PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 2,30 MB SHA-256 Hash: C3BD9003C2A8B57C18442587A4D35F1BF0780B3D069BF5F7042E1351957403F5 SHA-1 Hash: C48BB88BDCC7559E99AAF0DB05BCDBFBBFFD3F37 MD5 Hash: 559D2B4AFA2FEDC5BEED36806C198CFB Imphash: 7C15AD67C5CFE43A17BEFF396750AE2C MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 002545DF EntryPoint (rva): D1D08 SizeOfHeaders: 400 SizeOfImage: 28D000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 23E100 ImportTable: 23E2B4 IAT: D7000 Characteristics: 2022 TimeDateStamp: 69AEF976 Date: 09/03/2026 16:46:46 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | D5C00 | 1000 | D5B88 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
D6000 | 168A00 | D7000 | 16880C |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
23EA00 | 1200 | 240000 | 3EA18 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
23FC00 | BE00 | 27F000 | BCD0 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
24BA00 | 200 | 28B000 | 10 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
24BC00 | 600 | 28C000 | 4D8 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - D1108 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E80F0A00004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X1800D1D29 |CALL 0X1800D2738 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| CheckSum Integrity Problem: • Header: 2442719 • Calculated: 2426893 Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Polink(2.50*)[-] • Entropy: 7.52809 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| ET Functions (carving) |
| Original Name -> pajfzeexzy2y8qq.dll AnalyzeSnapshot DllGetClassObject GetUnixDomainSocketSizes GetVilValueFieldOffset Initialize InitializePAL InitializeSession InitializeUnhandledExceptionFilter RunDiagnosticAnalysis RunMainLoop Shutdown ShutdownSession WrapICorDebugHandleValue |
| File Access |
| NSystem.Private.Reflection.Exe api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll VCRUNTIME140.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll Secur32.dll ole32.dll KERNEL32.dll bcrypt.dll ADVAPI32.dll pajfzeexzy2y8qq.dll ntdll.dll netapi32.dll @System.Security.Cryptography.dll System.Private.TypeLoader.dll JSystem.Private.StackTraceMetadata.dll NSystem.Private.Reflection.Execution.dll BSystem.Collections.Concurrent.dll 4System.Private.CoreLib.dll PMJztqe4CKSrd.dll .dat 14ArrayTypeMismatchException.BadImageFormatException.Dat @.dat .Ini Temp |
| File Access (UNICODE) |
| Format of the executable (.exe PROCESSOR_COUNTkernel32.dll ntdll.dll exe) or library (.dll Temp |
| Interest's Words |
| PADDINGX PassWord <form exec attrib start shutdown systeminfo ping expand replace setx |
| Interest's Words (UNICODE) |
| exec attrib start ping replace |
| URLs (UNICODE) |
| https://aka.ms/nativeaot-compatibilityY( https://aka.ms/GlobalizationInvariantMode for more information.i?, |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Encryption (FromBase64String) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GlobalMemoryStatusEx) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Unicode | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (SetThreadContext) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealth (QueueUserAPC) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Unicode | Privileges (SeLockMemoryPrivilege) |
| Text | Unicode | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Technique to insert malicious code into a vulnerable application (Injection) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • '{0}' is missing native code or metadata. This can happen for code that is not compatible with trimming or AOT. Inspect and fix trimming and AOT related warnings that were generated when the app was published. For more information see https://aka.ms/nativeaot-compatibilityY( • ntdll.dll • .tls • .bss • ole32.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-string-l1-1-0.dll • wcsncmpapi-ms-win-crt-runtime-l1-1-0.dll • api-ms-win-crt-heap-l1-1-0.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 49D1A | N/A | .text | JMP QWORD PTR [RIP+0x2D3860F] |
| 4A019 | N/A | .text | JMP QWORD PTR [RIP+0x5BEB2875] |
| 7262A | N/A | .text | CALL QWORD PTR [RIP+0x63F20] |
| 7267B | N/A | .text | JMP QWORD PTR [RIP+0x63F57] |
| 76FDE | N/A | .text | CALL QWORD PTR [RIP+0x1CC0AC] |
| 77354 | N/A | .text | CALL QWORD PTR [RIP+0x1C866E] |
| 773A1 | N/A | .text | CALL QWORD PTR [RIP+0x5F2A1] |
| 773B1 | N/A | .text | CALL QWORD PTR [RIP+0x5F1A9] |
| 77440 | N/A | .text | CALL QWORD PTR [RIP+0x5F1FA] |
| 7752D | N/A | .text | CALL QWORD PTR [RIP+0x5F085] |
| 7A784 | N/A | .text | CALL QWORD PTR [RIP+0x5BEC6] |
| 7A971 | N/A | .text | CALL QWORD PTR [RIP+0x5BCD9] |
| 7BC0A | N/A | .text | CALL QWORD PTR [RIP+0x5AA40] |
| 7BE2F | N/A | .text | CALL QWORD PTR [RIP+0x1C93BB] |
| 7BE6C | N/A | .text | CALL QWORD PTR [RIP+0x5A88E] |
| 7BEA1 | N/A | .text | CALL QWORD PTR [RIP+0x5A859] |
| 7BEE3 | N/A | .text | CALL QWORD PTR [RIP+0x5A75F] |
| 7BEF8 | N/A | .text | CALL QWORD PTR [RIP+0x5A662] |
| 7BF05 | N/A | .text | CALL QWORD PTR [RIP+0x5A7ED] |
| 7BF43 | N/A | .text | CALL QWORD PTR [RIP+0x5A7A7] |
| 7BF51 | N/A | .text | CALL QWORD PTR [RIP+0x5A5F9] |
| 7BFA5 | N/A | .text | CALL QWORD PTR [RIP+0x5A745] |
| 7C00F | N/A | .text | CALL QWORD PTR [RIP+0x5A663] |
| 7C024 | N/A | .text | CALL QWORD PTR [RIP+0x5A58E] |
| 7C039 | N/A | .text | JMP QWORD PTR [RIP+0x5A641] |
| 7C074 | N/A | .text | CALL QWORD PTR [RIP+0x5A596] |
| 7C07E | N/A | .text | CALL QWORD PTR [RIP+0x5A554] |
| 7C09D | N/A | .text | CALL QWORD PTR [RIP+0x5A8FD] |
| 7C0B1 | N/A | .text | CALL QWORD PTR [RIP+0x5A521] |
| 7C0E1 | N/A | .text | JMP QWORD PTR [RIP+0x5A5A1] |
| 7C0F3 | N/A | .text | JMP QWORD PTR [RIP+0x5A5CF] |
| 7C10F | N/A | .text | CALL QWORD PTR [RIP+0x5A563] |
| 7C12F | N/A | .text | CALL QWORD PTR [RIP+0x5A483] |
| 7C13D | N/A | .text | CALL QWORD PTR [RIP+0x5A53D] |
| 7C160 | N/A | .text | CALL QWORD PTR [RIP+0x5A3C2] |
| 7C17A | N/A | .text | JMP QWORD PTR [RIP+0x5A538] |
| 7C198 | N/A | .text | CALL QWORD PTR [RIP+0x5A56A] |
| 7C1B3 | N/A | .text | CALL QWORD PTR [RIP+0x5A4EF] |
| 7C1D4 | N/A | .text | CALL QWORD PTR [RIP+0x5A4BE] |
| 7C221 | N/A | .text | CALL QWORD PTR [RIP+0x5A4B1] |
| 7C28E | N/A | .text | CALL QWORD PTR [RIP+0x5A2F4] |
| 7C2A1 | N/A | .text | CALL QWORD PTR [RIP+0x5A2B9] |
| 7C2B3 | N/A | .text | CALL QWORD PTR [RIP+0x5A26F] |
| 7C317 | N/A | .text | CALL QWORD PTR [RIP+0x5A34B] |
| 7C328 | N/A | .text | CALL QWORD PTR [RIP+0x5A33A] |
| 7C339 | N/A | .text | CALL QWORD PTR [RIP+0x5A329] |
| 7C362 | N/A | .text | CALL QWORD PTR [RIP+0x5A380] |
| 7C37B | N/A | .text | CALL QWORD PTR [RIP+0x5A1DF] |
| 7C3B3 | N/A | .text | CALL QWORD PTR [RIP+0x5A1CF] |
| 7C3C3 | N/A | .text | CALL QWORD PTR [RIP+0x5A197] |
| 7C40D | N/A | .text | CALL QWORD PTR [RIP+0x1C35E5] |
| 7C421 | N/A | .text | CALL QWORD PTR [RIP+0x5A129] |
| 7C43B | N/A | .text | CALL QWORD PTR [RIP+0x5A25F] |
| 7C45C | N/A | .text | CALL QWORD PTR [RIP+0x5A246] |
| 7C483 | N/A | .text | CALL QWORD PTR [RIP+0x1C8D67] |
| 7C48C | N/A | .text | CALL QWORD PTR [RIP+0x5A136] |
| 7C4BB | N/A | .text | CALL QWORD PTR [RIP+0x5A1AF] |
| 7C52D | N/A | .text | CALL QWORD PTR [RIP+0x59FF5] |
| 7C540 | N/A | .text | CALL QWORD PTR [RIP+0x5A19A] |
| 7C58F | N/A | .text | CALL QWORD PTR [RIP+0x5A13B] |
| 7C62A | N/A | .text | CALL QWORD PTR [RIP+0x59F38] |
| 7C647 | N/A | .text | CALL QWORD PTR [RIP+0x59FDB] |
| 7C693 | N/A | .text | JMP QWORD PTR [RIP+0x59FC7] |
| 7C6A4 | N/A | .text | CALL QWORD PTR [RIP+0x5A006] |
| 7C6C1 | N/A | .text | JMP QWORD PTR [RIP+0x59F31] |
| 7C6E9 | N/A | .text | CALL QWORD PTR [RIP+0x59DF1] |
| 7C6FC | N/A | .text | CALL QWORD PTR [RIP+0x59DBE] |
| 7C731 | N/A | .text | CALL QWORD PTR [RIP+0x59DA9] |
| 7C74D | N/A | .text | CALL QWORD PTR [RIP+0x59E9D] |
| 7C756 | N/A | .text | CALL QWORD PTR [RIP+0x59E6C] |
| 7C75F | N/A | .text | CALL QWORD PTR [RIP+0x59D5B] |
| 7C771 | N/A | .text | JMP QWORD PTR [RIP+0x59F19] |
| 7C78F | N/A | .text | JMP QWORD PTR [RIP+0x59E6B] |
| 7C7A9 | N/A | .text | JMP QWORD PTR [RIP+0x59E59] |
| 7C7B9 | N/A | .text | CALL QWORD PTR [RIP+0x59F01] |
| 7C7F3 | N/A | .text | CALL QWORD PTR [RIP+0x59E5F] |
| 7DA52 | N/A | .text | CALL QWORD PTR [RIP+0x58CB8] |
| 7DB11 | N/A | .text | JMP QWORD PTR [RIP+0x58A61] |
| 80CCD | N/A | .text | JMP QWORD PTR [RIP+0x55A75] |
| 80CE7 | N/A | .text | CALL QWORD PTR [RIP+0x558BB] |
| 80CF2 | N/A | .text | CALL QWORD PTR [RIP+0x558B8] |
| 80D43 | N/A | .text | CALL QWORD PTR [RIP+0x5585F] |
| 81A67 | N/A | .text | CALL QWORD PTR [RIP+0x54C8B] |
| 81ABE | N/A | .text | CALL QWORD PTR [RIP+0x54C34] |
| 81BEC | N/A | .text | CALL QWORD PTR [RIP+0x548CE] |
| 81C3F | N/A | .text | CALL QWORD PTR [RIP+0x54A43] |
| 81CD2 | N/A | .text | CALL QWORD PTR [RIP+0x549B0] |
| 81D21 | N/A | .text | JMP QWORD PTR [RIP+0x54A29] |
| 81D31 | N/A | .text | JMP QWORD PTR [RIP+0x549F1] |
| 81D41 | N/A | .text | JMP QWORD PTR [RIP+0x548E9] |
| 81D83 | N/A | .text | CALL QWORD PTR [RIP+0x549EF] |
| 81D8D | N/A | .text | CALL QWORD PTR [RIP+0x547BD] |
| 81DDF | N/A | .text | CALL QWORD PTR [RIP+0x54993] |
| 81E77 | N/A | .text | CALL QWORD PTR [RIP+0x546AB] |
| 81F3E | N/A | .text | CALL QWORD PTR [RIP+0x54824] |
| 8207B | N/A | .text | CALL QWORD PTR [RIP+0x544A7] |
| 8208B | N/A | .text | CALL QWORD PTR [RIP+0x5470F] |
| 820BD | N/A | .text | CALL QWORD PTR [RIP+0x5460D] |
| 82129 | N/A | .text | CALL QWORD PTR [RIP+0x54639] |
| 82161 | N/A | .text | CALL QWORD PTR [RIP+0x54601] |
| 19A61-19A7F | N/A | .text | Unusual NOPS Space, count: 31 |
| 1A362-1A37F | N/A | .text | Unusual NOPS Space, count: 30 |
| 1C562-1C57F | N/A | .text | Unusual NOPS Space, count: 30 |
| 226E1-226FF | N/A | .text | Unusual NOPS Space, count: 31 |
| 22A21-22A3F | N/A | .text | Unusual NOPS Space, count: 31 |
| 28842-2885F | N/A | .text | Unusual NOPS Space, count: 30 |
| 29F81-29F9F | N/A | .text | Unusual NOPS Space, count: 31 |
| 2A0E2-2A0FF | N/A | .text | Unusual NOPS Space, count: 30 |
| 327C1-327DF | N/A | .text | Unusual NOPS Space, count: 31 |
| 34622-3463F | N/A | .text | Unusual NOPS Space, count: 30 |
| 35A81-35A9F | N/A | .text | Unusual NOPS Space, count: 31 |
| 3EF81-3EF9F | N/A | .text | Unusual NOPS Space, count: 31 |
| 3F861-3F87F | N/A | .text | Unusual NOPS Space, count: 31 |
| 417A2-417BF | N/A | .text | Unusual NOPS Space, count: 30 |
| 45742-4575F | N/A | .text | Unusual NOPS Space, count: 30 |
| 47722-4773F | N/A | .text | Unusual NOPS Space, count: 30 |
| 47821-4783F | N/A | .text | Unusual NOPS Space, count: 31 |
| 49BE1-49BFF | N/A | .text | Unusual NOPS Space, count: 31 |
| 4D1A2-4D1BF | N/A | .text | Unusual NOPS Space, count: 30 |
| 4E262-4E27F | N/A | .text | Unusual NOPS Space, count: 30 |
| 52402-5241F | N/A | .text | Unusual NOPS Space, count: 30 |
| 53CE2-53CFF | N/A | .text | Unusual NOPS Space, count: 30 |
| 54902-5491F | N/A | .text | Unusual NOPS Space, count: 30 |
| 54BC1-54BDF | N/A | .text | Unusual NOPS Space, count: 31 |
| 55421-5543F | N/A | .text | Unusual NOPS Space, count: 31 |
| 55C61-55C7F | N/A | .text | Unusual NOPS Space, count: 31 |
| 56562-5657F | N/A | .text | Unusual NOPS Space, count: 30 |
| 65441-6545F | N/A | .text | Unusual NOPS Space, count: 31 |
| 6D982-6D99F | N/A | .text | Unusual NOPS Space, count: 30 |
| 6E1E1-6E1FF | N/A | .text | Unusual NOPS Space, count: 31 |
| 6ED22-6ED3F | N/A | .text | Unusual NOPS Space, count: 30 |
| 23FC00 | 180001020 | .pdata | ExceptionHook | Pointer to 1020 - 0x420 .text + UnwindInfo: .rdata |
| 23FC0C | 180001080 | .pdata | ExceptionHook | Pointer to 1080 - 0x480 .text + UnwindInfo: .rdata |
| 23FC18 | 1800010A0 | .pdata | ExceptionHook | Pointer to 10A0 - 0x4A0 .text + UnwindInfo: .rdata |
| 23FC24 | 180001110 | .pdata | ExceptionHook | Pointer to 1110 - 0x510 .text + UnwindInfo: .rdata |
| 23FC30 | 180001120 | .pdata | ExceptionHook | Pointer to 1120 - 0x520 .text + UnwindInfo: .rdata |
| 23FC3C | 180001160 | .pdata | ExceptionHook | Pointer to 1160 - 0x560 .text + UnwindInfo: .rdata |
| 23FC48 | 180001180 | .pdata | ExceptionHook | Pointer to 1180 - 0x580 .text + UnwindInfo: .rdata |
| 23FC54 | 1800011C0 | .pdata | ExceptionHook | Pointer to 11C0 - 0x5C0 .text + UnwindInfo: .rdata |
| 23FC60 | 180001200 | .pdata | ExceptionHook | Pointer to 1200 - 0x600 .text + UnwindInfo: .rdata |
| 23FC6C | 180001220 | .pdata | ExceptionHook | Pointer to 1220 - 0x620 .text + UnwindInfo: .rdata |
| 23FC78 | 180001260 | .pdata | ExceptionHook | Pointer to 1260 - 0x660 .text + UnwindInfo: .rdata |
| 23FC84 | 180001280 | .pdata | ExceptionHook | Pointer to 1280 - 0x680 .text + UnwindInfo: .rdata |
| 23FC90 | 1800012C0 | .pdata | ExceptionHook | Pointer to 12C0 - 0x6C0 .text + UnwindInfo: .rdata |
| 23FC9C | 1800012E0 | .pdata | ExceptionHook | Pointer to 12E0 - 0x6E0 .text + UnwindInfo: .rdata |
| 23FCA8 | 180001300 | .pdata | ExceptionHook | Pointer to 1300 - 0x700 .text + UnwindInfo: .rdata |
| 23FCB4 | 180001320 | .pdata | ExceptionHook | Pointer to 1320 - 0x720 .text + UnwindInfo: .rdata |
| 23FCC0 | 180001340 | .pdata | ExceptionHook | Pointer to 1340 - 0x740 .text + UnwindInfo: .rdata |
| 23FCCC | 180001360 | .pdata | ExceptionHook | Pointer to 1360 - 0x760 .text + UnwindInfo: .rdata |
| 23FCD8 | 180001380 | .pdata | ExceptionHook | Pointer to 1380 - 0x780 .text + UnwindInfo: .rdata |
| 23FCE4 | 1800013A0 | .pdata | ExceptionHook | Pointer to 13A0 - 0x7A0 .text + UnwindInfo: .rdata |
| 23FCF0 | 1800013C0 | .pdata | ExceptionHook | Pointer to 13C0 - 0x7C0 .text + UnwindInfo: .rdata |
| 23FCFC | 1800013E0 | .pdata | ExceptionHook | Pointer to 13E0 - 0x7E0 .text + UnwindInfo: .rdata |
| 23FD08 | 180001440 | .pdata | ExceptionHook | Pointer to 1440 - 0x840 .text + UnwindInfo: .rdata |
| 23FD14 | 180001460 | .pdata | ExceptionHook | Pointer to 1460 - 0x860 .text + UnwindInfo: .rdata |
| 23FD20 | 180001480 | .pdata | ExceptionHook | Pointer to 1480 - 0x880 .text + UnwindInfo: .rdata |
| 23FD2C | 1800014A0 | .pdata | ExceptionHook | Pointer to 14A0 - 0x8A0 .text + UnwindInfo: .rdata |
| 23FD38 | 1800014C0 | .pdata | ExceptionHook | Pointer to 14C0 - 0x8C0 .text + UnwindInfo: .rdata |
| 23FD44 | 1800014E0 | .pdata | ExceptionHook | Pointer to 14E0 - 0x8E0 .text + UnwindInfo: .rdata |
| 23FD50 | 180001500 | .pdata | ExceptionHook | Pointer to 1500 - 0x900 .text + UnwindInfo: .rdata |
| 23FD5C | 180001520 | .pdata | ExceptionHook | Pointer to 1520 - 0x920 .text + UnwindInfo: .rdata |
| 23FD68 | 180001540 | .pdata | ExceptionHook | Pointer to 1540 - 0x940 .text + UnwindInfo: .rdata |
| 23FD74 | 180001580 | .pdata | ExceptionHook | Pointer to 1580 - 0x980 .text + UnwindInfo: .rdata |
| 23FD80 | 1800015A0 | .pdata | ExceptionHook | Pointer to 15A0 - 0x9A0 .text + UnwindInfo: .rdata |
| 23FD8C | 1800015C0 | .pdata | ExceptionHook | Pointer to 15C0 - 0x9C0 .text + UnwindInfo: .rdata |
| 23FD98 | 1800015E0 | .pdata | ExceptionHook | Pointer to 15E0 - 0x9E0 .text + UnwindInfo: .rdata |
| 23FDA4 | 180001600 | .pdata | ExceptionHook | Pointer to 1600 - 0xA00 .text + UnwindInfo: .rdata |
| 23FDB0 | 180001620 | .pdata | ExceptionHook | Pointer to 1620 - 0xA20 .text + UnwindInfo: .rdata |
| 23FDBC | 1800016A0 | .pdata | ExceptionHook | Pointer to 16A0 - 0xAA0 .text + UnwindInfo: .rdata |
| 23FDC8 | 180001700 | .pdata | ExceptionHook | Pointer to 1700 - 0xB00 .text + UnwindInfo: .rdata |
| 23FDD4 | 180001720 | .pdata | ExceptionHook | Pointer to 1720 - 0xB20 .text + UnwindInfo: .rdata |
| 23FDE0 | 180001740 | .pdata | ExceptionHook | Pointer to 1740 - 0xB40 .text + UnwindInfo: .rdata |
| 23FDEC | 1800017E0 | .pdata | ExceptionHook | Pointer to 17E0 - 0xBE0 .text + UnwindInfo: .rdata |
| 23FDF8 | 180001820 | .pdata | ExceptionHook | Pointer to 1820 - 0xC20 .text + UnwindInfo: .rdata |
| 23FE04 | 180001860 | .pdata | ExceptionHook | Pointer to 1860 - 0xC60 .text + UnwindInfo: .rdata |
| 23FE10 | 1800018A0 | .pdata | ExceptionHook | Pointer to 18A0 - 0xCA0 .text + UnwindInfo: .rdata |
| 23FE1C | 180001940 | .pdata | ExceptionHook | Pointer to 1940 - 0xD40 .text + UnwindInfo: .rdata |
| 23FE28 | 180001950 | .pdata | ExceptionHook | Pointer to 1950 - 0xD50 .text + UnwindInfo: .rdata |
| 23FE34 | 180001960 | .pdata | ExceptionHook | Pointer to 1960 - 0xD60 .text + UnwindInfo: .rdata |
| 23FE40 | 180001970 | .pdata | ExceptionHook | Pointer to 1970 - 0xD70 .text + UnwindInfo: .rdata |
| 23FE4C | 180001980 | .pdata | ExceptionHook | Pointer to 1980 - 0xD80 .text + UnwindInfo: .rdata |
| 23FE58 | 1800019F0 | .pdata | ExceptionHook | Pointer to 19F0 - 0xDF0 .text + UnwindInfo: .rdata |
| 23FE64 | 180001A50 | .pdata | ExceptionHook | Pointer to 1A50 - 0xE50 .text + UnwindInfo: .rdata |
| 23FE70 | 180001AD0 | .pdata | ExceptionHook | Pointer to 1AD0 - 0xED0 .text + UnwindInfo: .rdata |
| 23FE7C | 180001B10 | .pdata | ExceptionHook | Pointer to 1B10 - 0xF10 .text + UnwindInfo: .rdata |
| 23FE88 | 180001B50 | .pdata | ExceptionHook | Pointer to 1B50 - 0xF50 .text + UnwindInfo: .rdata |
| 23FE94 | 180001BB0 | .pdata | ExceptionHook | Pointer to 1BB0 - 0xFB0 .text + UnwindInfo: .rdata |
| 23FEA0 | 180001C10 | .pdata | ExceptionHook | Pointer to 1C10 - 0x1010 .text + UnwindInfo: .rdata |
| 23FEAC | 180001C50 | .pdata | ExceptionHook | Pointer to 1C50 - 0x1050 .text + UnwindInfo: .rdata |
| 23FEB8 | 180001C90 | .pdata | ExceptionHook | Pointer to 1C90 - 0x1090 .text + UnwindInfo: .rdata |
| 23FEC4 | 180001CB0 | .pdata | ExceptionHook | Pointer to 1CB0 - 0x10B0 .text + UnwindInfo: .rdata |
| 23FED0 | 180001D30 | .pdata | ExceptionHook | Pointer to 1D30 - 0x1130 .text + UnwindInfo: .rdata |
| 23FEDC | 180001D80 | .pdata | ExceptionHook | Pointer to 1D80 - 0x1180 .text + UnwindInfo: .rdata |
| 23FEE8 | 180001DD0 | .pdata | ExceptionHook | Pointer to 1DD0 - 0x11D0 .text + UnwindInfo: .rdata |
| 23FEF4 | 180001E30 | .pdata | ExceptionHook | Pointer to 1E30 - 0x1230 .text + UnwindInfo: .rdata |
| 23FF00 | 180001E90 | .pdata | ExceptionHook | Pointer to 1E90 - 0x1290 .text + UnwindInfo: .rdata |
| 23FF0C | 180001EA0 | .pdata | ExceptionHook | Pointer to 1EA0 - 0x12A0 .text + UnwindInfo: .rdata |
| 23FF18 | 180001F10 | .pdata | ExceptionHook | Pointer to 1F10 - 0x1310 .text + UnwindInfo: .rdata |
| 23FF24 | 180001F20 | .pdata | ExceptionHook | Pointer to 1F20 - 0x1320 .text + UnwindInfo: .rdata |
| 23FF30 | 180001F80 | .pdata | ExceptionHook | Pointer to 1F80 - 0x1380 .text + UnwindInfo: .rdata |
| 23FF3C | 180001FE0 | .pdata | ExceptionHook | Pointer to 1FE0 - 0x13E0 .text + UnwindInfo: .rdata |
| 23FF48 | 1800021A0 | .pdata | ExceptionHook | Pointer to 21A0 - 0x15A0 .text + UnwindInfo: .rdata |
| 23FF54 | 180002660 | .pdata | ExceptionHook | Pointer to 2660 - 0x1A60 .text + UnwindInfo: .rdata |
| 23FF60 | 1800026E0 | .pdata | ExceptionHook | Pointer to 26E0 - 0x1AE0 .text + UnwindInfo: .rdata |
| 23FF6C | 1800026F0 | .pdata | ExceptionHook | Pointer to 26F0 - 0x1AF0 .text + UnwindInfo: .rdata |
| 23FF78 | 1800027E0 | .pdata | ExceptionHook | Pointer to 27E0 - 0x1BE0 .text + UnwindInfo: .rdata |
| 23FF84 | 1800028E0 | .pdata | ExceptionHook | Pointer to 28E0 - 0x1CE0 .text + UnwindInfo: .rdata |
| 23FF90 | 18000297F | .pdata | ExceptionHook | Pointer to 297F - 0x1D7F .text + UnwindInfo: .rdata |
| 23FF9C | 1800029A0 | .pdata | ExceptionHook | Pointer to 29A0 - 0x1DA0 .text + UnwindInfo: .rdata |
| 23FFA8 | 1800029E2 | .pdata | ExceptionHook | Pointer to 29E2 - 0x1DE2 .text + UnwindInfo: .rdata |
| 23FFB4 | 180002A00 | .pdata | ExceptionHook | Pointer to 2A00 - 0x1E00 .text + UnwindInfo: .rdata |
| 23FFC0 | 180002D7F | .pdata | ExceptionHook | Pointer to 2D7F - 0x217F .text + UnwindInfo: .rdata |
| 23FFCC | 180002DC0 | .pdata | ExceptionHook | Pointer to 2DC0 - 0x21C0 .text + UnwindInfo: .rdata |
| 23FFD8 | 180002FD9 | .pdata | ExceptionHook | Pointer to 2FD9 - 0x23D9 .text + UnwindInfo: .rdata |
| 23FFE4 | 18000300B | .pdata | ExceptionHook | Pointer to 300B - 0x240B .text + UnwindInfo: .rdata |
| 23FFF0 | 180003040 | .pdata | ExceptionHook | Pointer to 3040 - 0x2440 .text + UnwindInfo: .rdata |
| 23FFFC | 180003080 | .pdata | ExceptionHook | Pointer to 3080 - 0x2480 .text + UnwindInfo: .rdata |
| 240008 | 180003340 | .pdata | ExceptionHook | Pointer to 3340 - 0x2740 .text + UnwindInfo: .rdata |
| 240014 | 180003AD3 | .pdata | ExceptionHook | Pointer to 3AD3 - 0x2ED3 .text + UnwindInfo: .rdata |
| 240020 | 180003B06 | .pdata | ExceptionHook | Pointer to 3B06 - 0x2F06 .text + UnwindInfo: .rdata |
| 24002C | 180003B74 | .pdata | ExceptionHook | Pointer to 3B74 - 0x2F74 .text + UnwindInfo: .rdata |
| 240038 | 180003BE0 | .pdata | ExceptionHook | Pointer to 3BE0 - 0x2FE0 .text + UnwindInfo: .rdata |
| 240044 | 180003DD8 | .pdata | ExceptionHook | Pointer to 3DD8 - 0x31D8 .text + UnwindInfo: .rdata |
| 240050 | 180003E00 | .pdata | ExceptionHook | Pointer to 3E00 - 0x3200 .text + UnwindInfo: .rdata |
| 24005C | 180003FA0 | .pdata | ExceptionHook | Pointer to 3FA0 - 0x33A0 .text + UnwindInfo: .rdata |
| 240068 | 180004070 | .pdata | ExceptionHook | Pointer to 4070 - 0x3470 .text + UnwindInfo: .rdata |
| 240074 | 1800043CC | .pdata | ExceptionHook | Pointer to 43CC - 0x37CC .text + UnwindInfo: .rdata |
| 240080 | 180004430 | .pdata | ExceptionHook | Pointer to 4430 - 0x3830 .text + UnwindInfo: .rdata |
| 24008C | 180004710 | .pdata | ExceptionHook | Pointer to 4710 - 0x3B10 .text + UnwindInfo: .rdata |
| 240098 | 180004820 | .pdata | ExceptionHook | Pointer to 4820 - 0x3C20 .text + UnwindInfo: .rdata |
| 2400A4 | 1800048C0 | .pdata | ExceptionHook | Pointer to 48C0 - 0x3CC0 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1560999 | 64,7997% |
| Null Byte Code | 192439 | 7,9885% |
| NOP Cave Found | 0x9090909090 | Block Count: 3648 | Total: 0,3786% |
© 2026 All rights reserved.