PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 2,93 MB SHA-256 Hash: 39BBF53621127DF8D214437967ADC98547274EF0E151C7CA93B878E54D2B6ADB SHA-1 Hash: D7B18D0856B40C95BBC065EFC25907C96F913B02 MD5 Hash: 13DAA6D605043919C997A4BDB78E917B Imphash: A6C700968F568EFD8A2F00CF5475570A MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1605B4 SizeOfHeaders: 400 SizeOfImage: 2F6000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 1F9564 IAT: 166000 Characteristics: 22 TimeDateStamp: 6837814C Date: 28/05/2025 21:34:04 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 164A00 | 1000 | 164943 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
164E00 | 97400 | 166000 | 97238 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
1FC200 | E2E00 | 1FE000 | E5A88 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
2DF000 | E600 | 2E4000 | E520 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
2ED600 | 200 | 2F3000 | 1E8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
2ED800 | 1600 | 2F4000 | 14CC |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 15F9B4 Code -> 4883EC28E83F0600004883C428E97AFEFFFFCCCC4883EC284D8B4138488BCA498BD1E80D000000B8010000004883C428C3CC Assembler |SUB RSP, 0X28 |CALL 0X1648 |ADD RSP, 0X28 |JMP 0XE8C |INT3 |INT3 |SUB RSP, 0X28 |MOV R8, QWORD PTR [R9 + 0X38] |MOV RCX, RDX |MOV RDX, R9 |CALL 0X1034 |MOV EAX, 1 |ADD RSP, 0X28 |RET |INT3 |
| Signatures |
| Rich Signature Analyzer: Code -> C1F468458595061685950616859506168CED95169D950616E31DFB168C950616E31D051781950616E31D02178F950616E31D0317A7950616E31D07178395061603E50217EC95061606EC02179F950616F11407179F95061657C79A16809506168595071683970616021C0F1797950616021CF91684950616021C0417849506165269636885950616 Footprint md5 Hash -> 2ED6B7FE3F50A83203EECCF2D0300BD9 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 7.08021 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | CreateRemoteThread | Creates a thread in the address space of another process. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| ADVAPI32.DLL | CryptEncrypt | Performs a cryptographic operation on data in a data block. |
| File Access |
| api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll api-ms-win-crt-utility-l1-1-0.dll api-ms-win-crt-filesystem-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll VCRUNTIME140.dll VCRUNTIME140_1.dll dwmapi.dll D3DCOMPILER_47.dll IMM32.dll ntdll.dll WLDAP32.dll CRYPT32.dll Normaliz.dll WS2_32.dll MSVCP140.dll ADVAPI32.dll USER32.dll KERNEL32.dll d3d11.dll d3dx11_43.dll d3dx9_43.dll xinput9_1_0.dll xinput1_3.dll xinput1_1.dll xinput1_2.dll xinput1_4.dll secur32.dll security.dll failed to load WS2_32.DLL iphlpapi.dll .dat @.dat imgui_log.txt .txt Failed to open CitizenFX.ini imgui.ini Temp |
| File Access (UNICODE) |
| FiveM_GameProcess.exe FiveM_b\d{4}_GTAProcess\.exe FiveM_GTAProcess.exe FiveM_b\d{4}_GameProcess\.exe app\CitizenFX.ini AppData |
| Interest's Words |
| rcpt to: Virus BitCoin Spam smtp Encrypt Decrypt Encryption PassWord exec attrib start pause cipher hostname wmic shutdown ping expand replace |
| URLs |
| http://fontello.com https://curl.haxx.se/docs/http-cookies.html https://f https://f ftp://%s:%s@%s |
| URLs (UNICODE) |
| http://scripts.sil.org/OFLThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://fontello.com https://github.com/rsms/inter) |
| IP Addresses |
| 127.0.0.1 2.5.29.17 2.5.4.10 2.5.4.11 2.5.4.12 2.5.4.13 2.5.4.17 2.5.4.41 2.5.4.42 2.5.4.43 2.5.4.44 2.5.4.45 2.5.4.46 2.5.4.65 2.5.4.72 2.5.29.18 2.5.29.19 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Unicode escape - \u00 - (Common Unicode escape sequences) |
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (accept) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (recv) |
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegGetValue) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Ascii | Encryption (Microsoft Unified Security Protocol Provider) |
| Text | Ascii | Encryption API (CryptAcquireContext) |
| Text | Ascii | Encryption API (CryptReleaseContext) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (UnmapViewOfFile) |
| Text | Ascii | Stealth (MapViewOfFile) |
| Text | Ascii | Stealth (CreateFileMappingA) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealth (ReadProcessMemory) |
| Text | Ascii | Stealth (CreateRemoteThread) |
| Text | Ascii | Keyboard Key (Num 0) |
| Text | Ascii | Keyboard Key (Num 1) |
| Text | Ascii | Keyboard Key (Num 2) |
| Text | Ascii | Keyboard Key (Num 3) |
| Text | Ascii | Keyboard Key (Num 4) |
| Text | Ascii | Keyboard Key (Num 5) |
| Text | Ascii | Keyboard Key (Num 6) |
| Text | Ascii | Keyboard Key (Num 7) |
| Text | Ascii | Keyboard Key (Num 8) |
| Text | Ascii | Keyboard Key (Num 9) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (DownArrow) |
| Text | Ascii | Keyboard Key (RightArrow) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Keyboard Key (LeftArrow) |
| Text | Ascii | Keyboard Key (PageDown) |
| Text | Ascii | Keyboard Key (PageUp) |
| Text | Ascii | Keyboard Key (CapsLock) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Ascii | Keyboard Key (Ctrl+S) |
| Text | Ascii | Code that takes advantage of software vulnerabilities (Exploit) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\1\1033 | 2F3060 | 188 | 2ED660 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version='1.0' encoding='UTF-8' standalone='y |
| Intelligent String |
| • api-ms-win-crt-locale-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-convert-l1-1-0.dll • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • %s.%s.tmp • https://curl.haxx.se/docs/http-cookies.html • .gif • .jpg • .png • .svg • .txt • .htm • application/pdf.xml • %s://%sfile • iphlpapi.dll • LOGIN %s %s • failed to resume file:// transfer • WS2_32.DLL • file://%s%s%s • machinelogin • Couldn't read a file:// file • Login denied • security.dll • secur32.dll • 2.5.29.17 • 2.5.4.10 • 2.5.4.11 • 2.5.4.12 • 2.5.4.13 • 2.5.4.17 • 2.5.4.41 • 2.5.4.42 • 2.5.4.43 • 2.5.4.44 • 2.5.4.45 • 2.5.4.46 • 2.5.4.65 • 2.5.4.72 • 2.5.29.18 • 2.5.29.19 • LOGIN • .Ojw • *europe • invalid string: control character U+0001 (SOH) must be escaped to \u0001 • invalid string: control character U+0000 (NUL) must be escaped to \u0000 • invalid string: control character U+0003 (ETX) must be escaped to \u0003 • invalid string: control character U+0002 (STX) must be escaped to \u0002 • invalid string: control character U+0005 (ENQ) must be escaped to \u0005 • invalid string: control character U+0004 (EOT) must be escaped to \u0004 • invalid string: control character U+0007 (BEL) must be escaped to \u0007 • invalid string: control character U+0006 (ACK) must be escaped to \u0006 • invalid string: control character U+0009 (HT) must be escaped to \u0009 or \t • invalid string: control character U+0008 (BS) must be escaped to \u0008 or \b • invalid string: control character U+000B (VT) must be escaped to \u000B • invalid string: control character U+000A (LF) must be escaped to \u000A or \n • invalid string: control character U+000D (CR) must be escaped to \u000D or \r • invalid string: control character U+000C (FF) must be escaped to \u000C or \f • invalid string: control character U+000F (SI) must be escaped to \u000F • invalid string: control character U+000E (SO) must be escaped to \u000E • invalid string: control character U+0011 (DC1) must be escaped to \u0011 • invalid string: control character U+0010 (DLE) must be escaped to \u0010 • invalid string: control character U+0013 (DC3) must be escaped to \u0013 • invalid string: control character U+0012 (DC2) must be escaped to \u0012 • invalid string: control character U+0015 (NAK) must be escaped to \u0015 • invalid string: control character U+0014 (DC4) must be escaped to \u0014 • invalid string: control character U+0017 (ETB) must be escaped to \u0017 • invalid string: control character U+0016 (SYN) must be escaped to \u0016 • invalid string: control character U+0019 (EM) must be escaped to \u0019 • invalid string: control character U+0018 (CAN) must be escaped to \u0018 • invalid string: control character U+001B (ESC) must be escaped to \u001B • invalid string: control character U+001A (SUB) must be escaped to \u001A • invalid string: control character U+001D (GS) must be escaped to \u001D • invalid string: control character U+001C (FS) must be escaped to \u001C • invalid string: control character U+001F (US) must be escaped to \u001F • invalid string: control character U+001E (RS) must be escaped to \u001Etype must be boolean, but is • imgui.ini • imgui_log.txt • xinput1_4.dll • xinput1_2.dll • xinput1_1.dll • xinput1_3.dll • \FiveM\FiveM.app\CitizenFX.ini • Failed to open CitizenFX.ini • FiveM_b\d{4}_GameProcess\.exe • FiveM_GTAProcess.exe • FiveM_b\d{4}_GTAProcess\.exe • FiveM_GameProcess.exe • C:\Users\pc\Downloads\Wexize-V2-main (1) funfando fora do fivem\Wexize-V2-main (1) funfando fora do fivem\x64\Release\Wexize Revamp.pdb • .tls • .bss • KERNEL32.dll • USER32.dll • ADVAPI32.dll • MSVCP140.dll • WS2_32.dll • Normaliz.dll • D3DCOMPILER_47.dll • dwmapi.dll • VCRUNTIME140_1.dll • VCRUNTIME140.dll • I_openapi-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-filesystem-l1-1-0.dll • api-ms-win-crt-utility-l1-1-0.dll • api-ms-win-crt-environment-l1-1-0.dll • api-ms-win-crt-time-l1-1-0.dll • Black ItalicBlackExtraBold ItalicExtraBoldBold ItalicBoldSemiBold ItalicMedium ItalicMediumItalicLight ItalicLightExtraLight ItalicExtraLightThin ItalicThinSlantWeightSingle-storey aCaptital G with spurFlat-top threeUpper-case i with serifAlternate German double sr with curved tailLower-case L with tailOpen nineOpen sixOpen fourAlternate oneDisambiguation without slashed zeror curves into round neighborsDisambiguationOpen digitsSemiBoldInterhttp://scripts.sil.org/OFLThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFLhttps://rsms.me/Rasmus AnderssonrsmsInter UI and Inter is a trademark of rsms.Inter-SemiBoldVersion 3.019;git-0a5106e0b3.019;RSMS;Inter-SemiBoldRegularInter SemiBoldCopyright 2020 The Inter Project Authors (https://github.com/rsms/inter) • iGenerated by GlyphterGlyphterRegularGlyphterGlyphterVersion 1.0GlyphterGenerated by svg2ttf from Fontello project.http://fontello.comGenerated by GlyphterGlyphterRegularGlyphterGlyphterVersion 1.0GlyphterGenerated by svg2ttf from Fontello project.http://fontello.com |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 6C5 | N/A | .text | JMP QWORD PTR [RIP+0xEC45C700] |
| BB4 | N/A | .text | CALL QWORD PTR [RIP+0x16514E] |
| C0D | N/A | .text | CALL QWORD PTR [RIP+0x1650ED] |
| C4F | N/A | .text | JMP QWORD PTR [RIP+0x1650AB] |
| CD4 | N/A | .text | CALL QWORD PTR [RIP+0x16502E] |
| D14 | N/A | .text | CALL QWORD PTR [RIP+0x164FEE] |
| D3D | N/A | .text | CALL QWORD PTR [RIP+0x164DA5] |
| D46 | N/A | .text | CALL QWORD PTR [RIP+0x164D7C] |
| 1097 | N/A | .text | CALL QWORD PTR [RIP+0x165243] |
| 10D3 | N/A | .text | CALL QWORD PTR [RIP+0x165207] |
| 10E8 | N/A | .text | CALL QWORD PTR [RIP+0x1651CA] |
| 1193 | N/A | .text | CALL QWORD PTR [RIP+0x165147] |
| 11A3 | N/A | .text | CALL QWORD PTR [RIP+0x165117] |
| 1601 | N/A | .text | CALL QWORD PTR [RIP+0x164CD9] |
| 163E | N/A | .text | CALL QWORD PTR [RIP+0x164C9C] |
| 165E | N/A | .text | CALL QWORD PTR [RIP+0x164C7C] |
| 1698 | N/A | .text | CALL QWORD PTR [RIP+0x164C12] |
| 16FA | N/A | .text | CALL QWORD PTR [RIP+0x1643F0] |
| 170A | N/A | .text | CALL QWORD PTR [RIP+0x164290] |
| 1729 | N/A | .text | CALL QWORD PTR [RIP+0x1640D1] |
| 1739 | N/A | .text | CALL QWORD PTR [RIP+0x164261] |
| 1767 | N/A | .text | CALL QWORD PTR [RIP+0x164093] |
| 1777 | N/A | .text | CALL QWORD PTR [RIP+0x164223] |
| 17D0 | N/A | .text | CALL QWORD PTR [RIP+0x164ADA] |
| 1800 | N/A | .text | CALL QWORD PTR [RIP+0x164AE2] |
| 1833 | N/A | .text | CALL QWORD PTR [RIP+0x164AAF] |
| 18DB | N/A | .text | CALL QWORD PTR [RIP+0x16430F] |
| 18EA | N/A | .text | CALL QWORD PTR [RIP+0x164288] |
| 1A2E | N/A | .text | CALL QWORD PTR [RIP+0x1648AC] |
| 1AC9 | N/A | .text | CALL QWORD PTR [RIP+0x163D39] |
| 1AEF | N/A | .text | CALL QWORD PTR [RIP+0x163FA3] |
| 1AFF | N/A | .text | CALL QWORD PTR [RIP+0x163D03] |
| 1B4C | N/A | .text | CALL QWORD PTR [RIP+0x163F5E] |
| 1B6E | N/A | .text | CALL QWORD PTR [RIP+0x163F34] |
| 1B96 | N/A | .text | CALL QWORD PTR [RIP+0x163F14] |
| 1BDE | N/A | .text | CALL QWORD PTR [RIP+0x163EDC] |
| 1BE5 | N/A | .text | CALL QWORD PTR [RIP+0x163EF5] |
| 1BF2 | N/A | .text | CALL QWORD PTR [RIP+0x163F00] |
| 1C45 | N/A | .text | CALL QWORD PTR [RIP+0x163E6D] |
| 1C51 | N/A | .text | CALL QWORD PTR [RIP+0x163E49] |
| 1C5A | N/A | .text | CALL QWORD PTR [RIP+0x163E38] |
| 1CD6 | N/A | .text | CALL QWORD PTR [RIP+0x1643DC] |
| 1F2F | N/A | .text | CALL QWORD PTR [RIP+0x164183] |
| 201D | N/A | .text | CALL QWORD PTR [RIP+0x164095] |
| 2039 | N/A | .text | CALL QWORD PTR [RIP+0x163AA1] |
| 2046 | N/A | .text | CALL QWORD PTR [RIP+0x163AAC] |
| 20DC | N/A | .text | CALL QWORD PTR [RIP+0x163FD6] |
| 215B | N/A | .text | CALL QWORD PTR [RIP+0x163F57] |
| 224A | N/A | .text | CALL QWORD PTR [RIP+0x163E68] |
| 22CB | N/A | .text | CALL QWORD PTR [RIP+0x163547] |
| 2329 | N/A | .text | CALL QWORD PTR [RIP+0x163FB9] |
| 2390 | N/A | .text | CALL QWORD PTR [RIP+0x16348A] |
| 239F | N/A | .text | CALL QWORD PTR [RIP+0x16346B] |
| 23C1 | N/A | .text | CALL QWORD PTR [RIP+0x163449] |
| 2522 | N/A | .text | CALL QWORD PTR [RIP+0x163300] |
| 2577 | N/A | .text | CALL QWORD PTR [RIP+0x163D63] |
| 25AD | N/A | .text | CALL QWORD PTR [RIP+0x163D2D] |
| 25D9 | N/A | .text | CALL QWORD PTR [RIP+0x163D01] |
| 2608 | N/A | .text | CALL QWORD PTR [RIP+0x163CD2] |
| 2631 | N/A | .text | CALL QWORD PTR [RIP+0x1631F1] |
| 275D | N/A | .text | CALL QWORD PTR [RIP+0x163B7D] |
| 285F | N/A | .text | CALL QWORD PTR [RIP+0x163A7B] |
| 314B | N/A | .text | CALL QWORD PTR [RIP+0x162A9F] |
| 32D1 | N/A | .text | CALL QWORD PTR [RIP+0x162919] |
| 383E | N/A | .text | CALL QWORD PTR [RIP+0x162A9C] |
| 386F | N/A | .text | CALL QWORD PTR [RIP+0x162A6B] |
| 38B9 | N/A | .text | CALL QWORD PTR [RIP+0x162A21] |
| 38ED | N/A | .text | CALL QWORD PTR [RIP+0x1629ED] |
| 3924 | N/A | .text | CALL QWORD PTR [RIP+0x1629B6] |
| 3960 | N/A | .text | CALL QWORD PTR [RIP+0x16297A] |
| 399D | N/A | .text | CALL QWORD PTR [RIP+0x16293D] |
| 39E5 | N/A | .text | CALL QWORD PTR [RIP+0x1628F5] |
| 3A24 | N/A | .text | CALL QWORD PTR [RIP+0x1628B6] |
| 3A4A | N/A | .text | CALL QWORD PTR [RIP+0x162890] |
| 3AB3 | N/A | .text | CALL QWORD PTR [RIP+0x162827] |
| 52F5 | N/A | .text | CALL QWORD PTR [RIP+0x160F5D] |
| 5326 | N/A | .text | CALL QWORD PTR [RIP+0x160F1C] |
| 54EA | N/A | .text | CALL QWORD PTR [RIP+0x160D68] |
| 551B | N/A | .text | CALL QWORD PTR [RIP+0x160D27] |
| 6783 | N/A | .text | CALL QWORD PTR [RIP+0x15FACF] |
| 67A4 | N/A | .text | CALL QWORD PTR [RIP+0x15FA9E] |
| 6DA3 | N/A | .text | CALL QWORD PTR [RIP+0x15F537] |
| 75BE | N/A | .text | CALL QWORD PTR [RIP+0x15E62C] |
| 7628 | N/A | .text | CALL QWORD PTR [RIP+0x15ECBA] |
| 78FE | N/A | .text | CALL QWORD PTR [RIP+0x15E2EC] |
| 7E2D | N/A | .text | CALL QWORD PTR [RIP+0x15E4AD] |
| 7FE4 | N/A | .text | JMP QWORD PTR [RIP+0x15D83E] |
| 82B1 | N/A | .text | CALL QWORD PTR [RIP+0x15D561] |
| 85AA | N/A | .text | CALL QWORD PTR [RIP+0x15D268] |
| 889A | N/A | .text | CALL QWORD PTR [RIP+0x15CF78] |
| 8B39 | N/A | .text | CALL QWORD PTR [RIP+0x15CCD9] |
| 8E61 | N/A | .text | CALL QWORD PTR [RIP+0x15D251] |
| 907F | N/A | .text | CALL QWORD PTR [RIP+0x15D033] |
| 9159 | N/A | .text | CALL QWORD PTR [RIP+0x15C6B9] |
| 934A | N/A | .text | CALL QWORD PTR [RIP+0x15C4C8] |
| 952A | N/A | .text | CALL QWORD PTR [RIP+0x15C2E8] |
| 970A | N/A | .text | CALL QWORD PTR [RIP+0x15C108] |
| 98EE | N/A | .text | CALL QWORD PTR [RIP+0x15BF24] |
| 9B7B | N/A | .text | CALL QWORD PTR [RIP+0x15BC97] |
| 9BF2 | N/A | .text | CALL QWORD PTR [RIP+0x15C4C0] |
| 179D2E-179D3B | N/A | .rdata | Potential obfuscated jump sequence detected, count: 7 |
| 2709EB-270A11 | N/A | .data | Unusual NOPS Space, count: 39 |
| 2DF000 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 2DF00C | 1070 | .pdata | ExceptionHook | Pointer to 1070 - 0x470 .text + UnwindInfo: .rdata |
| 2DF018 | 10F0 | .pdata | ExceptionHook | Pointer to 10F0 - 0x4F0 .text + UnwindInfo: .rdata |
| 2DF024 | 1170 | .pdata | ExceptionHook | Pointer to 1170 - 0x570 .text + UnwindInfo: .rdata |
| 2DF030 | 1200 | .pdata | ExceptionHook | Pointer to 1200 - 0x600 .text + UnwindInfo: .rdata |
| 2DF03C | 1290 | .pdata | ExceptionHook | Pointer to 1290 - 0x690 .text + UnwindInfo: .rdata |
| 2DF048 | 1340 | .pdata | ExceptionHook | Pointer to 1340 - 0x740 .text + UnwindInfo: .rdata |
| 2DF054 | 1450 | .pdata | ExceptionHook | Pointer to 1450 - 0x850 .text + UnwindInfo: .rdata |
| 2DF060 | 1790 | .pdata | ExceptionHook | Pointer to 1790 - 0xB90 .text + UnwindInfo: .rdata |
| 2DF06C | 17F0 | .pdata | ExceptionHook | Pointer to 17F0 - 0xBF0 .text + UnwindInfo: .rdata |
| 2DF078 | 1890 | .pdata | ExceptionHook | Pointer to 1890 - 0xC90 .text + UnwindInfo: .rdata |
| 2DF084 | 18B0 | .pdata | ExceptionHook | Pointer to 18B0 - 0xCB0 .text + UnwindInfo: .rdata |
| 2DF090 | 18F0 | .pdata | ExceptionHook | Pointer to 18F0 - 0xCF0 .text + UnwindInfo: .rdata |
| 2DF09C | 1930 | .pdata | ExceptionHook | Pointer to 1930 - 0xD30 .text + UnwindInfo: .rdata |
| 2DF0A8 | 1C40 | .pdata | ExceptionHook | Pointer to 1C40 - 0x1040 .text + UnwindInfo: .rdata |
| 2DF0B4 | 1D40 | .pdata | ExceptionHook | Pointer to 1D40 - 0x1140 .text + UnwindInfo: .rdata |
| 2DF0C0 | 1EE0 | .pdata | ExceptionHook | Pointer to 1EE0 - 0x12E0 .text + UnwindInfo: .rdata |
| 2DF0CC | 1F00 | .pdata | ExceptionHook | Pointer to 1F00 - 0x1300 .text + UnwindInfo: .rdata |
| 2DF0D8 | 1F40 | .pdata | ExceptionHook | Pointer to 1F40 - 0x1340 .text + UnwindInfo: .rdata |
| 2DF0E4 | 1F70 | .pdata | ExceptionHook | Pointer to 1F70 - 0x1370 .text + UnwindInfo: .rdata |
| 2DF0F0 | 1FB0 | .pdata | ExceptionHook | Pointer to 1FB0 - 0x13B0 .text + UnwindInfo: .rdata |
| 2DF0FC | 20B6 | .pdata | ExceptionHook | Pointer to 20B6 - 0x14B6 .text + UnwindInfo: .rdata |
| 2DF108 | 21B0 | .pdata | ExceptionHook | Pointer to 21B0 - 0x15B0 .text + UnwindInfo: .rdata |
| 2DF114 | 221F | .pdata | ExceptionHook | Pointer to 221F - 0x161F .text + UnwindInfo: .rdata |
| 2DF120 | 2449 | .pdata | ExceptionHook | Pointer to 2449 - 0x1849 .text + UnwindInfo: .rdata |
| 2DF12C | 2470 | .pdata | ExceptionHook | Pointer to 2470 - 0x1870 .text + UnwindInfo: .rdata |
| 2DF138 | 2600 | .pdata | ExceptionHook | Pointer to 2600 - 0x1A00 .text + UnwindInfo: .rdata |
| 2DF144 | 2650 | .pdata | ExceptionHook | Pointer to 2650 - 0x1A50 .text + UnwindInfo: .rdata |
| 2DF150 | 2830 | .pdata | ExceptionHook | Pointer to 2830 - 0x1C30 .text + UnwindInfo: .rdata |
| 2DF15C | 2870 | .pdata | ExceptionHook | Pointer to 2870 - 0x1C70 .text + UnwindInfo: .rdata |
| 2DF168 | 28E0 | .pdata | ExceptionHook | Pointer to 28E0 - 0x1CE0 .text + UnwindInfo: .rdata |
| 2DF174 | 2903 | .pdata | ExceptionHook | Pointer to 2903 - 0x1D03 .text + UnwindInfo: .rdata |
| 2DF180 | 293F | .pdata | ExceptionHook | Pointer to 293F - 0x1D3F .text + UnwindInfo: .rdata |
| 2DF18C | 2960 | .pdata | ExceptionHook | Pointer to 2960 - 0x1D60 .text + UnwindInfo: .rdata |
| 2DF198 | 297F | .pdata | ExceptionHook | Pointer to 297F - 0x1D7F .text + UnwindInfo: .rdata |
| 2DF1A4 | 29AA | .pdata | ExceptionHook | Pointer to 29AA - 0x1DAA .text + UnwindInfo: .rdata |
| 2DF1B0 | 29D0 | .pdata | ExceptionHook | Pointer to 29D0 - 0x1DD0 .text + UnwindInfo: .rdata |
| 2DF1BC | 29EF | .pdata | ExceptionHook | Pointer to 29EF - 0x1DEF .text + UnwindInfo: .rdata |
| 2DF1C8 | 2A1A | .pdata | ExceptionHook | Pointer to 2A1A - 0x1E1A .text + UnwindInfo: .rdata |
| 2DF1D4 | 2A50 | .pdata | ExceptionHook | Pointer to 2A50 - 0x1E50 .text + UnwindInfo: .rdata |
| 2DF1E0 | 2AF0 | .pdata | ExceptionHook | Pointer to 2AF0 - 0x1EF0 .text + UnwindInfo: .rdata |
| 2DF1EC | 2B60 | .pdata | ExceptionHook | Pointer to 2B60 - 0x1F60 .text + UnwindInfo: .rdata |
| 2DF1F8 | 2B79 | .pdata | ExceptionHook | Pointer to 2B79 - 0x1F79 .text + UnwindInfo: .rdata |
| 2DF204 | 2BD4 | .pdata | ExceptionHook | Pointer to 2BD4 - 0x1FD4 .text + UnwindInfo: .rdata |
| 2DF210 | 2C30 | .pdata | ExceptionHook | Pointer to 2C30 - 0x2030 .text + UnwindInfo: .rdata |
| 2DF21C | 2C70 | .pdata | ExceptionHook | Pointer to 2C70 - 0x2070 .text + UnwindInfo: .rdata |
| 2DF228 | 2CF0 | .pdata | ExceptionHook | Pointer to 2CF0 - 0x20F0 .text + UnwindInfo: .rdata |
| 2DF234 | 2D70 | .pdata | ExceptionHook | Pointer to 2D70 - 0x2170 .text + UnwindInfo: .rdata |
| 2DF240 | 2DAE | .pdata | ExceptionHook | Pointer to 2DAE - 0x21AE .text + UnwindInfo: .rdata |
| 2DF24C | 2E31 | .pdata | ExceptionHook | Pointer to 2E31 - 0x2231 .text + UnwindInfo: .rdata |
| 2DF258 | 2E39 | .pdata | ExceptionHook | Pointer to 2E39 - 0x2239 .text + UnwindInfo: .rdata |
| 2DF264 | 2E51 | .pdata | ExceptionHook | Pointer to 2E51 - 0x2251 .text + UnwindInfo: .rdata |
| 2DF270 | 2E80 | .pdata | ExceptionHook | Pointer to 2E80 - 0x2280 .text + UnwindInfo: .rdata |
| 2DF27C | 2EC0 | .pdata | ExceptionHook | Pointer to 2EC0 - 0x22C0 .text + UnwindInfo: .rdata |
| 2DF288 | 2EE0 | .pdata | ExceptionHook | Pointer to 2EE0 - 0x22E0 .text + UnwindInfo: .rdata |
| 2DF294 | 2F50 | .pdata | ExceptionHook | Pointer to 2F50 - 0x2350 .text + UnwindInfo: .rdata |
| 2DF2A0 | 32B0 | .pdata | ExceptionHook | Pointer to 32B0 - 0x26B0 .text + UnwindInfo: .rdata |
| 2DF2AC | 34B0 | .pdata | ExceptionHook | Pointer to 34B0 - 0x28B0 .text + UnwindInfo: .rdata |
| 2DF2B8 | 35B0 | .pdata | ExceptionHook | Pointer to 35B0 - 0x29B0 .text + UnwindInfo: .rdata |
| 2DF2C4 | 7300 | .pdata | ExceptionHook | Pointer to 7300 - 0x6700 .text + UnwindInfo: .rdata |
| 2DF2D0 | 73E0 | .pdata | ExceptionHook | Pointer to 73E0 - 0x67E0 .text + UnwindInfo: .rdata |
| 2DF2DC | 74EA | .pdata | ExceptionHook | Pointer to 74EA - 0x68EA .text + UnwindInfo: .rdata |
| 2DF2E8 | 75F0 | .pdata | ExceptionHook | Pointer to 75F0 - 0x69F0 .text + UnwindInfo: .rdata |
| 2DF2F4 | 77E0 | .pdata | ExceptionHook | Pointer to 77E0 - 0x6BE0 .text + UnwindInfo: .rdata |
| 2DF300 | 8880 | .pdata | ExceptionHook | Pointer to 8880 - 0x7C80 .text + UnwindInfo: .rdata |
| 2DF30C | 8986 | .pdata | ExceptionHook | Pointer to 8986 - 0x7D86 .text + UnwindInfo: .rdata |
| 2DF318 | 89D2 | .pdata | ExceptionHook | Pointer to 89D2 - 0x7DD2 .text + UnwindInfo: .rdata |
| 2DF324 | 8A00 | .pdata | ExceptionHook | Pointer to 8A00 - 0x7E00 .text + UnwindInfo: .rdata |
| 2DF330 | 8A50 | .pdata | ExceptionHook | Pointer to 8A50 - 0x7E50 .text + UnwindInfo: .rdata |
| 2DF33C | 8A6F | .pdata | ExceptionHook | Pointer to 8A6F - 0x7E6F .text + UnwindInfo: .rdata |
| 2DF348 | 8A9A | .pdata | ExceptionHook | Pointer to 8A9A - 0x7E9A .text + UnwindInfo: .rdata |
| 2DF354 | 8AB0 | .pdata | ExceptionHook | Pointer to 8AB0 - 0x7EB0 .text + UnwindInfo: .rdata |
| 2DF360 | 8B60 | .pdata | ExceptionHook | Pointer to 8B60 - 0x7F60 .text + UnwindInfo: .rdata |
| 2DF36C | 8C00 | .pdata | ExceptionHook | Pointer to 8C00 - 0x8000 .text + UnwindInfo: .rdata |
| 2DF378 | 8C40 | .pdata | ExceptionHook | Pointer to 8C40 - 0x8040 .text + UnwindInfo: .rdata |
| 2DF384 | 8D00 | .pdata | ExceptionHook | Pointer to 8D00 - 0x8100 .text + UnwindInfo: .rdata |
| 2DF390 | 8D4A | .pdata | ExceptionHook | Pointer to 8D4A - 0x814A .text + UnwindInfo: .rdata |
| 2DF39C | 8D9F | .pdata | ExceptionHook | Pointer to 8D9F - 0x819F .text + UnwindInfo: .rdata |
| 2DF3A8 | 8DB0 | .pdata | ExceptionHook | Pointer to 8DB0 - 0x81B0 .text + UnwindInfo: .rdata |
| 2DF3B4 | 90A0 | .pdata | ExceptionHook | Pointer to 90A0 - 0x84A0 .text + UnwindInfo: .rdata |
| 2DF3C0 | 9390 | .pdata | ExceptionHook | Pointer to 9390 - 0x8790 .text + UnwindInfo: .rdata |
| 2DF3CC | 9670 | .pdata | ExceptionHook | Pointer to 9670 - 0x8A70 .text + UnwindInfo: .rdata |
| 2DF3D8 | 98E0 | .pdata | ExceptionHook | Pointer to 98E0 - 0x8CE0 .text + UnwindInfo: .rdata |
| 2DF3E4 | 9903 | .pdata | ExceptionHook | Pointer to 9903 - 0x8D03 .text + UnwindInfo: .rdata |
| 2DF3F0 | 9942 | .pdata | ExceptionHook | Pointer to 9942 - 0x8D42 .text + UnwindInfo: .rdata |
| 2DF3FC | 9960 | .pdata | ExceptionHook | Pointer to 9960 - 0x8D60 .text + UnwindInfo: .rdata |
| 2DF408 | 9998 | .pdata | ExceptionHook | Pointer to 9998 - 0x8D98 .text + UnwindInfo: .rdata |
| 2DF414 | 9AA8 | .pdata | ExceptionHook | Pointer to 9AA8 - 0x8EA8 .text + UnwindInfo: .rdata |
| 2DF420 | 9AF0 | .pdata | ExceptionHook | Pointer to 9AF0 - 0x8EF0 .text + UnwindInfo: .rdata |
| 2DF42C | 9B70 | .pdata | ExceptionHook | Pointer to 9B70 - 0x8F70 .text + UnwindInfo: .rdata |
| 2DF438 | 9BCF | .pdata | ExceptionHook | Pointer to 9BCF - 0x8FCF .text + UnwindInfo: .rdata |
| 2DF444 | 9C6C | .pdata | ExceptionHook | Pointer to 9C6C - 0x906C .text + UnwindInfo: .rdata |
| 2DF450 | 9C86 | .pdata | ExceptionHook | Pointer to 9C86 - 0x9086 .text + UnwindInfo: .rdata |
| 2DF45C | 9C90 | .pdata | ExceptionHook | Pointer to 9C90 - 0x9090 .text + UnwindInfo: .rdata |
| 2DF468 | 9F20 | .pdata | ExceptionHook | Pointer to 9F20 - 0x9320 .text + UnwindInfo: .rdata |
| 2DF474 | 9FA8 | .pdata | ExceptionHook | Pointer to 9FA8 - 0x93A8 .text + UnwindInfo: .rdata |
| 2DF480 | A0F2 | .pdata | ExceptionHook | Pointer to A0F2 - 0x94F2 .text + UnwindInfo: .rdata |
| 2DF48C | A100 | .pdata | ExceptionHook | Pointer to A100 - 0x9500 .text + UnwindInfo: .rdata |
| 2DF498 | A188 | .pdata | ExceptionHook | Pointer to A188 - 0x9588 .text + UnwindInfo: .rdata |
| 2DF4A4 | A2D2 | .pdata | ExceptionHook | Pointer to A2D2 - 0x96D2 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1905178 | 61,9452% |
| Null Byte Code | 409896 | 13,3274% |
| NOP Cave Found | 0x9090909090 | Block Count: 7 | Total: 0,0006% |
© 2026 All rights reserved.