PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Executable header (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 158,50 KB SHA-256 Hash: 5286AA97F983EC22BAFFE9E61BDC65034672C6C2D13F54D59D85CAEC50D7C9B4 SHA-1 Hash: 0BD46F4B7C4118E454B266CED80B7DDCC09202D0 MD5 Hash: AE187E9B932F962674C8FF28F66A5EFA Imphash: 53E4E12437621212A425D294842D0A96 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 13B80 SizeOfHeaders: 400 SizeOfImage: 2D000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 256AC IAT: 1A000 Characteristics: 22 TimeDateStamp: 691D0000 Date: 18/11/2025 23:23:44 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .reloc, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 60000020 (Code, Executable, Readable) | 400 | 18400 | 1000 | 1839C | 6,3630 | 708450,88 |
| .rdata | 40000040 (Initialized Data, Readable) | 18800 | C600 | 1A000 | C5FE | 4,8470 | 1974552,62 |
| .data | C0000040 (Initialized Data, Readable, Writeable) | 24E00 | C00 | 27000 | 1A40 | 2,2220 | 425818,83 |
| .pdata | 40000040 (Initialized Data, Readable) | 25A00 | 1600 | 29000 | 14C4 | 4,9255 | 232184,27 |
| .reloc | 42000040 (Initialized Data, GP-Relative, Readable) | 27000 | 400 | 2B000 | 33C | 4,8065 | 19021,50 |
| .rsrc | 40000040 (Initialized Data, Readable) | 27400 | 600 | 2C000 | 58C | 4,1373 | 77326,00 |
| Description |
| OriginalFilename: WordPal.dll CompanyName: WordPal ProductName: WordPal FileVersion: 1.1.0.0 FileDescription: WordPal ProductVersion: 1.0.0+d9d59d6c4f8efb06533b6f821ce0a874e402fbf5 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
| The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 12F80 Code -> 4883EC28E8DB0700004883C428E96AFEFFFFCCCC4883EC284D8B4138488BCA498BD1E80D000000B8010000004883C428C3CC • SUB RSP, 0X28 • CALL 0X17E4 • ADD RSP, 0X28 • JMP 0XE7C • INT3 • INT3 • SUB RSP, 0X28 • MOV R8, QWORD PTR [R9 + 0X38] • MOV RCX, RDX • MOV RDX, R9 • CALL 0X1034 • MOV EAX, 1 • ADD RSP, 0X28 • RET • INT3 |
| Signatures |
| Rich Signature Analyzer: Code -> 36D0F37F72B19D2C72B19D2C72B19D2CF5389E2D78B19D2CF538992D7FB19D2CF538982D24B19D2C7BC90E2C62B19D2C06309C2D7BB19D2C72B19C2CA6B19D2CE338942D78B19D2CE3389F2D73B19D2C5269636872B19D2C Footprint md5 Hash -> 3C014D7E48AFDB7E49A7E41DC13EEFE7 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 6.11521 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| SOFTWARE\dotnet |
| File Access |
| WordPal.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll USER32.dll KERNEL32.dll ADVAPI32.dll SHELL32.dll ntdll.dll .dat @.dat Temp |
| File Access (UNICODE) |
| kernel32.dll WordPal.dll comctl32.dll hostfxr.dll %d.log ProgramFiles |
| Interest's Words |
| exec attrib start |
| Interest's Words (UNICODE) |
| exec start |
| URLs (UNICODE) |
| https://aka.ms/dotnet/app-launch-failedDownload the .NET runtime:%s&apphost_version=%s https://aka.ms/dotnet-core-applaunch? https://aka.ms/dotnet/app-launch-failed https://aka.ms/dotnet/app-launch-failedWould you like to download it now? |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegGetValue) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Unicode | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\0 | 2C080 | 300 | 27480 | 000334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000100 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\0 | 2C380 | 1EA | 27780 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • WordPal.dll • 1.1.0.0 • api-ms-win-crt-heap-l1-1-0.dll • setvbufapi-ms-win-crt-runtime-l1-1-0.dll • https://aka.ms/dotnet/app-launch-failed • hostfxr.dll • <A HREF=" • comctl32.dll • TaskDialogIndirect • kernel32.dll • ntdll.dll • %s\%s.%d.log • D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb • .tls • .bss • api-ms-win-crt-time-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 889 | N/A | .text | CALL QWORD PTR [RIP+0x18C59] |
| 935 | N/A | .text | CALL QWORD PTR [RIP+0x18BAD] |
| 9BF | N/A | .text | CALL QWORD PTR [RIP+0x18DBB] |
| A2E | N/A | .text | CALL QWORD PTR [RIP+0x18D4C] |
| EB9 | N/A | .text | CALL QWORD PTR [RIP+0x188C1] |
| F9F | N/A | .text | CALL QWORD PTR [RIP+0x187DB] |
| 10C1 | N/A | .text | CALL QWORD PTR [RIP+0x186B9] |
| 113C | N/A | .text | CALL QWORD PTR [RIP+0x1863E] |
| 11ED | N/A | .text | CALL QWORD PTR [RIP+0x1858D] |
| 126B | N/A | .text | CALL QWORD PTR [RIP+0x1850F] |
| 130F | N/A | .text | CALL QWORD PTR [RIP+0x1846B] |
| 14FE | N/A | .text | CALL QWORD PTR [RIP+0x1827C] |
| 158F | N/A | .text | CALL QWORD PTR [RIP+0x181EB] |
| 15EB | N/A | .text | CALL QWORD PTR [RIP+0x1818F] |
| 1789 | N/A | .text | CALL QWORD PTR [RIP+0x180C9] |
| 186D | N/A | .text | CALL QWORD PTR [RIP+0x17F0D] |
| 199B | N/A | .text | CALL QWORD PTR [RIP+0x17B47] |
| 1A4E | N/A | .text | CALL QWORD PTR [RIP+0x17A94] |
| 1CB3 | N/A | .text | CALL QWORD PTR [RIP+0x17AC7] |
| 1EFF | N/A | .text | CALL QWORD PTR [RIP+0x1787B] |
| 1F7A | N/A | .text | CALL QWORD PTR [RIP+0x174E8] |
| 209E | N/A | .text | CALL QWORD PTR [RIP+0x173C4] |
| 20F1 | N/A | .text | CALL QWORD PTR [RIP+0x17761] |
| 211A | N/A | .text | CALL QWORD PTR [RIP+0x17738] |
| 2131 | N/A | .text | CALL QWORD PTR [RIP+0x17721] |
| 2144 | N/A | .text | CALL QWORD PTR [RIP+0x1731E] |
| 21B9 | N/A | .text | CALL QWORD PTR [RIP+0x172A9] |
| 2203 | N/A | .text | CALL QWORD PTR [RIP+0x1764F] |
| 22CA | N/A | .text | CALL QWORD PTR [RIP+0x17198] |
| 231E | N/A | .text | CALL QWORD PTR [RIP+0x17534] |
| 2342 | N/A | .text | CALL QWORD PTR [RIP+0x17510] |
| 237A | N/A | .text | CALL QWORD PTR [RIP+0x174D8] |
| 2468 | N/A | .text | CALL QWORD PTR [RIP+0x17312] |
| 24DF | N/A | .text | CALL QWORD PTR [RIP+0x1729B] |
| 2543 | N/A | .text | CALL QWORD PTR [RIP+0x17237] |
| 25A9 | N/A | .text | CALL QWORD PTR [RIP+0x171D1] |
| 2630 | N/A | .text | CALL QWORD PTR [RIP+0x1714A] |
| 2740 | N/A | .text | CALL QWORD PTR [RIP+0x1703A] |
| 2809 | N/A | .text | CALL QWORD PTR [RIP+0x16FB9] |
| 281C | N/A | .text | CALL QWORD PTR [RIP+0x16F86] |
| 2825 | N/A | .text | CALL QWORD PTR [RIP+0x16F9D] |
| 2830 | N/A | .text | CALL QWORD PTR [RIP+0x16F72] |
| 2839 | N/A | .text | CALL QWORD PTR [RIP+0x16F89] |
| 28D8 | N/A | .text | CALL QWORD PTR [RIP+0x16F7A] |
| 2AF1 | N/A | .text | CALL QWORD PTR [RIP+0x16D61] |
| 2B55 | N/A | .text | CALL QWORD PTR [RIP+0x16C25] |
| 2C0C | N/A | .text | CALL QWORD PTR [RIP+0x16B6E] |
| 2F54 | N/A | .text | CALL QWORD PTR [RIP+0x168FE] |
| 2F75 | N/A | .text | JMP QWORD PTR [RIP+0x168DD] |
| 309C | N/A | .text | CALL QWORD PTR [RIP+0x165C6] |
| 30AF | N/A | .text | CALL QWORD PTR [RIP+0x165B3] |
| 30C2 | N/A | .text | CALL QWORD PTR [RIP+0x165A0] |
| 30D5 | N/A | .text | CALL QWORD PTR [RIP+0x1658D] |
| 30E8 | N/A | .text | CALL QWORD PTR [RIP+0x1657A] |
| 30FB | N/A | .text | CALL QWORD PTR [RIP+0x16567] |
| 31D1 | N/A | .text | CALL QWORD PTR [RIP+0x16681] |
| 3241 | N/A | .text | CALL QWORD PTR [RIP+0x16611] |
| 3553 | N/A | .text | CALL QWORD PTR [RIP+0x1610F] |
| 355D | N/A | .text | CALL QWORD PTR [RIP+0x16105] |
| 3646 | N/A | .text | CALL QWORD PTR [RIP+0x16134] |
| 381B | N/A | .text | CALL QWORD PTR [RIP+0x15F87] |
| 3829 | N/A | .text | CALL QWORD PTR [RIP+0x15C81] |
| 3887 | N/A | .text | CALL QWORD PTR [RIP+0x15B83] |
| 3BA5 | N/A | .text | CALL QWORD PTR [RIP+0x1585D] |
| 3BAE | N/A | .text | CALL QWORD PTR [RIP+0x15874] |
| 3BFB | N/A | .text | CALL QWORD PTR [RIP+0x15B7F] |
| 3E04 | N/A | .text | CALL QWORD PTR [RIP+0x15976] |
| 3FA4 | N/A | .text | CALL QWORD PTR [RIP+0x15666] |
| 3FE9 | N/A | .text | CALL QWORD PTR [RIP+0x15471] |
| 418E | N/A | .text | CALL QWORD PTR [RIP+0x152AC] |
| 41AA | N/A | .text | CALL QWORD PTR [RIP+0x152A0] |
| 41CE | N/A | .text | CALL QWORD PTR [RIP+0x15274] |
| 41D8 | N/A | .text | CALL QWORD PTR [RIP+0x15272] |
| 4239 | N/A | .text | CALL QWORD PTR [RIP+0x15541] |
| 424A | N/A | .text | CALL QWORD PTR [RIP+0x15200] |
| 4500 | N/A | .text | CALL QWORD PTR [RIP+0x14F7A] |
| 4518 | N/A | .text | CALL QWORD PTR [RIP+0x14F4A] |
| 4529 | N/A | .text | CALL QWORD PTR [RIP+0x14F49] |
| 456C | N/A | .text | CALL QWORD PTR [RIP+0x14EFE] |
| 4583 | N/A | .text | CALL QWORD PTR [RIP+0x14ECF] |
| 471D | N/A | .text | CALL QWORD PTR [RIP+0x15135] |
| 4742 | N/A | .text | CALL QWORD PTR [RIP+0x14D30] |
| 478F | N/A | .text | CALL QWORD PTR [RIP+0x14FEB] |
| 47F1 | N/A | .text | CALL QWORD PTR [RIP+0x14E19] |
| 4899 | N/A | .text | CALL QWORD PTR [RIP+0x14D91] |
| 49CA | N/A | .text | CALL QWORD PTR [RIP+0x14DB0] |
| 4AB3 | N/A | .text | CALL QWORD PTR [RIP+0x14CC7] |
| 5192 | N/A | .text | CALL QWORD PTR [RIP+0x145E8] |
| 51AA | N/A | .text | CALL QWORD PTR [RIP+0x145D0] |
| 55B0 | N/A | .text | CALL QWORD PTR [RIP+0x141CA] |
| 55C6 | N/A | .text | CALL QWORD PTR [RIP+0x141B4] |
| 581E | N/A | .text | CALL QWORD PTR [RIP+0x13DFC] |
| 5859 | N/A | .text | CALL QWORD PTR [RIP+0x13DB1] |
| 58AC | N/A | .text | CALL QWORD PTR [RIP+0x13ECE] |
| 5946 | N/A | .text | CALL QWORD PTR [RIP+0x13E34] |
| 59B2 | N/A | .text | CALL QWORD PTR [RIP+0x13DC8] |
| 5A1B | N/A | .text | CALL QWORD PTR [RIP+0x13D5F] |
| 5ACA | N/A | .text | CALL QWORD PTR [RIP+0x13D88] |
| 5AE3 | N/A | .text | CALL QWORD PTR [RIP+0x13D6F] |
| 5DFE | N/A | .text | CALL QWORD PTR [RIP+0x1397C] |
| 25A00 | 1010 | .pdata | ExceptionHook | Pointer to 1010 - 0x410 .text + UnwindInfo: .rdata |
| 25A0C | 1040 | .pdata | ExceptionHook | Pointer to 1040 - 0x440 .text + UnwindInfo: .rdata |
| 25A18 | 1070 | .pdata | ExceptionHook | Pointer to 1070 - 0x470 .text + UnwindInfo: .rdata |
| 25A24 | 10A0 | .pdata | ExceptionHook | Pointer to 10A0 - 0x4A0 .text + UnwindInfo: .rdata |
| 25A30 | 10D0 | .pdata | ExceptionHook | Pointer to 10D0 - 0x4D0 .text + UnwindInfo: .rdata |
| 25A3C | 1120 | .pdata | ExceptionHook | Pointer to 1120 - 0x520 .text + UnwindInfo: .rdata |
| 25A48 | 1140 | .pdata | ExceptionHook | Pointer to 1140 - 0x540 .text + UnwindInfo: .rdata |
| 25A54 | 11A0 | .pdata | ExceptionHook | Pointer to 11A0 - 0x5A0 .text + UnwindInfo: .rdata |
| 25A60 | 1240 | .pdata | ExceptionHook | Pointer to 1240 - 0x640 .text + UnwindInfo: .rdata |
| 25A6C | 1260 | .pdata | ExceptionHook | Pointer to 1260 - 0x660 .text + UnwindInfo: .rdata |
| 25A78 | 12A0 | .pdata | ExceptionHook | Pointer to 12A0 - 0x6A0 .text + UnwindInfo: .rdata |
| 25A84 | 12E0 | .pdata | ExceptionHook | Pointer to 12E0 - 0x6E0 .text + UnwindInfo: .rdata |
| 25A90 | 1300 | .pdata | ExceptionHook | Pointer to 1300 - 0x700 .text + UnwindInfo: .rdata |
| 25A9C | 1670 | .pdata | ExceptionHook | Pointer to 1670 - 0xA70 .text + UnwindInfo: .rdata |
| 25AA8 | 1BB0 | .pdata | ExceptionHook | Pointer to 1BB0 - 0xFB0 .text + UnwindInfo: .rdata |
| 25AB4 | 1CD0 | .pdata | ExceptionHook | Pointer to 1CD0 - 0x10D0 .text + UnwindInfo: .rdata |
| 25AC0 | 1D50 | .pdata | ExceptionHook | Pointer to 1D50 - 0x1150 .text + UnwindInfo: .rdata |
| 25ACC | 1E00 | .pdata | ExceptionHook | Pointer to 1E00 - 0x1200 .text + UnwindInfo: .rdata |
| 25AD8 | 1E80 | .pdata | ExceptionHook | Pointer to 1E80 - 0x1280 .text + UnwindInfo: .rdata |
| 25AE4 | 1ED5 | .pdata | ExceptionHook | Pointer to 1ED5 - 0x12D5 .text + UnwindInfo: .rdata |
| 25AF0 | 1F7E | .pdata | ExceptionHook | Pointer to 1F7E - 0x137E .text + UnwindInfo: .rdata |
| 25AFC | 1F9A | .pdata | ExceptionHook | Pointer to 1F9A - 0x139A .text + UnwindInfo: .rdata |
| 25B08 | 1FA0 | .pdata | ExceptionHook | Pointer to 1FA0 - 0x13A0 .text + UnwindInfo: .rdata |
| 25B14 | 1FC9 | .pdata | ExceptionHook | Pointer to 1FC9 - 0x13C9 .text + UnwindInfo: .rdata |
| 25B20 | 20EF | .pdata | ExceptionHook | Pointer to 20EF - 0x14EF .text + UnwindInfo: .rdata |
| 25B2C | 2105 | .pdata | ExceptionHook | Pointer to 2105 - 0x1505 .text + UnwindInfo: .rdata |
| 25B38 | 210B | .pdata | ExceptionHook | Pointer to 210B - 0x150B .text + UnwindInfo: .rdata |
| 25B44 | 2120 | .pdata | ExceptionHook | Pointer to 2120 - 0x1520 .text + UnwindInfo: .rdata |
| 25B50 | 2140 | .pdata | ExceptionHook | Pointer to 2140 - 0x1540 .text + UnwindInfo: .rdata |
| 25B5C | 21A0 | .pdata | ExceptionHook | Pointer to 21A0 - 0x15A0 .text + UnwindInfo: .rdata |
| 25B68 | 2200 | .pdata | ExceptionHook | Pointer to 2200 - 0x1600 .text + UnwindInfo: .rdata |
| 25B74 | 2370 | .pdata | ExceptionHook | Pointer to 2370 - 0x1770 .text + UnwindInfo: .rdata |
| 25B80 | 23A0 | .pdata | ExceptionHook | Pointer to 23A0 - 0x17A0 .text + UnwindInfo: .rdata |
| 25B8C | 24A0 | .pdata | ExceptionHook | Pointer to 24A0 - 0x18A0 .text + UnwindInfo: .rdata |
| 25B98 | 3270 | .pdata | ExceptionHook | Pointer to 3270 - 0x2670 .text + UnwindInfo: .rdata |
| 25BA4 | 3470 | .pdata | ExceptionHook | Pointer to 3470 - 0x2870 .text + UnwindInfo: .rdata |
| 25BB0 | 34C0 | .pdata | ExceptionHook | Pointer to 34C0 - 0x28C0 .text + UnwindInfo: .rdata |
| 25BBC | 3550 | .pdata | ExceptionHook | Pointer to 3550 - 0x2950 .text + UnwindInfo: .rdata |
| 25BC8 | 3860 | .pdata | ExceptionHook | Pointer to 3860 - 0x2C60 .text + UnwindInfo: .rdata |
| 25BD4 | 38B0 | .pdata | ExceptionHook | Pointer to 38B0 - 0x2CB0 .text + UnwindInfo: .rdata |
| 25BE0 | 3910 | .pdata | ExceptionHook | Pointer to 3910 - 0x2D10 .text + UnwindInfo: .rdata |
| 25BEC | 3970 | .pdata | ExceptionHook | Pointer to 3970 - 0x2D70 .text + UnwindInfo: .rdata |
| 25BF8 | 3A30 | .pdata | ExceptionHook | Pointer to 3A30 - 0x2E30 .text + UnwindInfo: .rdata |
| 25C04 | 3A90 | .pdata | ExceptionHook | Pointer to 3A90 - 0x2E90 .text + UnwindInfo: .rdata |
| 25C10 | 3AB0 | .pdata | ExceptionHook | Pointer to 3AB0 - 0x2EB0 .text + UnwindInfo: .rdata |
| 25C1C | 3AF0 | .pdata | ExceptionHook | Pointer to 3AF0 - 0x2EF0 .text + UnwindInfo: .rdata |
| 25C28 | 3B40 | .pdata | ExceptionHook | Pointer to 3B40 - 0x2F40 .text + UnwindInfo: .rdata |
| 25C34 | 3B80 | .pdata | ExceptionHook | Pointer to 3B80 - 0x2F80 .text + UnwindInfo: .rdata |
| 25C40 | 3D40 | .pdata | ExceptionHook | Pointer to 3D40 - 0x3140 .text + UnwindInfo: .rdata |
| 25C4C | 3D90 | .pdata | ExceptionHook | Pointer to 3D90 - 0x3190 .text + UnwindInfo: .rdata |
| 25C58 | 3E00 | .pdata | ExceptionHook | Pointer to 3E00 - 0x3200 .text + UnwindInfo: .rdata |
| 25C64 | 3E80 | .pdata | ExceptionHook | Pointer to 3E80 - 0x3280 .text + UnwindInfo: .rdata |
| 25C70 | 3E95 | .pdata | ExceptionHook | Pointer to 3E95 - 0x3295 .text + UnwindInfo: .rdata |
| 25C7C | 3EBC | .pdata | ExceptionHook | Pointer to 3EBC - 0x32BC .text + UnwindInfo: .rdata |
| 25C88 | 3EE0 | .pdata | ExceptionHook | Pointer to 3EE0 - 0x32E0 .text + UnwindInfo: .rdata |
| 25C94 | 3EF5 | .pdata | ExceptionHook | Pointer to 3EF5 - 0x32F5 .text + UnwindInfo: .rdata |
| 25CA0 | 3F1C | .pdata | ExceptionHook | Pointer to 3F1C - 0x331C .text + UnwindInfo: .rdata |
| 25CAC | 3F30 | .pdata | ExceptionHook | Pointer to 3F30 - 0x3330 .text + UnwindInfo: .rdata |
| 25CB8 | 3F80 | .pdata | ExceptionHook | Pointer to 3F80 - 0x3380 .text + UnwindInfo: .rdata |
| 25CC4 | 3F96 | .pdata | ExceptionHook | Pointer to 3F96 - 0x3396 .text + UnwindInfo: .rdata |
| 25CD0 | 400E | .pdata | ExceptionHook | Pointer to 400E - 0x340E .text + UnwindInfo: .rdata |
| 25CDC | 4020 | .pdata | ExceptionHook | Pointer to 4020 - 0x3420 .text + UnwindInfo: .rdata |
| 25CE8 | 4080 | .pdata | ExceptionHook | Pointer to 4080 - 0x3480 .text + UnwindInfo: .rdata |
| 25CF4 | 40B0 | .pdata | ExceptionHook | Pointer to 40B0 - 0x34B0 .text + UnwindInfo: .rdata |
| 25D00 | 4113 | .pdata | ExceptionHook | Pointer to 4113 - 0x3513 .text + UnwindInfo: .rdata |
| 25D0C | 4130 | .pdata | ExceptionHook | Pointer to 4130 - 0x3530 .text + UnwindInfo: .rdata |
| 25D18 | 4190 | .pdata | ExceptionHook | Pointer to 4190 - 0x3590 .text + UnwindInfo: .rdata |
| 25D24 | 4280 | .pdata | ExceptionHook | Pointer to 4280 - 0x3680 .text + UnwindInfo: .rdata |
| 25D30 | 42E0 | .pdata | ExceptionHook | Pointer to 42E0 - 0x36E0 .text + UnwindInfo: .rdata |
| 25D3C | 4320 | .pdata | ExceptionHook | Pointer to 4320 - 0x3720 .text + UnwindInfo: .rdata |
| 25D48 | 432D | .pdata | ExceptionHook | Pointer to 432D - 0x372D .text + UnwindInfo: .rdata |
| 25D54 | 436A | .pdata | ExceptionHook | Pointer to 436A - 0x376A .text + UnwindInfo: .rdata |
| 25D60 | 43AC | .pdata | ExceptionHook | Pointer to 43AC - 0x37AC .text + UnwindInfo: .rdata |
| 25D6C | 43DF | .pdata | ExceptionHook | Pointer to 43DF - 0x37DF .text + UnwindInfo: .rdata |
| 25D78 | 4450 | .pdata | ExceptionHook | Pointer to 4450 - 0x3850 .text + UnwindInfo: .rdata |
| 25D84 | 4830 | .pdata | ExceptionHook | Pointer to 4830 - 0x3C30 .text + UnwindInfo: .rdata |
| 25D90 | 4A50 | .pdata | ExceptionHook | Pointer to 4A50 - 0x3E50 .text + UnwindInfo: .rdata |
| 25D9C | 4B80 | .pdata | ExceptionHook | Pointer to 4B80 - 0x3F80 .text + UnwindInfo: .rdata |
| 25DA8 | 4BB0 | .pdata | ExceptionHook | Pointer to 4BB0 - 0x3FB0 .text + UnwindInfo: .rdata |
| 25DB4 | 4E90 | .pdata | ExceptionHook | Pointer to 4E90 - 0x4290 .text + UnwindInfo: .rdata |
| 25DC0 | 50C0 | .pdata | ExceptionHook | Pointer to 50C0 - 0x44C0 .text + UnwindInfo: .rdata |
| 25DCC | 53C0 | .pdata | ExceptionHook | Pointer to 53C0 - 0x47C0 .text + UnwindInfo: .rdata |
| 25DD8 | 5400 | .pdata | ExceptionHook | Pointer to 5400 - 0x4800 .text + UnwindInfo: .rdata |
| 25DE4 | 6660 | .pdata | ExceptionHook | Pointer to 6660 - 0x5A60 .text + UnwindInfo: .rdata |
| 25DF0 | 6780 | .pdata | ExceptionHook | Pointer to 6780 - 0x5B80 .text + UnwindInfo: .rdata |
| 25DFC | 6B60 | .pdata | ExceptionHook | Pointer to 6B60 - 0x5F60 .text + UnwindInfo: .rdata |
| 25E08 | 6B90 | .pdata | ExceptionHook | Pointer to 6B90 - 0x5F90 .text + UnwindInfo: .rdata |
| 25E14 | 6BB8 | .pdata | ExceptionHook | Pointer to 6BB8 - 0x5FB8 .text + UnwindInfo: .rdata |
| 25E20 | 6BFD | .pdata | ExceptionHook | Pointer to 6BFD - 0x5FFD .text + UnwindInfo: .rdata |
| 25E2C | 6C10 | .pdata | ExceptionHook | Pointer to 6C10 - 0x6010 .text + UnwindInfo: .rdata |
| 25E38 | 6C41 | .pdata | ExceptionHook | Pointer to 6C41 - 0x6041 .text + UnwindInfo: .rdata |
| 25E44 | 6C88 | .pdata | ExceptionHook | Pointer to 6C88 - 0x6088 .text + UnwindInfo: .rdata |
| 25E50 | 6CA0 | .pdata | ExceptionHook | Pointer to 6CA0 - 0x60A0 .text + UnwindInfo: .rdata |
| 25E5C | 6CCD | .pdata | ExceptionHook | Pointer to 6CCD - 0x60CD .text + UnwindInfo: .rdata |
| 25E68 | 6D14 | .pdata | ExceptionHook | Pointer to 6D14 - 0x6114 .text + UnwindInfo: .rdata |
| 25E74 | 6D30 | .pdata | ExceptionHook | Pointer to 6D30 - 0x6130 .text + UnwindInfo: .rdata |
| 25E80 | 6F40 | .pdata | ExceptionHook | Pointer to 6F40 - 0x6340 .text + UnwindInfo: .rdata |
| 25E8C | 6FE7 | .pdata | ExceptionHook | Pointer to 6FE7 - 0x63E7 .text + UnwindInfo: .rdata |
| 25E98 | 704E | .pdata | ExceptionHook | Pointer to 704E - 0x644E .text + UnwindInfo: .rdata |
| 25EA4 | 7070 | .pdata | ExceptionHook | Pointer to 7070 - 0x6470 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 94848 | 58,4385% |
| Null Byte Code | 36037 | 22,2034% |
© 2026 All rights reserved.