PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,10 MBSHA-256 Hash: ABC0775730EB03189DEEF0E6F23B69235EA2FFA53961B3B11F0975C4FC9B5341 SHA-1 Hash: 21C29363F2AC03138BFB0390CD9C969594F417C0 MD5 Hash: 55EBD7841B6514B7B3E3A1CFE61BD827 Imphash: 58038768FE9C6FFC480E44D0D4D1C194 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 001280B3 EntryPoint (rva): 131B0 SizeOfHeaders: 400 SizeOfImage: 11F000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 7EC60 IAT: 7EFD0 Characteristics: 22 TimeDateStamp: 6AB0BF5D Date: 21/09/2026 5:23:41 File Type: EXE Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .tls, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 21800 | 1000 | 21601 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
21C00 | 5E200 | 23000 | 5E114 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
7FE00 | 52600 | 82000 | 530B0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
D2400 | 1400 | D6000 | 1248 |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
D3800 | 200 | D8000 | 149 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
D3A00 | 44600 | D9000 | 44420 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
118000 | A00 | 11E000 | 834 |
|
|
| Description |
| OriginalFilename: flislo-desktop.exe CompanyName: Friciledeo LLC LegalCopyright: Copyright (C) 2026 Friciledeo ProductName: Flislo FileVersion: 2.0.4.30 FileDescription: Flislo ProductVersion: 2.0.4.30 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 125B0 Code -> 4883EC28E8870200004883C428E96EFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC40534883EC2048833D12140C00FF488BD975 Assembler |SUB RSP, 0X28 |CALL 0X140013440 |ADD RSP, 0X28 |JMP 0X140013030 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |PUSH RBX |SUB RSP, 0X20 |CMP QWORD PTR [RIP + 0XC1412], -1 |MOV RBX, RCX |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(2015 v.14.0)[-] • PE+(64): linker: Microsoft Linker(14.0)[-] • Entropy: 6.35636 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| File Access |
| ntdll.dll api-ms-win-core-synch-l1-2-0.dll user32.dll kernel32.dll @.dat Temp |
| File Access (UNICODE) |
| flislo-desktop.exe mscoree.dll \\?\UNC\NTDLL.DLL )!wH.dll |
| Interest's Words |
| exec attrib start systeminfo ping fltmc |
| IP Addresses |
| 2.0.4.30 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \RT_MANIFEST\1\1033 | D94C0 | 48C | D3EC0 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| \ICON\1\1033 | D9950 | 40158 | D4350 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660004011F49444154780100FFFF000000BE | .PNG........IHDR.............\r.f....IDATx........ |
| \ICON\2\1033 | 119AA8 | 2474 | 1144A8 | 89504E470D0A1A0A0000000D49484452000000300000003008060000005702F9870000243B494441547801013024CFDB00BE | .PNG........IHDR...0...0.....W.....$;IDATx..0$.... |
| \ICON\3\1033 | 11BF20 | 1064 | 116920 | 89504E470D0A1A0A0000000D4948445200000020000000200806000000737A7AF40000102B494441547801012010DFEF00BE | .PNG........IHDR... ... .....szz....+IDATx.. ..... |
| \ICON\4\1033 | 11CF88 | 454 | 117988 | 89504E470D0A1A0A0000000D49484452000000100000001008060000001FF3FF610000041B494441547801011004EFFB00BE | .PNG........IHDR................a....IDATx........ |
| \GROUP_ICON\1\1033 | 11D3E0 | 3E | 117DE0 | 0000010004000000000001002000580104000100303000000100200074240000020020200000010020006410000003001010000001002000540400000400 | ............ .X.....00.... .t$.... .... .d........... .T..... |
| \VERSION\1\1033 | D91E0 | 2E0 | D3BE0 | E00234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • 2.0.4.30 • @.tls • )!wH.dll • \\?\UNC\NTDLL.DLL • mscoree.dll • flislo.pdb • ntwritefilekernel32.dll • user32.dll • api-ms-win-core-synch-l1-2-0.dll • ntdll.dll • flislo-desktop.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| AF4 | N/A | .text | CALL QWORD PTR [RIP+0x7DBBE] |
| B41 | N/A | .text | CALL QWORD PTR [RIP+0x7D941] |
| B4B | N/A | .text | CALL QWORD PTR [RIP+0x7D93F] |
| EB0 | N/A | .text | CALL QWORD PTR [RIP+0x7D602] |
| EB6 | N/A | .text | CALL QWORD PTR [RIP+0x7D5EC] |
| EBC | N/A | .text | CALL QWORD PTR [RIP+0x7D5EE] |
| EC2 | N/A | .text | CALL QWORD PTR [RIP+0x7D5D8] |
| ECE | N/A | .text | CALL QWORD PTR [RIP+0x7D64C] |
| 1069 | N/A | .text | CALL QWORD PTR [RIP+0x7D611] |
| 1082 | N/A | .text | CALL QWORD PTR [RIP+0x7D610] |
| 108A | N/A | .text | CALL QWORD PTR [RIP+0x7D600] |
| 1090 | N/A | .text | CALL QWORD PTR [RIP+0x7D5F2] |
| 13CC | N/A | .text | CALL QWORD PTR [RIP+0x7D1FE] |
| 140C | N/A | .text | CALL QWORD PTR [RIP+0x7CFC6] |
| 1412 | N/A | .text | CALL QWORD PTR [RIP+0x7D0F8] |
| 1418 | N/A | .text | CALL QWORD PTR [RIP+0x7D04A] |
| 16FC | N/A | .text | CALL QWORD PTR [RIP+0x7CCE6] |
| 1705 | N/A | .text | CALL QWORD PTR [RIP+0x7CDDD] |
| 17DF | N/A | .text | CALL QWORD PTR [RIP+0x7CBEB] |
| 1AD5 | N/A | .text | CALL QWORD PTR [RIP+0x7CB4D] |
| 1AF0 | N/A | .text | CALL QWORD PTR [RIP+0x7C9F2] |
| 1B05 | N/A | .text | CALL QWORD PTR [RIP+0x7C9DD] |
| 1B26 | N/A | .text | CALL QWORD PTR [RIP+0x7C9BC] |
| 1C9C | N/A | .text | CALL QWORD PTR [RIP+0x7C72E] |
| 22C4 | N/A | .text | CALL QWORD PTR [RIP+0x7C39E] |
| 22D7 | N/A | .text | CALL QWORD PTR [RIP+0x7C20B] |
| 26E8 | N/A | .text | CALL QWORD PTR [RIP+0x7BED2] |
| A20D | N/A | .text | CALL QWORD PTR [RIP+0x74315] |
| A221 | N/A | .text | JMP QWORD PTR [RIP+0x74349] |
| BF70 | N/A | .text | CALL QWORD PTR [RIP+0x72752] |
| BF85 | N/A | .text | CALL QWORD PTR [RIP+0x726CD] |
| C118 | N/A | .text | CALL QWORD PTR [RIP+0x724B2] |
| FD23 | N/A | .text | CALL QWORD PTR [RIP+0x6E7DF] |
| FD29 | N/A | .text | CALL QWORD PTR [RIP+0x6E7B1] |
| FD32 | N/A | .text | CALL QWORD PTR [RIP+0x6E810] |
| 1063A | N/A | .text | CALL QWORD PTR [RIP+0x6DEC0] |
| 107FF | N/A | .text | CALL QWORD PTR [RIP+0x6DCE3] |
| 1085E | N/A | .text | CALL QWORD PTR [RIP+0x6DBEC] |
| 10E4F | N/A | .text | CALL QWORD PTR [RIP+0x6D7C3] |
| 10E63 | N/A | .text | CALL QWORD PTR [RIP+0x6D67F] |
| 1118D | N/A | .text | CALL QWORD PTR [RIP+0x6D395] |
| 111A7 | N/A | .text | JMP QWORD PTR [RIP+0x6D3BB] |
| 1154D | N/A | .text | CALL QWORD PTR [RIP+0x6CFC5] |
| 118E1 | N/A | .text | CALL QWORD PTR [RIP+0x6CC71] |
| 118FC | N/A | .text | CALL QWORD PTR [RIP+0x6CBC6] |
| 11912 | N/A | .text | CALL QWORD PTR [RIP+0x6CB80] |
| 1192C | N/A | .text | CALL QWORD PTR [RIP+0x6CC2E] |
| 124F5 | N/A | .text | CALL QWORD PTR [RIP+0x6B995] |
| 1287A | N/A | .text | CALL QWORD PTR [RIP+0x6BCD0] |
| 1288A | N/A | .text | CALL QWORD PTR [RIP+0x6BC28] |
| 12897 | N/A | .text | CALL QWORD PTR [RIP+0x6BC0B] |
| 128A9 | N/A | .text | CALL QWORD PTR [RIP+0x6BD29] |
| 12938 | N/A | .text | JMP QWORD PTR [RIP+0x6BC52] |
| 129E6 | N/A | .text | CALL QWORD PTR [RIP+0x6BB14] |
| 12A58 | N/A | .text | JMP QWORD PTR [RIP+0x6BBDA] |
| 12AF8 | N/A | .text | CALL QWORD PTR [RIP+0x6B392] |
| 12B48 | N/A | .text | CALL QWORD PTR [RIP+0x6B342] |
| 12F05 | N/A | .text | CALL QWORD PTR [RIP+0x634A5] |
| 12F40 | N/A | .text | CALL QWORD PTR [RIP+0x6B6BA] |
| 130B2 | N/A | .text | CALL QWORD PTR [RIP+0x6ADD8] |
| 1340C | N/A | .text | CALL QWORD PTR [RIP+0x6B066] |
| 13419 | N/A | .text | CALL QWORD PTR [RIP+0x6B061] |
| 13519 | N/A | .text | CALL QWORD PTR [RIP+0x6AFD9] |
| 1352F | N/A | .text | CALL QWORD PTR [RIP+0x6AFE3] |
| 1354B | N/A | .text | CALL QWORD PTR [RIP+0x6AF0F] |
| 13564 | N/A | .text | CALL QWORD PTR [RIP+0x6AF36] |
| 1356F | N/A | .text | CALL QWORD PTR [RIP+0x6B0CB] |
| 1357E | N/A | .text | CALL QWORD PTR [RIP+0x6AE84] |
| 135AF | N/A | .text | CALL QWORD PTR [RIP+0x6AF4B] |
| 1480E | N/A | .text | CALL QWORD PTR [RIP+0x69D8C] |
| 1484B | N/A | .text | CALL QWORD PTR [RIP+0x69BD7] |
| 14865 | N/A | .text | CALL QWORD PTR [RIP+0x69BD5] |
| 1488B | N/A | .text | CALL QWORD PTR [RIP+0x69B9F] |
| 148BF | N/A | .text | CALL QWORD PTR [RIP+0x69B6B] |
| 148F7 | N/A | .text | CALL QWORD PTR [RIP+0x69BEB] |
| 14905 | N/A | .text | CALL QWORD PTR [RIP+0x69B2D] |
| 1492A | N/A | .text | CALL QWORD PTR [RIP+0x69B10] |
| 14953 | N/A | .text | CALL QWORD PTR [RIP+0x69AE7] |
| 14960 | N/A | .text | CALL QWORD PTR [RIP+0x69ADA] |
| 1497A | N/A | .text | CALL QWORD PTR [RIP+0x69CA8] |
| 14996 | N/A | .text | CALL QWORD PTR [RIP+0x69AA4] |
| 149A6 | N/A | .text | CALL QWORD PTR [RIP+0x69C7C] |
| 14AE0 | N/A | .text | CALL QWORD PTR [RIP+0x69AA2] |
| 14B1A | N/A | .text | CALL QWORD PTR [RIP+0x698D0] |
| 14B6A | N/A | .text | CALL QWORD PTR [RIP+0x69880] |
| 14BA8 | N/A | .text | CALL QWORD PTR [RIP+0x69AA2] |
| 14BD7 | N/A | .text | CALL QWORD PTR [RIP+0x69883] |
| 14CEE | N/A | .text | CALL QWORD PTR [RIP+0x696EC] |
| 14D0D | N/A | .text | JMP QWORD PTR [RIP+0x69715] |
| 14D15 | N/A | .text | JMP QWORD PTR [RIP+0x69715] |
| 14D1D | N/A | .text | JMP QWORD PTR [RIP+0x69715] |
| 14D25 | N/A | .text | JMP QWORD PTR [RIP+0x69715] |
| 14D39 | N/A | .text | JMP QWORD PTR [RIP+0x69849] |
| 14E17 | N/A | .text | CALL QWORD PTR [RIP+0x69793] |
| 14FA5 | N/A | .text | CALL QWORD PTR [RIP+0x6961D] |
| 14FB7 | N/A | .text | CALL QWORD PTR [RIP+0x6952B] |
| 14FF9 | N/A | .text | CALL QWORD PTR [RIP+0x695C9] |
| 15055 | N/A | .text | CALL QWORD PTR [RIP+0x695F5] |
| 15086 | N/A | .text | CALL QWORD PTR [RIP+0x695C4] |
| 150CA | N/A | .text | CALL QWORD PTR [RIP+0x69390] |
| 21A00-21BFF | N/A | .text | Unusual BP Cave, count: 512 |
| 7D718 | 140011610 | .rdata | TLS Callback | Pointer to 11610 - 0x10A10 .text |
| D2400 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| D240C | 1400010F1 | .pdata | ExceptionHook | Pointer to 10F1 - 0x4F1 .text + UnwindInfo: .rdata |
| D2418 | 1400012BC | .pdata | ExceptionHook | Pointer to 12BC - 0x6BC .text + UnwindInfo: .rdata |
| D2424 | 1400012F4 | .pdata | ExceptionHook | Pointer to 12F4 - 0x6F4 .text + UnwindInfo: .rdata |
| D2430 | 140001376 | .pdata | ExceptionHook | Pointer to 1376 - 0x776 .text + UnwindInfo: .rdata |
| D243C | 140001929 | .pdata | ExceptionHook | Pointer to 1929 - 0xD29 .text + UnwindInfo: .rdata |
| D2448 | 140001958 | .pdata | ExceptionHook | Pointer to 1958 - 0xD58 .text + UnwindInfo: .rdata |
| D2454 | 1400019DC | .pdata | ExceptionHook | Pointer to 19DC - 0xDDC .text + UnwindInfo: .rdata |
| D2460 | 140001AF0 | .pdata | ExceptionHook | Pointer to 1AF0 - 0xEF0 .text + UnwindInfo: .rdata |
| D246C | 140001DE2 | .pdata | ExceptionHook | Pointer to 1DE2 - 0x11E2 .text + UnwindInfo: .rdata |
| D2478 | 14000205B | .pdata | ExceptionHook | Pointer to 205B - 0x145B .text + UnwindInfo: .rdata |
| D2484 | 1400028EA | .pdata | ExceptionHook | Pointer to 28EA - 0x1CEA .text + UnwindInfo: .rdata |
| D2490 | 140002A67 | .pdata | ExceptionHook | Pointer to 2A67 - 0x1E67 .text + UnwindInfo: .rdata |
| D249C | 140002EAB | .pdata | ExceptionHook | Pointer to 2EAB - 0x22AB .text + UnwindInfo: .rdata |
| D24A8 | 140002F0D | .pdata | ExceptionHook | Pointer to 2F0D - 0x230D .text + UnwindInfo: .rdata |
| D24B4 | 140002F5E | .pdata | ExceptionHook | Pointer to 2F5E - 0x235E .text + UnwindInfo: .rdata |
| D24C0 | 140003D70 | .pdata | ExceptionHook | Pointer to 3D70 - 0x3170 .text + UnwindInfo: .rdata |
| D24CC | 14000ADFB | .pdata | ExceptionHook | Pointer to ADFB - 0xA1FB .text + UnwindInfo: .rdata |
| D24D8 | 14000AE27 | .pdata | ExceptionHook | Pointer to AE27 - 0xA227 .text + UnwindInfo: .rdata |
| D24E4 | 14000B4E8 | .pdata | ExceptionHook | Pointer to B4E8 - 0xA8E8 .text + UnwindInfo: .rdata |
| D24F0 | 14000CB2C | .pdata | ExceptionHook | Pointer to CB2C - 0xBF2C .text + UnwindInfo: .rdata |
| D24FC | 14000CBC4 | .pdata | ExceptionHook | Pointer to CBC4 - 0xBFC4 .text + UnwindInfo: .rdata |
| D2508 | 14000CBF3 | .pdata | ExceptionHook | Pointer to CBF3 - 0xBFF3 .text + UnwindInfo: .rdata |
| D2514 | 14000CC93 | .pdata | ExceptionHook | Pointer to CC93 - 0xC093 .text + UnwindInfo: .rdata |
| D2520 | 14000CE28 | .pdata | ExceptionHook | Pointer to CE28 - 0xC228 .text + UnwindInfo: .rdata |
| D252C | 14000CFF4 | .pdata | ExceptionHook | Pointer to CFF4 - 0xC3F4 .text + UnwindInfo: .rdata |
| D2538 | 14000D0EF | .pdata | ExceptionHook | Pointer to D0EF - 0xC4EF .text + UnwindInfo: .rdata |
| D2544 | 1400111CD | .pdata | ExceptionHook | Pointer to 111CD - 0x105CD .text + UnwindInfo: .rdata |
| D2550 | 1400111E7 | .pdata | ExceptionHook | Pointer to 111E7 - 0x105E7 .text + UnwindInfo: .rdata |
| D255C | 1400115C5 | .pdata | ExceptionHook | Pointer to 115C5 - 0x109C5 .text + UnwindInfo: .rdata |
| D2568 | 14001162D | .pdata | ExceptionHook | Pointer to 1162D - 0x10A2D .text + UnwindInfo: .rdata |
| D2574 | 1400118F9 | .pdata | ExceptionHook | Pointer to 118F9 - 0x10CF9 .text + UnwindInfo: .rdata |
| D2580 | 1400119B8 | .pdata | ExceptionHook | Pointer to 119B8 - 0x10DB8 .text + UnwindInfo: .rdata |
| D258C | 140011A44 | .pdata | ExceptionHook | Pointer to 11A44 - 0x10E44 .text + UnwindInfo: .rdata |
| D2598 | 140011D82 | .pdata | ExceptionHook | Pointer to 11D82 - 0x11182 .text + UnwindInfo: .rdata |
| D25A4 | 140011DB6 | .pdata | ExceptionHook | Pointer to 11DB6 - 0x111B6 .text + UnwindInfo: .rdata |
| D25B0 | 140012CCE | .pdata | ExceptionHook | Pointer to 12CCE - 0x120CE .text + UnwindInfo: .rdata |
| D25BC | 140012CE8 | .pdata | ExceptionHook | Pointer to 12CE8 - 0x120E8 .text + UnwindInfo: .rdata |
| D25C8 | 140012EA7 | .pdata | ExceptionHook | Pointer to 12EA7 - 0x122A7 .text + UnwindInfo: .rdata |
| D25D4 | 140012EF0 | .pdata | ExceptionHook | Pointer to 12EF0 - 0x122F0 .text + UnwindInfo: .rdata |
| D25E0 | 140012F40 | .pdata | ExceptionHook | Pointer to 12F40 - 0x12340 .text + UnwindInfo: .rdata |
| D25EC | 140013000 | .pdata | ExceptionHook | Pointer to 13000 - 0x12400 .text + UnwindInfo: .rdata |
| D25F8 | 140013010 | .pdata | ExceptionHook | Pointer to 13010 - 0x12410 .text + UnwindInfo: .rdata |
| D2604 | 140013030 | .pdata | ExceptionHook | Pointer to 13030 - 0x12430 .text + UnwindInfo: .rdata |
| D2610 | 1400131B0 | .pdata | ExceptionHook | Pointer to 131B0 - 0x125B0 .text + UnwindInfo: .rdata |
| D261C | 1400131D0 | .pdata | ExceptionHook | Pointer to 131D0 - 0x125D0 .text + UnwindInfo: .rdata |
| D2628 | 140013210 | .pdata | ExceptionHook | Pointer to 13210 - 0x12610 .text + UnwindInfo: .rdata |
| D2634 | 1400132B0 | .pdata | ExceptionHook | Pointer to 132B0 - 0x126B0 .text + UnwindInfo: .rdata |
| D2640 | 140013300 | .pdata | ExceptionHook | Pointer to 13300 - 0x12700 .text + UnwindInfo: .rdata |
| D264C | 140013330 | .pdata | ExceptionHook | Pointer to 13330 - 0x12730 .text + UnwindInfo: .rdata |
| D2658 | 140013370 | .pdata | ExceptionHook | Pointer to 13370 - 0x12770 .text + UnwindInfo: .rdata |
| D2664 | 1400133A0 | .pdata | ExceptionHook | Pointer to 133A0 - 0x127A0 .text + UnwindInfo: .rdata |
| D2670 | 140013440 | .pdata | ExceptionHook | Pointer to 13440 - 0x12840 .text + UnwindInfo: .rdata |
| D267C | 140013560 | .pdata | ExceptionHook | Pointer to 13560 - 0x12960 .text + UnwindInfo: .rdata |
| D2688 | 1400135E0 | .pdata | ExceptionHook | Pointer to 135E0 - 0x129E0 .text + UnwindInfo: .rdata |
| D2694 | 140013670 | .pdata | ExceptionHook | Pointer to 13670 - 0x12A70 .text + UnwindInfo: .rdata |
| D26A0 | 1400136D0 | .pdata | ExceptionHook | Pointer to 136D0 - 0x12AD0 .text + UnwindInfo: .rdata |
| D26AC | 140013720 | .pdata | ExceptionHook | Pointer to 13720 - 0x12B20 .text + UnwindInfo: .rdata |
| D26B8 | 140013770 | .pdata | ExceptionHook | Pointer to 13770 - 0x12B70 .text + UnwindInfo: .rdata |
| D26C4 | 14001377B | .pdata | ExceptionHook | Pointer to 1377B - 0x12B7B .text + UnwindInfo: .rdata |
| D26D0 | 1400138B3 | .pdata | ExceptionHook | Pointer to 138B3 - 0x12CB3 .text + UnwindInfo: .rdata |
| D26DC | 140013A30 | .pdata | ExceptionHook | Pointer to 13A30 - 0x12E30 .text + UnwindInfo: .rdata |
| D26E8 | 140013C50 | .pdata | ExceptionHook | Pointer to 13C50 - 0x13050 .text + UnwindInfo: .rdata |
| D26F4 | 140013CC0 | .pdata | ExceptionHook | Pointer to 13CC0 - 0x130C0 .text + UnwindInfo: .rdata |
| D2700 | 140013CE0 | .pdata | ExceptionHook | Pointer to 13CE0 - 0x130E0 .text + UnwindInfo: .rdata |
| D270C | 140013D20 | .pdata | ExceptionHook | Pointer to 13D20 - 0x13120 .text + UnwindInfo: .rdata |
| D2718 | 140013D40 | .pdata | ExceptionHook | Pointer to 13D40 - 0x13140 .text + UnwindInfo: .rdata |
| D2724 | 140013D90 | .pdata | ExceptionHook | Pointer to 13D90 - 0x13190 .text + UnwindInfo: .rdata |
| D2730 | 140013E30 | .pdata | ExceptionHook | Pointer to 13E30 - 0x13230 .text + UnwindInfo: .rdata |
| D273C | 140013E60 | .pdata | ExceptionHook | Pointer to 13E60 - 0x13260 .text + UnwindInfo: .rdata |
| D2748 | 140013E94 | .pdata | ExceptionHook | Pointer to 13E94 - 0x13294 .text + UnwindInfo: .rdata |
| D2754 | 140013EB8 | .pdata | ExceptionHook | Pointer to 13EB8 - 0x132B8 .text + UnwindInfo: .rdata |
| D2760 | 140013EC8 | .pdata | ExceptionHook | Pointer to 13EC8 - 0x132C8 .text + UnwindInfo: .rdata |
| D276C | 140013F10 | .pdata | ExceptionHook | Pointer to 13F10 - 0x13310 .text + UnwindInfo: .rdata |
| D2778 | 140013F50 | .pdata | ExceptionHook | Pointer to 13F50 - 0x13350 .text + UnwindInfo: .rdata |
| D2784 | 140013FC0 | .pdata | ExceptionHook | Pointer to 13FC0 - 0x133C0 .text + UnwindInfo: .rdata |
| D2790 | 140014008 | .pdata | ExceptionHook | Pointer to 14008 - 0x13408 .text + UnwindInfo: .rdata |
| D279C | 1400140B0 | .pdata | ExceptionHook | Pointer to 140B0 - 0x134B0 .text + UnwindInfo: .rdata |
| D27A8 | 1400140F4 | .pdata | ExceptionHook | Pointer to 140F4 - 0x134F4 .text + UnwindInfo: .rdata |
| D27B4 | 140014158 | .pdata | ExceptionHook | Pointer to 14158 - 0x13558 .text + UnwindInfo: .rdata |
| D27C0 | 140014188 | .pdata | ExceptionHook | Pointer to 14188 - 0x13588 .text + UnwindInfo: .rdata |
| D27CC | 14001426C | .pdata | ExceptionHook | Pointer to 1426C - 0x1366C .text + UnwindInfo: .rdata |
| D27D8 | 14001432C | .pdata | ExceptionHook | Pointer to 1432C - 0x1372C .text + UnwindInfo: .rdata |
| D27E4 | 140014370 | .pdata | ExceptionHook | Pointer to 14370 - 0x13770 .text + UnwindInfo: .rdata |
| D27F0 | 1400143DC | .pdata | ExceptionHook | Pointer to 143DC - 0x137DC .text + UnwindInfo: .rdata |
| D27FC | 14001440C | .pdata | ExceptionHook | Pointer to 1440C - 0x1380C .text + UnwindInfo: .rdata |
| D2808 | 14001447C | .pdata | ExceptionHook | Pointer to 1447C - 0x1387C .text + UnwindInfo: .rdata |
| D2814 | 1400145FC | .pdata | ExceptionHook | Pointer to 145FC - 0x139FC .text + UnwindInfo: .rdata |
| D2820 | 14001465C | .pdata | ExceptionHook | Pointer to 1465C - 0x13A5C .text + UnwindInfo: .rdata |
| D282C | 140014844 | .pdata | ExceptionHook | Pointer to 14844 - 0x13C44 .text + UnwindInfo: .rdata |
| D2838 | 14001488C | .pdata | ExceptionHook | Pointer to 1488C - 0x13C8C .text + UnwindInfo: .rdata |
| D2844 | 1400148E0 | .pdata | ExceptionHook | Pointer to 148E0 - 0x13CE0 .text + UnwindInfo: .rdata |
| D2850 | 140014A90 | .pdata | ExceptionHook | Pointer to 14A90 - 0x13E90 .text + UnwindInfo: .rdata |
| D285C | 140014BA8 | .pdata | ExceptionHook | Pointer to 14BA8 - 0x13FA8 .text + UnwindInfo: .rdata |
| D2868 | 140014BE4 | .pdata | ExceptionHook | Pointer to 14BE4 - 0x13FE4 .text + UnwindInfo: .rdata |
| D2874 | 140014C28 | .pdata | ExceptionHook | Pointer to 14C28 - 0x14028 .text + UnwindInfo: .rdata |
| D2880 | 140014C78 | .pdata | ExceptionHook | Pointer to 14C78 - 0x14078 .text + UnwindInfo: .rdata |
| D288C | 140014CB4 | .pdata | ExceptionHook | Pointer to 14CB4 - 0x140B4 .text + UnwindInfo: .rdata |
| D2898 | 140014CF8 | .pdata | ExceptionHook | Pointer to 14CF8 - 0x140F8 .text + UnwindInfo: .rdata |
| D28A4 | 140014D6C | .pdata | ExceptionHook | Pointer to 14D6C - 0x1416C .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 937786 | 81,5863% |
| Null Byte Code | 50518 | 4,395% |
© 2026 All rights reserved.