PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 268,79 KBSHA-256 Hash: 13A44BA07699E8BD18B6FC3AF00E93234F90314616768EEA01D73AFB7845E1A8 SHA-1 Hash: F9E48198989B5625DF602A80C1BE5CCCA774E080 MD5 Hash: 616351CFC24B2EEEF740DDC6F9CCB126 Imphash: CCC64CFFD55CD1A48098F5AD37094A0C MajorOSVersion: 5 MinorOSVersion: 2 CheckSum: 0005231C EntryPoint (rva): 4D1C SizeOfHeaders: 400 SizeOfImage: 47000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 1AB04 IAT: 12000 Characteristics: 22 TimeDateStamp: 6A3C91F9 Date: 25/06/2026 2:27:05 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 10200 | 1000 | 10055 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
10600 | 9400 | 12000 | 934C |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
19A00 | 1A00 | 1C000 | 3E50 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
1B400 | 1200 | 20000 | 117C |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1C600 | 23600 | 22000 | 23568 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
3FC00 | 800 | 46000 | 7F8 |
|
|
| Description |
| OriginalFilename: PartitionWizard.exe CompanyName: MiniTool Software Limited LegalCopyright: Copyright (C) 2026 MiniTool Software Limited, All rights reserved. ProductName: MiniTool Partition Wizard FileVersion: 13.9.0.0 FileDescription: MiniTool Partition Wizard ProductVersion: 13.9.0.0 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 411C Code -> 4883EC28E85F3D00004883C428E902000000CCCC48895C24104889742418574883EC30E8781200000FB7F0B902000000E8EB Assembler |SUB RSP, 0X28 |CALL 0X140008A84 |ADD RSP, 0X28 |JMP 0X140004D30 |INT3 |INT3 |MOV QWORD PTR [RSP + 0X10], RBX |MOV QWORD PTR [RSP + 0X18], RSI |PUSH RDI |SUB RSP, 0X30 |CALL 0X140005FBC |MOVZX ESI, AX |MOV ECX, 2 |
| Signatures |
| Rich Signature Analyzer: Code -> AB15672FEF74097CEF74097CEF74097CA925E97C8474097CA925D67CE474097CA925E87CC674097CE60C9A7CE974097C5AEAD47CEC74097CEF74087CB874097C5AEAEC7CED74097CE226D27CEE74097CEF749E7CEE74097C5AEAD77CEE74097C52696368EF74097C Footprint md5 Hash -> 2AC5E89137B0A8486638CB2FB0E5FA35 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(2013)[-] • PE+(64): linker: Microsoft Linker(12.0*)[-] • PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.38503 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| File Access |
| SHELL32.dll ADVAPI32.dll KERNEL32.dll partitionwizard.dll @.dat |
| File Access (UNICODE) |
| PartitionWizard.exe USER32.DLL kernel32.dll mscoree.dll Temp |
| Interest's Words |
| exec start ping |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://www.digicert.com/CPS0 http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl |
| IP Addresses |
| 13.9.0.0 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 22220 | 468 | 1C820 | 280000001000000020000000010020000000000000040000130B0000130B00000000000000000000C9C8C9629D9D9D8E0F0F | (....... ..... ............................b...... |
| \ICON\2\1033 | 22688 | 10A8 | 1CC88 | 280000002000000040000000010020000000000000100000130B0000130B00000000000000000000DFDFDF07D5D5D56B8989 | (... ...@..... ................................k.. |
| \ICON\3\1033 | 23730 | 25A8 | 1DD30 | 280000003000000060000000010020000000000000240000130B0000130B00000000000000000000F9F9F900FFFFFF05C2C2 | (...0........ ......$............................ |
| \ICON\4\1033 | 25CD8 | 4228 | 202D8 | 280000004000000080000000010020000000000000400000130B0000130B0000000000000000000000000000D6D6D600EEEE | (...@......... ......@............................ |
| \ICON\5\1033 | 29F00 | 10828 | 24500 | 280000008000000000010000010020000000000000000100130B0000130B0000000000000000000000000000000000000000 | (............. ................................... |
| \ICON\6\1033 | 3A728 | A8C4 | 34D28 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000080004944415478DAECFD799C65675D | .PNG........IHDR.............\r.f....IDATx...y.eg] |
| \GROUP_ICON\101\1033 | 44FF0 | 5A | 3F5F0 | 00000100060010100000010020006804000001002020000001002000A810000002003030000001002000A82500000300404000000100200028420000040080800000010020002808010005000000000001002000C4A800000600 | ............ .h..... .... .......00.... ..%....@@.... .(B.......... .(........... ....... |
| \VERSION\1\1033 | 45050 | 390 | 3F650 | 900334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000900 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 453E0 | 188 | 3F9E0 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • PartitionWizard.exe • 13.9.0.0 • mscoree.dll • kernel32.dll • USER32.DLL • runas • H:\MiniTool Partition Wizard -TFS\v13.0\MiniTool Partition Wizard v11\x64\Release\exeDummy.pdb • +0U00SQOMhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0SQOMhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0+00$+0http://ocsp.digicert.com0\+0Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0U00*H2NU.DMbZb|bm\6rL;+h%3{ _GfIO88\ZD]I)H"me%6A/TfwGmul2x_Zr8FEy9Mdi-0L6lCN|4Pg\;Avj;U/]-> • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| F3F | N/A | .text | CALL QWORD PTR [RIP+0x104FB] |
| F52 | N/A | .text | CALL QWORD PTR [RIP+0x104A8] |
| F9D | N/A | .text | CALL QWORD PTR [RIP+0x10465] |
| FCE | N/A | .text | CALL QWORD PTR [RIP+0x10464] |
| 1013 | N/A | .text | CALL QWORD PTR [RIP+0x103FF] |
| 10D7 | N/A | .text | CALL QWORD PTR [RIP+0x10343] |
| 10E5 | N/A | .text | CALL QWORD PTR [RIP+0x1054D] |
| 110C | N/A | .text | CALL QWORD PTR [RIP+0x10316] |
| 1312 | N/A | .text | CALL QWORD PTR [RIP+0x10110] |
| 1408 | N/A | .text | CALL QWORD PTR [RIP+0x10232] |
| 146F | N/A | .text | CALL QWORD PTR [RIP+0x101DB] |
| 3566 | N/A | .text | CALL QWORD PTR [RIP+0xDF1C] |
| 357C | N/A | .text | CALL QWORD PTR [RIP+0xDF0E] |
| 35A3 | N/A | .text | CALL QWORD PTR [RIP+0xDED7] |
| 3618 | N/A | .text | CALL QWORD PTR [RIP+0xF6AA] |
| 367C | N/A | .text | CALL QWORD PTR [RIP+0x1BBAE] |
| 36A0 | N/A | .text | CALL QWORD PTR [RIP+0xDDC2] |
| 37F4 | N/A | .text | CALL QWORD PTR [RIP+0xDC76] |
| 3812 | N/A | .text | CALL QWORD PTR [RIP+0xDC58] |
| 3840 | N/A | .text | CALL QWORD PTR [RIP+0xDC22] |
| 3855 | N/A | .text | CALL QWORD PTR [RIP+0xDC15] |
| 3860 | N/A | .text | CALL QWORD PTR [RIP+0xDC02] |
| 3872 | N/A | .text | CALL QWORD PTR [RIP+0xDBF8] |
| 3882 | N/A | .text | CALL QWORD PTR [RIP+0xDBE8] |
| 390E | N/A | .text | CALL QWORD PTR [RIP+0xDB6C] |
| 3ED1 | N/A | .text | CALL QWORD PTR [RIP+0xD591] |
| 3F25 | N/A | .text | CALL QWORD PTR [RIP+0xD545] |
| 3F35 | N/A | .text | CALL QWORD PTR [RIP+0xD535] |
| 3FB3 | N/A | .text | CALL QWORD PTR [RIP+0xD4AF] |
| 3FC3 | N/A | .text | CALL QWORD PTR [RIP+0xD49F] |
| 3FD0 | N/A | .text | CALL QWORD PTR [RIP+0xD492] |
| 402B | N/A | .text | CALL QWORD PTR [RIP+0xD43F] |
| 420E | N/A | .text | CALL QWORD PTR [RIP+0xD294] |
| 4416 | N/A | .text | CALL QWORD PTR [RIP+0xD094] |
| 4455 | N/A | .text | CALL QWORD PTR [RIP+0xD05D] |
| 44D2 | N/A | .text | CALL QWORD PTR [RIP+0xCFE8] |
| 4A37 | N/A | .text | CALL QWORD PTR [RIP+0xCA8B] |
| 4D19 | N/A | .text | CALL QWORD PTR [RIP+0xC7B1] |
| 4ED4 | N/A | .text | CALL QWORD PTR [RIP+0xC5F6] |
| 4F53 | N/A | .text | CALL QWORD PTR [RIP+0xC517] |
| 509E | N/A | .text | JMP QWORD PTR [RIP+0xC43C] |
| 50D7 | N/A | .text | CALL QWORD PTR [RIP+0xC413] |
| 5107 | N/A | .text | CALL QWORD PTR [RIP+0xC3E3] |
| 51D0 | N/A | .text | CALL QWORD PTR [RIP+0xC312] |
| 5262 | N/A | .text | JMP QWORD PTR [RIP+0xC280] |
| 5275 | N/A | .text | CALL QWORD PTR [RIP+0xC27D] |
| 528D | N/A | .text | CALL QWORD PTR [RIP+0xC22D] |
| 52C4 | N/A | .text | CALL QWORD PTR [RIP+0xC236] |
| 52E3 | N/A | .text | CALL QWORD PTR [RIP+0xC20F] |
| 52FD | N/A | .text | CALL QWORD PTR [RIP+0xC1BD] |
| 5334 | N/A | .text | CALL QWORD PTR [RIP+0xC1C6] |
| 5360 | N/A | .text | JMP QWORD PTR [RIP+0xC1D2] |
| 537C | N/A | .text | JMP QWORD PTR [RIP+0xC1CE] |
| 5398 | N/A | .text | JMP QWORD PTR [RIP+0xC1A2] |
| 53B4 | N/A | .text | JMP QWORD PTR [RIP+0xC08E] |
| 53C8 | N/A | .text | CALL QWORD PTR [RIP+0xC18A] |
| 5403 | N/A | .text | CALL QWORD PTR [RIP+0xC117] |
| 546D | N/A | .text | CALL QWORD PTR [RIP+0xC0ED] |
| 5480 | N/A | .text | CALL QWORD PTR [RIP+0xC00A] |
| 549E | N/A | .text | CALL QWORD PTR [RIP+0xBFEC] |
| 54BC | N/A | .text | CALL QWORD PTR [RIP+0xBFCE] |
| 54DA | N/A | .text | CALL QWORD PTR [RIP+0xBFB0] |
| 54F8 | N/A | .text | CALL QWORD PTR [RIP+0xBF92] |
| 5516 | N/A | .text | CALL QWORD PTR [RIP+0xBF74] |
| 5534 | N/A | .text | CALL QWORD PTR [RIP+0xBF56] |
| 5552 | N/A | .text | CALL QWORD PTR [RIP+0xBF38] |
| 5570 | N/A | .text | CALL QWORD PTR [RIP+0xBF1A] |
| 558E | N/A | .text | CALL QWORD PTR [RIP+0xBEFC] |
| 55AC | N/A | .text | CALL QWORD PTR [RIP+0xBEDE] |
| 55CA | N/A | .text | CALL QWORD PTR [RIP+0xBEC0] |
| 55E8 | N/A | .text | CALL QWORD PTR [RIP+0xBEA2] |
| 5606 | N/A | .text | CALL QWORD PTR [RIP+0xBE84] |
| 5624 | N/A | .text | CALL QWORD PTR [RIP+0xBE66] |
| 5642 | N/A | .text | CALL QWORD PTR [RIP+0xBE48] |
| 5660 | N/A | .text | CALL QWORD PTR [RIP+0xBE2A] |
| 567E | N/A | .text | CALL QWORD PTR [RIP+0xBE0C] |
| 569C | N/A | .text | CALL QWORD PTR [RIP+0xBDEE] |
| 56BA | N/A | .text | CALL QWORD PTR [RIP+0xBDD0] |
| 56D8 | N/A | .text | CALL QWORD PTR [RIP+0xBDB2] |
| 56F6 | N/A | .text | CALL QWORD PTR [RIP+0xBD94] |
| 5714 | N/A | .text | CALL QWORD PTR [RIP+0xBD76] |
| 5732 | N/A | .text | CALL QWORD PTR [RIP+0xBD58] |
| 5750 | N/A | .text | CALL QWORD PTR [RIP+0xBD3A] |
| 576E | N/A | .text | CALL QWORD PTR [RIP+0xBD1C] |
| 578C | N/A | .text | CALL QWORD PTR [RIP+0xBCFE] |
| 57AA | N/A | .text | CALL QWORD PTR [RIP+0xBCE0] |
| 57C8 | N/A | .text | CALL QWORD PTR [RIP+0xBCC2] |
| 57E6 | N/A | .text | CALL QWORD PTR [RIP+0xBCA4] |
| 5804 | N/A | .text | CALL QWORD PTR [RIP+0xBC86] |
| 5822 | N/A | .text | CALL QWORD PTR [RIP+0xBC68] |
| 5840 | N/A | .text | CALL QWORD PTR [RIP+0xBC4A] |
| 585D | N/A | .text | JMP QWORD PTR [RIP+0xBCAD] |
| 5865 | N/A | .text | JMP QWORD PTR [RIP+0xBCBD] |
| 5874 | N/A | .text | CALL QWORD PTR [RIP+0xBBC6] |
| 5885 | N/A | .text | JMP QWORD PTR [RIP+0xBCA5] |
| 5897 | N/A | .text | CALL QWORD PTR [RIP+0xBC73] |
| 58A6 | N/A | .text | JMP QWORD PTR [RIP+0xBC5C] |
| 59D8 | N/A | .text | CALL QWORD PTR [RIP+0xBA3A] |
| 5A95 | N/A | .text | CALL QWORD PTR [RIP+0xBACD] |
| 5AF5 | N/A | .text | CALL QWORD PTR [RIP+0xBA75] |
| 1B400 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 1B40C | 140001020 | .pdata | ExceptionHook | Pointer to 1020 - 0x420 .text + UnwindInfo: .rdata |
| 1B418 | 140001040 | .pdata | ExceptionHook | Pointer to 1040 - 0x440 .text + UnwindInfo: .rdata |
| 1B424 | 140001070 | .pdata | ExceptionHook | Pointer to 1070 - 0x470 .text + UnwindInfo: .rdata |
| 1B430 | 1400010A0 | .pdata | ExceptionHook | Pointer to 10A0 - 0x4A0 .text + UnwindInfo: .rdata |
| 1B43C | 1400010D0 | .pdata | ExceptionHook | Pointer to 10D0 - 0x4D0 .text + UnwindInfo: .rdata |
| 1B448 | 1400010F0 | .pdata | ExceptionHook | Pointer to 10F0 - 0x4F0 .text + UnwindInfo: .rdata |
| 1B454 | 140001110 | .pdata | ExceptionHook | Pointer to 1110 - 0x510 .text + UnwindInfo: .rdata |
| 1B460 | 140001130 | .pdata | ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .rdata |
| 1B46C | 1400011B0 | .pdata | ExceptionHook | Pointer to 11B0 - 0x5B0 .text + UnwindInfo: .rdata |
| 1B478 | 1400011E0 | .pdata | ExceptionHook | Pointer to 11E0 - 0x5E0 .text + UnwindInfo: .rdata |
| 1B484 | 140001220 | .pdata | ExceptionHook | Pointer to 1220 - 0x620 .text + UnwindInfo: .rdata |
| 1B490 | 1400012A0 | .pdata | ExceptionHook | Pointer to 12A0 - 0x6A0 .text + UnwindInfo: .rdata |
| 1B49C | 140001300 | .pdata | ExceptionHook | Pointer to 1300 - 0x700 .text + UnwindInfo: .rdata |
| 1B4A8 | 140001350 | .pdata | ExceptionHook | Pointer to 1350 - 0x750 .text + UnwindInfo: .rdata |
| 1B4B4 | 1400013A0 | .pdata | ExceptionHook | Pointer to 13A0 - 0x7A0 .text + UnwindInfo: .rdata |
| 1B4C0 | 1400013F0 | .pdata | ExceptionHook | Pointer to 13F0 - 0x7F0 .text + UnwindInfo: .rdata |
| 1B4CC | 140001440 | .pdata | ExceptionHook | Pointer to 1440 - 0x840 .text + UnwindInfo: .rdata |
| 1B4D8 | 1400014A0 | .pdata | ExceptionHook | Pointer to 14A0 - 0x8A0 .text + UnwindInfo: .rdata |
| 1B4E4 | 1400014F0 | .pdata | ExceptionHook | Pointer to 14F0 - 0x8F0 .text + UnwindInfo: .rdata |
| 1B4F0 | 1400015C0 | .pdata | ExceptionHook | Pointer to 15C0 - 0x9C0 .text + UnwindInfo: .rdata |
| 1B4FC | 140001600 | .pdata | ExceptionHook | Pointer to 1600 - 0xA00 .text + UnwindInfo: .rdata |
| 1B508 | 140001690 | .pdata | ExceptionHook | Pointer to 1690 - 0xA90 .text + UnwindInfo: .rdata |
| 1B514 | 140001710 | .pdata | ExceptionHook | Pointer to 1710 - 0xB10 .text + UnwindInfo: .rdata |
| 1B520 | 140001740 | .pdata | ExceptionHook | Pointer to 1740 - 0xB40 .text + UnwindInfo: .rdata |
| 1B52C | 140001780 | .pdata | ExceptionHook | Pointer to 1780 - 0xB80 .text + UnwindInfo: .rdata |
| 1B538 | 1400017E0 | .pdata | ExceptionHook | Pointer to 17E0 - 0xBE0 .text + UnwindInfo: .rdata |
| 1B544 | 140001820 | .pdata | ExceptionHook | Pointer to 1820 - 0xC20 .text + UnwindInfo: .rdata |
| 1B550 | 140001890 | .pdata | ExceptionHook | Pointer to 1890 - 0xC90 .text + UnwindInfo: .rdata |
| 1B55C | 1400018D0 | .pdata | ExceptionHook | Pointer to 18D0 - 0xCD0 .text + UnwindInfo: .rdata |
| 1B568 | 1400018F0 | .pdata | ExceptionHook | Pointer to 18F0 - 0xCF0 .text + UnwindInfo: .rdata |
| 1B574 | 140001930 | .pdata | ExceptionHook | Pointer to 1930 - 0xD30 .text + UnwindInfo: .rdata |
| 1B580 | 1400019A0 | .pdata | ExceptionHook | Pointer to 19A0 - 0xDA0 .text + UnwindInfo: .rdata |
| 1B58C | 1400019E0 | .pdata | ExceptionHook | Pointer to 19E0 - 0xDE0 .text + UnwindInfo: .rdata |
| 1B598 | 140001A00 | .pdata | ExceptionHook | Pointer to 1A00 - 0xE00 .text + UnwindInfo: .rdata |
| 1B5A4 | 140001A40 | .pdata | ExceptionHook | Pointer to 1A40 - 0xE40 .text + UnwindInfo: .rdata |
| 1B5B0 | 140001AB0 | .pdata | ExceptionHook | Pointer to 1AB0 - 0xEB0 .text + UnwindInfo: .rdata |
| 1B5BC | 140001B30 | .pdata | ExceptionHook | Pointer to 1B30 - 0xF30 .text + UnwindInfo: .rdata |
| 1B5C8 | 140001BE0 | .pdata | ExceptionHook | Pointer to 1BE0 - 0xFE0 .text + UnwindInfo: .rdata |
| 1B5D4 | 140001CA0 | .pdata | ExceptionHook | Pointer to 1CA0 - 0x10A0 .text + UnwindInfo: .rdata |
| 1B5E0 | 140001F60 | .pdata | ExceptionHook | Pointer to 1F60 - 0x1360 .text + UnwindInfo: .rdata |
| 1B5EC | 140002090 | .pdata | ExceptionHook | Pointer to 2090 - 0x1490 .text + UnwindInfo: .rdata |
| 1B5F8 | 1400020E0 | .pdata | ExceptionHook | Pointer to 20E0 - 0x14E0 .text + UnwindInfo: .rdata |
| 1B604 | 140002120 | .pdata | ExceptionHook | Pointer to 2120 - 0x1520 .text + UnwindInfo: .rdata |
| 1B610 | 140002170 | .pdata | ExceptionHook | Pointer to 2170 - 0x1570 .text + UnwindInfo: .rdata |
| 1B61C | 1400021D0 | .pdata | ExceptionHook | Pointer to 21D0 - 0x15D0 .text + UnwindInfo: .rdata |
| 1B628 | 1400021F0 | .pdata | ExceptionHook | Pointer to 21F0 - 0x15F0 .text + UnwindInfo: .rdata |
| 1B634 | 140002220 | .pdata | ExceptionHook | Pointer to 2220 - 0x1620 .text + UnwindInfo: .rdata |
| 1B640 | 140002250 | .pdata | ExceptionHook | Pointer to 2250 - 0x1650 .text + UnwindInfo: .rdata |
| 1B64C | 140002280 | .pdata | ExceptionHook | Pointer to 2280 - 0x1680 .text + UnwindInfo: .rdata |
| 1B658 | 1400022C0 | .pdata | ExceptionHook | Pointer to 22C0 - 0x16C0 .text + UnwindInfo: .rdata |
| 1B664 | 140002310 | .pdata | ExceptionHook | Pointer to 2310 - 0x1710 .text + UnwindInfo: .rdata |
| 1B670 | 140002340 | .pdata | ExceptionHook | Pointer to 2340 - 0x1740 .text + UnwindInfo: .rdata |
| 1B67C | 1400023B0 | .pdata | ExceptionHook | Pointer to 23B0 - 0x17B0 .text + UnwindInfo: .rdata |
| 1B688 | 1400023E0 | .pdata | ExceptionHook | Pointer to 23E0 - 0x17E0 .text + UnwindInfo: .rdata |
| 1B694 | 140002450 | .pdata | ExceptionHook | Pointer to 2450 - 0x1850 .text + UnwindInfo: .rdata |
| 1B6A0 | 140002490 | .pdata | ExceptionHook | Pointer to 2490 - 0x1890 .text + UnwindInfo: .rdata |
| 1B6AC | 140002590 | .pdata | ExceptionHook | Pointer to 2590 - 0x1990 .text + UnwindInfo: .rdata |
| 1B6B8 | 1400025C0 | .pdata | ExceptionHook | Pointer to 25C0 - 0x19C0 .text + UnwindInfo: .rdata |
| 1B6C4 | 1400026B0 | .pdata | ExceptionHook | Pointer to 26B0 - 0x1AB0 .text + UnwindInfo: .rdata |
| 1B6D0 | 1400026E0 | .pdata | ExceptionHook | Pointer to 26E0 - 0x1AE0 .text + UnwindInfo: .rdata |
| 1B6DC | 140002710 | .pdata | ExceptionHook | Pointer to 2710 - 0x1B10 .text + UnwindInfo: .rdata |
| 1B6E8 | 140002750 | .pdata | ExceptionHook | Pointer to 2750 - 0x1B50 .text + UnwindInfo: .rdata |
| 1B6F4 | 140002820 | .pdata | ExceptionHook | Pointer to 2820 - 0x1C20 .text + UnwindInfo: .rdata |
| 1B700 | 140002850 | .pdata | ExceptionHook | Pointer to 2850 - 0x1C50 .text + UnwindInfo: .rdata |
| 1B70C | 140002880 | .pdata | ExceptionHook | Pointer to 2880 - 0x1C80 .text + UnwindInfo: .rdata |
| 1B718 | 140002930 | .pdata | ExceptionHook | Pointer to 2930 - 0x1D30 .text + UnwindInfo: .rdata |
| 1B724 | 140002960 | .pdata | ExceptionHook | Pointer to 2960 - 0x1D60 .text + UnwindInfo: .rdata |
| 1B730 | 140002A30 | .pdata | ExceptionHook | Pointer to 2A30 - 0x1E30 .text + UnwindInfo: .rdata |
| 1B73C | 140002A80 | .pdata | ExceptionHook | Pointer to 2A80 - 0x1E80 .text + UnwindInfo: .rdata |
| 1B748 | 140002B60 | .pdata | ExceptionHook | Pointer to 2B60 - 0x1F60 .text + UnwindInfo: .rdata |
| 1B754 | 140002C40 | .pdata | ExceptionHook | Pointer to 2C40 - 0x2040 .text + UnwindInfo: .rdata |
| 1B760 | 140002C80 | .pdata | ExceptionHook | Pointer to 2C80 - 0x2080 .text + UnwindInfo: .rdata |
| 1B76C | 140002CC0 | .pdata | ExceptionHook | Pointer to 2CC0 - 0x20C0 .text + UnwindInfo: .rdata |
| 1B778 | 140002D10 | .pdata | ExceptionHook | Pointer to 2D10 - 0x2110 .text + UnwindInfo: .rdata |
| 1B784 | 140002DC0 | .pdata | ExceptionHook | Pointer to 2DC0 - 0x21C0 .text + UnwindInfo: .rdata |
| 1B790 | 140002E10 | .pdata | ExceptionHook | Pointer to 2E10 - 0x2210 .text + UnwindInfo: .rdata |
| 1B79C | 140002EF0 | .pdata | ExceptionHook | Pointer to 2EF0 - 0x22F0 .text + UnwindInfo: .rdata |
| 1B7A8 | 140002F40 | .pdata | ExceptionHook | Pointer to 2F40 - 0x2340 .text + UnwindInfo: .rdata |
| 1B7B4 | 140003020 | .pdata | ExceptionHook | Pointer to 3020 - 0x2420 .text + UnwindInfo: .rdata |
| 1B7C0 | 140003070 | .pdata | ExceptionHook | Pointer to 3070 - 0x2470 .text + UnwindInfo: .rdata |
| 1B7CC | 140003090 | .pdata | ExceptionHook | Pointer to 3090 - 0x2490 .text + UnwindInfo: .rdata |
| 1B7D8 | 1400030B0 | .pdata | ExceptionHook | Pointer to 30B0 - 0x24B0 .text + UnwindInfo: .rdata |
| 1B7E4 | 1400030D0 | .pdata | ExceptionHook | Pointer to 30D0 - 0x24D0 .text + UnwindInfo: .rdata |
| 1B7F0 | 140003130 | .pdata | ExceptionHook | Pointer to 3130 - 0x2530 .text + UnwindInfo: .rdata |
| 1B7FC | 140003250 | .pdata | ExceptionHook | Pointer to 3250 - 0x2650 .text + UnwindInfo: .rdata |
| 1B808 | 140003350 | .pdata | ExceptionHook | Pointer to 3350 - 0x2750 .text + UnwindInfo: .rdata |
| 1B814 | 140003400 | .pdata | ExceptionHook | Pointer to 3400 - 0x2800 .text + UnwindInfo: .rdata |
| 1B820 | 140003450 | .pdata | ExceptionHook | Pointer to 3450 - 0x2850 .text + UnwindInfo: .rdata |
| 1B82C | 1400034C0 | .pdata | ExceptionHook | Pointer to 34C0 - 0x28C0 .text + UnwindInfo: .rdata |
| 1B838 | 1400036B0 | .pdata | ExceptionHook | Pointer to 36B0 - 0x2AB0 .text + UnwindInfo: .rdata |
| 1B844 | 140003700 | .pdata | ExceptionHook | Pointer to 3700 - 0x2B00 .text + UnwindInfo: .rdata |
| 1B850 | 1400038F0 | .pdata | ExceptionHook | Pointer to 38F0 - 0x2CF0 .text + UnwindInfo: .rdata |
| 1B85C | 140003920 | .pdata | ExceptionHook | Pointer to 3920 - 0x2D20 .text + UnwindInfo: .rdata |
| 1B868 | 140003A30 | .pdata | ExceptionHook | Pointer to 3A30 - 0x2E30 .text + UnwindInfo: .rdata |
| 1B874 | 140003A90 | .pdata | ExceptionHook | Pointer to 3A90 - 0x2E90 .text + UnwindInfo: .rdata |
| 1B880 | 140003AC0 | .pdata | ExceptionHook | Pointer to 3AC0 - 0x2EC0 .text + UnwindInfo: .rdata |
| 1B88C | 140003AE0 | .pdata | ExceptionHook | Pointer to 3AE0 - 0x2EE0 .text + UnwindInfo: .rdata |
| 1B898 | 140003B10 | .pdata | ExceptionHook | Pointer to 3B10 - 0x2F10 .text + UnwindInfo: .rdata |
| 1B8A4 | 140003B30 | .pdata | ExceptionHook | Pointer to 3B30 - 0x2F30 .text + UnwindInfo: .rdata |
| 40400 | N/A | *Overlay* | 282F00000002020030822F1906092A864886F70D | (/......0./...*.H...) |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 140653 | 51,1019% |
| Null Byte Code | 68014 | 24,7108% |
© 2026 All rights reserved.