PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 5,95 MB SHA-256 Hash: 92C079A166898099598D8D864E62DB65B639BA2F67C87B6A21922C090FC4C9B5 SHA-1 Hash: 409B53128926CC4B2F6BC7FCE07E5F995AF3711C MD5 Hash: 2A84B12F513DC7A36E4E0FE6C40CE213 Imphash: 43C578FA57444551B567C3D1F8066035 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 005FDC80 EntryPoint (rva): 1440 SizeOfHeaders: 600 SizeOfImage: 587000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 114000 IAT: 114780 Characteristics: 26 TimeDateStamp: 6A860EA1 Date: 19/08/2026 20:14:25 File Type: DLL Number Of Sections: 20 ASLR: Disabled Section Names (Optional Header): .text, .data, .rdata, .pdata, .xdata, .bss, .idata, .tls, .reloc, /4, /19, /31, /45, /57, /70, /81, /92, /106, /122, /138 Number Of Executable Sections: 1 Subsystem: Windows Console |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
600 | D1A00 | 1000 | D1940 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
D2000 | C00 | D3000 | B60 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
D2C00 | 26800 | D4000 | 26658 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
F9400 | 8600 | FB000 | 843C |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
101A00 | E800 | 104000 | E6F8 |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | 113000 | 240 |
|
|
| .idata | 0x40000040 Initialized Data Readable |
110200 | 2000 | 114000 | 1EFC |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
112200 | 200 | 116000 | 10 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
112400 | 1000 | 117000 | FF0 |
|
|
| /4 | 0x42000040 Initialized Data GP-Relative Readable |
113400 | 1000 | 118000 | ED0 |
|
|
| /19 | 0x42000040 Initialized Data GP-Relative Readable |
114400 | 159600 | 119000 | 1594C2 |
|
|
| /31 | 0x42000040 Initialized Data GP-Relative Readable |
26DA00 | 7000 | 273000 | 6FF4 |
|
|
| /45 | 0x42000040 Initialized Data GP-Relative Readable |
274A00 | 79E00 | 27A000 | 79D4A |
|
|
| /57 | 0x42000040 Initialized Data GP-Relative Readable |
2EE800 | A00 | 2F4000 | 820 |
|
|
| /70 | 0x42000040 Initialized Data GP-Relative Readable |
2EF200 | 222A00 | 2F5000 | 222853 |
|
|
| /81 | 0x42000040 Initialized Data GP-Relative Readable |
511C00 | 1C00 | 518000 | 1A66 |
|
|
| /92 | 0x42000040 Initialized Data GP-Relative Readable |
513800 | 67C00 | 51A000 | 67AD0 |
|
|
| /106 | 0x42000040 Initialized Data GP-Relative Readable |
57B400 | 1200 | 582000 | 102F |
|
|
| /122 | 0x42000040 Initialized Data GP-Relative Readable |
57C600 | 1600 | 584000 | 1452 |
|
|
| /138 | 0x42000040 Initialized Data GP-Relative Readable |
57DC00 | 200 | 586000 | 18C |
|
|
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 437,52 KB |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - A40 Code -> 4883EC28488B0595900F00C70000000000E8CAFBFFFF90904883C428C30F1F00E993010D009090909090909090909090488D Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0XF9095] |MOV DWORD PTR [RAX], 0 |CALL 0X140001020 |NOP |NOP |ADD RSP, 0X28 |RET |NOP DWORD PTR [RAX] |JMP 0X1400D15F8 |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • Entropy: 6.36318 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | WSAStartup | Initializes the Winsock networking library. |
| Ws2_32.DLL | WSACleanup | Releases Winsock networking resources. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | listen | Puts a socket into listening mode. |
| Ws2_32.DLL | accept | Accepts an incoming network connection. |
| Ws2_32.DLL | recv | Receives data from a network socket. |
| Ws2_32.DLL | send | Sends data through a network socket. |
| File Access |
| \cmd.exe cmd.exe .exe ntdll.dll msvcrt.dll KERNEL32.dll bcryptprimitives.dll api-ms-win-core-synch-l1-2-0.dll ws2_32.dll userenv.dll user32.dll oleaut32.dll ole32.dll ole32.dll Windows.Foundation.PropertyValuecombase.dll .dll combase.dll .dat valuelog.txt Temp RootDir UserProfile |
| File Access (UNICODE) |
| msys-cygwin--ptyNTDLL.DLL |
| Interest's Words |
| KeyLogger exec attrib start pause hostname shutdown systeminfo ping replace |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Malicious code executed after exploiting a vulnerability (Payload) |
| Text | Ascii | Software that records keystrokes to capture credentials (Keylogger) |
| Text | Ascii | Software that installs additional malicious payloads (Dropper) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Windows or OS/2 Graphics format |
| Intelligent String |
| • .bss • @.bss • @.tls • %%cd:~,cmd.exe /e:ON /v:OFF /d /c "batch file arguments are invalid • @kernel32.dll • (@ole32.dll • P@P@P@user32.dll • d@userenv.dll • x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@x@ws2_32.dll • @@@api-ms-win-core-synch-l1-2-0.dll • @bcryptprimitives.dll • @KERNEL32.dll • @msvcrt.dll • @ntdll.dll • c_str.rsA • windows.rsB • print.rsC • mod.rsD • dir.rsE • gcc.rsF • windows.rsG • tcp.rsH • udp.rsH • context.rsI • waker.rsI • futex.rsJ • windows.rsK • sse2.rsL • socket_addr.rsM • os_str.rsN • mod.rsO • wtf8.rsP • mod.rsK • mod.rsQ • windows.rsR • win64.rsS • mod.rsS • windows.rsT • src\read\coff\symbol.rsU • src\arch\x86_64\memchr.rsV • src\read\util.rsU • src\arch\generic\memchr.rsV • src\memchr.rsV • src\ext.rsV • src\read\coff\section.rsU • src\read\pe\section.rsU • src\read\read_ref.rsU • src\read\mod.rsU • addr.rsW • stream.rsW • listener.rsW • windows_sys.rsX • hostname.rsH • windows.rsY • mod.rsZ • windows.rsZ • mod.rsB • src\read\pe\file.rsU • remove_dir_all.rsE • windows_prefix.rsK • builders.rsD • num.rsD • socket_addr.rsH • mod.rsa • zero.rsI • uninit.rsb • vector.rsc • eq.rsd • masks.rsc • .tls |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 786 | N/A | .text | CALL QWORD PTR [RIP+0x1138D4] |
| 8CE74 | N/A | .text | JMP QWORD PTR [RIP+0x8741E] |
| 8CE7C | N/A | .text | JMP QWORD PTR [RIP+0x87406] |
| 8CE84 | N/A | .text | JMP QWORD PTR [RIP+0x873F6] |
| 8CE8C | N/A | .text | JMP QWORD PTR [RIP+0x873E6] |
| CFEE0 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFEE8 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFEF0 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFEF8 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF00 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF08 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF10 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF18 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF20 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF28 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF30 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF38 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF40 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF48 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF50 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF58 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF60 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF68 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF70 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF78 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF80 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF88 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF90 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFF98 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFFA0 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFFA8 | N/A | .text | JMP QWORD PTR [RIP+0x442BA] |
| CFFB0 | N/A | .text | JMP QWORD PTR [RIP+0x441DA] |
| CFFB8 | N/A | .text | JMP QWORD PTR [RIP+0x441B2] |
| CFFC0 | N/A | .text | JMP QWORD PTR [RIP+0x441B2] |
| CFFC8 | N/A | .text | JMP QWORD PTR [RIP+0x441B2] |
| CFFD0 | N/A | .text | JMP QWORD PTR [RIP+0x4416A] |
| CFFD8 | N/A | .text | JMP QWORD PTR [RIP+0x4416A] |
| CFFE0 | N/A | .text | JMP QWORD PTR [RIP+0x4416A] |
| CFFE8 | N/A | .text | JMP QWORD PTR [RIP+0x4416A] |
| CFFF0 | N/A | .text | JMP QWORD PTR [RIP+0x4416A] |
| CFFF8 | N/A | .text | JMP QWORD PTR [RIP+0x44132] |
| D0000 | N/A | .text | JMP QWORD PTR [RIP+0x440FA] |
| D0008 | N/A | .text | JMP QWORD PTR [RIP+0x440FA] |
| D0010 | N/A | .text | JMP QWORD PTR [RIP+0x440FA] |
| D0018 | N/A | .text | JMP QWORD PTR [RIP+0x440FA] |
| D0020 | N/A | .text | JMP QWORD PTR [RIP+0x440FA] |
| D0028 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0030 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0038 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0040 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0048 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0050 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0058 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0060 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0068 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0070 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0078 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0080 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0088 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0090 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0098 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00A0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00A8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00B0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00B8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00C0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00C8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00D0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00D8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00E0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00E8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00F0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D00F8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0100 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0108 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0110 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0118 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0120 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0128 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0130 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0138 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0140 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0148 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0150 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0158 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0160 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0168 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0170 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0178 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0180 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0188 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0190 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D0198 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01A0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01A8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01B0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01B8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01C0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01C8 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| D01D0 | N/A | .text | JMP QWORD PTR [RIP+0x43D52] |
| 73ACB-73AE1 | N/A | .text | Potential obfuscated jump sequence detected, count: 7 |
| F9228 | 140079230 | .rdata | TLS Callback | Pointer to 79230 - 0x78830 .text |
| F9230 | 1400D1770 | .rdata | TLS Callback | Pointer to D1770 - 0xD0D70 .text |
| F9238 | 1400D1750 | .rdata | TLS Callback | Pointer to D1750 - 0xD0D50 .text |
| F9400 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x600 .text + UnwindInfo: .xdata |
| F940C | 140001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x610 .text + UnwindInfo: .xdata |
| F9418 | 140001020 | .pdata | ExceptionHook | Pointer to 1020 - 0x620 .text + UnwindInfo: .xdata |
| F9424 | 140001420 | .pdata | ExceptionHook | Pointer to 1420 - 0xA20 .text + UnwindInfo: .xdata |
| F9430 | 140001440 | .pdata | ExceptionHook | Pointer to 1440 - 0xA40 .text + UnwindInfo: .xdata |
| F943C | 140001460 | .pdata | ExceptionHook | Pointer to 1460 - 0xA60 .text + UnwindInfo: .xdata |
| F9448 | 140001470 | .pdata | ExceptionHook | Pointer to 1470 - 0xA70 .text + UnwindInfo: .xdata |
| F9454 | 140001480 | .pdata | ExceptionHook | Pointer to 1480 - 0xA80 .text + UnwindInfo: .xdata |
| F9460 | 140001490 | .pdata | ExceptionHook | Pointer to 1490 - 0xA90 .text + UnwindInfo: .xdata |
| F946C | 1400014E0 | .pdata | ExceptionHook | Pointer to 14E0 - 0xAE0 .text + UnwindInfo: .xdata |
| F9478 | 140001520 | .pdata | ExceptionHook | Pointer to 1520 - 0xB20 .text + UnwindInfo: .xdata |
| F9484 | 140001570 | .pdata | ExceptionHook | Pointer to 1570 - 0xB70 .text + UnwindInfo: .xdata |
| F9490 | 140001590 | .pdata | ExceptionHook | Pointer to 1590 - 0xB90 .text + UnwindInfo: .xdata |
| F949C | 1400015B0 | .pdata | ExceptionHook | Pointer to 15B0 - 0xBB0 .text + UnwindInfo: .xdata |
| F94A8 | 1400015D0 | .pdata | ExceptionHook | Pointer to 15D0 - 0xBD0 .text + UnwindInfo: .xdata |
| F94B4 | 1400015F0 | .pdata | ExceptionHook | Pointer to 15F0 - 0xBF0 .text + UnwindInfo: .xdata |
| F94C0 | 140001640 | .pdata | ExceptionHook | Pointer to 1640 - 0xC40 .text + UnwindInfo: .xdata |
| F94CC | 140001820 | .pdata | ExceptionHook | Pointer to 1820 - 0xE20 .text + UnwindInfo: .xdata |
| F94D8 | 140001870 | .pdata | ExceptionHook | Pointer to 1870 - 0xE70 .text + UnwindInfo: .xdata |
| F94E4 | 1400018C0 | .pdata | ExceptionHook | Pointer to 18C0 - 0xEC0 .text + UnwindInfo: .xdata |
| F94F0 | 140001EB0 | .pdata | ExceptionHook | Pointer to 1EB0 - 0x14B0 .text + UnwindInfo: .xdata |
| F94FC | 140001EF0 | .pdata | ExceptionHook | Pointer to 1EF0 - 0x14F0 .text + UnwindInfo: .xdata |
| F9508 | 140001F10 | .pdata | ExceptionHook | Pointer to 1F10 - 0x1510 .text + UnwindInfo: .xdata |
| F9514 | 140001F90 | .pdata | ExceptionHook | Pointer to 1F90 - 0x1590 .text + UnwindInfo: .xdata |
| F9520 | 1400020F0 | .pdata | ExceptionHook | Pointer to 20F0 - 0x16F0 .text + UnwindInfo: .xdata |
| F952C | 140002120 | .pdata | ExceptionHook | Pointer to 2120 - 0x1720 .text + UnwindInfo: .xdata |
| F9538 | 140002320 | .pdata | ExceptionHook | Pointer to 2320 - 0x1920 .text + UnwindInfo: .xdata |
| F9544 | 140002350 | .pdata | ExceptionHook | Pointer to 2350 - 0x1950 .text + UnwindInfo: .xdata |
| F9550 | 1400023A0 | .pdata | ExceptionHook | Pointer to 23A0 - 0x19A0 .text + UnwindInfo: .xdata |
| F955C | 1400023C0 | .pdata | ExceptionHook | Pointer to 23C0 - 0x19C0 .text + UnwindInfo: .xdata |
| F9568 | 140002410 | .pdata | ExceptionHook | Pointer to 2410 - 0x1A10 .text + UnwindInfo: .xdata |
| F9574 | 140002420 | .pdata | ExceptionHook | Pointer to 2420 - 0x1A20 .text + UnwindInfo: .xdata |
| F9580 | 140002470 | .pdata | ExceptionHook | Pointer to 2470 - 0x1A70 .text + UnwindInfo: .xdata |
| F958C | 1400024B0 | .pdata | ExceptionHook | Pointer to 24B0 - 0x1AB0 .text + UnwindInfo: .xdata |
| F9598 | 1400024C0 | .pdata | ExceptionHook | Pointer to 24C0 - 0x1AC0 .text + UnwindInfo: .xdata |
| F95A4 | 1400024E0 | .pdata | ExceptionHook | Pointer to 24E0 - 0x1AE0 .text + UnwindInfo: .xdata |
| F95B0 | 1400025A0 | .pdata | ExceptionHook | Pointer to 25A0 - 0x1BA0 .text + UnwindInfo: .xdata |
| F95BC | 1400025C0 | .pdata | ExceptionHook | Pointer to 25C0 - 0x1BC0 .text + UnwindInfo: .xdata |
| F95C8 | 140002600 | .pdata | ExceptionHook | Pointer to 2600 - 0x1C00 .text + UnwindInfo: .xdata |
| F95D4 | 140002640 | .pdata | ExceptionHook | Pointer to 2640 - 0x1C40 .text + UnwindInfo: .xdata |
| F95E0 | 140002680 | .pdata | ExceptionHook | Pointer to 2680 - 0x1C80 .text + UnwindInfo: .xdata |
| F95EC | 1400026A0 | .pdata | ExceptionHook | Pointer to 26A0 - 0x1CA0 .text + UnwindInfo: .xdata |
| F95F8 | 1400026C0 | .pdata | ExceptionHook | Pointer to 26C0 - 0x1CC0 .text + UnwindInfo: .xdata |
| F9604 | 140002710 | .pdata | ExceptionHook | Pointer to 2710 - 0x1D10 .text + UnwindInfo: .xdata |
| F9610 | 140002740 | .pdata | ExceptionHook | Pointer to 2740 - 0x1D40 .text + UnwindInfo: .xdata |
| F961C | 140002760 | .pdata | ExceptionHook | Pointer to 2760 - 0x1D60 .text + UnwindInfo: .xdata |
| F9628 | 140002770 | .pdata | ExceptionHook | Pointer to 2770 - 0x1D70 .text + UnwindInfo: .xdata |
| F9634 | 1400027E0 | .pdata | ExceptionHook | Pointer to 27E0 - 0x1DE0 .text + UnwindInfo: .xdata |
| F9640 | 140002800 | .pdata | ExceptionHook | Pointer to 2800 - 0x1E00 .text + UnwindInfo: .xdata |
| F964C | 140002820 | .pdata | ExceptionHook | Pointer to 2820 - 0x1E20 .text + UnwindInfo: .xdata |
| F9658 | 140002860 | .pdata | ExceptionHook | Pointer to 2860 - 0x1E60 .text + UnwindInfo: .xdata |
| F9664 | 140002880 | .pdata | ExceptionHook | Pointer to 2880 - 0x1E80 .text + UnwindInfo: .xdata |
| F9670 | 1400028B0 | .pdata | ExceptionHook | Pointer to 28B0 - 0x1EB0 .text + UnwindInfo: .xdata |
| F967C | 140002930 | .pdata | ExceptionHook | Pointer to 2930 - 0x1F30 .text + UnwindInfo: .xdata |
| F9688 | 140002950 | .pdata | ExceptionHook | Pointer to 2950 - 0x1F50 .text + UnwindInfo: .xdata |
| F9694 | 140002970 | .pdata | ExceptionHook | Pointer to 2970 - 0x1F70 .text + UnwindInfo: .xdata |
| F96A0 | 140002990 | .pdata | ExceptionHook | Pointer to 2990 - 0x1F90 .text + UnwindInfo: .xdata |
| F96AC | 1400029B0 | .pdata | ExceptionHook | Pointer to 29B0 - 0x1FB0 .text + UnwindInfo: .xdata |
| F96B8 | 1400029D0 | .pdata | ExceptionHook | Pointer to 29D0 - 0x1FD0 .text + UnwindInfo: .xdata |
| F96C4 | 1400029F0 | .pdata | ExceptionHook | Pointer to 29F0 - 0x1FF0 .text + UnwindInfo: .xdata |
| F96D0 | 140002A10 | .pdata | ExceptionHook | Pointer to 2A10 - 0x2010 .text + UnwindInfo: .xdata |
| F96DC | 140002A70 | .pdata | ExceptionHook | Pointer to 2A70 - 0x2070 .text + UnwindInfo: .xdata |
| F96E8 | 140002AB0 | .pdata | ExceptionHook | Pointer to 2AB0 - 0x20B0 .text + UnwindInfo: .xdata |
| F96F4 | 140002B90 | .pdata | ExceptionHook | Pointer to 2B90 - 0x2190 .text + UnwindInfo: .xdata |
| F9700 | 140002C80 | .pdata | ExceptionHook | Pointer to 2C80 - 0x2280 .text + UnwindInfo: .xdata |
| F970C | 140002CB0 | .pdata | ExceptionHook | Pointer to 2CB0 - 0x22B0 .text + UnwindInfo: .xdata |
| F9718 | 140002CD0 | .pdata | ExceptionHook | Pointer to 2CD0 - 0x22D0 .text + UnwindInfo: .xdata |
| F9724 | 140002CF0 | .pdata | ExceptionHook | Pointer to 2CF0 - 0x22F0 .text + UnwindInfo: .xdata |
| F9730 | 140002D50 | .pdata | ExceptionHook | Pointer to 2D50 - 0x2350 .text + UnwindInfo: .xdata |
| F973C | 140003070 | .pdata | ExceptionHook | Pointer to 3070 - 0x2670 .text + UnwindInfo: .xdata |
| F9748 | 140003140 | .pdata | ExceptionHook | Pointer to 3140 - 0x2740 .text + UnwindInfo: .xdata |
| F9754 | 140003160 | .pdata | ExceptionHook | Pointer to 3160 - 0x2760 .text + UnwindInfo: .xdata |
| F9760 | 140003190 | .pdata | ExceptionHook | Pointer to 3190 - 0x2790 .text + UnwindInfo: .xdata |
| F976C | 1400031B0 | .pdata | ExceptionHook | Pointer to 31B0 - 0x27B0 .text + UnwindInfo: .xdata |
| F9778 | 140003290 | .pdata | ExceptionHook | Pointer to 3290 - 0x2890 .text + UnwindInfo: .xdata |
| F9784 | 1400032D0 | .pdata | ExceptionHook | Pointer to 32D0 - 0x28D0 .text + UnwindInfo: .xdata |
| F9790 | 1400032F0 | .pdata | ExceptionHook | Pointer to 32F0 - 0x28F0 .text + UnwindInfo: .xdata |
| F979C | 1400033F0 | .pdata | ExceptionHook | Pointer to 33F0 - 0x29F0 .text + UnwindInfo: .xdata |
| F97A8 | 140003460 | .pdata | ExceptionHook | Pointer to 3460 - 0x2A60 .text + UnwindInfo: .xdata |
| F97B4 | 140003480 | .pdata | ExceptionHook | Pointer to 3480 - 0x2A80 .text + UnwindInfo: .xdata |
| F97C0 | 1400034B0 | .pdata | ExceptionHook | Pointer to 34B0 - 0x2AB0 .text + UnwindInfo: .xdata |
| F97CC | 140003530 | .pdata | ExceptionHook | Pointer to 3530 - 0x2B30 .text + UnwindInfo: .xdata |
| F97D8 | 140003580 | .pdata | ExceptionHook | Pointer to 3580 - 0x2B80 .text + UnwindInfo: .xdata |
| F97E4 | 1400035F0 | .pdata | ExceptionHook | Pointer to 35F0 - 0x2BF0 .text + UnwindInfo: .xdata |
| F97F0 | 140003620 | .pdata | ExceptionHook | Pointer to 3620 - 0x2C20 .text + UnwindInfo: .xdata |
| F97FC | 140003670 | .pdata | ExceptionHook | Pointer to 3670 - 0x2C70 .text + UnwindInfo: .xdata |
| F9808 | 1400036B0 | .pdata | ExceptionHook | Pointer to 36B0 - 0x2CB0 .text + UnwindInfo: .xdata |
| F9814 | 140003730 | .pdata | ExceptionHook | Pointer to 3730 - 0x2D30 .text + UnwindInfo: .xdata |
| F9820 | 140003780 | .pdata | ExceptionHook | Pointer to 3780 - 0x2D80 .text + UnwindInfo: .xdata |
| F982C | 140003880 | .pdata | ExceptionHook | Pointer to 3880 - 0x2E80 .text + UnwindInfo: .xdata |
| F9838 | 1400038B0 | .pdata | ExceptionHook | Pointer to 38B0 - 0x2EB0 .text + UnwindInfo: .xdata |
| F9844 | 1400038E0 | .pdata | ExceptionHook | Pointer to 38E0 - 0x2EE0 .text + UnwindInfo: .xdata |
| F9850 | 140003910 | .pdata | ExceptionHook | Pointer to 3910 - 0x2F10 .text + UnwindInfo: .xdata |
| F985C | 140003960 | .pdata | ExceptionHook | Pointer to 3960 - 0x2F60 .text + UnwindInfo: .xdata |
| F9868 | 1400039A0 | .pdata | ExceptionHook | Pointer to 39A0 - 0x2FA0 .text + UnwindInfo: .xdata |
| F9874 | 140003AC0 | .pdata | ExceptionHook | Pointer to 3AC0 - 0x30C0 .text + UnwindInfo: .xdata |
| F9880 | 140003B90 | .pdata | ExceptionHook | Pointer to 3B90 - 0x3190 .text + UnwindInfo: .xdata |
| F988C | 140003C40 | .pdata | ExceptionHook | Pointer to 3C40 - 0x3240 .text + UnwindInfo: .xdata |
| F9898 | 140003CA0 | .pdata | ExceptionHook | Pointer to 3CA0 - 0x32A0 .text + UnwindInfo: .xdata |
| F98A4 | 140003CD0 | .pdata | ExceptionHook | Pointer to 3CD0 - 0x32D0 .text + UnwindInfo: .xdata |
| 57DE00 | N/A | *Overlay* | 2E66696C6500000071000000FEFF000067016372 | .file...q.......g.cr |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 4237438 | 67,8657% |
| Null Byte Code | 1107840 | 17,7429% |
| NOP Cave Found | 0x9090909090 | Block Count: 28 | Total: 0,0011% |
© 2026 All rights reserved.