PREMIUM PESCAN.IO - Analysis Report

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 196,50 KB
SHA-256 Hash: 36AF3ACC78058023CDCF9307BC15BE640BE9425DE97E574FDAF42D03D308725B
SHA-1 Hash: 9F05045F5447D79C8C0D0F5CB589FD85C89620D3
MD5 Hash: 0DE14E58CC4DE3F62C2F01CB48C5826C
Imphash: 0CE7BBCB8E41ACA230F8E4F3E064A14F
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 0003883F
EntryPoint (rva): 13D0
SizeOfHeaders: 400
SizeOfImage: 39000
ImageBase: 0000000140000000
Architecture: x64
ImportTable: 34000
IAT: 34410
Characteristics: 22E
TimeDateStamp: 6AA837AF
Date: 14/09/2026 18:06:39
File Type: EXE
Number Of Sections: 11
ASLR: Disabled
Section Names (Optional Header): .text, .data, .stgcfg, .rdata, .pdata, .xdata, .bss, .idata, .CRT, .tls, .reloc
Number Of Executable Sections: 1
Subsystem: Windows GUI
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000060
Code
Initialized Data
Executable
Readable
 400 1E400 1000 1E3B8
6.2821
1017973.18
.data
0xC0000040
Initialized Data
Readable
Writeable
 1E800 2000 20000 1EC0
0.5674
1855102.56
.stgcfg
0xC0000040
Initialized Data
Readable
Writeable
 20800 C00 22000 A20
7.1104
27417
.rdata
0x40000040
Initialized Data
Readable
 21400 DA00 23000 D920
5.9813
660206.77
.pdata
0x40000040
Initialized Data
Readable
 2EE00 400 31000 288
2.9717
106563.5
.xdata
0x40000040
Initialized Data
Readable
 2F200 200 32000 1F0
3.5925
21715
.bss
0xC0000080
Uninitialized Data
Readable
Writeable
 0 0 33000 150
N/A
N/A
.idata
0xC0000040
Initialized Data
Readable
Writeable
 2F400 1200 34000 1040
4.1408
241511.22
.CRT
0xC0000040
Initialized Data
Readable
Writeable
 30600 200 36000 60
0.2866
122518
.tls
0xC0000040
Initialized Data
Readable
Writeable
 30800 200 37000 10
0
130560
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 30A00 800 38000 6C0
4.9925
28409
Entry Point
The section number (1) have the Entry Point
Information -> EntryPoint (calculated) - 7D0
Code -> 4883EC28488B05D5760200C70001000000E89AFDFFFF90904883C428C30F1F004883EC28488B05B5760200C70000000000E8
Assembler
|SUB RSP, 0X28
|MOV RAX, QWORD PTR [RIP + 0X276D5]
|MOV DWORD PTR [RAX], 1
|CALL 0X140001180
|NOP
|NOP
|ADD RSP, 0X28
|RET
|NOP DWORD PTR [RAX]
|SUB RSP, 0X28
|MOV RAX, QWORD PTR [RIP + 0X276B5]
|MOV DWORD PTR [RAX], 0
Signatures
CheckSum Integrity Problem:
• Header: 231487
• Calculated: 260856
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Detect It Easy (die)
• PE+(64): linker: GNU linker ld (GNU Binutils)(2.39)[-]
• Entropy: 6.35309
Suspicious Functions
Library Function Description
KERNEL32.DLL VirtualAlloc Reserve, commit, or both, a region of memory within the virtual address space of a process.
KERNEL32.DLL CreateRemoteThread Creates a thread in the address space of another process.
KERNEL32.DLL WriteProcessMemory Writes data to an area of memory in a specified process.
KERNEL32.DLL CreateFileA Creates or opens a file or I/O device.
KERNEL32.DLL DeleteFileA Deletes an existing file.
KERNEL32.DLL GetTempPathA Retrieves the temporary directory path.
KERNEL32.DLL ReadFile Reads data from a file.
KERNEL32.DLL FindFirstFileA Starts file and directory enumeration.
KERNEL32.DLL FindNextFileA Continues file and directory enumeration.
KERNEL32.DLL FindClose Closes a file search handle.
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL UnmapViewOfFile Unmaps a mapped file view.
KERNEL32.DLL VirtualProtect Changes memory protection attributes.
KERNEL32.DLL CreateProcessA Creates and starts a new process.
KERNEL32.DLL OpenProcess Opens an existing process.
KERNEL32.DLL VirtualAllocEx Allocates memory within the virtual address space of another process.
KERNEL32.DLL VirtualProtectEx Changes the protection on a region of memory in another process.
Windows REG
Software\Opera GX Stable
Software\Opera Stable
Software\Brave-Browser\User Data
Software\Browser\User Data
Software\Brave-Browser-Nightly\User Data
Software\Brave-Browser-Beta\User Data
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\VMware, Inc.\VMware Tools
SOFTWARE\Oracle\VirtualBox Guest Additions
SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
Software\Opera Neon\User Data
Software\Valve\Steam
Software\Valve\Steam\Users
Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Terminal Server Client\Servers
Software\Martin Prikryl\WinSCP 2\Sessions
Software\Roblox\RobloxStudioBrowser\roblox.com
Software\Roblox\RobloxPlayerBrowser\roblox.com
SYSTEM\CurrentControlSet\Services\VBoxGuest
SYSTEM\CurrentControlSet\Services\vmci
Rebuilt string - SOFTWARE\Policies\Microsoft\Windows\System
File Access
.exe
steam.exe
steamwebhelper.exe
zen.exe
floorp.exe
thunderbird.exe
seamonkey.exe
basilisk.exe
palemoon.exe
librewolf.exe
waterfox.exe
firefox.exe
supermium.exe
thorium.exe
arc.exe
comodo.exe
sidekick.exe
kinza.exe
ccleaner.exe
avgbrowser.exe
avastbrowser.exe
maxthon.exe
whale.exe
qqbrowser.exe
orbitum.exe
atom.exe
sputnik.exe
amigo.exe
7star.exe
chromium.exe
iron.exe
urbrowser.exe
slimjet.exe
torch.exe
iridium.exe
epic.exe
dragon.exe
coccoc.exe
centbrowser.exe
360browser.exe
360chrome.exe
yandex.exe
browser.exe
vivaldi.exe
opera.exe
brave.exe
msedge.exe
chrome.exe
xagt.exe
cyserver.exe
eectrl.exe
sentinelagent.exe
csfalconservice.exe
360tray.exe
sfc.exe
psuaservice.exe
fsav32.exe
fmon.exe
fortitray.exe
cis.exe
cmdagent.exe
hmpalert.exe
savservice.exe
sophosui.exe
mcuicnt.exe
mfemms.exe
mcshield.exe
pccntmon.exe
coreserviceshell.exe
avastui.exe
avastsvc.exe
ns.exe
ccsvchst.exe
navapsvc.exe
msseces.exe
mpcmdrun.exe
msmpeng.exe
mbamservice.exe
mbam.exe
ekrn.exe
egui.exe
dwservice.exe
dwengine.exe
bdservicehost.exe
bdagent.exe
avgnt.exe
avguard.exe
avgsvc.exe
avgui.exe
avpui.exe
avp.exe
\Windows\System32\calc.exe
\Windows\System32\cmd.exe
\Windows\notepad.exe
\Windows\explorer.exe
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
KERNEL32.dll
%s\nss3.dll
advapi32.dll
.dll
.msi
.sys
Games/Ubisoft/users.dat
%s\Ubisoft Game Launcher\users.dat
%s\Roblox\LocalStorage\RobloxCookies.dat
FTP/FlashFXP/Sites.dat
%s\FlashFXP\Sites.dat
wallet.dat
.dat
.log
AISessions/Gemini/Tokens.txt
AISessions/Copilot/Tokens.txt
AISessions/ChatGPT/Cookies.txt
AISessions/%s/Cookies.txt
AISessions/WindsurfNext/Tokens.txt
AISessions/Windsurf/Tokens.txt
AISessions/CursorInsiders/Tokens.txt
AISessions/Cursor/Tokens.txt
Messengers/DiscordForks/Tokens.txt
Mails/Thunderbird/passwords.txt
Games/Roblox/cookies.txt
FTP/WinSCP/Sessions.txt
FTP/FileZilla/Servers.txt
RDP/Connections.txt
Mails/Outlook/Profiles.txt
Clipboard.txt
Games/Steam/Tokens.txt
Messengers/Discord/Tokens.txt
Browser/Cookies/%s_Cookies.txt
UserInformation.txt
UserAgent.txt
InstalledSoftware.txt
Environment.txt
ProcessList.txt
Passwords.txt
Browser/History.txt
Browser/GoogleTokens.txt
Browser/Autofill.txt
Browser/CreditCards.txt
Browser/Passwords.txt
.ini
\system.ini
.pdf
prefs.js
.zip
.rar
.7z
Temp
WinDir
ProgramFiles
AppData
UserProfile
Interest's Words
Virus
BitCoin
outlook
smtp
taskkill
Encrypt
Decrypt
PassWord
taskkill
attrib
start
hostname
shutdown
sfc.exe
URLs

AV Services
guard.exe - (AVG Anti-Spyware)
navapsvc.exe - (Norton AntiVirus)
avp.exe - (Kaspersky AntiVirus)
ekrn.exe - (ESET)
egui.exe - (ESET)
avgnt.exe - (Avira)
msmpeng.exe - (Defender)
avastsvc.exe - (Avast)
mbamservice.exe - (Malwarebytes)
360tray.exe
sentinelagent.exe
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Antivirus Software (comodo)
Text Ascii Antivirus Software (avast)
Text Ascii Antivirus Software (sophos)
Text Ascii Antivirus Software (defender)
Text Ascii Antivirus Software (Dr.Web)
Text Ascii Antivirus Software (Kaspersky)
Text Ascii Antivirus Software (McAfee AV)
Text Ascii Antivirus Software (Panda Antivirus/Firewall)
Text Ascii Antivirus Software (Norton)
Text Ascii Antivirus Software (F-Secure AV)
Entry Point Hex Pattern Microsoft Visual C++ 8.0 (DLL)
Intelligent String
• @.bss
• .CRT
• .tls
• C:\Global\%08lx
• https://http://getaddrinfofreeaddrinfo
• Nhttpshttp%s/chunkX-Chunk: %sX-Chunk-Index: %uX-Total: %u%s://%s:%u%s/completeCOMPLETE
• Bootstrap\\.\pipe\akg_%lx_%lx"%s" --no-startup-window --headlessSTATUS:DONEERROR:KEY:%02xSTATUS:NO_ABE
• C:\HWID: %08X-%s
• InstalledSoftware.txtLOCALAPPDATAProgramFilesMozilla/5.0 (Windows NT %lu.%lu; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36UserAgent.txtUserInformation.txt
• %sakg_%lx_%lx.tmp%s\Login Datalogins%s\Login Data For Account%s\Network\Cookies%s\Cookiescookies%s\Web Datalocal_stored_cvccredit_cardsautofilltoken_service%s\Historyurls%s\DefaultDefault%s\Profile *%s\%schrome://edge://brave://about:chrome-ext%02d.%02d.%d, %02d:%02d:%02dUrl: %.*s
• Messengers/Discord/Tokens.txtdiscorddiscordptbdiscordcanaryLightcorddiscorddevelopment%s\*%s\%s%s/%s.jpg.png.mp4.webp.ogg.mp3.gif.tgsAPPDATALOCALAPPDATA%s\Telegram Desktop\tdataMessengers/Telegram/tdata%s\Kotatogram Desktop\tdataMessengers/Telegram/Kotatogram%s\64Gram Desktop\tdataMessengers/Telegram/64Gram%s\Unigram\tdataMessengers/Telegram/Unigram%s\AyuGram Desktop\tdataMessengers/Telegram/AyuGram%s\Extragram Desktop\tdataMessengers/Telegram/Extragram%s\Nekogram Desktop\tdataMessengers/Telegram/Nekogram%s\iMe Desktop\tdataMessengers/Telegram/iMeemojitemptdummydumpswebviewGPUCacheCode Cacheworkingmedia_cachecacheuser_datastickersavatarslangpackshortcutstdata_oldloglogscrash_reportstdata_tempimagesdocumentsmusicuser_data2user_data3user_data4
• %s\config\loginusers.vdfAccount: %.*s (SteamID64: %.*s)
• steamwebhelper.exesteam.exe
• CreateStreamOnHGlobalGetHGlobalFromStreamScreenshot.jpg
• Clipboard.txt
• RDP/Connections.txt
• C:\\wscmsddfscrswsm
• KERNEL32.dll
• api-ms-win-crt-environment-l1-1-0.dll
• api-ms-win-crt-heap-l1-1-0.dll
• api-ms-win-crt-math-l1-1-0.dll
• api-ms-win-crt-private-l1-1-0.dll
• api-ms-win-crt-runtime-l1-1-0.dll
• api-ms-win-crt-string-l1-1-0.dll
• api-ms-win-crt-time-l1-1-0.dll
Flow Anomalies
Offset FlowVA Section Description
62F N/A .text CALL QWORD PTR [RIP+0x332D3]
930 N/A .text JMP QWORD PTR [RIP+0x3305A]
D1B N/A .text CALL QWORD PTR [RIP+0x32C47]
D7E N/A .text CALL QWORD PTR [RIP+0x32BD4]
D88 N/A .text CALL QWORD PTR [RIP+0x32B12]
1344 N/A .text CALL QWORD PTR [RIP+0x3250E]
139A N/A .text JMP QWORD PTR [RIP+0x32540]
13E7 N/A .text CALL QWORD PTR [RIP+0x3246B]
1402 N/A .text CALL QWORD PTR [RIP+0x324D8]
143A N/A .text CALL QWORD PTR [RIP+0x32418]
1476 N/A .text CALL QWORD PTR [RIP+0x32464]
1555 N/A .text CALL QWORD PTR [RIP+0x322ED]
1587 N/A .text CALL QWORD PTR [RIP+0x3234B]
1D40 N/A .text JMP QWORD PTR [RIP+0x31DEA]
1D48 N/A .text JMP QWORD PTR [RIP+0x31DEA]
1D50 N/A .text JMP QWORD PTR [RIP+0x31DEA]
1D58 N/A .text JMP QWORD PTR [RIP+0x31DA2]
1D60 N/A .text JMP QWORD PTR [RIP+0x31DA2]
1D68 N/A .text JMP QWORD PTR [RIP+0x31DA2]
1D70 N/A .text JMP QWORD PTR [RIP+0x31DA2]
1D78 N/A .text JMP QWORD PTR [RIP+0x31DA2]
1D80 N/A .text JMP QWORD PTR [RIP+0x31D32]
1D88 N/A .text JMP QWORD PTR [RIP+0x31D32]
1D90 N/A .text JMP QWORD PTR [RIP+0x31D32]
1D98 N/A .text JMP QWORD PTR [RIP+0x31D32]
1DA0 N/A .text JMP QWORD PTR [RIP+0x31D32]
1DA8 N/A .text JMP QWORD PTR [RIP+0x31D32]
1DB0 N/A .text JMP QWORD PTR [RIP+0x31D32]
1DB8 N/A .text JMP QWORD PTR [RIP+0x31D32]
1DC0 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DC8 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DD0 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DD8 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DE0 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DE8 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DF0 N/A .text JMP QWORD PTR [RIP+0x31C62]
1DF8 N/A .text JMP QWORD PTR [RIP+0x31C62]
1E00 N/A .text JMP QWORD PTR [RIP+0x31C6A]
1E08 N/A .text JMP QWORD PTR [RIP+0x31C6A]
1E10 N/A .text JMP QWORD PTR [RIP+0x31C6A]
1E18 N/A .text JMP QWORD PTR [RIP+0x31C6A]
1E20 N/A .text JMP QWORD PTR [RIP+0x31C6A]
1E28 N/A .text JMP QWORD PTR [RIP+0x31C6A]
1E30 N/A .text JMP QWORD PTR [RIP+0x31C72]
1E38 N/A .text JMP QWORD PTR [RIP+0x31BBA]
1E40 N/A .text JMP QWORD PTR [RIP+0x31BBA]
1E48 N/A .text JMP QWORD PTR [RIP+0x31BBA]
1E50 N/A .text JMP QWORD PTR [RIP+0x31BBA]
1E58 N/A .text JMP QWORD PTR [RIP+0x31BBA]
1E60 N/A .text JMP QWORD PTR [RIP+0x31B82]
1E68 N/A .text JMP QWORD PTR [RIP+0x31B4A]
1E70 N/A .text JMP QWORD PTR [RIP+0x31B4A]
1E78 N/A .text JMP QWORD PTR [RIP+0x31B4A]
1E80 N/A .text JMP QWORD PTR [RIP+0x31B4A]
1E88 N/A .text JMP QWORD PTR [RIP+0x31B4A]
1E90 N/A .text JMP QWORD PTR [RIP+0x31B0A]
1E98 N/A .text JMP QWORD PTR [RIP+0x31B0A]
2208 N/A .text CALL QWORD PTR [RIP+0x3172A]
2310 N/A .text CALL QWORD PTR [RIP+0x31632]
2799 N/A .text CALL QWORD PTR [RIP+0x311D9]
27AB N/A .text CALL QWORD PTR [RIP+0x3116F]
27B4 N/A .text CALL QWORD PTR [RIP+0x31056]
27BF N/A .text CALL QWORD PTR [RIP+0x3104B]
2904 N/A .text CALL QWORD PTR [RIP+0x30F16]
291E N/A .text CALL QWORD PTR [RIP+0x30F74]
299B N/A .text CALL QWORD PTR [RIP+0x30F5F]
29CF N/A .text CALL QWORD PTR [RIP+0x30F73]
2A1B N/A .text CALL QWORD PTR [RIP+0x30F27]
2D20 N/A .text CALL QWORD PTR [RIP+0x30C12]
2F85 N/A .text CALL QWORD PTR [RIP+0x30935]
2F95 N/A .text CALL QWORD PTR [RIP+0x308E5]
2FED N/A .text CALL QWORD PTR [RIP+0x30835]
3008 N/A .text CALL QWORD PTR [RIP+0x3093A]
30AB N/A .text CALL QWORD PTR [RIP+0x3077F]
30BA N/A .text CALL QWORD PTR [RIP+0x30750]
3143 N/A .text CALL QWORD PTR [RIP+0x307F7]
319B N/A .text CALL QWORD PTR [RIP+0x307E7]
31F7 N/A .text CALL QWORD PTR [RIP+0x3078B]
32CC N/A .text CALL QWORD PTR [RIP+0x306B6]
330B N/A .text CALL QWORD PTR [RIP+0x3064F]
33AE N/A .text CALL QWORD PTR [RIP+0x30484]
33DA N/A .text CALL QWORD PTR [RIP+0x30460]
33EB N/A .text CALL QWORD PTR [RIP+0x30587]
3403 N/A .text CALL QWORD PTR [RIP+0x30517]
3479 N/A .text CALL QWORD PTR [RIP+0x30479]
348E N/A .text CALL QWORD PTR [RIP+0x3047C]
34CA N/A .text CALL QWORD PTR [RIP+0x30430]
3584 N/A .text CALL QWORD PTR [RIP+0x303AE]
362F N/A .text CALL QWORD PTR [RIP+0x301DB]
3655 N/A .text CALL QWORD PTR [RIP+0x302F5]
36B4 N/A .text CALL QWORD PTR [RIP+0x3025E]
36FA N/A .text CALL QWORD PTR [RIP+0x30248]
3DF1 N/A .text CALL QWORD PTR [RIP+0x2FA19]
43D1 N/A .text CALL QWORD PTR [RIP+0x2F439]
43EF N/A .text CALL QWORD PTR [RIP+0x2F41B]
443B N/A .text CALL QWORD PTR [RIP+0x2F4F7]
44E8 N/A .text CALL QWORD PTR [RIP+0x2F45A]
44FB N/A .text CALL QWORD PTR [RIP+0x2F447]
4678 N/A .text CALL QWORD PTR [RIP+0x2F2BA]
47B0 N/A .text CALL QWORD PTR [RIP+0x2F182]
30638 140001650 .CRT TLS Callback | Pointer to 1650 - 0xA50 .text
30640 140001620 .CRT TLS Callback | Pointer to 1620 - 0xA20 .text
2EE00 140001000 .pdata ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .xdata
2EE0C 140001010 .pdata ExceptionHook | Pointer to 1010 - 0x410 .text + UnwindInfo: .xdata
2EE18 140001130 .pdata ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .xdata
2EE24 140001180 .pdata ExceptionHook | Pointer to 1180 - 0x580 .text + UnwindInfo: .xdata
2EE30 1400013D0 .pdata ExceptionHook | Pointer to 13D0 - 0x7D0 .text + UnwindInfo: .xdata
2EE3C 1400013F0 .pdata ExceptionHook | Pointer to 13F0 - 0x7F0 .text + UnwindInfo: .xdata
2EE48 140001410 .pdata ExceptionHook | Pointer to 1410 - 0x810 .text + UnwindInfo: .xdata
2EE54 140001430 .pdata ExceptionHook | Pointer to 1430 - 0x830 .text + UnwindInfo: .xdata
2EE60 140001440 .pdata ExceptionHook | Pointer to 1440 - 0x840 .text + UnwindInfo: .xdata
2EE6C 140001540 .pdata ExceptionHook | Pointer to 1540 - 0x940 .text + UnwindInfo: .xdata
2EE78 140001580 .pdata ExceptionHook | Pointer to 1580 - 0x980 .text + UnwindInfo: .xdata
2EE84 1400015F0 .pdata ExceptionHook | Pointer to 15F0 - 0x9F0 .text + UnwindInfo: .xdata
2EE90 140001610 .pdata ExceptionHook | Pointer to 1610 - 0xA10 .text + UnwindInfo: .xdata
2EE9C 140001620 .pdata ExceptionHook | Pointer to 1620 - 0xA20 .text + UnwindInfo: .xdata
2EEA8 140001650 .pdata ExceptionHook | Pointer to 1650 - 0xA50 .text + UnwindInfo: .xdata
2EEB4 1400016E0 .pdata ExceptionHook | Pointer to 16E0 - 0xAE0 .text + UnwindInfo: .xdata
2EEC0 1400016F0 .pdata ExceptionHook | Pointer to 16F0 - 0xAF0 .text + UnwindInfo: .xdata
2EECC 1400017F0 .pdata ExceptionHook | Pointer to 17F0 - 0xBF0 .text + UnwindInfo: .xdata
2EED8 140001800 .pdata ExceptionHook | Pointer to 1800 - 0xC00 .text + UnwindInfo: .xdata
2EEE4 140001870 .pdata ExceptionHook | Pointer to 1870 - 0xC70 .text + UnwindInfo: .xdata
2EEF0 1400019E0 .pdata ExceptionHook | Pointer to 19E0 - 0xDE0 .text + UnwindInfo: .xdata
2EEFC 140001D40 .pdata ExceptionHook | Pointer to 1D40 - 0x1140 .text + UnwindInfo: .xdata
2EF08 140001D80 .pdata ExceptionHook | Pointer to 1D80 - 0x1180 .text + UnwindInfo: .xdata
2EF14 140001D90 .pdata ExceptionHook | Pointer to 1D90 - 0x1190 .text + UnwindInfo: .xdata
2EF20 140001F30 .pdata ExceptionHook | Pointer to 1F30 - 0x1330 .text + UnwindInfo: .xdata
2EF2C 140001FA0 .pdata ExceptionHook | Pointer to 1FA0 - 0x13A0 .text + UnwindInfo: .xdata
2EF38 140002010 .pdata ExceptionHook | Pointer to 2010 - 0x1410 .text + UnwindInfo: .xdata
2EF44 1400020A0 .pdata ExceptionHook | Pointer to 20A0 - 0x14A0 .text + UnwindInfo: .xdata
2EF50 1400021A0 .pdata ExceptionHook | Pointer to 21A0 - 0x15A0 .text + UnwindInfo: .xdata
2EF5C 1400021B0 .pdata ExceptionHook | Pointer to 21B0 - 0x15B0 .text + UnwindInfo: .xdata
2EF68 1400021C0 .pdata ExceptionHook | Pointer to 21C0 - 0x15C0 .text + UnwindInfo: .xdata
2EF74 1400021F0 .pdata ExceptionHook | Pointer to 21F0 - 0x15F0 .text + UnwindInfo: .xdata
2EF80 140002240 .pdata ExceptionHook | Pointer to 2240 - 0x1640 .text + UnwindInfo: .xdata
2EF8C 1400022E0 .pdata ExceptionHook | Pointer to 22E0 - 0x16E0 .text + UnwindInfo: .xdata
2EF98 140002360 .pdata ExceptionHook | Pointer to 2360 - 0x1760 .text + UnwindInfo: .xdata
2EFA4 1400023A0 .pdata ExceptionHook | Pointer to 23A0 - 0x17A0 .text + UnwindInfo: .xdata
2EFB0 140002420 .pdata ExceptionHook | Pointer to 2420 - 0x1820 .text + UnwindInfo: .xdata
2EFBC 140002460 .pdata ExceptionHook | Pointer to 2460 - 0x1860 .text + UnwindInfo: .xdata
2EFC8 1400024F0 .pdata ExceptionHook | Pointer to 24F0 - 0x18F0 .text + UnwindInfo: .xdata
2EFD4 140002600 .pdata ExceptionHook | Pointer to 2600 - 0x1A00 .text + UnwindInfo: .xdata
2EFE0 140002630 .pdata ExceptionHook | Pointer to 2630 - 0x1A30 .text + UnwindInfo: .xdata
2EFEC 140002650 .pdata ExceptionHook | Pointer to 2650 - 0x1A50 .text + UnwindInfo: .xdata
2EFF8 140002690 .pdata ExceptionHook | Pointer to 2690 - 0x1A90 .text + UnwindInfo: .xdata
2F004 1400026D0 .pdata ExceptionHook | Pointer to 26D0 - 0x1AD0 .text + UnwindInfo: .xdata
2F010 140002710 .pdata ExceptionHook | Pointer to 2710 - 0x1B10 .text + UnwindInfo: .xdata
2F01C 140002720 .pdata ExceptionHook | Pointer to 2720 - 0x1B20 .text + UnwindInfo: .xdata
2F028 140002790 .pdata ExceptionHook | Pointer to 2790 - 0x1B90 .text + UnwindInfo: .xdata
2F034 140002800 .pdata ExceptionHook | Pointer to 2800 - 0x1C00 .text + UnwindInfo: .xdata
2F040 140002820 .pdata ExceptionHook | Pointer to 2820 - 0x1C20 .text + UnwindInfo: .xdata
2F04C 140002840 .pdata ExceptionHook | Pointer to 2840 - 0x1C40 .text + UnwindInfo: .xdata
2F058 140002880 .pdata ExceptionHook | Pointer to 2880 - 0x1C80 .text + UnwindInfo: .xdata
2F064 1400028C0 .pdata ExceptionHook | Pointer to 28C0 - 0x1CC0 .text + UnwindInfo: .xdata
2F070 140002900 .pdata ExceptionHook | Pointer to 2900 - 0x1D00 .text + UnwindInfo: .xdata
2F07C 14001F380 .pdata ExceptionHook | Pointer to 1F380 - 0x1E780 .text + UnwindInfo: .xdata
Extra Analysis
Metric Value Percentage
Ascii Code 120672 59,9714%
Null Byte Code 39384 19,573%
NOP Cave Found 0x9090909090 Block Count: 251 | Total: 0,3119%
© 2026 All rights reserved.