PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 3,06 MB SHA-256 Hash: 547C2E12A1E75336EA7478D4AAF15D35260C160EAC91D1392183FD7423917D24 SHA-1 Hash: 8E761FA775BD94BFB835D94B77F669A7BD87CFFB MD5 Hash: 14D14E4C2B3F6F60CA912126AB31E7B2 Imphash: 9CD173F7D2AD7C9039291D9EA60D5000 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1C50 SizeOfHeaders: 400 SizeOfImage: 357000 ImageBase: 0000000180000000 Architecture: x64 ImportTable: 1DD78 IAT: 14000 Characteristics: 2022 TimeDateStamp: 6A391DCB Date: 22/06/2026 11:34:35 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, _RDATA, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 13000 | 1000 | 12FB0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
13400 | A600 | 14000 | A58A |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
1DA00 | 2EF800 | 1F000 | 3339B0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
30D200 | 1200 | 353000 | 1194 |
|
|
| _RDATA | 0x40000040 Initialized Data Readable |
30E400 | 200 | 355000 | F4 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
30E600 | 800 | 356000 | 66C |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 1050 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8BB0200004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X180001C71 |CALL 0X180001F2C |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> 335FCCF4773EA2A7773EA2A7773EA2A76355A6A67C3EA2A76355A1A6723EA2A76355A7A6E73EA2A7254BA7A66A3EA2A7254BA6A6793EA2A7254BA1A67E3EA2A76355A3A6743EA2A7773EA3A72D3EA2A7B84BA6A6763EA2A7B84BA0A6763EA2A752696368773EA2A7 Footprint md5 Hash -> 43E4923AEF190D72CC4C9CA173A1C7C4 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.29**)[-] • Entropy: 7.98699 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| File Access |
| KERNEL32.dll -] LoadLibrary jvm.dll .dat @.dat \Intel\mod\jvminject\loader.log |
| File Access (UNICODE) |
| mscoree.dll \Program Files\Java\jdk-17\bin\server\jvm.dll |
| Interest's Words |
| start replace |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Threat focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • C:\Intel\mod\jvminject\loader.log • C:\Program Files\Java\jdk-17\bin • C:\Program Files\Java\jdk-17\bin\server\jvm.dll • mscoree.dll • .bss • KERNEL32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 409 | N/A | .text | CALL QWORD PTR [RIP+0x13011] |
| 428 | N/A | .text | CALL QWORD PTR [RIP+0x12FEA] |
| 436 | N/A | .text | CALL QWORD PTR [RIP+0x12FCC] |
| 4C7 | N/A | .text | CALL QWORD PTR [RIP+0x12F33] |
| 755 | N/A | .text | CALL QWORD PTR [RIP+0x12CDD] |
| 762 | N/A | .text | CALL QWORD PTR [RIP+0x12CC8] |
| 76D | N/A | .text | CALL QWORD PTR [RIP+0x12C9D] |
| 794 | N/A | .text | CALL QWORD PTR [RIP+0x12C8E] |
| F6F | N/A | .text | CALL QWORD PTR [RIP+0x126FB] |
| FE6 | N/A | .text | CALL QWORD PTR [RIP+0x12684] |
| 1029 | N/A | .text | CALL QWORD PTR [RIP+0x12641] |
| 109B | N/A | .text | CALL QWORD PTR [RIP+0x123BF] |
| 10A4 | N/A | .text | CALL QWORD PTR [RIP+0x123AE] |
| 10AA | N/A | .text | CALL QWORD PTR [RIP+0x123B8] |
| 10BE | N/A | .text | JMP QWORD PTR [RIP+0x123AC] |
| 10D2 | N/A | .text | CALL QWORD PTR [RIP+0x123A0] |
| 11B9 | N/A | .text | CALL QWORD PTR [RIP+0x122B9] |
| 1255 | N/A | .text | CALL QWORD PTR [RIP+0x121E5] |
| 126D | N/A | .text | CALL QWORD PTR [RIP+0x121D5] |
| 12A4 | N/A | .text | CALL QWORD PTR [RIP+0x121A6] |
| 12C3 | N/A | .text | CALL QWORD PTR [RIP+0x12177] |
| 12DD | N/A | .text | CALL QWORD PTR [RIP+0x12165] |
| 1314 | N/A | .text | CALL QWORD PTR [RIP+0x12136] |
| 1358 | N/A | .text | CALL QWORD PTR [RIP+0x1213A] |
| 1366 | N/A | .text | CALL QWORD PTR [RIP+0x12124] |
| 1372 | N/A | .text | CALL QWORD PTR [RIP+0x12110] |
| 1382 | N/A | .text | CALL QWORD PTR [RIP+0x120F8] |
| 13E0 | N/A | .text | JMP QWORD PTR [RIP+0x120BA] |
| 1518 | N/A | .text | CALL QWORD PTR [RIP+0x12152] |
| 1770 | N/A | .text | CALL QWORD PTR [RIP+0x11D02] |
| 179D | N/A | .text | CALL QWORD PTR [RIP+0x11C9D] |
| 17B7 | N/A | .text | CALL QWORD PTR [RIP+0x11C8B] |
| 17F8 | N/A | .text | CALL QWORD PTR [RIP+0x11C52] |
| 184C | N/A | .text | CALL QWORD PTR [RIP+0x11C56] |
| 186D | N/A | .text | CALL QWORD PTR [RIP+0x11BED] |
| 1878 | N/A | .text | CALL QWORD PTR [RIP+0x11BDA] |
| 18C2 | N/A | .text | CALL QWORD PTR [RIP+0x11DA8] |
| 18FE | N/A | .text | CALL QWORD PTR [RIP+0x11D6C] |
| 197C | N/A | .text | JMP QWORD PTR [RIP+0xFFF3FF0] |
| 2259 | N/A | .text | CALL QWORD PTR [RIP+0x11901] |
| 2297 | N/A | .text | CALL QWORD PTR [RIP+0x11223] |
| 239A | N/A | .text | CALL QWORD PTR [RIP+0x11128] |
| 249E | N/A | .text | CALL QWORD PTR [RIP+0x111CC] |
| 2797 | N/A | .text | CALL QWORD PTR [RIP+0x10C73] |
| 281E | N/A | .text | CALL QWORD PTR [RIP+0x10CAC] |
| 28F7 | N/A | .text | CALL QWORD PTR [RIP+0x10BEB] |
| 2995 | N/A | .text | CALL QWORD PTR [RIP+0x10B85] |
| 29A3 | N/A | .text | CALL QWORD PTR [RIP+0x10A67] |
| 29CD | N/A | .text | CALL QWORD PTR [RIP+0x10B4D] |
| 2A13 | N/A | .text | CALL QWORD PTR [RIP+0x10AFF] |
| 2A1F | N/A | .text | CALL QWORD PTR [RIP+0x10A03] |
| 2A93 | N/A | .text | JMP QWORD PTR [RIP+0x10BD7] |
| 2A9F | N/A | .text | JMP QWORD PTR [RIP+0x10A53] |
| 2ADC | N/A | .text | JMP QWORD PTR [RIP+0x10B8E] |
| 2AE8 | N/A | .text | JMP QWORD PTR [RIP+0x10A22] |
| 2B24 | N/A | .text | JMP QWORD PTR [RIP+0x10B46] |
| 2B30 | N/A | .text | JMP QWORD PTR [RIP+0x109CA] |
| 2B70 | N/A | .text | CALL QWORD PTR [RIP+0x10AFA] |
| 2B78 | N/A | .text | CALL QWORD PTR [RIP+0x1098A] |
| 2BCF | N/A | .text | CALL QWORD PTR [RIP+0x10A9B] |
| 2BD7 | N/A | .text | CALL QWORD PTR [RIP+0x10913] |
| 48D5 | N/A | .text | CALL QWORD PTR [RIP+0xED95] |
| 4919 | N/A | .text | CALL QWORD PTR [RIP+0xED51] |
| 4A97 | N/A | .text | CALL QWORD PTR [RIP+0xEBD3] |
| 4AAC | N/A | .text | CALL QWORD PTR [RIP+0xEBBE] |
| 4B5B | N/A | .text | CALL QWORD PTR [RIP+0xEB0F] |
| 4BFB | N/A | .text | CALL QWORD PTR [RIP+0xE8B7] |
| 4CC1 | N/A | .text | CALL QWORD PTR [RIP+0xE7A1] |
| 4CCC | N/A | .text | CALL QWORD PTR [RIP+0xE79E] |
| 4CDB | N/A | .text | CALL QWORD PTR [RIP+0xE84F] |
| 4D00 | N/A | .text | CALL QWORD PTR [RIP+0xE832] |
| 4D16 | N/A | .text | CALL QWORD PTR [RIP+0xE70C] |
| 4D23 | N/A | .text | CALL QWORD PTR [RIP+0xE947] |
| 4D33 | N/A | .text | CALL QWORD PTR [RIP+0xE7DF] |
| 5405 | N/A | .text | CALL QWORD PTR [RIP+0xE265] |
| 56BE | N/A | .text | CALL QWORD PTR [RIP+0xDFAC] |
| 5766 | N/A | .text | CALL QWORD PTR [RIP+0xDD0C] |
| 5C5D | N/A | .text | CALL QWORD PTR [RIP+0xD7DD] |
| 5C75 | N/A | .text | CALL QWORD PTR [RIP+0xD7CD] |
| 5CB0 | N/A | .text | CALL QWORD PTR [RIP+0xD79A] |
| 5CE9 | N/A | .text | CALL QWORD PTR [RIP+0xD7B9] |
| 5CF3 | N/A | .text | CALL QWORD PTR [RIP+0xD767] |
| 5CFE | N/A | .text | CALL QWORD PTR [RIP+0xD754] |
| 5D94 | N/A | .text | CALL QWORD PTR [RIP+0xD8D6] |
| 5E21 | N/A | .text | CALL QWORD PTR [RIP+0xD651] |
| 5E46 | N/A | .text | CALL QWORD PTR [RIP+0xD61C] |
| 5E59 | N/A | .text | JMP QWORD PTR [RIP+0xD611] |
| 5F4E | N/A | .text | CALL QWORD PTR [RIP+0xD5F4] |
| 5F60 | N/A | .text | CALL QWORD PTR [RIP+0xD4AA] |
| 60F6 | N/A | .text | CALL QWORD PTR [RIP+0xD30C] |
| 6100 | N/A | .text | CALL QWORD PTR [RIP+0xD30A] |
| 62DD | N/A | .text | CALL QWORD PTR [RIP+0xD205] |
| 630D | N/A | .text | JMP QWORD PTR [RIP+0xD1C5] |
| 6319 | N/A | .text | JMP QWORD PTR [RIP+0xD1C1] |
| 651B | N/A | .text | JMP QWORD PTR [RIP+0xCFB7] |
| 6543 | N/A | .text | CALL QWORD PTR [RIP+0xCF9F] |
| 656F | N/A | .text | JMP QWORD PTR [RIP+0xCF6B] |
| 65C6 | N/A | .text | CALL QWORD PTR [RIP+0xCF84] |
| 65DA | N/A | .text | CALL QWORD PTR [RIP+0xCE30] |
| 6707 | N/A | .text | CALL QWORD PTR [RIP+0xCE53] |
| 139C98-139CA8 | N/A | .data | Potential obfuscated jump sequence detected, count: 7 |
| 30D200 | 180001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 30D20C | 180001060 | .pdata | ExceptionHook | Pointer to 1060 - 0x460 .text + UnwindInfo: .rdata |
| 30D218 | 180001130 | .pdata | ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .rdata |
| 30D224 | 180001340 | .pdata | ExceptionHook | Pointer to 1340 - 0x740 .text + UnwindInfo: .rdata |
| 30D230 | 1800013BB | .pdata | ExceptionHook | Pointer to 13BB - 0x7BB .text + UnwindInfo: .rdata |
| 30D23C | 180001420 | .pdata | ExceptionHook | Pointer to 1420 - 0x820 .text + UnwindInfo: .rdata |
| 30D248 | 180001506 | .pdata | ExceptionHook | Pointer to 1506 - 0x906 .text + UnwindInfo: .rdata |
| 30D254 | 1800015BD | .pdata | ExceptionHook | Pointer to 15BD - 0x9BD .text + UnwindInfo: .rdata |
| 30D260 | 1800016D1 | .pdata | ExceptionHook | Pointer to 16D1 - 0xAD1 .text + UnwindInfo: .rdata |
| 30D26C | 18000181F | .pdata | ExceptionHook | Pointer to 181F - 0xC1F .text + UnwindInfo: .rdata |
| 30D278 | 180001845 | .pdata | ExceptionHook | Pointer to 1845 - 0xC45 .text + UnwindInfo: .rdata |
| 30D284 | 180001880 | .pdata | ExceptionHook | Pointer to 1880 - 0xC80 .text + UnwindInfo: .rdata |
| 30D290 | 1800018A0 | .pdata | ExceptionHook | Pointer to 18A0 - 0xCA0 .text + UnwindInfo: .rdata |
| 30D29C | 180001910 | .pdata | ExceptionHook | Pointer to 1910 - 0xD10 .text + UnwindInfo: .rdata |
| 30D2A8 | 180001930 | .pdata | ExceptionHook | Pointer to 1930 - 0xD30 .text + UnwindInfo: .rdata |
| 30D2B4 | 180001980 | .pdata | ExceptionHook | Pointer to 1980 - 0xD80 .text + UnwindInfo: .rdata |
| 30D2C0 | 180001A98 | .pdata | ExceptionHook | Pointer to 1A98 - 0xE98 .text + UnwindInfo: .rdata |
| 30D2CC | 180001B1C | .pdata | ExceptionHook | Pointer to 1B1C - 0xF1C .text + UnwindInfo: .rdata |
| 30D2D8 | 180001C50 | .pdata | ExceptionHook | Pointer to 1C50 - 0x1050 .text + UnwindInfo: .rdata |
| 30D2E4 | 180001C90 | .pdata | ExceptionHook | Pointer to 1C90 - 0x1090 .text + UnwindInfo: .rdata |
| 30D2F0 | 180001CC4 | .pdata | ExceptionHook | Pointer to 1CC4 - 0x10C4 .text + UnwindInfo: .rdata |
| 30D2FC | 180001D98 | .pdata | ExceptionHook | Pointer to 1D98 - 0x1198 .text + UnwindInfo: .rdata |
| 30D308 | 180001DAC | .pdata | ExceptionHook | Pointer to 1DAC - 0x11AC .text + UnwindInfo: .rdata |
| 30D314 | 180001E48 | .pdata | ExceptionHook | Pointer to 1E48 - 0x1248 .text + UnwindInfo: .rdata |
| 30D320 | 180001EB8 | .pdata | ExceptionHook | Pointer to 1EB8 - 0x12B8 .text + UnwindInfo: .rdata |
| 30D32C | 180001F2C | .pdata | ExceptionHook | Pointer to 1F2C - 0x132C .text + UnwindInfo: .rdata |
| 30D338 | 180001FFC | .pdata | ExceptionHook | Pointer to 1FFC - 0x13FC .text + UnwindInfo: .rdata |
| 30D344 | 180002018 | .pdata | ExceptionHook | Pointer to 2018 - 0x1418 .text + UnwindInfo: .rdata |
| 30D350 | 180002054 | .pdata | ExceptionHook | Pointer to 2054 - 0x1454 .text + UnwindInfo: .rdata |
| 30D35C | 180002088 | .pdata | ExceptionHook | Pointer to 2088 - 0x1488 .text + UnwindInfo: .rdata |
| 30D368 | 1800020A0 | .pdata | ExceptionHook | Pointer to 20A0 - 0x14A0 .text + UnwindInfo: .rdata |
| 30D374 | 1800020C8 | .pdata | ExceptionHook | Pointer to 20C8 - 0x14C8 .text + UnwindInfo: .rdata |
| 30D380 | 1800020E0 | .pdata | ExceptionHook | Pointer to 20E0 - 0x14E0 .text + UnwindInfo: .rdata |
| 30D38C | 180002140 | .pdata | ExceptionHook | Pointer to 2140 - 0x1540 .text + UnwindInfo: .rdata |
| 30D398 | 180002170 | .pdata | ExceptionHook | Pointer to 2170 - 0x1570 .text + UnwindInfo: .rdata |
| 30D3A4 | 180002184 | .pdata | ExceptionHook | Pointer to 2184 - 0x1584 .text + UnwindInfo: .rdata |
| 30D3B0 | 1800021D0 | .pdata | ExceptionHook | Pointer to 21D0 - 0x15D0 .text + UnwindInfo: .rdata |
| 30D3BC | 18000225C | .pdata | ExceptionHook | Pointer to 225C - 0x165C .text + UnwindInfo: .rdata |
| 30D3C8 | 1800022F4 | .pdata | ExceptionHook | Pointer to 22F4 - 0x16F4 .text + UnwindInfo: .rdata |
| 30D3D4 | 180002318 | .pdata | ExceptionHook | Pointer to 2318 - 0x1718 .text + UnwindInfo: .rdata |
| 30D3E0 | 180002354 | .pdata | ExceptionHook | Pointer to 2354 - 0x1754 .text + UnwindInfo: .rdata |
| 30D3EC | 1800024A0 | .pdata | ExceptionHook | Pointer to 24A0 - 0x18A0 .text + UnwindInfo: .rdata |
| 30D3F8 | 1800024DC | .pdata | ExceptionHook | Pointer to 24DC - 0x18DC .text + UnwindInfo: .rdata |
| 30D404 | 18000251C | .pdata | ExceptionHook | Pointer to 251C - 0x191C .text + UnwindInfo: .rdata |
| 30D410 | 1800026F0 | .pdata | ExceptionHook | Pointer to 26F0 - 0x1AF0 .text + UnwindInfo: .rdata |
| 30D41C | 180002710 | .pdata | ExceptionHook | Pointer to 2710 - 0x1B10 .text + UnwindInfo: .rdata |
| 30D428 | 180002D88 | .pdata | ExceptionHook | Pointer to 2D88 - 0x2188 .text + UnwindInfo: .rdata |
| 30D434 | 180002F94 | .pdata | ExceptionHook | Pointer to 2F94 - 0x2394 .text + UnwindInfo: .rdata |
| 30D440 | 180002FC0 | .pdata | ExceptionHook | Pointer to 2FC0 - 0x23C0 .text + UnwindInfo: .rdata |
| 30D44C | 180002FE8 | .pdata | ExceptionHook | Pointer to 2FE8 - 0x23E8 .text + UnwindInfo: .rdata |
| 30D458 | 180002FFC | .pdata | ExceptionHook | Pointer to 2FFC - 0x23FC .text + UnwindInfo: .rdata |
| 30D464 | 180003010 | .pdata | ExceptionHook | Pointer to 3010 - 0x2410 .text + UnwindInfo: .rdata |
| 30D470 | 18000302C | .pdata | ExceptionHook | Pointer to 302C - 0x242C .text + UnwindInfo: .rdata |
| 30D47C | 18000303C | .pdata | ExceptionHook | Pointer to 303C - 0x243C .text + UnwindInfo: .rdata |
| 30D488 | 1800030C0 | .pdata | ExceptionHook | Pointer to 30C0 - 0x24C0 .text + UnwindInfo: .rdata |
| 30D494 | 1800030E0 | .pdata | ExceptionHook | Pointer to 30E0 - 0x24E0 .text + UnwindInfo: .rdata |
| 30D4A0 | 180003280 | .pdata | ExceptionHook | Pointer to 3280 - 0x2680 .text + UnwindInfo: .rdata |
| 30D4AC | 1800032A0 | .pdata | ExceptionHook | Pointer to 32A0 - 0x26A0 .text + UnwindInfo: .rdata |
| 30D4B8 | 1800032B0 | .pdata | ExceptionHook | Pointer to 32B0 - 0x26B0 .text + UnwindInfo: .rdata |
| 30D4C4 | 1800032EC | .pdata | ExceptionHook | Pointer to 32EC - 0x26EC .text + UnwindInfo: .rdata |
| 30D4D0 | 18000330C | .pdata | ExceptionHook | Pointer to 330C - 0x270C .text + UnwindInfo: .rdata |
| 30D4DC | 18000335C | .pdata | ExceptionHook | Pointer to 335C - 0x275C .text + UnwindInfo: .rdata |
| 30D4E8 | 180003378 | .pdata | ExceptionHook | Pointer to 3378 - 0x2778 .text + UnwindInfo: .rdata |
| 30D4F4 | 180003438 | .pdata | ExceptionHook | Pointer to 3438 - 0x2838 .text + UnwindInfo: .rdata |
| 30D500 | 180003480 | .pdata | ExceptionHook | Pointer to 3480 - 0x2880 .text + UnwindInfo: .rdata |
| 30D50C | 1800034A4 | .pdata | ExceptionHook | Pointer to 34A4 - 0x28A4 .text + UnwindInfo: .rdata |
| 30D518 | 1800034D8 | .pdata | ExceptionHook | Pointer to 34D8 - 0x28D8 .text + UnwindInfo: .rdata |
| 30D524 | 180003510 | .pdata | ExceptionHook | Pointer to 3510 - 0x2910 .text + UnwindInfo: .rdata |
| 30D530 | 180003660 | .pdata | ExceptionHook | Pointer to 3660 - 0x2A60 .text + UnwindInfo: .rdata |
| 30D53C | 1800036A8 | .pdata | ExceptionHook | Pointer to 36A8 - 0x2AA8 .text + UnwindInfo: .rdata |
| 30D548 | 1800036F0 | .pdata | ExceptionHook | Pointer to 36F0 - 0x2AF0 .text + UnwindInfo: .rdata |
| 30D554 | 180003738 | .pdata | ExceptionHook | Pointer to 3738 - 0x2B38 .text + UnwindInfo: .rdata |
| 30D560 | 18000378C | .pdata | ExceptionHook | Pointer to 378C - 0x2B8C .text + UnwindInfo: .rdata |
| 30D56C | 180003800 | .pdata | ExceptionHook | Pointer to 3800 - 0x2C00 .text + UnwindInfo: .rdata |
| 30D578 | 180003850 | .pdata | ExceptionHook | Pointer to 3850 - 0x2C50 .text + UnwindInfo: .rdata |
| 30D584 | 180003880 | .pdata | ExceptionHook | Pointer to 3880 - 0x2C80 .text + UnwindInfo: .rdata |
| 30D590 | 1800038B0 | .pdata | ExceptionHook | Pointer to 38B0 - 0x2CB0 .text + UnwindInfo: .rdata |
| 30D59C | 1800038F8 | .pdata | ExceptionHook | Pointer to 38F8 - 0x2CF8 .text + UnwindInfo: .rdata |
| 30D5A8 | 18000397C | .pdata | ExceptionHook | Pointer to 397C - 0x2D7C .text + UnwindInfo: .rdata |
| 30D5B4 | 1800039E0 | .pdata | ExceptionHook | Pointer to 39E0 - 0x2DE0 .text + UnwindInfo: .rdata |
| 30D5C0 | 180003A7C | .pdata | ExceptionHook | Pointer to 3A7C - 0x2E7C .text + UnwindInfo: .rdata |
| 30D5CC | 180003B5C | .pdata | ExceptionHook | Pointer to 3B5C - 0x2F5C .text + UnwindInfo: .rdata |
| 30D5D8 | 180003B9C | .pdata | ExceptionHook | Pointer to 3B9C - 0x2F9C .text + UnwindInfo: .rdata |
| 30D5E4 | 180003BFC | .pdata | ExceptionHook | Pointer to 3BFC - 0x2FFC .text + UnwindInfo: .rdata |
| 30D5F0 | 180003C78 | .pdata | ExceptionHook | Pointer to 3C78 - 0x3078 .text + UnwindInfo: .rdata |
| 30D5FC | 180003CCC | .pdata | ExceptionHook | Pointer to 3CCC - 0x30CC .text + UnwindInfo: .rdata |
| 30D608 | 180003D34 | .pdata | ExceptionHook | Pointer to 3D34 - 0x3134 .text + UnwindInfo: .rdata |
| 30D614 | 180003DFC | .pdata | ExceptionHook | Pointer to 3DFC - 0x31FC .text + UnwindInfo: .rdata |
| 30D620 | 180003E3C | .pdata | ExceptionHook | Pointer to 3E3C - 0x323C .text + UnwindInfo: .rdata |
| 30D62C | 180003EA8 | .pdata | ExceptionHook | Pointer to 3EA8 - 0x32A8 .text + UnwindInfo: .rdata |
| 30D638 | 180003FB0 | .pdata | ExceptionHook | Pointer to 3FB0 - 0x33B0 .text + UnwindInfo: .rdata |
| 30D644 | 18000417C | .pdata | ExceptionHook | Pointer to 417C - 0x357C .text + UnwindInfo: .rdata |
| 30D650 | 180004224 | .pdata | ExceptionHook | Pointer to 4224 - 0x3624 .text + UnwindInfo: .rdata |
| 30D65C | 1800042AC | .pdata | ExceptionHook | Pointer to 42AC - 0x36AC .text + UnwindInfo: .rdata |
| 30D668 | 18000433C | .pdata | ExceptionHook | Pointer to 433C - 0x373C .text + UnwindInfo: .rdata |
| 30D674 | 1800043B4 | .pdata | ExceptionHook | Pointer to 43B4 - 0x37B4 .text + UnwindInfo: .rdata |
| 30D680 | 180004568 | .pdata | ExceptionHook | Pointer to 4568 - 0x3968 .text + UnwindInfo: .rdata |
| 30D68C | 18000460C | .pdata | ExceptionHook | Pointer to 460C - 0x3A0C .text + UnwindInfo: .rdata |
| 30D698 | 180004814 | .pdata | ExceptionHook | Pointer to 4814 - 0x3C14 .text + UnwindInfo: .rdata |
| 30D6A4 | 180004888 | .pdata | ExceptionHook | Pointer to 4888 - 0x3C88 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2184372 | 68,1199% |
| Null Byte Code | 44965 | 1,4022% |
© 2026 All rights reserved.