PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 156,50 KBSHA-256 Hash: 871E4F28FE39BCAD8D295AE46E148BE458778C0195ED660B7DB18EB595D00BD8 SHA-1 Hash: E783F6D4B754EA8424699203B8831BDC9CBDD4E6 MD5 Hash: 7AACFD85B8DFF0AA6867BEDE82CFD147 Imphash: 21C5088120F053F6A67B20E86076CCA2 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): D800 SizeOfHeaders: 400 SizeOfImage: 2A000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 1A9F8 IAT: 15000 Characteristics: 22 TimeDateStamp: 60BCCD09 Date: 06/06/2021 13:26:33 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 13C00 | 1000 | 13A68 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
14000 | 6E00 | 15000 | 6CE2 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
1AE00 | 400 | 1C000 | C00 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
1B200 | 1000 | 1D000 | F84 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1C200 | AE00 | 1E000 | ACA8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
27000 | 200 | 29000 | FC |
|
|
| Description |
| OriginalFilename: NSudoL.exe CompanyName: M2-Team LegalCopyright: M2-Team and Contributors. All rights reserved. ProductName: NSudo FileVersion: 8.2.0.0 FileDescription: NSudo Launcher ProductVersion: 8.2.0.0 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - CC00 Code -> 4883EC28E8870300004883C428E97EFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCCB801000000C3CCCCCCCCCCCCCCCCCCCC4883 Assembler |SUB RSP, 0X28 |CALL 0X1390 |ADD RSP, 0X28 |JMP 0XE90 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |MOV EAX, 1 |RET |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |
| Signatures |
| Rich Signature Analyzer: Code -> 68D8E84E2CB9861D2CB9861D2CB9861DB0D7831C2DB9861D9AC8871C2EB9861DB219411D21B9861D7ECC821C2FB9861D7ECC851C28B9861D38D2821C28B9861D38D2831C2BB9861DF4CD831C3AB9861D7ECC831C2AB9861D79CC821C2BB9861D79CC831C34B9861D38D2871C39B9861D2CB9871D20B8861D79CC8F1C29B9861D79CC791D2DB9861D2CB9111D28B9861D79CC841C2DB9861D526963682CB9861D Footprint md5 Hash -> CDA9D46449F417FC720398C4ACBE3A47 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.29**)[-] • Entropy: 6.42303 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| File Access |
| msvcrt.dll WTSAPI32.dll USERENV.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll KERNEL32.dll atlthunk.dll .dat @.dat NSudo.Log Temp |
| File Access (UNICODE) |
| NSudoL.exe lsass.exe SHCore.dll AddDllDirectoryuser32.dll mscoree.dll |
| Interest's Words |
| exec attrib start expand |
| Interest's Words (UNICODE) |
| start |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings http://schemas.microsoft.com/SMI/2016/WindowsSettings https://m2team.github.io/NSudo/zh-hans https://github.com/Thdub/NSudo_Installer https://m2team.github.io/NSudo/zh-hant https://m2team.github.io/NSudo. |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Ascii | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Ascii | Privileges (SE_DEBUG_NAME) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \STRING\2001\4 | 21180 | 401 | 1F380 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A2022E585 | ...{.. "Translations": {.. "Button.About": ".. |
| \STRING\2001\7 | 22DE8 | 48A | 20FE8 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A202226C3 | ...{.. "Translations": {.. "Button.About": "&. |
| \STRING\2001\9 | 23FB8 | 40C | 221B8 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A20222641 | ...{.. "Translations": {.. "Button.About": "&A |
| \STRING\2001\10 | 24EC0 | 47B | 230C0 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A20222649 | ...{.. "Translations": {.. "Button.About": "&I |
| \STRING\2001\12 | 25FF0 | 47D | 241F0 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A20222641 | ...{.. "Translations": {.. "Button.About": "&A |
| \STRING\2001\1028 | 21F60 | 413 | 20160 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A2022E997 | ...{.. "Translations": {.. "Button.About": ".. |
| \STRING\2001\1040 | 27168 | 471 | 25368 | EFBBBF7B0D0A2020225472616E736C6174696F6E73223A207B0D0A2020202022427574746F6E2E41626F7574223A20222649 | ...{.. "Translations": {.. "Button.About": "&I |
| \STRING\2002\4 | 215E0 | 97D | 1F7E0 | EFBBBFE6A0BCE5BC8F3A204E5375646F4C205B20E98089E9A1B9E4B88EE58F82E695B0205D20E591BDE4BBA4E8A18CE68896 | .........: NSudoL [ ............... ] ............ |
| \STRING\2002\7 | 232C8 | CF0 | 214C8 | EFBBBF466F726D61743A204E5375646F4C205B204F7074696F6E656E20756E6420506172616D65746572205D204B6F6D6D61 | ...Format: NSudoL [ Optionen und Parameter ] Komma |
| \STRING\2002\9 | 24418 | AA2 | 22618 | EFBBBF466F726D61743A204E5375646F4C205B204F7074696F6E7320616E6420706172616D6574657273205D20436F6D6D61 | ...Format: NSudoL [ Options and parameters ] Comma |
| \STRING\2002\10 | 25390 | C5E | 23590 | EFBBBF466F726D61746F3A204E5375646F4C205B204F7063696F6E6573207920706172C3A16D6574726F73205D20636F6D61 | ...Formato: NSudoL [ Opciones y par..metros ] coma |
| \STRING\2002\12 | 264C8 | C9D | 246C8 | EFBBBF466F726D61743A204E5375646F4C205B4F7074696F6E7320657420706172616DC3A8747265735D204C69676E652064 | ...Format: NSudoL [Options et param..tres] Ligne d |
| \STRING\2002\1028 | 223D0 | A14 | 205D0 | EFBBBFE6A0BCE5BC8F3A204E5375646F4C205B20E981B8E9A085E88887E58F83E695B8205D20E591BDE4BBA4E58897E59FB7 | .........: NSudoL [ ............... ] ............ |
| \STRING\2002\1040 | 27630 | BF5 | 25830 | EFBBBF466F726D61746F3A204E5375646F4C205B204F707A696F6E69206520706172616D65747269205D204C696E65612064 | ...Formato: NSudoL [ Opzioni e parametri ] Linea d |
| \STRING\2003\4 | 21588 | 51 | 1F788 | EFBBBF0D0A0D0AE6ACB2E4BA86E8A7A3E69BB4E5A49AE4BFA1E681AF2C20E8AFB7E8AEBFE997AE2068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2F7A682D68616E73E38082 | ............................, ......... https://m2team.github.io/NSudo/zh-hans... |
| \STRING\2003\7 | 23278 | 4C | 21478 | EFBBBF0D0A0D0A46C3BC72206D65687220496E666F726D6174696F6E656E20626573756368656E205369653A2068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2E | .......F..r mehr Informationen besuchen Sie: https://m2team.github.io/NSudo. |
| \STRING\2003\9 | 243C8 | 4C | 225C8 | EFBBBF0D0A0D0A466F72206675727468657220696E666F726D6174696F6E2C20706C656173652076697369742068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2E | .......For further information, please visit https://m2team.github.io/NSudo. |
| \STRING\2003\10 | 25340 | 49 | 23540 | EFBBBF50617261206F6274656E6572206DC3A17320696E666F726D616369C3B36E2C207669736974652068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2E | ...Para obtener m..s informaci..n, visite https://m2team.github.io/NSudo. |
| \STRING\2003\12 | 26470 | 53 | 24670 | EFBBBF0D0A0D0A506F757220706C7573206427696E666F726D6174696F6E732C20766575696C6C657A20636F6E73756C7465722068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2E | .......Pour plus d'informations, veuillez consulter https://m2team.github.io/NSudo. |
| \STRING\2003\1028 | 22378 | 51 | 20578 | EFBBBF0D0A0D0AE6ACB2E79EADE8A7A3E69BB4E5A49AE8B387E8A88A2C20E8AB8BE8A8AAE5958F2068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2F7A682D68616E74E38082 | ............................, ......... https://m2team.github.io/NSudo/zh-hant... |
| \STRING\2003\1040 | 275E0 | 4B | 257E0 | EFBBBF0D0A0D0A50657220756C746572696F726920696E666F726D617A696F6E692C2076697369746172652068747470733A2F2F6D327465616D2E6769746875622E696F2F4E5375646F2E | .......Per ulteriori informazioni, visitare https://m2team.github.io/NSudo. |
| \ICON\1\0 | 1E560 | 128 | 1C760 | 28000000100000002000000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (....... ................................}....(... |
| \ICON\2\0 | 1E688 | 1A8 | 1C888 | 28000000140000002800000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (.......(................................}....(... |
| \ICON\3\0 | 1E830 | 1E8 | 1CA30 | 28000000180000003000000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (.......0................................}....(... |
| \ICON\4\0 | 1EA18 | 2E8 | 1CC18 | 28000000200000004000000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (... ...@................................}....(... |
| \ICON\5\0 | 1ED00 | 4C8 | 1CF00 | 28000000280000005000000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (...(...P................................}....(... |
| \ICON\6\0 | 1F1C8 | 668 | 1D3C8 | 28000000300000006000000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (...0...................................}....(... |
| \ICON\7\0 | 1F830 | A68 | 1DA30 | 28000000400000008000000001000400000000000000000000000000000000000000000000000000D37D0C00D3822800D88F | (...@....................................}....(... |
| \ICON\8\0 | 20298 | E6A | 1E498 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600000E3149444154789CEDDD5F6C54E799 | .PNG........IHDR.............\r.f...1IDATx..._lT.. |
| \DIALOG\105\0 | 28228 | 84 | 26428 | 0100FFFF00000000000004004808C8800200000000005601C2000000000000000A00900100014D0053002000530068006500 | ............H.........V...............M.S. .S.h.e. |
| \DIALOG\132\0 | 282B0 | 180 | 264B0 | 0100FFFF00000000100000004808CA000A00000000002C0180000000000000000800900100014D0053002000530068006500 | ............H.........,...............M.S. .S.h.e. |
| \GROUP_ICON\2000\0 | 21108 | 76 | 1F308 | 00000100080010101000010004002801000001001414100001000400A801000002001818100001000400E801000003002020 | ..............(................................. |
| \VERSION\1\0 | 289C8 | 2DC | 26BC8 | DC0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000200 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\0 | 28430 | 591 | 26630 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • 8.2.0.0 • Please use https://github.com/Thdub/NSudo_Installer for context menu management. • atlthunk.dll • mscoree.dll • Button.Run • cmd /c start "NSudo.Launcher" • AddDllDirectoryuser32.dll • SHCore.dll • lsass.exe • D:\Projects\MouriNaruto\NSudoPrivate\Source\Native\Output\Binaries\Release\x64\NSudoLG.pdb • .tls • .bss • COMDLG32.dll • ole32.dll • WTSAPI32.dll • msvcrt.dll • r mehr Informationen besuchen Sie: https://m2team.github.io/NSudo. • r die • For further information, please visit https://m2team.github.io/NSudo. • n, visite https://m2team.github.io/NSudo. • Por favor utilice https://github.com/Thdub/NSudo_Installer para manejar un menu • Pour plus d'informations, veuillez consulter https://m2team.github.io/NSudo. • Per ulteriori informazioni, visitare https://m2team.github.io/NSudo. • <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">True/PM</dpiAware> • <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness> • NSudoL.exe |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 410 | N/A | .text | CALL QWORD PTR [RIP+0x142A2] |
| 41A | N/A | .text | CALL QWORD PTR [RIP+0x14278] |
| 474 | N/A | .text | CALL QWORD PTR [RIP+0x14456] |
| 4AC | N/A | .text | CALL QWORD PTR [RIP+0x1441E] |
| 54B | N/A | .text | CALL QWORD PTR [RIP+0x140D7] |
| 604 | N/A | .text | CALL QWORD PTR [RIP+0x142C6] |
| 625 | N/A | .text | CALL QWORD PTR [RIP+0x142A5] |
| 6E9 | N/A | .text | CALL QWORD PTR [RIP+0x14069] |
| 703 | N/A | .text | CALL QWORD PTR [RIP+0x14027] |
| 715 | N/A | .text | CALL QWORD PTR [RIP+0x14015] |
| 722 | N/A | .text | CALL QWORD PTR [RIP+0x14070] |
| 734 | N/A | .text | CALL QWORD PTR [RIP+0x14066] |
| 740 | N/A | .text | CALL QWORD PTR [RIP+0x14052] |
| 778 | N/A | .text | CALL QWORD PTR [RIP+0x13FE2] |
| 79F | N/A | .text | CALL QWORD PTR [RIP+0x1411B] |
| 7F1 | N/A | .text | JMP QWORD PTR [RIP+0x140C9] |
| 829 | N/A | .text | CALL QWORD PTR [RIP+0x14089] |
| 859 | N/A | .text | CALL QWORD PTR [RIP+0x14059] |
| 8C7 | N/A | .text | JMP QWORD PTR [RIP+0x13DB3] |
| 8D1 | N/A | .text | JMP QWORD PTR [RIP+0x13DE1] |
| 109E | N/A | .text | CALL QWORD PTR [RIP+0x137F4] |
| 10DC | N/A | .text | CALL QWORD PTR [RIP+0x137C6] |
| 12B5 | N/A | .text | CALL QWORD PTR [RIP+0x1339D] |
| 12D7 | N/A | .text | CALL QWORD PTR [RIP+0x1322B] |
| 12EB | N/A | .text | CALL QWORD PTR [RIP+0x1334F] |
| 12FD | N/A | .text | CALL QWORD PTR [RIP+0x1320D] |
| 130B | N/A | .text | CALL QWORD PTR [RIP+0x131E7] |
| 131A | N/A | .text | CALL QWORD PTR [RIP+0x13378] |
| 1666 | N/A | .text | CALL QWORD PTR [RIP+0x12FEC] |
| 168A | N/A | .text | CALL QWORD PTR [RIP+0x12E78] |
| 169E | N/A | .text | CALL QWORD PTR [RIP+0x12F9C] |
| 16B0 | N/A | .text | CALL QWORD PTR [RIP+0x12E5A] |
| 16BE | N/A | .text | CALL QWORD PTR [RIP+0x12E34] |
| 16CA | N/A | .text | CALL QWORD PTR [RIP+0x12FC8] |
| 1765 | N/A | .text | CALL QWORD PTR [RIP+0x13145] |
| 19AB | N/A | .text | CALL QWORD PTR [RIP+0x12EF7] |
| 1BA7 | N/A | .text | CALL QWORD PTR [RIP+0x12B03] |
| 1BCE | N/A | .text | CALL QWORD PTR [RIP+0x12A64] |
| 1BE4 | N/A | .text | CALL QWORD PTR [RIP+0x12A76] |
| 1BF4 | N/A | .text | CALL QWORD PTR [RIP+0x12A7E] |
| 1C25 | N/A | .text | CALL QWORD PTR [RIP+0x128B5] |
| 1C4E | N/A | .text | CALL QWORD PTR [RIP+0x129F4] |
| 1C5A | N/A | .text | CALL QWORD PTR [RIP+0x12A38] |
| 1C76 | N/A | .text | CALL QWORD PTR [RIP+0x1289C] |
| 1C82 | N/A | .text | CALL QWORD PTR [RIP+0x12A00] |
| 1D15 | N/A | .text | CALL QWORD PTR [RIP+0x12B95] |
| 200F | N/A | .text | CALL QWORD PTR [RIP+0x12893] |
| 201C | N/A | .text | CALL QWORD PTR [RIP+0x126C6] |
| 2022 | N/A | .text | CALL QWORD PTR [RIP+0x12670] |
| 2028 | N/A | .text | CALL QWORD PTR [RIP+0x12632] |
| 2036 | N/A | .text | CALL QWORD PTR [RIP+0x12694] |
| 203E | N/A | .text | CALL QWORD PTR [RIP+0x12654] |
| 2047 | N/A | .text | CALL QWORD PTR [RIP+0x1263B] |
| 231C | N/A | .text | CALL QWORD PTR [RIP+0x12336] |
| 2366 | N/A | .text | CALL QWORD PTR [RIP+0x122B4] |
| 2465 | N/A | .text | CALL QWORD PTR [RIP+0x12435] |
| 25A9 | N/A | .text | CALL QWORD PTR [RIP+0x12321] |
| 25CB | N/A | .text | CALL QWORD PTR [RIP+0x122FF] |
| 281F | N/A | .text | CALL QWORD PTR [RIP+0x120B3] |
| 284E | N/A | .text | CALL QWORD PTR [RIP+0x12084] |
| 287D | N/A | .text | CALL QWORD PTR [RIP+0x12055] |
| 28A8 | N/A | .text | CALL QWORD PTR [RIP+0x1202A] |
| 2978 | N/A | .text | CALL QWORD PTR [RIP+0x11F5A] |
| 299E | N/A | .text | CALL QWORD PTR [RIP+0x11F34] |
| 2A00 | N/A | .text | CALL QWORD PTR [RIP+0x11ED2] |
| 2A23 | N/A | .text | CALL QWORD PTR [RIP+0x11EAF] |
| 2A49 | N/A | .text | CALL QWORD PTR [RIP+0x11E89] |
| 2A6F | N/A | .text | CALL QWORD PTR [RIP+0x11E63] |
| 2A99 | N/A | .text | CALL QWORD PTR [RIP+0x11E39] |
| 2AC3 | N/A | .text | CALL QWORD PTR [RIP+0x11E0F] |
| 2AE5 | N/A | .text | CALL QWORD PTR [RIP+0x11DED] |
| 2B14 | N/A | .text | CALL QWORD PTR [RIP+0x11DBE] |
| 2B45 | N/A | .text | CALL QWORD PTR [RIP+0x11D8D] |
| 2B6B | N/A | .text | CALL QWORD PTR [RIP+0x11D67] |
| 2B92 | N/A | .text | CALL QWORD PTR [RIP+0x11D40] |
| 2BBD | N/A | .text | CALL QWORD PTR [RIP+0x11D15] |
| 2BE3 | N/A | .text | CALL QWORD PTR [RIP+0x11CEF] |
| 2C0E | N/A | .text | CALL QWORD PTR [RIP+0x11CC4] |
| 2C39 | N/A | .text | CALL QWORD PTR [RIP+0x11C99] |
| 2C5F | N/A | .text | CALL QWORD PTR [RIP+0x11C73] |
| 2C85 | N/A | .text | CALL QWORD PTR [RIP+0x11C4D] |
| 2CAB | N/A | .text | CALL QWORD PTR [RIP+0x11C27] |
| 2CD1 | N/A | .text | CALL QWORD PTR [RIP+0x11C01] |
| 2CF7 | N/A | .text | CALL QWORD PTR [RIP+0x11BDB] |
| 2D21 | N/A | .text | CALL QWORD PTR [RIP+0x11BB1] |
| 2D4B | N/A | .text | CALL QWORD PTR [RIP+0x11B87] |
| 2D98 | N/A | .text | CALL QWORD PTR [RIP+0x11B3A] |
| 2DBE | N/A | .text | CALL QWORD PTR [RIP+0x11B14] |
| 2DE5 | N/A | .text | CALL QWORD PTR [RIP+0x11AED] |
| 2E0B | N/A | .text | CALL QWORD PTR [RIP+0x11AC7] |
| 2E32 | N/A | .text | CALL QWORD PTR [RIP+0x11AA0] |
| 2E61 | N/A | .text | CALL QWORD PTR [RIP+0x11A71] |
| 2FD2 | N/A | .text | CALL QWORD PTR [RIP+0x11708] |
| 2FF6 | N/A | .text | CALL QWORD PTR [RIP+0x116C4] |
| 34F9 | N/A | .text | CALL QWORD PTR [RIP+0x112B1] |
| 393F | N/A | .text | CALL QWORD PTR [RIP+0x10DA3] |
| 3A49 | N/A | .text | CALL QWORD PTR [RIP+0x10D61] |
| 3A90 | N/A | .text | CALL QWORD PTR [RIP+0x10C02] |
| 3B9C | N/A | .text | CALL QWORD PTR [RIP+0x10BBE] |
| 3D5C | N/A | .text | CALL QWORD PTR [RIP+0x10A3E] |
| 1B200 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 1B20C | 1060 | .pdata | ExceptionHook | Pointer to 1060 - 0x460 .text + UnwindInfo: .rdata |
| 1B218 | 1110 | .pdata | ExceptionHook | Pointer to 1110 - 0x510 .text + UnwindInfo: .rdata |
| 1B224 | 1140 | .pdata | ExceptionHook | Pointer to 1140 - 0x540 .text + UnwindInfo: .rdata |
| 1B230 | 1170 | .pdata | ExceptionHook | Pointer to 1170 - 0x570 .text + UnwindInfo: .rdata |
| 1B23C | 1280 | .pdata | ExceptionHook | Pointer to 1280 - 0x680 .text + UnwindInfo: .rdata |
| 1B248 | 12A0 | .pdata | ExceptionHook | Pointer to 12A0 - 0x6A0 .text + UnwindInfo: .rdata |
| 1B254 | 12DC | .pdata | ExceptionHook | Pointer to 12DC - 0x6DC .text + UnwindInfo: .rdata |
| 1B260 | 135E | .pdata | ExceptionHook | Pointer to 135E - 0x75E .text + UnwindInfo: .rdata |
| 1B26C | 1390 | .pdata | ExceptionHook | Pointer to 1390 - 0x790 .text + UnwindInfo: .rdata |
| 1B278 | 1400 | .pdata | ExceptionHook | Pointer to 1400 - 0x800 .text + UnwindInfo: .rdata |
| 1B284 | 1420 | .pdata | ExceptionHook | Pointer to 1420 - 0x820 .text + UnwindInfo: .rdata |
| 1B290 | 1450 | .pdata | ExceptionHook | Pointer to 1450 - 0x850 .text + UnwindInfo: .rdata |
| 1B29C | 1480 | .pdata | ExceptionHook | Pointer to 1480 - 0x880 .text + UnwindInfo: .rdata |
| 1B2A8 | 14A0 | .pdata | ExceptionHook | Pointer to 14A0 - 0x8A0 .text + UnwindInfo: .rdata |
| 1B2B4 | 14E0 | .pdata | ExceptionHook | Pointer to 14E0 - 0x8E0 .text + UnwindInfo: .rdata |
| 1B2C0 | 1AB0 | .pdata | ExceptionHook | Pointer to 1AB0 - 0xEB0 .text + UnwindInfo: .rdata |
| 1B2CC | 1AED | .pdata | ExceptionHook | Pointer to 1AED - 0xEED .text + UnwindInfo: .rdata |
| 1B2D8 | 1D0A | .pdata | ExceptionHook | Pointer to 1D0A - 0x110A .text + UnwindInfo: .rdata |
| 1B2E4 | 1E90 | .pdata | ExceptionHook | Pointer to 1E90 - 0x1290 .text + UnwindInfo: .rdata |
| 1B2F0 | 1FF0 | .pdata | ExceptionHook | Pointer to 1FF0 - 0x13F0 .text + UnwindInfo: .rdata |
| 1B2FC | 2600 | .pdata | ExceptionHook | Pointer to 2600 - 0x1A00 .text + UnwindInfo: .rdata |
| 1B308 | 2670 | .pdata | ExceptionHook | Pointer to 2670 - 0x1A70 .text + UnwindInfo: .rdata |
| 1B314 | 2730 | .pdata | ExceptionHook | Pointer to 2730 - 0x1B30 .text + UnwindInfo: .rdata |
| 1B320 | 2CA0 | .pdata | ExceptionHook | Pointer to 2CA0 - 0x20A0 .text + UnwindInfo: .rdata |
| 1B32C | 2D60 | .pdata | ExceptionHook | Pointer to 2D60 - 0x2160 .text + UnwindInfo: .rdata |
| 1B338 | 2D6A | .pdata | ExceptionHook | Pointer to 2D6A - 0x216A .text + UnwindInfo: .rdata |
| 1B344 | 2E35 | .pdata | ExceptionHook | Pointer to 2E35 - 0x2235 .text + UnwindInfo: .rdata |
| 1B350 | 2EE0 | .pdata | ExceptionHook | Pointer to 2EE0 - 0x22E0 .text + UnwindInfo: .rdata |
| 1B35C | 32A0 | .pdata | ExceptionHook | Pointer to 32A0 - 0x26A0 .text + UnwindInfo: .rdata |
| 1B368 | 32BA | .pdata | ExceptionHook | Pointer to 32BA - 0x26BA .text + UnwindInfo: .rdata |
| 1B374 | 32F9 | .pdata | ExceptionHook | Pointer to 32F9 - 0x26F9 .text + UnwindInfo: .rdata |
| 1B380 | 3310 | .pdata | ExceptionHook | Pointer to 3310 - 0x2710 .text + UnwindInfo: .rdata |
| 1B38C | 332A | .pdata | ExceptionHook | Pointer to 332A - 0x272A .text + UnwindInfo: .rdata |
| 1B398 | 3369 | .pdata | ExceptionHook | Pointer to 3369 - 0x2769 .text + UnwindInfo: .rdata |
| 1B3A4 | 3380 | .pdata | ExceptionHook | Pointer to 3380 - 0x2780 .text + UnwindInfo: .rdata |
| 1B3B0 | 3B90 | .pdata | ExceptionHook | Pointer to 3B90 - 0x2F90 .text + UnwindInfo: .rdata |
| 1B3BC | 41F0 | .pdata | ExceptionHook | Pointer to 41F0 - 0x35F0 .text + UnwindInfo: .rdata |
| 1B3C8 | 4750 | .pdata | ExceptionHook | Pointer to 4750 - 0x3B50 .text + UnwindInfo: .rdata |
| 1B3D4 | 4920 | .pdata | ExceptionHook | Pointer to 4920 - 0x3D20 .text + UnwindInfo: .rdata |
| 1B3E0 | 50D0 | .pdata | ExceptionHook | Pointer to 50D0 - 0x44D0 .text + UnwindInfo: .rdata |
| 1B3EC | 5300 | .pdata | ExceptionHook | Pointer to 5300 - 0x4700 .text + UnwindInfo: .rdata |
| 1B3F8 | 54D0 | .pdata | ExceptionHook | Pointer to 54D0 - 0x48D0 .text + UnwindInfo: .rdata |
| 1B404 | 65D0 | .pdata | ExceptionHook | Pointer to 65D0 - 0x59D0 .text + UnwindInfo: .rdata |
| 1B410 | 6820 | .pdata | ExceptionHook | Pointer to 6820 - 0x5C20 .text + UnwindInfo: .rdata |
| 1B41C | 6890 | .pdata | ExceptionHook | Pointer to 6890 - 0x5C90 .text + UnwindInfo: .rdata |
| 1B428 | 71B0 | .pdata | ExceptionHook | Pointer to 71B0 - 0x65B0 .text + UnwindInfo: .rdata |
| 1B434 | 7220 | .pdata | ExceptionHook | Pointer to 7220 - 0x6620 .text + UnwindInfo: .rdata |
| 1B440 | 7370 | .pdata | ExceptionHook | Pointer to 7370 - 0x6770 .text + UnwindInfo: .rdata |
| 1B44C | 7390 | .pdata | ExceptionHook | Pointer to 7390 - 0x6790 .text + UnwindInfo: .rdata |
| 1B458 | 73D6 | .pdata | ExceptionHook | Pointer to 73D6 - 0x67D6 .text + UnwindInfo: .rdata |
| 1B464 | 7420 | .pdata | ExceptionHook | Pointer to 7420 - 0x6820 .text + UnwindInfo: .rdata |
| 1B470 | 7490 | .pdata | ExceptionHook | Pointer to 7490 - 0x6890 .text + UnwindInfo: .rdata |
| 1B47C | 7530 | .pdata | ExceptionHook | Pointer to 7530 - 0x6930 .text + UnwindInfo: .rdata |
| 1B488 | 7630 | .pdata | ExceptionHook | Pointer to 7630 - 0x6A30 .text + UnwindInfo: .rdata |
| 1B494 | 7690 | .pdata | ExceptionHook | Pointer to 7690 - 0x6A90 .text + UnwindInfo: .rdata |
| 1B4A0 | 7724 | .pdata | ExceptionHook | Pointer to 7724 - 0x6B24 .text + UnwindInfo: .rdata |
| 1B4AC | 7801 | .pdata | ExceptionHook | Pointer to 7801 - 0x6C01 .text + UnwindInfo: .rdata |
| 1B4B8 | 780D | .pdata | ExceptionHook | Pointer to 780D - 0x6C0D .text + UnwindInfo: .rdata |
| 1B4C4 | 7820 | .pdata | ExceptionHook | Pointer to 7820 - 0x6C20 .text + UnwindInfo: .rdata |
| 1B4D0 | 79A0 | .pdata | ExceptionHook | Pointer to 79A0 - 0x6DA0 .text + UnwindInfo: .rdata |
| 1B4DC | 79D1 | .pdata | ExceptionHook | Pointer to 79D1 - 0x6DD1 .text + UnwindInfo: .rdata |
| 1B4E8 | 7A18 | .pdata | ExceptionHook | Pointer to 7A18 - 0x6E18 .text + UnwindInfo: .rdata |
| 1B4F4 | 7A30 | .pdata | ExceptionHook | Pointer to 7A30 - 0x6E30 .text + UnwindInfo: .rdata |
| 1B500 | 7ABB | .pdata | ExceptionHook | Pointer to 7ABB - 0x6EBB .text + UnwindInfo: .rdata |
| 1B50C | 7B7C | .pdata | ExceptionHook | Pointer to 7B7C - 0x6F7C .text + UnwindInfo: .rdata |
| 1B518 | 7B88 | .pdata | ExceptionHook | Pointer to 7B88 - 0x6F88 .text + UnwindInfo: .rdata |
| 1B524 | 7BA0 | .pdata | ExceptionHook | Pointer to 7BA0 - 0x6FA0 .text + UnwindInfo: .rdata |
| 1B530 | 7BF0 | .pdata | ExceptionHook | Pointer to 7BF0 - 0x6FF0 .text + UnwindInfo: .rdata |
| 1B53C | 7D10 | .pdata | ExceptionHook | Pointer to 7D10 - 0x7110 .text + UnwindInfo: .rdata |
| 1B548 | 7E70 | .pdata | ExceptionHook | Pointer to 7E70 - 0x7270 .text + UnwindInfo: .rdata |
| 1B554 | 7E88 | .pdata | ExceptionHook | Pointer to 7E88 - 0x7288 .text + UnwindInfo: .rdata |
| 1B560 | 7EC6 | .pdata | ExceptionHook | Pointer to 7EC6 - 0x72C6 .text + UnwindInfo: .rdata |
| 1B56C | 7ED0 | .pdata | ExceptionHook | Pointer to 7ED0 - 0x72D0 .text + UnwindInfo: .rdata |
| 1B578 | 8170 | .pdata | ExceptionHook | Pointer to 8170 - 0x7570 .text + UnwindInfo: .rdata |
| 1B584 | 8188 | .pdata | ExceptionHook | Pointer to 8188 - 0x7588 .text + UnwindInfo: .rdata |
| 1B590 | 81C6 | .pdata | ExceptionHook | Pointer to 81C6 - 0x75C6 .text + UnwindInfo: .rdata |
| 1B59C | 81D0 | .pdata | ExceptionHook | Pointer to 81D0 - 0x75D0 .text + UnwindInfo: .rdata |
| 1B5A8 | 81FF | .pdata | ExceptionHook | Pointer to 81FF - 0x75FF .text + UnwindInfo: .rdata |
| 1B5B4 | 8370 | .pdata | ExceptionHook | Pointer to 8370 - 0x7770 .text + UnwindInfo: .rdata |
| 1B5C0 | 837C | .pdata | ExceptionHook | Pointer to 837C - 0x777C .text + UnwindInfo: .rdata |
| 1B5CC | 8390 | .pdata | ExceptionHook | Pointer to 8390 - 0x7790 .text + UnwindInfo: .rdata |
| 1B5D8 | 839F | .pdata | ExceptionHook | Pointer to 839F - 0x779F .text + UnwindInfo: .rdata |
| 1B5E4 | 8412 | .pdata | ExceptionHook | Pointer to 8412 - 0x7812 .text + UnwindInfo: .rdata |
| 1B5F0 | 8413 | .pdata | ExceptionHook | Pointer to 8413 - 0x7813 .text + UnwindInfo: .rdata |
| 1B5FC | 8420 | .pdata | ExceptionHook | Pointer to 8420 - 0x7820 .text + UnwindInfo: .rdata |
| 1B608 | 844E | .pdata | ExceptionHook | Pointer to 844E - 0x784E .text + UnwindInfo: .rdata |
| 1B614 | 85C3 | .pdata | ExceptionHook | Pointer to 85C3 - 0x79C3 .text + UnwindInfo: .rdata |
| 1B620 | 85CF | .pdata | ExceptionHook | Pointer to 85CF - 0x79CF .text + UnwindInfo: .rdata |
| 1B62C | 85E0 | .pdata | ExceptionHook | Pointer to 85E0 - 0x79E0 .text + UnwindInfo: .rdata |
| 1B638 | 8620 | .pdata | ExceptionHook | Pointer to 8620 - 0x7A20 .text + UnwindInfo: .rdata |
| 1B644 | 8690 | .pdata | ExceptionHook | Pointer to 8690 - 0x7A90 .text + UnwindInfo: .rdata |
| 1B650 | 8910 | .pdata | ExceptionHook | Pointer to 8910 - 0x7D10 .text + UnwindInfo: .rdata |
| 1B65C | 8B40 | .pdata | ExceptionHook | Pointer to 8B40 - 0x7F40 .text + UnwindInfo: .rdata |
| 1B668 | 8B60 | .pdata | ExceptionHook | Pointer to 8B60 - 0x7F60 .text + UnwindInfo: .rdata |
| 1B674 | 8DA0 | .pdata | ExceptionHook | Pointer to 8DA0 - 0x81A0 .text + UnwindInfo: .rdata |
| 1B680 | 8FE0 | .pdata | ExceptionHook | Pointer to 8FE0 - 0x83E0 .text + UnwindInfo: .rdata |
| 1B68C | 9200 | .pdata | ExceptionHook | Pointer to 9200 - 0x8600 .text + UnwindInfo: .rdata |
| 1B698 | 93C0 | .pdata | ExceptionHook | Pointer to 93C0 - 0x87C0 .text + UnwindInfo: .rdata |
| 1B6A4 | 93EC | .pdata | ExceptionHook | Pointer to 93EC - 0x87EC .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 99892 | 62,3328% |
| Null Byte Code | 29993 | 18,7157% |
© 2026 All rights reserved.