PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 4,31 MBSHA-256 Hash: C43055B9C357F948641C33776CFAD5A92CB98D582C1E183308631834C1B7D562 SHA-1 Hash: B2E7F28B948E13A6BF6FA1BF1DB75377A27030F8 MD5 Hash: 0C72F1DD4205E0511A716F4883708C6B Imphash: 3B426D11B61F45B10C17C9F157E8E970 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 0000FF67 EntryPoint (rva): 14D0 SizeOfHeaders: 400 SizeOfImage: 13000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: D000 IAT: D248 Characteristics: 22E TimeDateStamp: 6A873CC1 Date: 20/08/2026 17:43:29 File Type: EXE Number Of Sections: 11 ASLR: Disabled Section Names (Optional Header): .text, .data, .rdata, .pdata, .xdata, .bss, .idata, .CRT, .tls, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000060 Code Initialized Data Executable Readable |
400 | 6E00 | 1000 | 6DE8 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
7200 | 200 | 8000 | E0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
7400 | E00 | 9000 | DF0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
8200 | 600 | A000 | 480 |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
8800 | 600 | B000 | 44C |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | C000 | BA0 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
8E00 | A00 | D000 | 8C4 |
|
|
| .CRT | 0xC0000040 Initialized Data Readable Writeable |
9800 | 200 | E000 | 68 |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
9A00 | 200 | F000 | 10 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
9C00 | 1200 | 10000 | 1178 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
AE00 | 200 | 12000 | 8C |
|
|
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 4,23 MB |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 8D0 Code -> 4883EC28488B0585830000C70001000000E8AAFCFFFF90904883C428C30F1F004883EC28488B0565830000C70000000000E8 Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X8385] |MOV DWORD PTR [RAX], 1 |CALL 0X140001190 |NOP |NOP |ADD RSP, 0X28 |RET |NOP DWORD PTR [RAX] |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X8365] |MOV DWORD PTR [RAX], 0 |
| Signatures |
| CheckSum Integrity Problem: • Header: 65383 • Calculated: 4559204 Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): linker: GNU linker ld (GNU Binutils)(2.38)[-] • Entropy: 7.99773 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| File Access |
| WindowsSecyrty.exe sherkey.exe SHELL32.dll msvcrt.dll KERNEL32.dll .dat |
| Interest's Words |
| exec start dism |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 100B8 | 10A8 | 9CB8 | 280000002000000040000000010020000000000000100000C30E0000C30E0000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \GROUP_ICON\IDI_ICON1\1033 | 11160 | 14 | AD60 | 0000010001002020000001002000A81000000100 | ...... .... ....... |
| Intelligent String |
| • @.bss • .CRT • .tls • C:\Windo$ • KERNEL32.dll • msvcrt.dll • SHELL32.dll • 8QRosr896>gepkb_ljouu}jlestyZqBdNDJXv\UGLPPkBel_t_~z • ljIh4f |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 668 | N/A | .text | CALL QWORD PTR [RIP+0xC04A] |
| 873 | N/A | .text | CALL QWORD PTR [RIP+0xBE0F] |
| 982 | N/A | .text | CALL QWORD PTR [RIP+0xBCF8] |
| A56 | N/A | .text | CALL QWORD PTR [RIP+0xBC34] |
| A5E | N/A | .text | CALL QWORD PTR [RIP+0xBC0C] |
| ABF | N/A | .text | CALL QWORD PTR [RIP+0xBB8B] |
| C34 | N/A | .text | CALL QWORD PTR [RIP+0xBA1E] |
| D80 | N/A | .text | JMP QWORD PTR [RIP+0xBAAA] |
| E61 | N/A | .text | JMP QWORD PTR [RIP+0xB8B9] |
| 1179 | N/A | .text | CALL QWORD PTR [RIP+0xB559] |
| 125E | N/A | .text | CALL QWORD PTR [RIP+0xB46C] |
| 126C | N/A | .text | CALL QWORD PTR [RIP+0xB406] |
| 1800 | N/A | .text | CALL QWORD PTR [RIP+0xAE62] |
| 1855 | N/A | .text | JMP QWORD PTR [RIP+0xAE4D] |
| 18A4 | N/A | .text | CALL QWORD PTR [RIP+0xADBE] |
| 18C3 | N/A | .text | CALL QWORD PTR [RIP+0xADDF] |
| 1907 | N/A | .text | CALL QWORD PTR [RIP+0xAD5B] |
| 194A | N/A | .text | CALL QWORD PTR [RIP+0xAD58] |
| 19C7 | N/A | .text | CALL QWORD PTR [RIP+0xACCB] |
| 1A2D | N/A | .text | CALL QWORD PTR [RIP+0xAC2D] |
| 5E27 | N/A | .text | JMP QWORD PTR [RIP+0x683B] |
| 5F3F | N/A | .text | CALL QWORD PTR [RIP+0x6763] |
| 600E | N/A | .text | JMP QWORD PTR [RIP+0x6694] |
| 62FE | N/A | .text | CALL QWORD PTR [RIP+0x63A4] |
| 638F | N/A | .text | CALL QWORD PTR [RIP+0x6313] |
| 69E0 | N/A | .text | JMP QWORD PTR [RIP+0x5E3A] |
| 69E8 | N/A | .text | JMP QWORD PTR [RIP+0x5E2A] |
| 69F0 | N/A | .text | JMP QWORD PTR [RIP+0x5E1A] |
| 69F8 | N/A | .text | JMP QWORD PTR [RIP+0x5E0A] |
| 6A00 | N/A | .text | JMP QWORD PTR [RIP+0x5DFA] |
| 6A08 | N/A | .text | JMP QWORD PTR [RIP+0x5DEA] |
| 6A10 | N/A | .text | JMP QWORD PTR [RIP+0x5DDA] |
| 6A18 | N/A | .text | JMP QWORD PTR [RIP+0x5DCA] |
| 6A20 | N/A | .text | JMP QWORD PTR [RIP+0x5DBA] |
| 6A28 | N/A | .text | JMP QWORD PTR [RIP+0x5DAA] |
| 6A30 | N/A | .text | JMP QWORD PTR [RIP+0x5D9A] |
| 6A38 | N/A | .text | JMP QWORD PTR [RIP+0x5D8A] |
| 6A40 | N/A | .text | JMP QWORD PTR [RIP+0x5D7A] |
| 6A48 | N/A | .text | JMP QWORD PTR [RIP+0x5D6A] |
| 6A50 | N/A | .text | JMP QWORD PTR [RIP+0x5D5A] |
| 6A58 | N/A | .text | JMP QWORD PTR [RIP+0x5D4A] |
| 6A60 | N/A | .text | JMP QWORD PTR [RIP+0x5D3A] |
| 6A68 | N/A | .text | JMP QWORD PTR [RIP+0x5D2A] |
| 6A70 | N/A | .text | JMP QWORD PTR [RIP+0x5D1A] |
| 6A78 | N/A | .text | JMP QWORD PTR [RIP+0x5D0A] |
| 6A80 | N/A | .text | JMP QWORD PTR [RIP+0x5CFA] |
| 6A88 | N/A | .text | JMP QWORD PTR [RIP+0x5CEA] |
| 6A90 | N/A | .text | JMP QWORD PTR [RIP+0x5CDA] |
| 6A98 | N/A | .text | JMP QWORD PTR [RIP+0x5CCA] |
| 6AA0 | N/A | .text | JMP QWORD PTR [RIP+0x5CB2] |
| 6AA8 | N/A | .text | JMP QWORD PTR [RIP+0x5C9A] |
| 6AB0 | N/A | .text | JMP QWORD PTR [RIP+0x5C8A] |
| 6AB8 | N/A | .text | JMP QWORD PTR [RIP+0x5C72] |
| 6AC0 | N/A | .text | JMP QWORD PTR [RIP+0x5C62] |
| 6AC8 | N/A | .text | JMP QWORD PTR [RIP+0x5C52] |
| 6AD0 | N/A | .text | JMP QWORD PTR [RIP+0x5C32] |
| 6AD8 | N/A | .text | JMP QWORD PTR [RIP+0x5C12] |
| 6B3A | N/A | .text | CALL QWORD PTR [RIP+0x5B60] |
| 6B7A | N/A | .text | CALL QWORD PTR [RIP+0x5B30] |
| 6C12 | N/A | .text | CALL QWORD PTR [RIP+0x5A98] |
| 6EA2 | N/A | .text | CALL QWORD PTR [RIP+0x5838] |
| 7090 | N/A | .text | JMP QWORD PTR [RIP+0x5682] |
| 7098 | N/A | .text | JMP QWORD PTR [RIP+0x5662] |
| 70A0 | N/A | .text | JMP QWORD PTR [RIP+0x5652] |
| 70B0 | N/A | .text | JMP QWORD PTR [RIP+0x562A] |
| 70B8 | N/A | .text | JMP QWORD PTR [RIP+0x561A] |
| 70C0 | N/A | .text | JMP QWORD PTR [RIP+0x560A] |
| 70C8 | N/A | .text | JMP QWORD PTR [RIP+0x55FA] |
| 70D0 | N/A | .text | JMP QWORD PTR [RIP+0x55EA] |
| 70D8 | N/A | .text | JMP QWORD PTR [RIP+0x55DA] |
| 70E0 | N/A | .text | JMP QWORD PTR [RIP+0x55CA] |
| 70E8 | N/A | .text | JMP QWORD PTR [RIP+0x55BA] |
| 70F0 | N/A | .text | JMP QWORD PTR [RIP+0x55AA] |
| 70F8 | N/A | .text | JMP QWORD PTR [RIP+0x559A] |
| 7100 | N/A | .text | JMP QWORD PTR [RIP+0x558A] |
| 7108 | N/A | .text | JMP QWORD PTR [RIP+0x557A] |
| 7110 | N/A | .text | JMP QWORD PTR [RIP+0x556A] |
| 7118 | N/A | .text | JMP QWORD PTR [RIP+0x555A] |
| 7120 | N/A | .text | JMP QWORD PTR [RIP+0x554A] |
| 7128 | N/A | .text | JMP QWORD PTR [RIP+0x553A] |
| 7130 | N/A | .text | JMP QWORD PTR [RIP+0x552A] |
| 7138 | N/A | .text | JMP QWORD PTR [RIP+0x551A] |
| 7140 | N/A | .text | JMP QWORD PTR [RIP+0x550A] |
| 7148 | N/A | .text | JMP QWORD PTR [RIP+0x54FA] |
| 1C270 | N/A | *padding* | CALL QWORD PTR [RIP+0x8778B4D0] |
| 2F170 | N/A | *padding* | CALL QWORD PTR [RIP+0x16867FF0] |
| 3F769 | N/A | *padding* | JMP QWORD PTR [RIP+0x621C0367] |
| 3F954 | N/A | *padding* | JMP QWORD PTR [RIP+0x2E569926] |
| 45BF8 | N/A | *padding* | JMP QWORD PTR [RIP+0x7477B265] |
| 46D49 | N/A | *padding* | CALL QWORD PTR [RIP+0x20251CB] |
| 4F998 | N/A | *padding* | CALL QWORD PTR [RIP+0x8213198E] |
| 66049 | N/A | *padding* | CALL QWORD PTR [RIP+0xC0DD40CB] |
| 67128 | N/A | *padding* | JMP QWORD PTR [RIP+0xF22EAB5D] |
| 782CE | N/A | *padding* | JMP QWORD PTR [RIP+0xD7155E5D] |
| 82FF0 | N/A | *padding* | JMP QWORD PTR [RIP+0xEAEBECBE] |
| 85071 | N/A | *padding* | JMP QWORD PTR [RIP+0x25DE7F75] |
| 852F3 | N/A | *padding* | JMP QWORD PTR [RIP+0x7878797B] |
| 874AA | N/A | *padding* | JMP QWORD PTR [RIP+0xF1E72D45] |
| 91798 | N/A | *padding* | JMP QWORD PTR [RIP+0x5AECECA0] |
| 9729E | N/A | *padding* | CALL QWORD PTR [RIP+0xA7652E26] |
| 805B1-805BE | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| BAA62-BAA6F | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 106D64-106D74 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 1751F1-175200 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 178A51-178A60 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 18D2EF-18D300 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 9 |
| 190FF0-191000 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 1933F3-193400 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 1A74F0-1A74FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1B1BEB-1B1BFF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 9 |
| 1B94F0-1B9502 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1C0BF0-1C0BFF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1C62F0-1C62FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1C90F0-1C90FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1CD4F0-1CD4FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1CD7F2-1CD7FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 1E23F0-1E23FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1EB9F3-1EBA00 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 1F14EF-1F1500 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 9 |
| 1F30F1-1F3102 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 9 |
| 1F39F1-1F3A02 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 9 |
| 1FF4F1-1FF500 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 1FFDEE-1FFDFF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 209FF0-20A000 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 21B7EC-21B800 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 9 |
| 220FF3-221000 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 224FF1-225000 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 2316F0-2316FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 2341F0-2341FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 24E9EF-24E9FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 24F1F3-24F200 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 2701F0-2701FF | N/A | *padding* | Potential obfuscated jump sequence detected, count: 8 |
| 2705F3-270600 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 2718F0-2718FD | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| 9840 | 140001AB0 | .CRT | TLS Callback | Pointer to 1AB0 - 0xEB0 .text |
| 9848 | 140001A80 | .CRT | TLS Callback | Pointer to 1A80 - 0xE80 .text |
| 8200 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .xdata |
| 820C | 140001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x410 .text + UnwindInfo: .xdata |
| 8218 | 140001140 | .pdata | ExceptionHook | Pointer to 1140 - 0x540 .text + UnwindInfo: .xdata |
| 8224 | 140001190 | .pdata | ExceptionHook | Pointer to 1190 - 0x590 .text + UnwindInfo: .xdata |
| 8230 | 1400014D0 | .pdata | ExceptionHook | Pointer to 14D0 - 0x8D0 .text + UnwindInfo: .xdata |
| 823C | 1400014F0 | .pdata | ExceptionHook | Pointer to 14F0 - 0x8F0 .text + UnwindInfo: .xdata |
| 8248 | 140001510 | .pdata | ExceptionHook | Pointer to 1510 - 0x910 .text + UnwindInfo: .xdata |
| 8254 | 140001530 | .pdata | ExceptionHook | Pointer to 1530 - 0x930 .text + UnwindInfo: .xdata |
| 8260 | 140001540 | .pdata | ExceptionHook | Pointer to 1540 - 0x940 .text + UnwindInfo: .xdata |
| 826C | 140001550 | .pdata | ExceptionHook | Pointer to 1550 - 0x950 .text + UnwindInfo: .xdata |
| 8278 | 140001990 | .pdata | ExceptionHook | Pointer to 1990 - 0xD90 .text + UnwindInfo: .xdata |
| 8284 | 1400019D0 | .pdata | ExceptionHook | Pointer to 19D0 - 0xDD0 .text + UnwindInfo: .xdata |
| 8290 | 140001A40 | .pdata | ExceptionHook | Pointer to 1A40 - 0xE40 .text + UnwindInfo: .xdata |
| 829C | 140001A60 | .pdata | ExceptionHook | Pointer to 1A60 - 0xE60 .text + UnwindInfo: .xdata |
| 82A8 | 140001A70 | .pdata | ExceptionHook | Pointer to 1A70 - 0xE70 .text + UnwindInfo: .xdata |
| 82B4 | 140001A80 | .pdata | ExceptionHook | Pointer to 1A80 - 0xE80 .text + UnwindInfo: .xdata |
| 82C0 | 140001AB0 | .pdata | ExceptionHook | Pointer to 1AB0 - 0xEB0 .text + UnwindInfo: .xdata |
| 82CC | 140001B40 | .pdata | ExceptionHook | Pointer to 1B40 - 0xF40 .text + UnwindInfo: .xdata |
| 82D8 | 140001B50 | .pdata | ExceptionHook | Pointer to 1B50 - 0xF50 .text + UnwindInfo: .xdata |
| 82E4 | 140001C50 | .pdata | ExceptionHook | Pointer to 1C50 - 0x1050 .text + UnwindInfo: .xdata |
| 82F0 | 140001C60 | .pdata | ExceptionHook | Pointer to 1C60 - 0x1060 .text + UnwindInfo: .xdata |
| 82FC | 140001CD0 | .pdata | ExceptionHook | Pointer to 1CD0 - 0x10D0 .text + UnwindInfo: .xdata |
| 8308 | 140001EF0 | .pdata | ExceptionHook | Pointer to 1EF0 - 0x12F0 .text + UnwindInfo: .xdata |
| 8314 | 1400021E0 | .pdata | ExceptionHook | Pointer to 21E0 - 0x15E0 .text + UnwindInfo: .xdata |
| 8320 | 140002230 | .pdata | ExceptionHook | Pointer to 2230 - 0x1630 .text + UnwindInfo: .xdata |
| 832C | 140002240 | .pdata | ExceptionHook | Pointer to 2240 - 0x1640 .text + UnwindInfo: .xdata |
| 8338 | 1400023F0 | .pdata | ExceptionHook | Pointer to 23F0 - 0x17F0 .text + UnwindInfo: .xdata |
| 8344 | 140002460 | .pdata | ExceptionHook | Pointer to 2460 - 0x1860 .text + UnwindInfo: .xdata |
| 8350 | 1400024E0 | .pdata | ExceptionHook | Pointer to 24E0 - 0x18E0 .text + UnwindInfo: .xdata |
| 835C | 140002570 | .pdata | ExceptionHook | Pointer to 2570 - 0x1970 .text + UnwindInfo: .xdata |
| 8368 | 140002650 | .pdata | ExceptionHook | Pointer to 2650 - 0x1A50 .text + UnwindInfo: .xdata |
| 8374 | 140002670 | .pdata | ExceptionHook | Pointer to 2670 - 0x1A70 .text + UnwindInfo: .xdata |
| 8380 | 140002690 | .pdata | ExceptionHook | Pointer to 2690 - 0x1A90 .text + UnwindInfo: .xdata |
| 838C | 1400026E0 | .pdata | ExceptionHook | Pointer to 26E0 - 0x1AE0 .text + UnwindInfo: .xdata |
| 8398 | 140002780 | .pdata | ExceptionHook | Pointer to 2780 - 0x1B80 .text + UnwindInfo: .xdata |
| 83A4 | 140002810 | .pdata | ExceptionHook | Pointer to 2810 - 0x1C10 .text + UnwindInfo: .xdata |
| 83B0 | 140002840 | .pdata | ExceptionHook | Pointer to 2840 - 0x1C40 .text + UnwindInfo: .xdata |
| 83BC | 1400028B0 | .pdata | ExceptionHook | Pointer to 28B0 - 0x1CB0 .text + UnwindInfo: .xdata |
| 83C8 | 1400028E0 | .pdata | ExceptionHook | Pointer to 28E0 - 0x1CE0 .text + UnwindInfo: .xdata |
| 83D4 | 140002970 | .pdata | ExceptionHook | Pointer to 2970 - 0x1D70 .text + UnwindInfo: .xdata |
| 83E0 | 140002A70 | .pdata | ExceptionHook | Pointer to 2A70 - 0x1E70 .text + UnwindInfo: .xdata |
| 83EC | 140002AD0 | .pdata | ExceptionHook | Pointer to 2AD0 - 0x1ED0 .text + UnwindInfo: .xdata |
| 83F8 | 140002BE0 | .pdata | ExceptionHook | Pointer to 2BE0 - 0x1FE0 .text + UnwindInfo: .xdata |
| 8404 | 140002C40 | .pdata | ExceptionHook | Pointer to 2C40 - 0x2040 .text + UnwindInfo: .xdata |
| 8410 | 140002D70 | .pdata | ExceptionHook | Pointer to 2D70 - 0x2170 .text + UnwindInfo: .xdata |
| 841C | 140002E60 | .pdata | ExceptionHook | Pointer to 2E60 - 0x2260 .text + UnwindInfo: .xdata |
| 8428 | 140002EB0 | .pdata | ExceptionHook | Pointer to 2EB0 - 0x22B0 .text + UnwindInfo: .xdata |
| 8434 | 140002F60 | .pdata | ExceptionHook | Pointer to 2F60 - 0x2360 .text + UnwindInfo: .xdata |
| 8440 | 140003070 | .pdata | ExceptionHook | Pointer to 3070 - 0x2470 .text + UnwindInfo: .xdata |
| 844C | 140003430 | .pdata | ExceptionHook | Pointer to 3430 - 0x2830 .text + UnwindInfo: .xdata |
| 8458 | 140003500 | .pdata | ExceptionHook | Pointer to 3500 - 0x2900 .text + UnwindInfo: .xdata |
| 8464 | 140003870 | .pdata | ExceptionHook | Pointer to 3870 - 0x2C70 .text + UnwindInfo: .xdata |
| 8470 | 140003960 | .pdata | ExceptionHook | Pointer to 3960 - 0x2D60 .text + UnwindInfo: .xdata |
| 847C | 140003A10 | .pdata | ExceptionHook | Pointer to 3A10 - 0x2E10 .text + UnwindInfo: .xdata |
| 8488 | 140003B80 | .pdata | ExceptionHook | Pointer to 3B80 - 0x2F80 .text + UnwindInfo: .xdata |
| 8494 | 140004020 | .pdata | ExceptionHook | Pointer to 4020 - 0x3420 .text + UnwindInfo: .xdata |
| 84A0 | 1400045A0 | .pdata | ExceptionHook | Pointer to 45A0 - 0x39A0 .text + UnwindInfo: .xdata |
| 84AC | 140004EF0 | .pdata | ExceptionHook | Pointer to 4EF0 - 0x42F0 .text + UnwindInfo: .xdata |
| 84B8 | 140004F30 | .pdata | ExceptionHook | Pointer to 4F30 - 0x4330 .text + UnwindInfo: .xdata |
| 84C4 | 140004FC0 | .pdata | ExceptionHook | Pointer to 4FC0 - 0x43C0 .text + UnwindInfo: .xdata |
| 84D0 | 140004FE0 | .pdata | ExceptionHook | Pointer to 4FE0 - 0x43E0 .text + UnwindInfo: .xdata |
| 84DC | 140005150 | .pdata | ExceptionHook | Pointer to 5150 - 0x4550 .text + UnwindInfo: .xdata |
| 84E8 | 140006830 | .pdata | ExceptionHook | Pointer to 6830 - 0x5C30 .text + UnwindInfo: .xdata |
| 84F4 | 140006930 | .pdata | ExceptionHook | Pointer to 6930 - 0x5D30 .text + UnwindInfo: .xdata |
| 8500 | 140006980 | .pdata | ExceptionHook | Pointer to 6980 - 0x5D80 .text + UnwindInfo: .xdata |
| 850C | 140006A60 | .pdata | ExceptionHook | Pointer to 6A60 - 0x5E60 .text + UnwindInfo: .xdata |
| 8518 | 140006AB0 | .pdata | ExceptionHook | Pointer to 6AB0 - 0x5EB0 .text + UnwindInfo: .xdata |
| 8524 | 140006BB0 | .pdata | ExceptionHook | Pointer to 6BB0 - 0x5FB0 .text + UnwindInfo: .xdata |
| 8530 | 140006C20 | .pdata | ExceptionHook | Pointer to 6C20 - 0x6020 .text + UnwindInfo: .xdata |
| 853C | 140006CD0 | .pdata | ExceptionHook | Pointer to 6CD0 - 0x60D0 .text + UnwindInfo: .xdata |
| 8548 | 140006D00 | .pdata | ExceptionHook | Pointer to 6D00 - 0x6100 .text + UnwindInfo: .xdata |
| 8554 | 140006E50 | .pdata | ExceptionHook | Pointer to 6E50 - 0x6250 .text + UnwindInfo: .xdata |
| 8560 | 140006FE0 | .pdata | ExceptionHook | Pointer to 6FE0 - 0x63E0 .text + UnwindInfo: .xdata |
| 856C | 140007110 | .pdata | ExceptionHook | Pointer to 7110 - 0x6510 .text + UnwindInfo: .xdata |
| 8578 | 140007160 | .pdata | ExceptionHook | Pointer to 7160 - 0x6560 .text + UnwindInfo: .xdata |
| 8584 | 140007330 | .pdata | ExceptionHook | Pointer to 7330 - 0x6730 .text + UnwindInfo: .xdata |
| 8590 | 140007450 | .pdata | ExceptionHook | Pointer to 7450 - 0x6850 .text + UnwindInfo: .xdata |
| 859C | 140007550 | .pdata | ExceptionHook | Pointer to 7550 - 0x6950 .text + UnwindInfo: .xdata |
| 85A8 | 140007580 | .pdata | ExceptionHook | Pointer to 7580 - 0x6980 .text + UnwindInfo: .xdata |
| 85B4 | 1400075B0 | .pdata | ExceptionHook | Pointer to 75B0 - 0x69B0 .text + UnwindInfo: .xdata |
| 85C0 | 1400076E0 | .pdata | ExceptionHook | Pointer to 76E0 - 0x6AE0 .text + UnwindInfo: .xdata |
| 85CC | 140007860 | .pdata | ExceptionHook | Pointer to 7860 - 0x6C60 .text + UnwindInfo: .xdata |
| 85D8 | 1400078D0 | .pdata | ExceptionHook | Pointer to 78D0 - 0x6CD0 .text + UnwindInfo: .xdata |
| 85E4 | 1400079E0 | .pdata | ExceptionHook | Pointer to 79E0 - 0x6DE0 .text + UnwindInfo: .xdata |
| 85F0 | 140007A40 | .pdata | ExceptionHook | Pointer to 7A40 - 0x6E40 .text + UnwindInfo: .xdata |
| 85FC | 140007AD0 | .pdata | ExceptionHook | Pointer to 7AD0 - 0x6ED0 .text + UnwindInfo: .xdata |
| 8608 | 140007B20 | .pdata | ExceptionHook | Pointer to 7B20 - 0x6F20 .text + UnwindInfo: .xdata |
| 8614 | 140007C20 | .pdata | ExceptionHook | Pointer to 7C20 - 0x7020 .text + UnwindInfo: .xdata |
| 8620 | 140007C40 | .pdata | ExceptionHook | Pointer to 7C40 - 0x7040 .text + UnwindInfo: .xdata |
| 862C | 140007C50 | .pdata | ExceptionHook | Pointer to 7C50 - 0x7050 .text + UnwindInfo: .xdata |
| 8638 | 140007C60 | .pdata | ExceptionHook | Pointer to 7C60 - 0x7060 .text + UnwindInfo: .xdata |
| 8644 | 140007C70 | .pdata | ExceptionHook | Pointer to 7C70 - 0x7070 .text + UnwindInfo: .xdata |
| 8650 | 140007C80 | .pdata | ExceptionHook | Pointer to 7C80 - 0x7080 .text + UnwindInfo: .xdata |
| 865C | 140007D50 | .pdata | ExceptionHook | Pointer to 7D50 - 0x7150 .text + UnwindInfo: .xdata |
| 8668 | 140007D70 | .pdata | ExceptionHook | Pointer to 7D70 - 0x7170 .text + UnwindInfo: .xdata |
| 8674 | 140007DB0 | .pdata | ExceptionHook | Pointer to 7DB0 - 0x71B0 .text + UnwindInfo: .xdata |
| B000 | N/A | *Overlay* | C2D41D8C888A8988838685847C7D8180279E9D9C | ............|}..’... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 3097894 | 68,5766% |
| Null Byte Code | 32975 | 0,73% |
| NOP Cave Found | 0x9090909090 | Block Count: 40 | Total: 0,0022% |
© 2026 All rights reserved.