PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,56 MB SHA-256 Hash: C13BE88A14D2C50B4E5EBCA6B490FD6B8A6982555051C58B1D45FEF6011671EE SHA-1 Hash: 3DD7B3BBB0DCFE89E1A3FF1C1B0ABCD5371B706E MD5 Hash: 057739A12FA0D25A1017E5F7A8538140 Imphash: 314D410BEF1E80EE695ECC184F2190CC MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): D1A0 SizeOfHeaders: 400 SizeOfImage: 195000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 18C860 ImportTable: 18C934 IAT: 1D000 Characteristics: 2022 TimeDateStamp: 6A54E8C0 Date: 13/07/2026 13:31:44 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .fptable, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 1B600 | 1000 | 1B4FA |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
1BA00 | 170200 | 1D000 | 17019C |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
18BC00 | 2000 | 18E000 | 2B9C |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
18DC00 | 1800 | 191000 | 1764 |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
18F400 | 200 | 193000 | 100 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
18F600 | 800 | 194000 | 69C |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - C5A0 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8CF0200004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X1021 |CALL 0X12F0 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> F69429A7B2F547F4B2F547F4B2F547F4CB7442F53FF547F4CB7443F5BEF547F4CB7444F5BAF547F43B7E44F5B8F547F43B7E43F5BDF547F43B7E42F599F547F4CB7446F5BBF547F4B2F546F4DFF547F4CB7441F5B3F547F4257842F5BDF547F4257847F5B3F547F4257845F5B3F547F452696368B2F547F4 Footprint md5 Hash -> 7E68CF229514AC587F64FE4EFD44B2A3 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.51**)[-] • Entropy: 6.2125 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| ET Functions (carving) |
| Original Name -> cmutil.dll CmFree CmMalloc CmRealloc GetOSMajorVersion GetOSVersion SzToWzWithAlloc WzToSzWithAlloc |
| File Access |
| KERNEL32.dll cmutil.dll .dat @.dat |
| File Access (UNICODE) |
| mscoree.dll |
| Interest's Words |
| start wmic |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealer malware focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Text | Ascii | Malware that monitors and collects user data (Spy) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • mscoree.dll • .tls • .bss • KERNEL32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| A43 | N/A | .text | CALL QWORD PTR [RIP+0x1B9D7] |
| A49 | N/A | .text | CALL QWORD PTR [RIP+0x1BA11] |
| A51 | N/A | .text | CALL QWORD PTR [RIP+0x1B9F9] |
| A59 | N/A | .text | CALL QWORD PTR [RIP+0x1B9F9] |
| A63 | N/A | .text | CALL QWORD PTR [RIP+0x1BA0F] |
| E43 | N/A | .text | CALL QWORD PTR [RIP+0x1B6A7] |
| EB7 | N/A | .text | JMP QWORD PTR [RIP+0x1B58B] |
| 1A49 | N/A | .text | CALL QWORD PTR [RIP+0x1A9F1] |
| 1A5D | N/A | .text | JMP QWORD PTR [RIP+0x1A9D5] |
| 1BB4 | N/A | .text | CALL QWORD PTR [RIP+0x1A886] |
| 1BCB | N/A | .text | JMP QWORD PTR [RIP+0x1A857] |
| 2047 | N/A | .text | CALL QWORD PTR [RIP+0x1A3F3] |
| 205B | N/A | .text | CALL QWORD PTR [RIP+0x1A3CF] |
| 21F6 | N/A | .text | CALL QWORD PTR [RIP+0x1A274] |
| 2612 | N/A | .text | CALL QWORD PTR [RIP+0x19E68] |
| 263F | N/A | .text | CALL QWORD PTR [RIP+0x19E3B] |
| 2696 | N/A | .text | CALL QWORD PTR [RIP+0x19DEC] |
| 26CA | N/A | .text | CALL QWORD PTR [RIP+0x19DB8] |
| 89DD | N/A | .text | CALL QWORD PTR [RIP+0x13AB5] |
| 8E69 | N/A | .text | CALL QWORD PTR [RIP+0x13631] |
| 9051 | N/A | .text | CALL QWORD PTR [RIP+0x13469] |
| 90AF | N/A | .text | CALL QWORD PTR [RIP+0x1340B] |
| 9105 | N/A | .text | CALL QWORD PTR [RIP+0x133B5] |
| 91FA | N/A | .text | CALL QWORD PTR [RIP+0x132A8] |
| 923A | N/A | .text | CALL QWORD PTR [RIP+0x13260] |
| 92E7 | N/A | .text | CALL QWORD PTR [RIP+0x131D3] |
| 93DC | N/A | .text | CALL QWORD PTR [RIP+0x130E6] |
| 93FF | N/A | .text | CALL QWORD PTR [RIP+0x130C3] |
| A69F | N/A | .text | CALL QWORD PTR [RIP+0x11E3B] |
| A7EA | N/A | .text | CALL QWORD PTR [RIP+0x11CE8] |
| B7BA | N/A | .text | CALL QWORD PTR [RIP+0x10CD8] |
| BACC | N/A | .text | CALL QWORD PTR [RIP+0x10BBE] |
| BCCD | N/A | .text | CALL QWORD PTR [RIP+0x109BD] |
| BF5A | N/A | .text | CALL QWORD PTR [RIP+0x10730] |
| C382 | N/A | .text | CALL QWORD PTR [RIP+0x10308] |
| C4BA | N/A | .text | CALL QWORD PTR [RIP+0x101D0] |
| C531 | N/A | .text | CALL QWORD PTR [RIP+0x10159] |
| C572 | N/A | .text | CALL QWORD PTR [RIP+0x10118] |
| C8CA | N/A | .text | CALL QWORD PTR [RIP+0xFC60] |
| C8DA | N/A | .text | CALL QWORD PTR [RIP+0xFB78] |
| C8E7 | N/A | .text | CALL QWORD PTR [RIP+0xFB63] |
| C8F9 | N/A | .text | CALL QWORD PTR [RIP+0xFB21] |
| C958 | N/A | .text | JMP QWORD PTR [RIP+0xFBDA] |
| C9D8 | N/A | .text | CALL QWORD PTR [RIP+0xFCB2] |
| CA28 | N/A | .text | CALL QWORD PTR [RIP+0xFC62] |
| CA85 | N/A | .text | CALL QWORD PTR [RIP+0xFC05] |
| CAD6 | N/A | .text | CALL QWORD PTR [RIP+0xFBB4] |
| CB13 | N/A | .text | CALL QWORD PTR [RIP+0xFB77] |
| CB28 | N/A | .text | JMP QWORD PTR [RIP+0xFA12] |
| CB69 | N/A | .text | CALL QWORD PTR [RIP+0xFB21] |
| CB78 | N/A | .text | CALL QWORD PTR [RIP+0xF9C2] |
| CCE6 | N/A | .text | CALL QWORD PTR [RIP+0xF9A4] |
| CD00 | N/A | .text | CALL QWORD PTR [RIP+0xF84A] |
| CD43 | N/A | .text | CALL QWORD PTR [RIP+0xF80F] |
| CDC2 | N/A | .text | CALL QWORD PTR [RIP+0xF8C8] |
| CF09 | N/A | .text | CALL QWORD PTR [RIP+0xF781] |
| CF59 | N/A | .text | CALL QWORD PTR [RIP+0xF731] |
| D167 | N/A | .text | CALL QWORD PTR [RIP+0xF3F3] |
| D2D7 | N/A | .text | CALL QWORD PTR [RIP+0xF283] |
| D760 | N/A | .text | CALL QWORD PTR [RIP+0xEE02] |
| D8D6 | N/A | .text | CALL QWORD PTR [RIP+0xEC8C] |
| DEB5 | N/A | .text | CALL QWORD PTR [RIP+0x174025] |
| DEF0 | N/A | .text | CALL QWORD PTR [RIP+0xE672] |
| E034 | N/A | .text | CALL QWORD PTR [RIP+0xE536] |
| E0A4 | N/A | .text | CALL QWORD PTR [RIP+0xE44E] |
| E0B5 | N/A | .text | CALL QWORD PTR [RIP+0xE4CD] |
| E107 | N/A | .text | CALL QWORD PTR [RIP+0xE43B] |
| E115 | N/A | .text | CALL QWORD PTR [RIP+0xE3DD] |
| E13A | N/A | .text | CALL QWORD PTR [RIP+0xE448] |
| E163 | N/A | .text | CALL QWORD PTR [RIP+0xE41F] |
| E170 | N/A | .text | CALL QWORD PTR [RIP+0xE412] |
| E18A | N/A | .text | CALL QWORD PTR [RIP+0xE3E8] |
| E1A6 | N/A | .text | CALL QWORD PTR [RIP+0xE3DC] |
| E1B6 | N/A | .text | CALL QWORD PTR [RIP+0xE3BC] |
| E1EE | N/A | .text | CALL QWORD PTR [RIP+0xE354] |
| E1FC | N/A | .text | CALL QWORD PTR [RIP+0xE2F6] |
| E21D | N/A | .text | CALL QWORD PTR [RIP+0xE365] |
| E250 | N/A | .text | CALL QWORD PTR [RIP+0xE332] |
| E272 | N/A | .text | CALL QWORD PTR [RIP+0xE310] |
| E289 | N/A | .text | CALL QWORD PTR [RIP+0xE2E9] |
| E2BB | N/A | .text | CALL QWORD PTR [RIP+0xE2BF] |
| E2D5 | N/A | .text | CALL QWORD PTR [RIP+0xE2AD] |
| E2FB | N/A | .text | CALL QWORD PTR [RIP+0xE28F] |
| E32F | N/A | .text | CALL QWORD PTR [RIP+0xE25B] |
| E7B6 | N/A | .text | CALL QWORD PTR [RIP+0xDED4] |
| E997 | N/A | .text | CALL QWORD PTR [RIP+0xDCF3] |
| F852 | N/A | .text | CALL QWORD PTR [RIP+0xCD40] |
| FACA | N/A | .text | CALL QWORD PTR [RIP+0xCAC8] |
| 101D4 | N/A | .text | CALL QWORD PTR [RIP+0xC4B6] |
| 1042E | N/A | .text | CALL QWORD PTR [RIP+0xC25C] |
| 107C8 | N/A | .text | CALL QWORD PTR [RIP+0xBD8A] |
| 10A2B | N/A | .text | CALL QWORD PTR [RIP+0xBB27] |
| 118D0 | N/A | .text | CALL QWORD PTR [RIP+0xACDA] |
| 1190A | N/A | .text | CALL QWORD PTR [RIP+0xACA8] |
| 1195A | N/A | .text | CALL QWORD PTR [RIP+0xAC58] |
| 11B84 | N/A | .text | CALL QWORD PTR [RIP+0xA9A6] |
| 11C04 | N/A | .text | CALL QWORD PTR [RIP+0xA93E] |
| 11C38 | N/A | .text | CALL QWORD PTR [RIP+0xA93A] |
| 12127 | N/A | .text | CALL QWORD PTR [RIP+0xA34B] |
| 121F0 | N/A | .text | CALL QWORD PTR [RIP+0xA2CA] |
| 1BD18 | C680 | .rdata | TLS Callback | Pointer to 18000C680 - 0xBA80 .text |
| 1BD20 | CB00 | .rdata | TLS Callback | Pointer to 18000CB00 - 0xBF00 .text |
| 18DC00 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 18DC0C | 1080 | .pdata | ExceptionHook | Pointer to 1080 - 0x480 .text + UnwindInfo: .rdata |
| 18DC18 | 1240 | .pdata | ExceptionHook | Pointer to 1240 - 0x640 .text + UnwindInfo: .rdata |
| 18DC24 | 1244 | .pdata | ExceptionHook | Pointer to 1244 - 0x644 .text + UnwindInfo: .rdata |
| 18DC30 | 143F | .pdata | ExceptionHook | Pointer to 143F - 0x83F .text + UnwindInfo: .rdata |
| 18DC3C | 1575 | .pdata | ExceptionHook | Pointer to 1575 - 0x975 .text + UnwindInfo: .rdata |
| 18DC48 | 15E7 | .pdata | ExceptionHook | Pointer to 15E7 - 0x9E7 .text + UnwindInfo: .rdata |
| 18DC54 | 1610 | .pdata | ExceptionHook | Pointer to 1610 - 0xA10 .text + UnwindInfo: .rdata |
| 18DC60 | 1621 | .pdata | ExceptionHook | Pointer to 1621 - 0xA21 .text + UnwindInfo: .rdata |
| 18DC6C | 162B | .pdata | ExceptionHook | Pointer to 162B - 0xA2B .text + UnwindInfo: .rdata |
| 18DC78 | 1759 | .pdata | ExceptionHook | Pointer to 1759 - 0xB59 .text + UnwindInfo: .rdata |
| 18DC84 | 1784 | .pdata | ExceptionHook | Pointer to 1784 - 0xB84 .text + UnwindInfo: .rdata |
| 18DC90 | 1790 | .pdata | ExceptionHook | Pointer to 1790 - 0xB90 .text + UnwindInfo: .rdata |
| 18DC9C | 18A0 | .pdata | ExceptionHook | Pointer to 18A0 - 0xCA0 .text + UnwindInfo: .rdata |
| 18DCA8 | 1A20 | .pdata | ExceptionHook | Pointer to 1A20 - 0xE20 .text + UnwindInfo: .rdata |
| 18DCB4 | 1AC0 | .pdata | ExceptionHook | Pointer to 1AC0 - 0xEC0 .text + UnwindInfo: .rdata |
| 18DCC0 | 1AC4 | .pdata | ExceptionHook | Pointer to 1AC4 - 0xEC4 .text + UnwindInfo: .rdata |
| 18DCCC | 1F4B | .pdata | ExceptionHook | Pointer to 1F4B - 0x134B .text + UnwindInfo: .rdata |
| 18DCD8 | 1F90 | .pdata | ExceptionHook | Pointer to 1F90 - 0x1390 .text + UnwindInfo: .rdata |
| 18DCE4 | 24D0 | .pdata | ExceptionHook | Pointer to 24D0 - 0x18D0 .text + UnwindInfo: .rdata |
| 18DCF0 | 2670 | .pdata | ExceptionHook | Pointer to 2670 - 0x1A70 .text + UnwindInfo: .rdata |
| 18DCFC | 27E0 | .pdata | ExceptionHook | Pointer to 27E0 - 0x1BE0 .text + UnwindInfo: .rdata |
| 18DD08 | 2C70 | .pdata | ExceptionHook | Pointer to 2C70 - 0x2070 .text + UnwindInfo: .rdata |
| 18DD14 | 2F40 | .pdata | ExceptionHook | Pointer to 2F40 - 0x2340 .text + UnwindInfo: .rdata |
| 18DD20 | 3090 | .pdata | ExceptionHook | Pointer to 3090 - 0x2490 .text + UnwindInfo: .rdata |
| 18DD2C | 31E0 | .pdata | ExceptionHook | Pointer to 31E0 - 0x25E0 .text + UnwindInfo: .rdata |
| 18DD38 | 3260 | .pdata | ExceptionHook | Pointer to 3260 - 0x2660 .text + UnwindInfo: .rdata |
| 18DD44 | 32F0 | .pdata | ExceptionHook | Pointer to 32F0 - 0x26F0 .text + UnwindInfo: .rdata |
| 18DD50 | 3460 | .pdata | ExceptionHook | Pointer to 3460 - 0x2860 .text + UnwindInfo: .rdata |
| 18DD5C | 35D0 | .pdata | ExceptionHook | Pointer to 35D0 - 0x29D0 .text + UnwindInfo: .rdata |
| 18DD68 | 3740 | .pdata | ExceptionHook | Pointer to 3740 - 0x2B40 .text + UnwindInfo: .rdata |
| 18DD74 | 38B0 | .pdata | ExceptionHook | Pointer to 38B0 - 0x2CB0 .text + UnwindInfo: .rdata |
| 18DD80 | 3A20 | .pdata | ExceptionHook | Pointer to 3A20 - 0x2E20 .text + UnwindInfo: .rdata |
| 18DD8C | 3B90 | .pdata | ExceptionHook | Pointer to 3B90 - 0x2F90 .text + UnwindInfo: .rdata |
| 18DD98 | 3CF9 | .pdata | ExceptionHook | Pointer to 3CF9 - 0x30F9 .text + UnwindInfo: .rdata |
| 18DDA4 | 3D35 | .pdata | ExceptionHook | Pointer to 3D35 - 0x3135 .text + UnwindInfo: .rdata |
| 18DDB0 | 4A3C | .pdata | ExceptionHook | Pointer to 4A3C - 0x3E3C .text + UnwindInfo: .rdata |
| 18DDBC | 4A50 | .pdata | ExceptionHook | Pointer to 4A50 - 0x3E50 .text + UnwindInfo: .rdata |
| 18DDC8 | 4A60 | .pdata | ExceptionHook | Pointer to 4A60 - 0x3E60 .text + UnwindInfo: .rdata |
| 18DDD4 | 4BCD | .pdata | ExceptionHook | Pointer to 4BCD - 0x3FCD .text + UnwindInfo: .rdata |
| 18DDE0 | 4C09 | .pdata | ExceptionHook | Pointer to 4C09 - 0x4009 .text + UnwindInfo: .rdata |
| 18DDEC | 5906 | .pdata | ExceptionHook | Pointer to 5906 - 0x4D06 .text + UnwindInfo: .rdata |
| 18DDF8 | 591A | .pdata | ExceptionHook | Pointer to 591A - 0x4D1A .text + UnwindInfo: .rdata |
| 18DE04 | 5930 | .pdata | ExceptionHook | Pointer to 5930 - 0x4D30 .text + UnwindInfo: .rdata |
| 18DE10 | 5A99 | .pdata | ExceptionHook | Pointer to 5A99 - 0x4E99 .text + UnwindInfo: .rdata |
| 18DE1C | 5AD5 | .pdata | ExceptionHook | Pointer to 5AD5 - 0x4ED5 .text + UnwindInfo: .rdata |
| 18DE28 | 67DC | .pdata | ExceptionHook | Pointer to 67DC - 0x5BDC .text + UnwindInfo: .rdata |
| 18DE34 | 67F0 | .pdata | ExceptionHook | Pointer to 67F0 - 0x5BF0 .text + UnwindInfo: .rdata |
| 18DE40 | 6800 | .pdata | ExceptionHook | Pointer to 6800 - 0x5C00 .text + UnwindInfo: .rdata |
| 18DE4C | 696C | .pdata | ExceptionHook | Pointer to 696C - 0x5D6C .text + UnwindInfo: .rdata |
| 18DE58 | 69A8 | .pdata | ExceptionHook | Pointer to 69A8 - 0x5DA8 .text + UnwindInfo: .rdata |
| 18DE64 | 76A6 | .pdata | ExceptionHook | Pointer to 76A6 - 0x6AA6 .text + UnwindInfo: .rdata |
| 18DE70 | 76BA | .pdata | ExceptionHook | Pointer to 76BA - 0x6ABA .text + UnwindInfo: .rdata |
| 18DE7C | 76D0 | .pdata | ExceptionHook | Pointer to 76D0 - 0x6AD0 .text + UnwindInfo: .rdata |
| 18DE88 | 783D | .pdata | ExceptionHook | Pointer to 783D - 0x6C3D .text + UnwindInfo: .rdata |
| 18DE94 | 7879 | .pdata | ExceptionHook | Pointer to 7879 - 0x6C79 .text + UnwindInfo: .rdata |
| 18DEA0 | 8576 | .pdata | ExceptionHook | Pointer to 8576 - 0x7976 .text + UnwindInfo: .rdata |
| 18DEAC | 858A | .pdata | ExceptionHook | Pointer to 858A - 0x798A .text + UnwindInfo: .rdata |
| 18DEB8 | 85A0 | .pdata | ExceptionHook | Pointer to 85A0 - 0x79A0 .text + UnwindInfo: .rdata |
| 18DEC4 | 86FF | .pdata | ExceptionHook | Pointer to 86FF - 0x7AFF .text + UnwindInfo: .rdata |
| 18DED0 | 873B | .pdata | ExceptionHook | Pointer to 873B - 0x7B3B .text + UnwindInfo: .rdata |
| 18DEDC | 95D6 | .pdata | ExceptionHook | Pointer to 95D6 - 0x89D6 .text + UnwindInfo: .rdata |
| 18DEE8 | 95EB | .pdata | ExceptionHook | Pointer to 95EB - 0x89EB .text + UnwindInfo: .rdata |
| 18DEF4 | 9600 | .pdata | ExceptionHook | Pointer to 9600 - 0x8A00 .text + UnwindInfo: .rdata |
| 18DF00 | 9A80 | .pdata | ExceptionHook | Pointer to 9A80 - 0x8E80 .text + UnwindInfo: .rdata |
| 18DF0C | A080 | .pdata | ExceptionHook | Pointer to A080 - 0x9480 .text + UnwindInfo: .rdata |
| 18DF18 | A0CF | .pdata | ExceptionHook | Pointer to A0CF - 0x94CF .text + UnwindInfo: .rdata |
| 18DF24 | A170 | .pdata | ExceptionHook | Pointer to A170 - 0x9570 .text + UnwindInfo: .rdata |
| 18DF30 | A176 | .pdata | ExceptionHook | Pointer to A176 - 0x9576 .text + UnwindInfo: .rdata |
| 18DF3C | A180 | .pdata | ExceptionHook | Pointer to A180 - 0x9580 .text + UnwindInfo: .rdata |
| 18DF48 | A1C0 | .pdata | ExceptionHook | Pointer to A1C0 - 0x95C0 .text + UnwindInfo: .rdata |
| 18DF54 | A230 | .pdata | ExceptionHook | Pointer to A230 - 0x9630 .text + UnwindInfo: .rdata |
| 18DF60 | A290 | .pdata | ExceptionHook | Pointer to A290 - 0x9690 .text + UnwindInfo: .rdata |
| 18DF6C | A2E0 | .pdata | ExceptionHook | Pointer to A2E0 - 0x96E0 .text + UnwindInfo: .rdata |
| 18DF78 | A384 | .pdata | ExceptionHook | Pointer to A384 - 0x9784 .text + UnwindInfo: .rdata |
| 18DF84 | A893 | .pdata | ExceptionHook | Pointer to A893 - 0x9C93 .text + UnwindInfo: .rdata |
| 18DF90 | A8B0 | .pdata | ExceptionHook | Pointer to A8B0 - 0x9CB0 .text + UnwindInfo: .rdata |
| 18DF9C | A8D0 | .pdata | ExceptionHook | Pointer to A8D0 - 0x9CD0 .text + UnwindInfo: .rdata |
| 18DFA8 | A8F0 | .pdata | ExceptionHook | Pointer to A8F0 - 0x9CF0 .text + UnwindInfo: .rdata |
| 18DFB4 | A910 | .pdata | ExceptionHook | Pointer to A910 - 0x9D10 .text + UnwindInfo: .rdata |
| 18DFC0 | AE40 | .pdata | ExceptionHook | Pointer to AE40 - 0xA240 .text + UnwindInfo: .rdata |
| 18DFCC | AE5C | .pdata | ExceptionHook | Pointer to AE5C - 0xA25C .text + UnwindInfo: .rdata |
| 18DFD8 | AE6E | .pdata | ExceptionHook | Pointer to AE6E - 0xA26E .text + UnwindInfo: .rdata |
| 18DFE4 | AFF8 | .pdata | ExceptionHook | Pointer to AFF8 - 0xA3F8 .text + UnwindInfo: .rdata |
| 18DFF0 | AFFD | .pdata | ExceptionHook | Pointer to AFFD - 0xA3FD .text + UnwindInfo: .rdata |
| 18DFFC | B006 | .pdata | ExceptionHook | Pointer to B006 - 0xA406 .text + UnwindInfo: .rdata |
| 18E008 | B130 | .pdata | ExceptionHook | Pointer to B130 - 0xA530 .text + UnwindInfo: .rdata |
| 18E014 | B290 | .pdata | ExceptionHook | Pointer to B290 - 0xA690 .text + UnwindInfo: .rdata |
| 18E020 | B297 | .pdata | ExceptionHook | Pointer to B297 - 0xA697 .text + UnwindInfo: .rdata |
| 18E02C | B429 | .pdata | ExceptionHook | Pointer to B429 - 0xA829 .text + UnwindInfo: .rdata |
| 18E038 | C3B2 | .pdata | ExceptionHook | Pointer to C3B2 - 0xB7B2 .text + UnwindInfo: .rdata |
| 18E044 | C40F | .pdata | ExceptionHook | Pointer to C40F - 0xB80F .text + UnwindInfo: .rdata |
| 18E050 | C570 | .pdata | ExceptionHook | Pointer to C570 - 0xB970 .text + UnwindInfo: .rdata |
| 18E05C | C5B0 | .pdata | ExceptionHook | Pointer to C5B0 - 0xB9B0 .text + UnwindInfo: .rdata |
| 18E068 | C600 | .pdata | ExceptionHook | Pointer to C600 - 0xBA00 .text + UnwindInfo: .rdata |
| 18E074 | C640 | .pdata | ExceptionHook | Pointer to C640 - 0xBA40 .text + UnwindInfo: .rdata |
| 18E080 | C680 | .pdata | ExceptionHook | Pointer to C680 - 0xBA80 .text + UnwindInfo: .rdata |
| 18E08C | C6F0 | .pdata | ExceptionHook | Pointer to C6F0 - 0xBAF0 .text + UnwindInfo: .rdata |
| 18E098 | C740 | .pdata | ExceptionHook | Pointer to C740 - 0xBB40 .text + UnwindInfo: .rdata |
| 18E0A4 | C790 | .pdata | ExceptionHook | Pointer to C790 - 0xBB90 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1557420 | 95,0871% |
| Null Byte Code | 42881 | 2,6181% |
© 2026 All rights reserved.