PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 633,06 KB
SHA-256 Hash: 6B6295657C8CE1818DE5329F8DC669AE7A233323E52CB6F8A28BC6C9A9AF5E45
SHA-1 Hash: 58A3D2666C47D7DC63212B837B91A927C50D0E8B
MD5 Hash: 20BC002A13A6FD64E25F9E95768C34E8
Imphash: 32015C6C9E87868ADF5376D1F47CFAFB
MajorOSVersion: 6
MinorOSVersion: 0
CheckSum: 000A7C0C
EntryPoint (rva): 32360
SizeOfHeaders: 400
SizeOfImage: A8000
ImageBase: 0000000180000000
Architecture: x64
ExportTable: 8F280
ImportTable: 90F28
IAT: 64000
Characteristics: 2022
TimeDateStamp: 5D64DE7A
Date: 27/08/2019 7:40:42
File Type: DLL
Number Of Sections: 8
ASLR: Disabled
Section Names (Optional Header): .text, .rdata, .data, .pdata, .gfids, .tls, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows Console
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 400 62600 1000 624FC
6.4029
2608792.87
.rdata
0x40000040
Initialized Data
Readable
 62A00 2E000 64000 2DF3A
4.9207
9158566.38
.data
0xC0000040
Initialized Data
Readable
Writeable
 90A00 3400 92000 9104
4.1607
589897.19
.pdata
0x40000040
Initialized Data
Readable
 93E00 6400 9C000 6300
5.7237
598866.34
.gfids
0x40000040
Initialized Data
Readable
 9A200 400 A3000 224
2.3784
138232.5
.tls
0xC0000040
Initialized Data
Readable
Writeable
 9A600 200 A4000 9
0.0204
130049
.rsrc
0x40000040
Initialized Data
Readable
 9A800 600 A5000 560
3.8468
95423
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 9AE00 1800 A6000 161C
5.305
47084.42
Description
OriginalFilename: VulcanMessage.dll
CompanyName: Adobe Inc
LegalCopyright: Copyright 2019, Adobe Inc. All rights reserved.
ProductName: Vulcan Message Library
FileVersion: 5.6.1.39
FileDescription: Vulcan Message Library
ProductVersion: 5.6.1.39
Language: English (United Kingdom) (ID=0x809)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) have the Entry Point
Information -> EntryPoint (calculated) - 31760
Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8470800004C8BC78BD3488BCE488B5C2430488B7424
Assembler
|MOV QWORD PTR [RSP + 8], RBX
|MOV QWORD PTR [RSP + 0X10], RSI
|PUSH RDI
|SUB RSP, 0X20
|MOV RDI, R8
|MOV EBX, EDX
|MOV RSI, RCX
|CMP EDX, 1
|JNE 0X180032381
|CALL 0X180032BC8
|MOV R8, RDI
|MOV EDX, EBX
|MOV RCX, RSI
|MOV RBX, QWORD PTR [RSP + 0X30]
Signatures
Rich Signature Analyzer:
Code -> D0C785EF94A6EBBC94A6EBBC94A6EBBC203A1ABC98A6EBBC203A18BC37A6EBBC203A19BCB5A6EBBCAFF8E8BD9CA6EBBCAFF8EEBDA3A6EBBCAFF8EFBDB0A6EBBC49593BBC95A6EBBC495920BC9FA6EBBC94A6EABC65A6EBBC01F8EEBDD3A6EBBC01F8E3BD87A6EBBC01F8EBBD95A6EBBC06F814BC95A6EBBC94A67CBC95A6EBBC01F8E9BD95A6EBBC5269636894A6EBBC
Footprint md5 Hash -> 6430D0ADFFD1FF9B824C875CBAB9F00C
• The Rich header apparently has not been modified
Certificate - Digital Signature:
• The file is signed and the signature is correct
Packer/Compiler
Compiler: Microsoft Visual Studio
Detect It Easy (die)
• PE+(64): compiler: Microsoft Visual C/C++(2015 v.14.0)[-]
• PE+(64): linker: Microsoft Linker(14.0, Visual Studio 2015 14.0*)[-]
• PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7]
• Entropy: 6.24278
Suspicious Functions
Library Function Description
KERNEL32.DLL CreateMutexW Create a named or unnamed mutex object for controlling access to a shared resource.
KERNEL32.DLL GetModuleFileNameA Retrieve the fully qualified path for the executable file of a specified module.
KERNEL32.DLL VirtualAlloc Reserve, commit, or both, a region of memory within the virtual address space of a process.
KERNEL32.DLL WriteFile Writes data to a specified file or input/output (I/O) device.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
SHELL32.DLL ShellExecuteExW Performs a run operation on a specific file.
ET Functions (carving)
Original Name -> VulcanMessage5.dll
??0EndPoint@api5@vulcan@adobe@@QEAA@AEBV0123@@Z
??0EndPoint@api5@vulcan@adobe@@QEAA@XZ
??0ErrorMessage@api5@vulcan@adobe@@QEAA@AEBV0123@@Z
??0ErrorMessage@api5@vulcan@adobe@@QEAA@XZ
??0GetEndPointsMessage@impl@vulcan@adobe@@QEAA@AEBV0123@@Z
??0GetEndPointsMessage@impl@vulcan@adobe@@QEAA@XZ
??0IVulcanMessageDispatcher@api5@vulcan@adobe@@QEAA@AEBV0123@@Z
??0IVulcanMessageDispatcher@api5@vulcan@adobe@@QEAA@XZ
??0IVulcanMessageListener@api5@vulcan@adobe@@QEAA@$$QEAV0123@@Z
??0IVulcanMessageListener@api5@vulcan@adobe@@QEAA@AEBV0123@@Z
??0IVulcanMessageListener@api5@vulcan@adobe@@QEAA@XZ
??0SuiteMessage@api5@vulcan@adobe@@QEAA@AEBV0123@@Z
??0SuiteMessage@api5@vulcan@adobe@@QEAA@PEBD@Z
??0VulcanMessage@api5@vulcan@adobe@@QEAA@AEBV0123@@Z
??0VulcanMessage@api5@vulcan@adobe@@QEAA@XZ
??1EndPoint@api5@vulcan@adobe@@UEAA@XZ
??1ErrorMessage@api5@vulcan@adobe@@UEAA@XZ
??1GetEndPointsMessage@impl@vulcan@adobe@@UEAA@XZ
??1IVulcanMessageDispatcher@api5@vulcan@adobe@@UEAA@XZ
??1SuiteMessage@api5@vulcan@adobe@@UEAA@XZ
??1VulcanMessage@api5@vulcan@adobe@@UEAA@XZ
??4EndPoint@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4ErrorMessage@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4GetEndPointsMessage@impl@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4IVulcanMessageDispatcher@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4IVulcanMessageListener@api5@vulcan@adobe@@QEAAAEAV0123@$$QEAV0123@@Z
??4IVulcanMessageListener@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4MessageUtil@api5@vulcan@adobe@@QEAAAEAV0123@$$QEAV0123@@Z
??4MessageUtil@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4SuiteMessage@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??4VulcanMessage@api5@vulcan@adobe@@QEAAAEAV0123@AEBV0123@@Z
??8EndPoint@api5@vulcan@adobe@@QEBA_NAEBV0123@@Z
??9EndPoint@api5@vulcan@adobe@@QEBA_NAEBV0123@@Z
??_7EndPoint@api5@vulcan@adobe@@6B@
??_7ErrorMessage@api5@vulcan@adobe@@6B@
??_7GetEndPointsMessage@impl@vulcan@adobe@@6B@
??_7IVulcanMessageDispatcher@api5@vulcan@adobe@@6B@
??_7IVulcanMessageListener@api5@vulcan@adobe@@6B@
??_7SuiteMessage@api5@vulcan@adobe@@6B@
??_7VulcanMessage@api5@vulcan@adobe@@6B@
?Clone@ErrorMessage@api5@vulcan@adobe@@UEBAPEAV1234@XZ
?Clone@GetEndPointsMessage@impl@vulcan@adobe@@UEBAPEAV1234@XZ
?Clone@SuiteMessage@api5@vulcan@adobe@@UEBAPEAV1234@XZ
?Create@EndPoint@api5@vulcan@adobe@@SA?AV1234@PEBD@Z
?CreateMessage@MessageUtil@api5@vulcan@adobe@@SAPEAVVulcanMessage@234@PEBD@Z
?CreateMessageByType@MessageUtil@api5@vulcan@adobe@@SAPEAVVulcanMessage@234@PEBD@Z
?DESTINATION_UNREACHABLE_ERROR@ErrorMessage@api5@vulcan@adobe@@2QEBDEB
?GetAppId@EndPoint@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetAppId@VulcanMessage@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetAppIdSize@EndPoint@api5@vulcan@adobe@@QEBA_KXZ
?GetAppIdSize@VulcanMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetAppVersion@EndPoint@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetAppVersion@VulcanMessage@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetAppVersionSize@EndPoint@api5@vulcan@adobe@@QEBA_KXZ
?GetAppVersionSize@VulcanMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PEAPEAD0@Z
?GetData@ErrorMessage@api5@vulcan@adobe@@UEBAXPEAD@Z
?GetData@GetEndPointsMessage@impl@vulcan@adobe@@UEBAXPEAD@Z
?GetData@SuiteMessage@api5@vulcan@adobe@@UEBAXPEAD@Z
?GetDataSize@ErrorMessage@api5@vulcan@adobe@@UEBA_KXZ
?GetDataSize@GetEndPointsMessage@impl@vulcan@adobe@@UEBA_KXZ
?GetDataSize@SuiteMessage@api5@vulcan@adobe@@UEBA_KXZ
?GetDestinationCount@SuiteMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetDestinations@SuiteMessage@api5@vulcan@adobe@@QEBAXPEAVEndPoint@234@@Z
?GetError@ErrorMessage@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetErrorSize@ErrorMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetFault@ErrorMessage@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetFaultSize@ErrorMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetId@EndPoint@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetIdSize@EndPoint@api5@vulcan@adobe@@QEBA_KXZ
?GetInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PEAPEAV1234@@Z
?GetPayload@SuiteMessage@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetPayloadSize@SuiteMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetResult@GetEndPointsMessage@impl@vulcan@adobe@@QEBAXPEAVEndPoint@api5@34@@Z
?GetResultCount@GetEndPointsMessage@impl@vulcan@adobe@@QEBA_KXZ
?GetScope@VulcanMessage@api5@vulcan@adobe@@QEBA?AW4MessageScope@234@XZ
?GetSource@SuiteMessage@api5@vulcan@adobe@@QEBA?AVEndPoint@234@XZ
?GetSourceEndPoint@GetEndPointsMessage@impl@vulcan@adobe@@QEBA?AVEndPoint@api5@34@XZ
?GetType@VulcanMessage@api5@vulcan@adobe@@QEBAXPEAD@Z
?GetTypeSize@VulcanMessage@api5@vulcan@adobe@@QEBA_KXZ
?GetXmlSize@EndPoint@api5@vulcan@adobe@@QEBA_KXZ
?GetXmlSize@VulcanMessage@api5@vulcan@adobe@@UEBA_KXZ
?INVALID_ENDPOINT@EndPoint@api5@vulcan@adobe@@2V1234@B
?IsRefreshEndPoints@GetEndPointsMessage@impl@vulcan@adobe@@QEAA_NXZ
?IsSuiteMessage@SuiteMessage@api5@vulcan@adobe@@SA_NAEBVVulcanMessage@234@@Z
?ReleaseInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SAXXZ
?SetAppId@EndPoint@api5@vulcan@adobe@@QEAAXPEBD@Z
?SetAppId@MessageUtil@api5@vulcan@adobe@@SAXAEAVVulcanMessage@234@PEBD@Z
?SetAppVersion@EndPoint@api5@vulcan@adobe@@QEAAXPEBD@Z
?SetAppVersion@MessageUtil@api5@vulcan@adobe@@SAXAEAVVulcanMessage@234@PEBD@Z
?SetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PEBD0@Z
?SetData@ErrorMessage@api5@vulcan@adobe@@UEAAXPEBD@Z
?SetData@GetEndPointsMessage@impl@vulcan@adobe@@UEAAXPEBD@Z
?SetData@SuiteMessage@api5@vulcan@adobe@@UEAAXPEBD@Z
?SetDestination@SuiteMessage@api5@vulcan@adobe@@QEAAXAEBVEndPoint@234@@Z
?SetDestinations@SuiteMessage@api5@vulcan@adobe@@QEAAXPEBVEndPoint@234@_K@Z
?SetId@EndPoint@api5@vulcan@adobe@@QEAAXPEBD@Z
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QEAAXPEBD@Z
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QEAAXPEBD_K@Z
?SetRefreshEndPoints@GetEndPointsMessage@impl@vulcan@adobe@@QEAAXXZ
?SetSource@SuiteMessage@api5@vulcan@adobe@@QEAAXAEBVEndPoint@234@@Z
?TYPE@ErrorMessage@api5@vulcan@adobe@@2QEBDEB
?TYPE@GetEndPointsMessage@impl@vulcan@adobe@@2QEBDEB
?TYPE_PREFIX@SuiteMessage@api5@vulcan@adobe@@2QEBDEB
?TYPE_PREFIX@VulcanMessage@api5@vulcan@adobe@@2QEBDEB
?ToXml@EndPoint@api5@vulcan@adobe@@QEBAXPEAD@Z
?ToXml@VulcanMessage@api5@vulcan@adobe@@UEBAXPEAD@Z
Windows REG (UNICODE)
SOFTWARE\Adobe\Vulcan\5.0
File Access
\IPCBox\AdobeIPCBroker.exe
SHELL32.dll
ADVAPI32.dll
USER32.dll
KERNEL32.dll
VulcanMessage5.dll
.dat
@.dat
Temp
AppData
UserProfile
File Access (UNICODE)
AdobeIPCBroker.exe
\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
VulcanMessage.dll
VulcanMessage5.dll
mscoree.dll
kernel32.dll
versionDbghelp.dll
shell32.dll
shlwapi.dll
ProgramFiles
Interest's Words
exec
attrib
start
shutdown
ping
Anti-VM/Sandbox/Debug Tricks (UNICODE)
OllyDbg Libary - dbghelp.dll
URLs
http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl
http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl
http://ocsp.digicert.com
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
http://www.digicert.com/ssl-cps-repository.htm
http://crl3.digicert.com/sha2-assured-ts.crl
http://crl4.digicert.com/sha2-assured-ts.crl
http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
https://www.digicert.com/CPS0
https://www.digicert.com/CPS0
https://www.digicert.com/CPS0
IP Addresses
5.6.1.39
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii WinAPI Sockets (bind)
Text Ascii WinAPI Sockets (listen)
Text Ascii WinAPI Sockets (accept)
Text Unicode WinAPI Sockets (accept)
Text Ascii WinAPI Sockets (connect)
Text Ascii WinAPI Sockets (recv)
Text Ascii WinAPI Sockets (send)
Text Ascii Registry (RegCreateKeyEx)
Text Ascii Registry (RegOpenKeyEx)
Text Ascii Registry (RegSetValueEx)
Text Ascii File (GetTempPath)
Text Ascii File (CopyFile)
Text Ascii File (CreateFile)
Text Ascii File (WriteFile)
Text Ascii File (ReadFile)
Text Ascii Service (OpenSCManager)
Text Ascii Service (CreateService)
Text Ascii Service (StartServiceCtrlDispatcher)
Text Ascii Anti-Analysis VM (IsDebuggerPresent)
Text Ascii Anti-Analysis VM (GlobalMemoryStatusEx)
Text Ascii Reconnaissance (FindNextFileA)
Text Ascii Reconnaissance (FindFirstFileW)
Text Ascii Reconnaissance (FindClose)
Text Ascii Stealth (ExitThread)
Text Ascii Stealth (ReleaseSemaphore)
Text Ascii Stealth (CloseHandle)
Text Ascii Stealth (UnmapViewOfFile)
Text Ascii Stealth (MapViewOfFile)
Text Ascii Stealth (VirtualAlloc)
Text Ascii Execution (CreateProcessW)
Text Ascii Execution (ShellExecute)
Text Ascii Execution (CreateSemaphoreW)
Text Ascii Execution (CreateEventW)
Text Unicode Privileges (SeIncreaseQuotaPrivilege)
Text Ascii Malicious code executed after exploiting a vulnerability (Payload)
Entry Point Hex Pattern Microsoft Visual C++ 8.0 (DLL)
Resources
Path DataRVA Size FileOffset CodeText
\VERSION\1\2057 A50A0 33C 9A8A0 3C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000600<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\2\1033 A53E0 17D 9ABE0 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779<?xml version='1.0' encoding='UTF-8' standalone='y
Intelligent String
• 5.6.1.39
• AdobeIPCBroker.exe
• @.tls
• C:\Program Files\Common Files
• \Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
• \Adobe\Vulcan\specifiers\adobedesktopservice.xml
• \IPCBox\AdobeIPCBroker.exe
• \Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
• shlwapi.dll
• shell32.dll
• versionDbghelp.dll
• kernel32.dll
• .exe
• .cmd
• .bat
• .com
• mscoree.dll
• Global\{CDF58EEC-E7BF-42dd-B3C5-AE2129FE636B}
• VulcanMessage5.pdb
• .bss
• .tls
• KERNEL32.dll
• USER32.dll
• ADVAPI32.dll
• VulcanMessage5.dll
• VulcanMessage.dll
• I0G08
Flow Anomalies
Offset FlowVA Section Description
69B N/A .text CALL QWORD PTR [RIP+0x62FD7]
6CB N/A .text CALL QWORD PTR [RIP+0x62FA7]
6FB N/A .text CALL QWORD PTR [RIP+0x62F77]
72B N/A .text CALL QWORD PTR [RIP+0x62F47]
2FBD N/A .text CALL QWORD PTR [RIP+0x606D5]
2FDC N/A .text CALL QWORD PTR [RIP+0x606D6]
2FE9 N/A .text CALL QWORD PTR [RIP+0x606A1]
2FF3 N/A .text CALL QWORD PTR [RIP+0x606AF]
2FFC N/A .text CALL QWORD PTR [RIP+0x6068E]
4CBC N/A .text CALL QWORD PTR [RIP+0x5E7A6]
4CEE N/A .text CALL QWORD PTR [RIP+0x5E77C]
4CFD N/A .text CALL QWORD PTR [RIP+0x5E75D]
4D07 N/A .text CALL QWORD PTR [RIP+0x5E753]
4D87 N/A .text CALL QWORD PTR [RIP+0x5E90B]
4DAA N/A .text CALL QWORD PTR [RIP+0x5E908]
4DB7 N/A .text CALL QWORD PTR [RIP+0x5E8D3]
4DC7 N/A .text CALL QWORD PTR [RIP+0x5E8DB]
4DD0 N/A .text CALL QWORD PTR [RIP+0x5E8BA]
4F34 N/A .text CALL QWORD PTR [RIP+0x5E776]
4F3D N/A .text CALL QWORD PTR [RIP+0x5E75D]
4F52 N/A .text CALL QWORD PTR [RIP+0x5E738]
4F5F N/A .text CALL QWORD PTR [RIP+0x5E72B]
18FBA N/A .text JMP QWORD PTR [RIP+0x4A6C0]
1947A N/A .text CALL QWORD PTR [RIP+0x4A208]
1952B N/A .text JMP QWORD PTR [RIP+0x4A14F]
19CD8 N/A .text CALL QWORD PTR [RIP+0x499AA]
19D06 N/A .text CALL QWORD PTR [RIP+0x49974]
19E6E N/A .text CALL QWORD PTR [RIP+0x49814]
19EA9 N/A .text JMP QWORD PTR [RIP+0x497D1]
19ECC N/A .text CALL QWORD PTR [RIP+0x497B6]
19F6D N/A .text JMP QWORD PTR [RIP+0x4970D]
19FBC N/A .text CALL QWORD PTR [RIP+0x496C6]
19FFC N/A .text CALL QWORD PTR [RIP+0x4967E]
1A048 N/A .text CALL QWORD PTR [RIP+0x4963A]
1A096 N/A .text CALL QWORD PTR [RIP+0x495E4]
1A169 N/A .text CALL QWORD PTR [RIP+0x49519]
1A192 N/A .text CALL QWORD PTR [RIP+0x494E8]
1A21B N/A .text CALL QWORD PTR [RIP+0x49467]
1A2DA N/A .text CALL QWORD PTR [RIP+0x493A0]
1A3A4 N/A .text CALL QWORD PTR [RIP+0x492DE]
1A487 N/A .text CALL QWORD PTR [RIP+0x491F3]
1A524 N/A .text CALL QWORD PTR [RIP+0x4915E]
1A5BE N/A .text CALL QWORD PTR [RIP+0x490BC]
1A61C N/A .text CALL QWORD PTR [RIP+0x49066]
1A65F N/A .text CALL QWORD PTR [RIP+0x4901B]
1A6A8 N/A .text CALL QWORD PTR [RIP+0x48FDA]
1A6FC N/A .text CALL QWORD PTR [RIP+0x48F7E]
1AADA N/A .text CALL QWORD PTR [RIP+0x48BA8]
1AB9E N/A .text CALL QWORD PTR [RIP+0x48ADC]
1ACDC N/A .text CALL QWORD PTR [RIP+0x489A6]
1AD1F N/A .text CALL QWORD PTR [RIP+0x4895B]
1AD68 N/A .text CALL QWORD PTR [RIP+0x4891A]
1ADBC N/A .text CALL QWORD PTR [RIP+0x488BE]
1AE22 N/A .text CALL QWORD PTR [RIP+0x48860]
1AEE1 N/A .text JMP QWORD PTR [RIP+0x48799]
1AF2C N/A .text CALL QWORD PTR [RIP+0x48756]
1AF6F N/A .text CALL QWORD PTR [RIP+0x4870B]
1AFB8 N/A .text CALL QWORD PTR [RIP+0x486CA]
1B00C N/A .text CALL QWORD PTR [RIP+0x4866E]
1B12F N/A .text CALL QWORD PTR [RIP+0x48553]
1B1DC N/A .text CALL QWORD PTR [RIP+0x4849E]
1B24C N/A .text CALL QWORD PTR [RIP+0x48436]
1B28F N/A .text CALL QWORD PTR [RIP+0x483EB]
1B2D8 N/A .text CALL QWORD PTR [RIP+0x483AA]
1B32C N/A .text CALL QWORD PTR [RIP+0x4834E]
1B44F N/A .text CALL QWORD PTR [RIP+0x48233]
1B4FC N/A .text CALL QWORD PTR [RIP+0x4817E]
1B56C N/A .text CALL QWORD PTR [RIP+0x48116]
1B5AF N/A .text CALL QWORD PTR [RIP+0x480CB]
1B5F8 N/A .text CALL QWORD PTR [RIP+0x4808A]
1B64C N/A .text CALL QWORD PTR [RIP+0x4802E]
1B6C8 N/A .text CALL QWORD PTR [RIP+0x47FBA]
1B77C N/A .text CALL QWORD PTR [RIP+0x47EFE]
1B83C N/A .text CALL QWORD PTR [RIP+0x47E46]
1B87F N/A .text CALL QWORD PTR [RIP+0x47DFB]
1B8C8 N/A .text CALL QWORD PTR [RIP+0x47DBA]
1B91C N/A .text CALL QWORD PTR [RIP+0x47D5E]
1BA3C N/A .text CALL QWORD PTR [RIP+0x47C46]
1BAEC N/A .text CALL QWORD PTR [RIP+0x47B8E]
1BB5D N/A .text CALL QWORD PTR [RIP+0x47B25]
1BB8D N/A .text CALL QWORD PTR [RIP+0x47AED]
1C55B N/A .text CALL QWORD PTR [RIP+0x47127]
1C57F N/A .text CALL QWORD PTR [RIP+0x470FB]
1C5F3 N/A .text CALL QWORD PTR [RIP+0x47087]
1C637 N/A .text CALL QWORD PTR [RIP+0x4704B]
1C6B7 N/A .text CALL QWORD PTR [RIP+0x46FC3]
1C6C4 N/A .text CALL QWORD PTR [RIP+0x46FB6]
1C721 N/A .text CALL QWORD PTR [RIP+0x46F61]
1C745 N/A .text CALL QWORD PTR [RIP+0x46F35]
1C7A0 N/A .text CALL QWORD PTR [RIP+0x46EDA]
1C7E7 N/A .text CALL QWORD PTR [RIP+0x46E93]
1C820 N/A .text CALL QWORD PTR [RIP+0x46E62]
1C883 N/A .text CALL QWORD PTR [RIP+0x46DF7]
1F126 N/A .text CALL QWORD PTR [RIP+0x44564]
1F2C2 N/A .text CALL QWORD PTR [RIP+0x443C8]
1F2F3 N/A .text CALL QWORD PTR [RIP+0x44397]
1F30B N/A .text CALL QWORD PTR [RIP+0x4437F]
1F323 N/A .text CALL QWORD PTR [RIP+0x44367]
1F4E3 N/A .text CALL QWORD PTR [RIP+0x441A7]
200F9 N/A .text CALL QWORD PTR [RIP+0x43569]
93E00 180001000 .pdata ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata
93E0C 180001050 .pdata ExceptionHook | Pointer to 1050 - 0x450 .text + UnwindInfo: .rdata
93E18 180001080 .pdata ExceptionHook | Pointer to 1080 - 0x480 .text + UnwindInfo: .rdata
93E24 1800010B0 .pdata ExceptionHook | Pointer to 10B0 - 0x4B0 .text + UnwindInfo: .rdata
93E30 1800010E0 .pdata ExceptionHook | Pointer to 10E0 - 0x4E0 .text + UnwindInfo: .rdata
93E3C 180001130 .pdata ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .rdata
93E48 180001160 .pdata ExceptionHook | Pointer to 1160 - 0x560 .text + UnwindInfo: .rdata
93E54 180001190 .pdata ExceptionHook | Pointer to 1190 - 0x590 .text + UnwindInfo: .rdata
93E60 1800011C0 .pdata ExceptionHook | Pointer to 11C0 - 0x5C0 .text + UnwindInfo: .rdata
93E6C 180001200 .pdata ExceptionHook | Pointer to 1200 - 0x600 .text + UnwindInfo: .rdata
93E78 180001230 .pdata ExceptionHook | Pointer to 1230 - 0x630 .text + UnwindInfo: .rdata
93E84 180001260 .pdata ExceptionHook | Pointer to 1260 - 0x660 .text + UnwindInfo: .rdata
93E90 180001290 .pdata ExceptionHook | Pointer to 1290 - 0x690 .text + UnwindInfo: .rdata
93E9C 1800012C0 .pdata ExceptionHook | Pointer to 12C0 - 0x6C0 .text + UnwindInfo: .rdata
93EA8 1800012F0 .pdata ExceptionHook | Pointer to 12F0 - 0x6F0 .text + UnwindInfo: .rdata
93EB4 180001320 .pdata ExceptionHook | Pointer to 1320 - 0x720 .text + UnwindInfo: .rdata
93EC0 180001350 .pdata ExceptionHook | Pointer to 1350 - 0x750 .text + UnwindInfo: .rdata
93ECC 180001390 .pdata ExceptionHook | Pointer to 1390 - 0x790 .text + UnwindInfo: .rdata
93ED8 1800013D0 .pdata ExceptionHook | Pointer to 13D0 - 0x7D0 .text + UnwindInfo: .rdata
93EE4 180001430 .pdata ExceptionHook | Pointer to 1430 - 0x830 .text + UnwindInfo: .rdata
93EF0 1800014A0 .pdata ExceptionHook | Pointer to 14A0 - 0x8A0 .text + UnwindInfo: .rdata
93EFC 1800014D0 .pdata ExceptionHook | Pointer to 14D0 - 0x8D0 .text + UnwindInfo: .rdata
93F08 180001510 .pdata ExceptionHook | Pointer to 1510 - 0x910 .text + UnwindInfo: .rdata
93F14 180001540 .pdata ExceptionHook | Pointer to 1540 - 0x940 .text + UnwindInfo: .rdata
93F20 180001584 .pdata ExceptionHook | Pointer to 1584 - 0x984 .text + UnwindInfo: .rdata
93F2C 1800015B0 .pdata ExceptionHook | Pointer to 15B0 - 0x9B0 .text + UnwindInfo: .rdata
93F38 180001750 .pdata ExceptionHook | Pointer to 1750 - 0xB50 .text + UnwindInfo: .rdata
93F44 180001890 .pdata ExceptionHook | Pointer to 1890 - 0xC90 .text + UnwindInfo: .rdata
93F50 180001980 .pdata ExceptionHook | Pointer to 1980 - 0xD80 .text + UnwindInfo: .rdata
93F5C 1800019F0 .pdata ExceptionHook | Pointer to 19F0 - 0xDF0 .text + UnwindInfo: .rdata
93F68 180001A70 .pdata ExceptionHook | Pointer to 1A70 - 0xE70 .text + UnwindInfo: .rdata
93F74 180001AA1 .pdata ExceptionHook | Pointer to 1AA1 - 0xEA1 .text + UnwindInfo: .rdata
93F80 180001B1E .pdata ExceptionHook | Pointer to 1B1E - 0xF1E .text + UnwindInfo: .rdata
93F8C 180001B40 .pdata ExceptionHook | Pointer to 1B40 - 0xF40 .text + UnwindInfo: .rdata
93F98 180001C82 .pdata ExceptionHook | Pointer to 1C82 - 0x1082 .text + UnwindInfo: .rdata
93FA4 180001DA4 .pdata ExceptionHook | Pointer to 1DA4 - 0x11A4 .text + UnwindInfo: .rdata
93FB0 180001ED6 .pdata ExceptionHook | Pointer to 1ED6 - 0x12D6 .text + UnwindInfo: .rdata
93FBC 180001EE0 .pdata ExceptionHook | Pointer to 1EE0 - 0x12E0 .text + UnwindInfo: .rdata
93FC8 180001F00 .pdata ExceptionHook | Pointer to 1F00 - 0x1300 .text + UnwindInfo: .rdata
93FD4 180001F20 .pdata ExceptionHook | Pointer to 1F20 - 0x1320 .text + UnwindInfo: .rdata
93FE0 180001F70 .pdata ExceptionHook | Pointer to 1F70 - 0x1370 .text + UnwindInfo: .rdata
93FEC 1800023D0 .pdata ExceptionHook | Pointer to 23D0 - 0x17D0 .text + UnwindInfo: .rdata
93FF8 1800025B0 .pdata ExceptionHook | Pointer to 25B0 - 0x19B0 .text + UnwindInfo: .rdata
94004 1800028D0 .pdata ExceptionHook | Pointer to 28D0 - 0x1CD0 .text + UnwindInfo: .rdata
94010 180002900 .pdata ExceptionHook | Pointer to 2900 - 0x1D00 .text + UnwindInfo: .rdata
9401C 18000295D .pdata ExceptionHook | Pointer to 295D - 0x1D5D .text + UnwindInfo: .rdata
94028 180002971 .pdata ExceptionHook | Pointer to 2971 - 0x1D71 .text + UnwindInfo: .rdata
94034 180002990 .pdata ExceptionHook | Pointer to 2990 - 0x1D90 .text + UnwindInfo: .rdata
94040 180002A30 .pdata ExceptionHook | Pointer to 2A30 - 0x1E30 .text + UnwindInfo: .rdata
9404C 180002A46 .pdata ExceptionHook | Pointer to 2A46 - 0x1E46 .text + UnwindInfo: .rdata
94058 180002A82 .pdata ExceptionHook | Pointer to 2A82 - 0x1E82 .text + UnwindInfo: .rdata
94064 180002AB0 .pdata ExceptionHook | Pointer to 2AB0 - 0x1EB0 .text + UnwindInfo: .rdata
94070 180002AE0 .pdata ExceptionHook | Pointer to 2AE0 - 0x1EE0 .text + UnwindInfo: .rdata
9407C 180002B3D .pdata ExceptionHook | Pointer to 2B3D - 0x1F3D .text + UnwindInfo: .rdata
94088 180002B51 .pdata ExceptionHook | Pointer to 2B51 - 0x1F51 .text + UnwindInfo: .rdata
94094 180002B60 .pdata ExceptionHook | Pointer to 2B60 - 0x1F60 .text + UnwindInfo: .rdata
940A0 180002BE0 .pdata ExceptionHook | Pointer to 2BE0 - 0x1FE0 .text + UnwindInfo: .rdata
940AC 180002C90 .pdata ExceptionHook | Pointer to 2C90 - 0x2090 .text + UnwindInfo: .rdata
940B8 180002D1A .pdata ExceptionHook | Pointer to 2D1A - 0x211A .text + UnwindInfo: .rdata
940C4 180002DBA .pdata ExceptionHook | Pointer to 2DBA - 0x21BA .text + UnwindInfo: .rdata
940D0 180002DC7 .pdata ExceptionHook | Pointer to 2DC7 - 0x21C7 .text + UnwindInfo: .rdata
940DC 180002DE0 .pdata ExceptionHook | Pointer to 2DE0 - 0x21E0 .text + UnwindInfo: .rdata
940E8 180002E2B .pdata ExceptionHook | Pointer to 2E2B - 0x222B .text + UnwindInfo: .rdata
940F4 180002EDD .pdata ExceptionHook | Pointer to 2EDD - 0x22DD .text + UnwindInfo: .rdata
94100 180002EF7 .pdata ExceptionHook | Pointer to 2EF7 - 0x22F7 .text + UnwindInfo: .rdata
9410C 180002F10 .pdata ExceptionHook | Pointer to 2F10 - 0x2310 .text + UnwindInfo: .rdata
94118 1800030A0 .pdata ExceptionHook | Pointer to 30A0 - 0x24A0 .text + UnwindInfo: .rdata
94124 180003100 .pdata ExceptionHook | Pointer to 3100 - 0x2500 .text + UnwindInfo: .rdata
94130 180003170 .pdata ExceptionHook | Pointer to 3170 - 0x2570 .text + UnwindInfo: .rdata
9413C 1800031D0 .pdata ExceptionHook | Pointer to 31D0 - 0x25D0 .text + UnwindInfo: .rdata
94148 180003240 .pdata ExceptionHook | Pointer to 3240 - 0x2640 .text + UnwindInfo: .rdata
94154 180003280 .pdata ExceptionHook | Pointer to 3280 - 0x2680 .text + UnwindInfo: .rdata
94160 1800032A0 .pdata ExceptionHook | Pointer to 32A0 - 0x26A0 .text + UnwindInfo: .rdata
9416C 180003300 .pdata ExceptionHook | Pointer to 3300 - 0x2700 .text + UnwindInfo: .rdata
94178 180003330 .pdata ExceptionHook | Pointer to 3330 - 0x2730 .text + UnwindInfo: .rdata
94184 1800033E0 .pdata ExceptionHook | Pointer to 33E0 - 0x27E0 .text + UnwindInfo: .rdata
94190 180003460 .pdata ExceptionHook | Pointer to 3460 - 0x2860 .text + UnwindInfo: .rdata
9419C 1800034C0 .pdata ExceptionHook | Pointer to 34C0 - 0x28C0 .text + UnwindInfo: .rdata
941A8 180003520 .pdata ExceptionHook | Pointer to 3520 - 0x2920 .text + UnwindInfo: .rdata
941B4 180003570 .pdata ExceptionHook | Pointer to 3570 - 0x2970 .text + UnwindInfo: .rdata
941C0 1800035D0 .pdata ExceptionHook | Pointer to 35D0 - 0x29D0 .text + UnwindInfo: .rdata
941CC 180003660 .pdata ExceptionHook | Pointer to 3660 - 0x2A60 .text + UnwindInfo: .rdata
941D8 180003700 .pdata ExceptionHook | Pointer to 3700 - 0x2B00 .text + UnwindInfo: .rdata
941E4 180003840 .pdata ExceptionHook | Pointer to 3840 - 0x2C40 .text + UnwindInfo: .rdata
941F0 1800039F0 .pdata ExceptionHook | Pointer to 39F0 - 0x2DF0 .text + UnwindInfo: .rdata
941FC 1800046D0 .pdata ExceptionHook | Pointer to 46D0 - 0x3AD0 .text + UnwindInfo: .rdata
94208 180004720 .pdata ExceptionHook | Pointer to 4720 - 0x3B20 .text + UnwindInfo: .rdata
94214 1800047C0 .pdata ExceptionHook | Pointer to 47C0 - 0x3BC0 .text + UnwindInfo: .rdata
94220 180004810 .pdata ExceptionHook | Pointer to 4810 - 0x3C10 .text + UnwindInfo: .rdata
9422C 180004AA0 .pdata ExceptionHook | Pointer to 4AA0 - 0x3EA0 .text + UnwindInfo: .rdata
94238 180004C30 .pdata ExceptionHook | Pointer to 4C30 - 0x4030 .text + UnwindInfo: .rdata
94244 180004CC0 .pdata ExceptionHook | Pointer to 4CC0 - 0x40C0 .text + UnwindInfo: .rdata
94250 180004E70 .pdata ExceptionHook | Pointer to 4E70 - 0x4270 .text + UnwindInfo: .rdata
9425C 180004FE0 .pdata ExceptionHook | Pointer to 4FE0 - 0x43E0 .text + UnwindInfo: .rdata
94268 180005120 .pdata ExceptionHook | Pointer to 5120 - 0x4520 .text + UnwindInfo: .rdata
94274 180005220 .pdata ExceptionHook | Pointer to 5220 - 0x4620 .text + UnwindInfo: .rdata
94280 180005270 .pdata ExceptionHook | Pointer to 5270 - 0x4670 .text + UnwindInfo: .rdata
9428C 1800053B0 .pdata ExceptionHook | Pointer to 53B0 - 0x47B0 .text + UnwindInfo: .rdata
94298 180005540 .pdata ExceptionHook | Pointer to 5540 - 0x4940 .text + UnwindInfo: .rdata
942A4 1800055C0 .pdata ExceptionHook | Pointer to 55C0 - 0x49C0 .text + UnwindInfo: .rdata
9C600 N/A *Overlay* 401E00000002020030821E3306092A864886F70D | @.......0..3..*.H...
Extra Analysis
Metric Value Percentage
Ascii Code 369801 57,0455%
Null Byte Code 135760 20,9423%
© 2026 All rights reserved.