PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 2,53 MB SHA-256 Hash: FCCAFB182F4730122FB07838C13EAC3CE357EB70DF095C616DFA7F8BF1FE4933 SHA-1 Hash: D9C6EC0E56DC53AFC230BAE8909559C239CA8013 MD5 Hash: 3C2FB21B939B946959810A04EFEDC7FC Imphash: 12E1E61FEB04B593CEA90EAEFB206A8E MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 9540C SizeOfHeaders: 400 SizeOfImage: 290000 ImageBase: 0000000180000000 Architecture: x64 ImportTable: 27D23C IAT: C7000 Characteristics: 2022 TimeDateStamp: 6A6B5852 Date: 30/07/2026 13:57:38 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | C5200 | 1000 | C51BC |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
C5600 | 1B7800 | C7000 | 1B762A |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
27CE00 | 2400 | 27F000 | 59F8 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
27F200 | 8600 | 285000 | 8520 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
287800 | 200 | 28E000 | F8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
287A00 | 1000 | 28F000 | EF0 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 9480C Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8AF0500004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X18009542D |CALL 0X1800959DC |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> 93289189D749FFDAD749FFDAD749FFDA9C31FCDBCF49FFDA9C31FADB6449FFDA9C31FBDBCE49FFDAC6CFFCDBDD49FFDAC6CFFBDBD849FFDAC6CFFADB8549FFDA9C31FEDBC449FFDAD749FEDA3549FFDA2ECEF6DBC349FFDA2ECE00DAD649FFDA2ECEFDDBD649FFDA52696368D749FFDA Footprint md5 Hash -> C15CD8437D0A7009CC7F3991226C6A70 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.43**)[-] • Entropy: 7.33587 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| WININET.DLL | InternetConnectA | Opens an File Transfer Protocol (FTP) or HTTP session for a given site. |
| File Access |
| IMM32.dll gdiplus.dll ole32.dll SHELL32.dll USER32.dll KERNEL32.dll WININET.dll xinput1_1.dll xinput1_2.dll xinput9_1_0.dll xinput1_3.dll xinput1_4.dll steamnetworkingsockets.dll client.dll tier0.dll engine.dll shaderapivk.dll shaderapidx9.dll steam_api.dll steam_api64.dll .dat @.dat imgui_log.txt put it in deepl_api_key.txt deepl_api_key.txt imgui.ini Temp |
| File Access (UNICODE) |
| mscoree.dll kernel32.dll |
| Interest's Words |
| lockbit Virus BitCoin exec start pause systeminfo ping expand route |
| URLs |
| http://www.ascendercorp.com/ http://www.ascendercorp.com/typedesigners.html http://scripts.sil.org/OFL https://steamcommunity.com/profiles/ https://fontawesome.comFont https://backpack.tf/api/IGetCurrencies/v1?key= https://backpack.tf/api/users/info/v1?key= https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key= https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key= https://api.steampowered.com/ISteamUser/GetFriendList/v1/?key= https://github.com/ocornut/imgui/blob/master/docs/FAQ.mdqa-usage |
| URLs (UNICODE) |
| http://www.ascendercorp.com/ http://www.ascendercorp.com/typedesigners.html http://scripts.sil.org/OFL https://fontawesome.comFont Awesome 6 Free SolidFontAwesome6Free-SolidCopyright (c) Font AwesomeSolid |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (listen) |
| Text | Ascii | WinAPI Sockets (accept) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (SetThreadContext) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (DownArrow) |
| Text | Ascii | Keyboard Key (RightArrow) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Keyboard Key (LeftArrow) |
| Text | Ascii | Keyboard Key (PageDown) |
| Text | Ascii | Keyboard Key (PageUp) |
| Text | Ascii | Keyboard Key (CapsLock) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Ascii | Keyboard Key (Ctrl+S) |
| Text | Ascii | Malicious code executed after exploiting a vulnerability (Payload) |
| Text | Ascii | Malware that monitors and collects user data (Spy) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 28E060 | 91 | 287860 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version='1.0' encoding='UTF-8' standalone='y |
| Intelligent String |
| • steam_api.dll • steam_api64.dll • kernel32.dll • mscoree.dll • client.dll • mammoth_settings.cfg • shaderapidx9.dll • engine.dll • Msgtier0.dll • l4XD • http://www.ascendercorp.com/typedesigners.html • http://scripts.sil.org/OFL • .Ojw • .ATr • Version 773.01953125 (Font Awesome version: 6.5.2)The web's most popular icon set and toolkit.Font Awesome 6 FreeFont Awesome 6 Free Solid-6.5.2https://fontawesome.comFont Awesome 6 Free SolidFontAwesome6Free-SolidCopyright (c) Font AwesomeSolidVersion 773.01953125 (Font Awesome version: 6.5.2)The web's most popular icon set and toolkit.Font Awesome 6 FreeFont Awesome 6 Free Solid-6.5.2https://fontawesome.comFont Awesome 6 Free SolidFontAwesome6Free-SolidCopyright (c) Font AwesomeSolid • whiskey-glassearth-europe • translate.googleapis.com • translate.google.com • deepl_api_key.txt • api-free.deepl.com • api.deepl.com • steamnetworkingsockets.dll • imgui.ini • imgui_log.txt • (Hold Ctrl to: https://github.com/ocornut/imgui/blob/master/docs/FAQ.mdqa-usage • ProggyClean.ttfProggyForever.ttf • R:%0.3fG:%0.3fB:%0.3fA:%0.3fH:%0.3fS:%0.3fV:%0.3fM:0.000M:000 • xinput1_4.dll • xinput1_3.dll • xinput9_1_0.dll • xinput1_2.dll • xinput1_1.dll • .tls • .bss • USER32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 112E | N/A | .text | CALL QWORD PTR [RIP+0xC5314] |
| 1147 | N/A | .text | CALL QWORD PTR [RIP+0xC533B] |
| 254D | N/A | .text | CALL QWORD PTR [RIP+0xC4415] |
| 2562 | N/A | .text | CALL QWORD PTR [RIP+0xC4418] |
| 25AB | N/A | .text | CALL QWORD PTR [RIP+0xC43DF] |
| 25BD | N/A | .text | CALL QWORD PTR [RIP+0xC43AD] |
| 25FF | N/A | .text | JMP QWORD PTR [RIP+0xC4363] |
| 2682 | N/A | .text | CALL QWORD PTR [RIP+0xC3DA8] |
| 5EA7 | N/A | .text | CALL QWORD PTR [RIP+0xC0AF3] |
| 5ED9 | N/A | .text | CALL QWORD PTR [RIP+0xC0589] |
| 5EEE | N/A | .text | CALL QWORD PTR [RIP+0xC059C] |
| 5F15 | N/A | .text | CALL QWORD PTR [RIP+0xC0585] |
| 5F2B | N/A | .text | CALL QWORD PTR [RIP+0xC0A8F] |
| 5F59 | N/A | .text | CALL QWORD PTR [RIP+0xC0A19] |
| 5F9B | N/A | .text | CALL QWORD PTR [RIP+0xC0A07] |
| 5FB4 | N/A | .text | CALL QWORD PTR [RIP+0xC09DE] |
| 6088 | N/A | .text | CALL QWORD PTR [RIP+0xC0922] |
| 60C9 | N/A | .text | CALL QWORD PTR [RIP+0xC0899] |
| 612F | N/A | .text | CALL QWORD PTR [RIP+0xC0853] |
| 6168 | N/A | .text | CALL QWORD PTR [RIP+0xC02EA] |
| 619C | N/A | .text | CALL QWORD PTR [RIP+0xC02CE] |
| 61F8 | N/A | .text | CALL QWORD PTR [RIP+0xC025A] |
| 7C58 | N/A | .text | CALL QWORD PTR [RIP+0xBE7FA] |
| 7FBD | N/A | .text | CALL QWORD PTR [RIP+0xBE495] |
| 844A | N/A | .text | CALL QWORD PTR [RIP+0xBDFF8] |
| 8469 | N/A | .text | CALL QWORD PTR [RIP+0xBDFD1] |
| 847F | N/A | .text | CALL QWORD PTR [RIP+0xBDFF3] |
| 890A | N/A | .text | CALL QWORD PTR [RIP+0xBDF70] |
| 8910 | N/A | .text | CALL QWORD PTR [RIP+0xBDB82] |
| 892A | N/A | .text | CALL QWORD PTR [RIP+0xBDF38] |
| 8BB7 | N/A | .text | CALL QWORD PTR [RIP+0xBDCB3] |
| 9717 | N/A | .text | CALL QWORD PTR [RIP+0xBD143] |
| 9990 | N/A | .text | CALL QWORD PTR [RIP+0xBCEC2] |
| 100EA | N/A | .text | CALL QWORD PTR [RIP+0xB6368] |
| 1178D | N/A | .text | JMP QWORD PTR [RIP+0x894C0008] |
| 117A8 | N/A | .text | CALL QWORD PTR [RIP+0xB4C9A] |
| 117BD | N/A | .text | CALL QWORD PTR [RIP+0xB4C85] |
| 117D5 | N/A | .text | CALL QWORD PTR [RIP+0xB4CAD] |
| 117E8 | N/A | .text | CALL QWORD PTR [RIP+0xB4C9A] |
| 12996 | N/A | .text | CALL QWORD PTR [RIP+0xB3AAC] |
| 129AB | N/A | .text | CALL QWORD PTR [RIP+0xB3A97] |
| 129C7 | N/A | .text | CALL QWORD PTR [RIP+0xB3ABB] |
| 129DA | N/A | .text | CALL QWORD PTR [RIP+0xB3AA8] |
| 12DA2 | N/A | .text | CALL QWORD PTR [RIP+0xB3AD0] |
| 12DFA | N/A | .text | CALL QWORD PTR [RIP+0xB3A78] |
| 12F27 | N/A | .text | CALL QWORD PTR [RIP+0xB351B] |
| 12F39 | N/A | .text | CALL QWORD PTR [RIP+0xB3509] |
| 12F49 | N/A | .text | CALL QWORD PTR [RIP+0xB3501] |
| 12F56 | N/A | .text | CALL QWORD PTR [RIP+0xB34F4] |
| 12F63 | N/A | .text | CALL QWORD PTR [RIP+0xB34DF] |
| 12F73 | N/A | .text | CALL QWORD PTR [RIP+0xB350F] |
| 12F8C | N/A | .text | CALL QWORD PTR [RIP+0xB34B6] |
| 12F9C | N/A | .text | CALL QWORD PTR [RIP+0xB34E6] |
| 12FAC | N/A | .text | CALL QWORD PTR [RIP+0xB3496] |
| 12FBC | N/A | .text | CALL QWORD PTR [RIP+0xB34C6] |
| 1305D | N/A | .text | CALL QWORD PTR [RIP+0xB33E5] |
| 1308F | N/A | .text | CALL QWORD PTR [RIP+0xB33BB] |
| 1323F | N/A | .text | CALL QWORD PTR [RIP+0xB3203] |
| 13258 | N/A | .text | CALL QWORD PTR [RIP+0xB322A] |
| 1335D | N/A | .text | CALL QWORD PTR [RIP+0xB30D5] |
| 13387 | N/A | .text | CALL QWORD PTR [RIP+0xB30AB] |
| 13399 | N/A | .text | CALL QWORD PTR [RIP+0xB30A9] |
| 133B3 | N/A | .text | CALL QWORD PTR [RIP+0xB308F] |
| 133C8 | N/A | .text | CALL QWORD PTR [RIP+0xB3082] |
| 133D3 | N/A | .text | CALL QWORD PTR [RIP+0xB306F] |
| 133E3 | N/A | .text | CALL QWORD PTR [RIP+0xB3067] |
| 13423 | N/A | .text | CALL QWORD PTR [RIP+0xB301F] |
| 134AD | N/A | .text | CALL QWORD PTR [RIP+0xB2FF5] |
| 134E5 | N/A | .text | CALL QWORD PTR [RIP+0xB2FBD] |
| 13596 | N/A | .text | CALL QWORD PTR [RIP+0xB32C4] |
| 135CC | N/A | .text | CALL QWORD PTR [RIP+0x2704C6] |
| 135D9 | N/A | .text | CALL QWORD PTR [RIP+0x2704B9] |
| 13603 | N/A | .text | CALL QWORD PTR [RIP+0x27048F] |
| 13637 | N/A | .text | CALL QWORD PTR [RIP+0x27045B] |
| 13682 | N/A | .text | CALL QWORD PTR [RIP+0x270410] |
| 136B5 | N/A | .text | CALL QWORD PTR [RIP+0x2703DD] |
| 136E8 | N/A | .text | CALL QWORD PTR [RIP+0x2703AA] |
| 136FC | N/A | .text | CALL QWORD PTR [RIP+0x270396] |
| 13710 | N/A | .text | CALL QWORD PTR [RIP+0xB2D32] |
| 13745 | N/A | .text | CALL QWORD PTR [RIP+0xB2CFD] |
| 13765 | N/A | .text | CALL QWORD PTR [RIP+0x27032D] |
| 137B0 | N/A | .text | CALL QWORD PTR [RIP+0xB2CAA] |
| 137CF | N/A | .text | CALL QWORD PTR [RIP+0xB2CAB] |
| 1DC4B | N/A | .text | CALL QWORD PTR [RIP+0xA87F7] |
| 1DC6A | N/A | .text | CALL QWORD PTR [RIP+0xA87D0] |
| 1DC80 | N/A | .text | CALL QWORD PTR [RIP+0xA87F2] |
| 1E0E3 | N/A | .text | CALL QWORD PTR [RIP+0x265A77] |
| 1ED70 | N/A | .text | CALL QWORD PTR [RIP+0xA76D2] |
| 1EDAD | N/A | .text | CALL QWORD PTR [RIP+0xA76D5] |
| 1EE57 | N/A | .text | CALL QWORD PTR [RIP+0xA75E3] |
| 1EE6E | N/A | .text | CALL QWORD PTR [RIP+0xA7604] |
| 1EEC5 | N/A | .text | CALL QWORD PTR [RIP+0xA756D] |
| 1EF1B | N/A | .text | CALL QWORD PTR [RIP+0xA7517] |
| 218A3 | N/A | .text | CALL QWORD PTR [RIP+0xA506F] |
| 21945 | N/A | .text | CALL QWORD PTR [RIP+0xA4FCD] |
| 219E9 | N/A | .text | CALL QWORD PTR [RIP+0xA4F49] |
| 21A3C | N/A | .text | CALL QWORD PTR [RIP+0xA4EFE] |
| 21A55 | N/A | .text | CALL QWORD PTR [RIP+0xA4EE5] |
| 21A6E | N/A | .text | CALL QWORD PTR [RIP+0xA4ECC] |
| 21A9E | N/A | .text | CALL QWORD PTR [RIP+0xA4EA4] |
| 27F200 | 180001050 | .pdata | ExceptionHook | Pointer to 1050 - 0x450 .text + UnwindInfo: .rdata |
| 27F20C | 1800010E0 | .pdata | ExceptionHook | Pointer to 10E0 - 0x4E0 .text + UnwindInfo: .rdata |
| 27F218 | 180001130 | .pdata | ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .rdata |
| 27F224 | 180001250 | .pdata | ExceptionHook | Pointer to 1250 - 0x650 .text + UnwindInfo: .rdata |
| 27F230 | 1800012C0 | .pdata | ExceptionHook | Pointer to 12C0 - 0x6C0 .text + UnwindInfo: .rdata |
| 27F23C | 180001314 | .pdata | ExceptionHook | Pointer to 1314 - 0x714 .text + UnwindInfo: .rdata |
| 27F248 | 180001358 | .pdata | ExceptionHook | Pointer to 1358 - 0x758 .text + UnwindInfo: .rdata |
| 27F254 | 180001390 | .pdata | ExceptionHook | Pointer to 1390 - 0x790 .text + UnwindInfo: .rdata |
| 27F260 | 1800013F0 | .pdata | ExceptionHook | Pointer to 13F0 - 0x7F0 .text + UnwindInfo: .rdata |
| 27F26C | 180001450 | .pdata | ExceptionHook | Pointer to 1450 - 0x850 .text + UnwindInfo: .rdata |
| 27F278 | 1800014F0 | .pdata | ExceptionHook | Pointer to 14F0 - 0x8F0 .text + UnwindInfo: .rdata |
| 27F284 | 180001510 | .pdata | ExceptionHook | Pointer to 1510 - 0x910 .text + UnwindInfo: .rdata |
| 27F290 | 180001550 | .pdata | ExceptionHook | Pointer to 1550 - 0x950 .text + UnwindInfo: .rdata |
| 27F29C | 180001590 | .pdata | ExceptionHook | Pointer to 1590 - 0x990 .text + UnwindInfo: .rdata |
| 27F2A8 | 1800015B0 | .pdata | ExceptionHook | Pointer to 15B0 - 0x9B0 .text + UnwindInfo: .rdata |
| 27F2B4 | 180001620 | .pdata | ExceptionHook | Pointer to 1620 - 0xA20 .text + UnwindInfo: .rdata |
| 27F2C0 | 1800016A0 | .pdata | ExceptionHook | Pointer to 16A0 - 0xAA0 .text + UnwindInfo: .rdata |
| 27F2CC | 1800016F0 | .pdata | ExceptionHook | Pointer to 16F0 - 0xAF0 .text + UnwindInfo: .rdata |
| 27F2D8 | 180001770 | .pdata | ExceptionHook | Pointer to 1770 - 0xB70 .text + UnwindInfo: .rdata |
| 27F2E4 | 1800018D0 | .pdata | ExceptionHook | Pointer to 18D0 - 0xCD0 .text + UnwindInfo: .rdata |
| 27F2F0 | 1800019D0 | .pdata | ExceptionHook | Pointer to 19D0 - 0xDD0 .text + UnwindInfo: .rdata |
| 27F2FC | 180001A20 | .pdata | ExceptionHook | Pointer to 1A20 - 0xE20 .text + UnwindInfo: .rdata |
| 27F308 | 180001A80 | .pdata | ExceptionHook | Pointer to 1A80 - 0xE80 .text + UnwindInfo: .rdata |
| 27F314 | 180001AE0 | .pdata | ExceptionHook | Pointer to 1AE0 - 0xEE0 .text + UnwindInfo: .rdata |
| 27F320 | 180001B60 | .pdata | ExceptionHook | Pointer to 1B60 - 0xF60 .text + UnwindInfo: .rdata |
| 27F32C | 180001BC0 | .pdata | ExceptionHook | Pointer to 1BC0 - 0xFC0 .text + UnwindInfo: .rdata |
| 27F338 | 180001BE0 | .pdata | ExceptionHook | Pointer to 1BE0 - 0xFE0 .text + UnwindInfo: .rdata |
| 27F344 | 180001C20 | .pdata | ExceptionHook | Pointer to 1C20 - 0x1020 .text + UnwindInfo: .rdata |
| 27F350 | 180001D10 | .pdata | ExceptionHook | Pointer to 1D10 - 0x1110 .text + UnwindInfo: .rdata |
| 27F35C | 180001D6D | .pdata | ExceptionHook | Pointer to 1D6D - 0x116D .text + UnwindInfo: .rdata |
| 27F368 | 180001D87 | .pdata | ExceptionHook | Pointer to 1D87 - 0x1187 .text + UnwindInfo: .rdata |
| 27F374 | 180001D92 | .pdata | ExceptionHook | Pointer to 1D92 - 0x1192 .text + UnwindInfo: .rdata |
| 27F380 | 180001DA8 | .pdata | ExceptionHook | Pointer to 1DA8 - 0x11A8 .text + UnwindInfo: .rdata |
| 27F38C | 180002830 | .pdata | ExceptionHook | Pointer to 2830 - 0x1C30 .text + UnwindInfo: .rdata |
| 27F398 | 18000286D | .pdata | ExceptionHook | Pointer to 286D - 0x1C6D .text + UnwindInfo: .rdata |
| 27F3A4 | 180002882 | .pdata | ExceptionHook | Pointer to 2882 - 0x1C82 .text + UnwindInfo: .rdata |
| 27F3B0 | 180002A6D | .pdata | ExceptionHook | Pointer to 2A6D - 0x1E6D .text + UnwindInfo: .rdata |
| 27F3BC | 180002A89 | .pdata | ExceptionHook | Pointer to 2A89 - 0x1E89 .text + UnwindInfo: .rdata |
| 27F3C8 | 180002A8E | .pdata | ExceptionHook | Pointer to 2A8E - 0x1E8E .text + UnwindInfo: .rdata |
| 27F3D4 | 180002AA0 | .pdata | ExceptionHook | Pointer to 2AA0 - 0x1EA0 .text + UnwindInfo: .rdata |
| 27F3E0 | 180002AD0 | .pdata | ExceptionHook | Pointer to 2AD0 - 0x1ED0 .text + UnwindInfo: .rdata |
| 27F3EC | 180002BA0 | .pdata | ExceptionHook | Pointer to 2BA0 - 0x1FA0 .text + UnwindInfo: .rdata |
| 27F3F8 | 180002BF0 | .pdata | ExceptionHook | Pointer to 2BF0 - 0x1FF0 .text + UnwindInfo: .rdata |
| 27F404 | 180002D90 | .pdata | ExceptionHook | Pointer to 2D90 - 0x2190 .text + UnwindInfo: .rdata |
| 27F410 | 180002DA5 | .pdata | ExceptionHook | Pointer to 2DA5 - 0x21A5 .text + UnwindInfo: .rdata |
| 27F41C | 180002DCA | .pdata | ExceptionHook | Pointer to 2DCA - 0x21CA .text + UnwindInfo: .rdata |
| 27F428 | 180002DF0 | .pdata | ExceptionHook | Pointer to 2DF0 - 0x21F0 .text + UnwindInfo: .rdata |
| 27F434 | 180002E05 | .pdata | ExceptionHook | Pointer to 2E05 - 0x2205 .text + UnwindInfo: .rdata |
| 27F440 | 180002E2A | .pdata | ExceptionHook | Pointer to 2E2A - 0x222A .text + UnwindInfo: .rdata |
| 27F44C | 180002E50 | .pdata | ExceptionHook | Pointer to 2E50 - 0x2250 .text + UnwindInfo: .rdata |
| 27F458 | 180002E70 | .pdata | ExceptionHook | Pointer to 2E70 - 0x2270 .text + UnwindInfo: .rdata |
| 27F464 | 180002E90 | .pdata | ExceptionHook | Pointer to 2E90 - 0x2290 .text + UnwindInfo: .rdata |
| 27F470 | 180002F00 | .pdata | ExceptionHook | Pointer to 2F00 - 0x2300 .text + UnwindInfo: .rdata |
| 27F47C | 180003090 | .pdata | ExceptionHook | Pointer to 3090 - 0x2490 .text + UnwindInfo: .rdata |
| 27F488 | 1800030F0 | .pdata | ExceptionHook | Pointer to 30F0 - 0x24F0 .text + UnwindInfo: .rdata |
| 27F494 | 180003130 | .pdata | ExceptionHook | Pointer to 3130 - 0x2530 .text + UnwindInfo: .rdata |
| 27F4A0 | 180003190 | .pdata | ExceptionHook | Pointer to 3190 - 0x2590 .text + UnwindInfo: .rdata |
| 27F4AC | 180003230 | .pdata | ExceptionHook | Pointer to 3230 - 0x2630 .text + UnwindInfo: .rdata |
| 27F4B8 | 180003360 | .pdata | ExceptionHook | Pointer to 3360 - 0x2760 .text + UnwindInfo: .rdata |
| 27F4C4 | 180003490 | .pdata | ExceptionHook | Pointer to 3490 - 0x2890 .text + UnwindInfo: .rdata |
| 27F4D0 | 180003650 | .pdata | ExceptionHook | Pointer to 3650 - 0x2A50 .text + UnwindInfo: .rdata |
| 27F4DC | 180003E50 | .pdata | ExceptionHook | Pointer to 3E50 - 0x3250 .text + UnwindInfo: .rdata |
| 27F4E8 | 180003EF0 | .pdata | ExceptionHook | Pointer to 3EF0 - 0x32F0 .text + UnwindInfo: .rdata |
| 27F4F4 | 180006640 | .pdata | ExceptionHook | Pointer to 6640 - 0x5A40 .text + UnwindInfo: .rdata |
| 27F500 | 1800066C0 | .pdata | ExceptionHook | Pointer to 66C0 - 0x5AC0 .text + UnwindInfo: .rdata |
| 27F50C | 1800068A0 | .pdata | ExceptionHook | Pointer to 68A0 - 0x5CA0 .text + UnwindInfo: .rdata |
| 27F518 | 180006940 | .pdata | ExceptionHook | Pointer to 6940 - 0x5D40 .text + UnwindInfo: .rdata |
| 27F524 | 1800069A0 | .pdata | ExceptionHook | Pointer to 69A0 - 0x5DA0 .text + UnwindInfo: .rdata |
| 27F530 | 180006A50 | .pdata | ExceptionHook | Pointer to 6A50 - 0x5E50 .text + UnwindInfo: .rdata |
| 27F53C | 180006DC0 | .pdata | ExceptionHook | Pointer to 6DC0 - 0x61C0 .text + UnwindInfo: .rdata |
| 27F548 | 180006DE9 | .pdata | ExceptionHook | Pointer to 6DE9 - 0x61E9 .text + UnwindInfo: .rdata |
| 27F554 | 180006F89 | .pdata | ExceptionHook | Pointer to 6F89 - 0x6389 .text + UnwindInfo: .rdata |
| 27F560 | 180006F9D | .pdata | ExceptionHook | Pointer to 6F9D - 0x639D .text + UnwindInfo: .rdata |
| 27F56C | 180007366 | .pdata | ExceptionHook | Pointer to 7366 - 0x6766 .text + UnwindInfo: .rdata |
| 27F578 | 180007425 | .pdata | ExceptionHook | Pointer to 7425 - 0x6825 .text + UnwindInfo: .rdata |
| 27F584 | 18000748A | .pdata | ExceptionHook | Pointer to 748A - 0x688A .text + UnwindInfo: .rdata |
| 27F590 | 180007675 | .pdata | ExceptionHook | Pointer to 7675 - 0x6A75 .text + UnwindInfo: .rdata |
| 27F59C | 1800076D9 | .pdata | ExceptionHook | Pointer to 76D9 - 0x6AD9 .text + UnwindInfo: .rdata |
| 27F5A8 | 1800076F0 | .pdata | ExceptionHook | Pointer to 76F0 - 0x6AF0 .text + UnwindInfo: .rdata |
| 27F5B4 | 180007A20 | .pdata | ExceptionHook | Pointer to 7A20 - 0x6E20 .text + UnwindInfo: .rdata |
| 27F5C0 | 180007A80 | .pdata | ExceptionHook | Pointer to 7A80 - 0x6E80 .text + UnwindInfo: .rdata |
| 27F5CC | 180007CD0 | .pdata | ExceptionHook | Pointer to 7CD0 - 0x70D0 .text + UnwindInfo: .rdata |
| 27F5D8 | 180007DB0 | .pdata | ExceptionHook | Pointer to 7DB0 - 0x71B0 .text + UnwindInfo: .rdata |
| 27F5E4 | 180008810 | .pdata | ExceptionHook | Pointer to 8810 - 0x7C10 .text + UnwindInfo: .rdata |
| 27F5F0 | 180008B80 | .pdata | ExceptionHook | Pointer to 8B80 - 0x7F80 .text + UnwindInfo: .rdata |
| 27F5FC | 180008E00 | .pdata | ExceptionHook | Pointer to 8E00 - 0x8200 .text + UnwindInfo: .rdata |
| 27F608 | 180009030 | .pdata | ExceptionHook | Pointer to 9030 - 0x8430 .text + UnwindInfo: .rdata |
| 27F614 | 1800094E0 | .pdata | ExceptionHook | Pointer to 94E0 - 0x88E0 .text + UnwindInfo: .rdata |
| 27F620 | 180009580 | .pdata | ExceptionHook | Pointer to 9580 - 0x8980 .text + UnwindInfo: .rdata |
| 27F62C | 1800097E0 | .pdata | ExceptionHook | Pointer to 97E0 - 0x8BE0 .text + UnwindInfo: .rdata |
| 27F638 | 180009CE0 | .pdata | ExceptionHook | Pointer to 9CE0 - 0x90E0 .text + UnwindInfo: .rdata |
| 27F644 | 180009D60 | .pdata | ExceptionHook | Pointer to 9D60 - 0x9160 .text + UnwindInfo: .rdata |
| 27F650 | 180009D6F | .pdata | ExceptionHook | Pointer to 9D6F - 0x916F .text + UnwindInfo: .rdata |
| 27F65C | 180009D86 | .pdata | ExceptionHook | Pointer to 9D86 - 0x9186 .text + UnwindInfo: .rdata |
| 27F668 | 18000A013 | .pdata | ExceptionHook | Pointer to A013 - 0x9413 .text + UnwindInfo: .rdata |
| 27F674 | 18000A183 | .pdata | ExceptionHook | Pointer to A183 - 0x9583 .text + UnwindInfo: .rdata |
| 27F680 | 18000A2A4 | .pdata | ExceptionHook | Pointer to A2A4 - 0x96A4 .text + UnwindInfo: .rdata |
| 27F68C | 18000A2D0 | .pdata | ExceptionHook | Pointer to A2D0 - 0x96D0 .text + UnwindInfo: .rdata |
| 27F698 | 18000A5E0 | .pdata | ExceptionHook | Pointer to A5E0 - 0x99E0 .text + UnwindInfo: .rdata |
| 27F6A4 | 18000BC00 | .pdata | ExceptionHook | Pointer to BC00 - 0xB000 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1720628 | 64,764% |
| Null Byte Code | 251428 | 9,4637% |
© 2026 All rights reserved.