits_withSecretandSeed
XXH3_128bits_withSeed
XXH3_64bits
XXH3_64bits_digest
XXH3_64bits_reset
XXH3_64bits_reset_withSecret
XXH3_64bits_reset_withSecretandSeed
XXH3_64bits_reset_withSeed
XXH3_64bits_update
XXH3_64bits_withSecret
XXH3_64bits_withSecretandSeed
XXH3_64bits_withSeed
XXH3_copyState
XXH3_createState
XXH3_freeState
XXH3_generateSecret
XXH3_generateSecret_fromSeed
XXH64
XXH64_canonicalFromHash
XXH64_copyState
XXH64_createState
XXH64_digest
XXH64_freeState
XXH64_hashFromCanonical
XXH64_reset
XXH64_update
XXH_versionNumber

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SaladBootstrapper/zstd.dll
.dll windows:6 windows x64 arch:x64

f32e8587cacdf9095c309b87f2877ebb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\rizve\Desktop\zstd\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
CloseHandle
GetLastError
WaitForSingleObject
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

vcruntime140

memcmp
memcpy
__C_specific_handler
memmove
__std_type_info_destroy_list
memset

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_cexit
_initterm_e
_configure_narrow_argv
_seh_filter_dll
_initterm
_beginthreadex
_errno
_execute_onexit_table
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

fflush
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

clock

Exports

Exports

ZDICT_addEntropyTablesFromBuffer
ZDICT_finalizeDictionary
ZDICT_getDictHeaderSize
ZDICT_getDictID
ZDICT_getErrorName
ZDICT_isError
ZDICT_optimizeTrainFromBuffer_cover
ZDICT_optimizeTrainFromBuffer_fastCover
ZDICT_trainFromBuffer
ZDICT_trainFromBuffer_cover
ZDICT_trainFromBuffer_fastCover
ZDICT_trainFromBuffer_legacy
ZSTD_CCtxParams_getParameter
ZSTD_CCtxParams_init
ZSTD_CCtxParams_init_advanced
ZSTD_CCtxParams_registerSequenceProducer
ZSTD_CCtxParams_reset
ZSTD_CCtxParams_setParameter
ZSTD_CCtx_getParameter
ZSTD_CCtx_loadDictionary
ZSTD_CCtx_loadDictionary_advanced
ZSTD_CCtx_loadDictionary_byReference
ZSTD_CCtx_refCDict
ZSTD_CCtx_refPrefix
ZSTD_CCtx_refPrefix_advanced
ZSTD_CCtx_refThreadPool
ZSTD_CCtx_reset
ZSTD_CCtx_setCParams
ZSTD_CCtx_setFParams
ZSTD_CCtx_setParameter
ZSTD_CCtx_setParametersUsingCCtxParams
ZSTD_CCtx_setParams
ZSTD_CCtx_setPledgedSrcSize
ZSTD_CStreamInSize
ZSTD_CStreamOutSize
ZSTD_DCtx_getParameter
ZSTD_DCtx_loadDictionary
ZSTD_DCtx_loadDictionary_advanced
ZSTD_DCtx_loadDictionary_byReference
ZSTD_DCtx_refDDict
ZSTD_DCtx_refPrefix
ZSTD_DCtx_refPrefix_advanced
ZSTD_DCtx_reset
ZSTD_DCtx_setFormat
ZSTD_DCtx_setMaxWindowSize
ZSTD_DCtx_setParameter
ZSTD_DStreamInSize
ZSTD_DStreamOutSize
ZSTD_adjustCParams
ZSTD_cParam_getBounds
ZSTD_checkCParams
ZSTD_compress
ZSTD_compress2
ZSTD_compressBegin
ZSTD_compressBegin_advanced
ZSTD_compressBegin_usingCDict
ZSTD_compressBegin_usingCDict_advanced
ZSTD_compressBegin_usingDict
ZSTD_compressBlock
ZSTD_compressBound
ZSTD_compressCCtx
ZSTD_compressContinue
ZSTD_compressEnd
ZSTD_compressSequences
ZSTD_compressStream
ZSTD_compressStream2
ZSTD_compressStream2_simpleArgs
ZSTD_compress_advanced
ZSTD_compress_usingCDict
ZSTD_compress_usingCDict_advanced
ZSTD_compress_usingDict
ZSTD_copyCCtx
ZSTD_copyDCtx
ZSTD_createCCtx
ZSTD_createCCtxParams
ZSTD_createCCtx_advanced
ZSTD_createCDict
ZSTD_createCDict_advanced
ZSTD_createCDict_advanced2
ZSTD_createCDict_byReference
ZSTD_createCStream
ZSTD_createCStream_advanced
ZSTD_createDCtx
ZSTD_createDCtx_advanced
ZSTD_createDDict
ZSTD_createDDict_advanced
ZSTD_createDDict_byReference
ZSTD_createDStream
ZSTD_createDStream_advanced
ZSTD_createThreadPool
ZSTD_dParam_getBounds
ZSTD_decodingBufferSize_min
ZSTD_decompress
ZSTD_decompressBegin
ZSTD_decompressBegin_usingDDict
ZSTD_decompressBegin_usingDict
ZSTD_decompressBlock
ZSTD_decompressBound
ZSTD_decompressContinue
ZSTD_decompressDCtx
ZSTD_decompressStream
ZSTD_decompressStream_simpleArgs
ZSTD_decompress_usingDDict
ZSTD_decompress_usingDict
ZSTD_decompressionMargin
ZSTD_defaultCLevel
ZSTD_endStream
ZSTD_estimateCCtxSize
ZSTD_estimateCCtxSize_usingCCtxParams
ZSTD_estimateCCtxSize_usingCParams
ZSTD_estimateCDictSize
ZSTD_estimateCDictSize_advanced
ZSTD_estimateCStreamSize
ZSTD_estimateCStreamSize_usingCCtxParams
ZSTD_estimateCStreamSize_usingCParams
ZSTD_estimateDCtxSize
ZSTD_estimateDDictSize
ZSTD_estimateDStreamSize
ZSTD_estimateDStreamSize_fromFrame
ZSTD_findDecompressedSize
ZSTD_findFrameCompressedSize
ZSTD_flushStream
ZSTD_frameHeaderSize
ZSTD_freeCCtx
ZSTD_freeCCtxParams
ZSTD_freeCDict
ZSTD_freeCStream
ZSTD_freeDCtx
ZSTD_freeDDict
ZSTD_freeDStream
ZSTD_freeThreadPool
ZSTD_generateSequences
ZSTD_getBlockSize
ZSTD_getCParams
ZSTD_getDecompressedSize
ZSTD_getDictID_fromCDict
ZSTD_getDictID_fromDDict
ZSTD_getDictID_fromDict
ZSTD_getDictID_fromFrame
ZSTD_getErrorCode
ZSTD_getErrorName
ZSTD_getErrorString
ZSTD_getFrameContentSize
ZSTD_getFrameHeader
ZSTD_getFrameHeader_advanced
ZSTD_getFrameProgression
ZSTD_getParams
ZSTD_initCStream
ZSTD_initCStream_advanced
ZSTD_initCStream_srcSize
ZSTD_initCStream_usingCDict
ZSTD_initCStream_usingCDict_advanced
ZSTD_initCStream_usingDict
ZSTD_initDStream
ZSTD_initDStream_usingDDict
ZSTD_initDStream_usingDict
ZSTD_initStaticCCtx
ZSTD_initStaticCDict
ZSTD_initStaticCStream
ZSTD_initStaticDCtx
ZSTD_initStaticDDict
ZSTD_initStaticDStream
ZSTD_insertBlock
ZSTD_isError
ZSTD_isFrame
ZSTD_isSkippableFrame
ZSTD_maxCLevel
ZSTD_mergeBlockDelimiters
ZSTD_minCLevel
ZSTD_nextInputType
ZSTD_nextSrcSizeToDecompress
ZSTD_readSkippableFrame
ZSTD_registerSequenceProducer
ZSTD_resetCStream
ZSTD_resetDStream
ZSTD_sequenceBound
ZSTD_sizeof_CCtx
ZSTD_sizeof_CDict
ZSTD_sizeof_CStream
ZSTD_sizeof_DCtx
ZSTD_sizeof_DDict
ZSTD_sizeof_DStream
ZSTD_toFlushNow
ZSTD_versionNumber
ZSTD_versionString
ZSTD_writeSkippableFrame

Sections

.text
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12a9ce968f1a98b80da3deb780350fa5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

libcrypto-3-x64

libssl-3-x64

xxhash

zstd

msvcp140

ws2_32

crypt32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 615KB - Virtual size: 615KB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 46KB - Virtual size: 53KB

.pdata Size: 26KB - Virtual size: 26KB

.rsrc Size: 75KB - Virtual size: 75KB

.reloc Size: 5KB - Virtual size: 4KB

72c4e339b7af8ab1ed2eb3821c98713a

Headers

DLL Characteristics

File Characteristics

Imports

user32

comctl32

kernel32

advapi32

gdi32

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 3KB - Virtual size: 20KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

9e17feafd9e32ed7cb877d6739c852c0

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

advapi32

user32

kernel32

oleaut32

bcrypt

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 38KB - Virtual size: 67KB

.pdata Size: 177KB - Virtual size: 177KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 49KB - Virtual size: 48KB

fba6b233846a2ea5e6907e23b2de9a26

.text
Size: 615KB - Virtual size: 615KB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 46KB - Virtual size: 53KB

.pdata
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 75KB - Virtual size: 75KB

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 3KB - Virtual size: 20KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 38KB - Virtual size: 67KB

.pdata
Size: 177KB - Virtual size: 177KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 49KB - Virtual size: 48KB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 44B

.text
Size: 553KB - Virtual size: 553KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 196B