PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 2,23 MB
SHA-256 Hash: 48FCB0930865709EFF281043FA1D818F3B65B0F75825046FEA8877AA2EFD2B74
SHA-1 Hash: CD24BC095444B5AFEFCDCC621EAD7FE3C7A93E79
MD5 Hash: B744E5CF7100394DA1BA469FA33D0C32
Imphash: 5FE58DE96E68CF9269D989966D1AD19B
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 0024AC89
EntryPoint (rva): 1046
SizeOfHeaders: 600
SizeOfImage: 1B7000
ImageBase: 0000000140000000
Architecture: x64
ImportTable: 183000
IAT: 183988
Characteristics: 26
TimeDateStamp: 6A6D24B9
Date: 31/07/2026 22:42:01
File Type: DLL
Number Of Sections: 19
ASLR: Disabled
Section Names (Optional Header): .text, .data, .rdata, /4, .pdata, .xdata, .bss, .idata, .tls, .reloc, /14, /29, /41, /55, /67, /80, /91, /107, /123
Number Of Executable Sections: 1
Subsystem: Windows Console
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 600 101A00 1000 101840
6.3492
7867033.2
.data
0xC0000040
Initialized Data
Readable
Writeable
 102000 4200 103000 4100
3.7908
1259145.48
.rdata
0x40000040
Initialized Data
Readable
 106200 57E00 108000 57CF0
5.5021
2950969.33
/4
0xC0000040
Initialized Data
Readable
Writeable
 15E000 200 160000 4
0
130560
.pdata
0x40000040
Initialized Data
Readable
 15E200 9C00 161000 9BE8
6.1336
768613.38
.xdata
0x40000040
Initialized Data
Readable
 167E00 AC00 16B000 AB4C
4.7115
1020230.43
.bss
0xC0000080
Uninitialized Data
Readable
Writeable
 0 0 176000 C6D0
N/A
N/A
.idata
0x40000040
Initialized Data
Readable
 172A00 2A00 183000 2838
4.5087
458702.1
.tls
0xC0000040
Initialized Data
Readable
Writeable
 175400 200 186000 10
0
130560
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 175600 1000 187000 E4C
5.2329
36906.38
/14
0x42000040
Initialized Data
GP-Relative
Readable
 176600 C00 188000 AC0
2.6122
361484.17
/29
0x42000040
Initialized Data
GP-Relative
Readable
 177200 20400 189000 202F4
6.0281
1399546.52
/41
0x42000040
Initialized Data
GP-Relative
Readable
 197600 1A00 1AA000 182B
4.8422
120428.77
/55
0x42000040
Initialized Data
GP-Relative
Readable
 199000 3600 1AC000 3538
5.3107
206615.96
/67
0x42000040
Initialized Data
GP-Relative
Readable
 19C600 2E00 1B0000 2DE0
4.1218
568412.35
/80
0x42000040
Initialized Data
GP-Relative
Readable
 19F400 C00 1B3000 A51
4.5474
56092.17
/91
0x42000040
Initialized Data
GP-Relative
Readable
 1A0000 A00 1B4000 935
4.8497
28211.4
/107
0x42000040
Initialized Data
GP-Relative
Readable
 1A0A00 A00 1B5000 994
4.5617
85727.6
/123
0x42000040
Initialized Data
GP-Relative
Readable
 1A1400 800 1B6000 786
4.2917
79395.25
Binder/Joiner/Crypter
Dropper code detected (EOF) - 530,90 KB
Entry Point
The section number (1) have the Entry Point
Information -> EntryPoint (calculated) - 646
Code -> 554889E54883EC30C745FCFF000000488B05F4AC1500C70000000000E80E0000008945FC90908B45FC4883C4305DC3554889
Assembler
|PUSH RBP
|MOV RBP, RSP
|SUB RSP, 0X30
|MOV DWORD PTR [RBP - 4], 0XFF
|MOV RAX, QWORD PTR [RIP + 0X15ACF4]
|MOV DWORD PTR [RAX], 0
|CALL 0X140001075
|MOV DWORD PTR [RBP - 4], EAX
|NOP
|NOP
|MOV EAX, DWORD PTR [RBP - 4]
|ADD RSP, 0X30
|POP RBP
|RET
|PUSH RBP
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Detect It Easy (die)
• Entropy: 6.30519
Suspicious Functions
Library Function Description
KERNEL32.DLL GetModuleHandleA Retrieves a handle to the specified module.
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL LoadLibraryW Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
File Access
WINMM.dll
USER32.dll
SHELL32.dll
msvcrt.dll
KERNEL32.dll
GDI32.dll
kernelbase.dll
OSMesa.dll
libOSMesa.dll
libGLESv2.dll
GLESv2.dll
libGLES_CM.dll
GLESv1_CM.dll
EGL.dll
libEGL.dll
Failed to load opengl32.dll
opengl32.dll
ntdll.dll
shcore.dll
dwmapi.dll
xinput1_1.dll
xinput1_2.dll
xinput9_1_0.dll
xinput1_3.dll
dinput8.dll
Failed to load user32.dll
xinput1_4.dll
vulkan-1.dll
libgcc_s_dw2-1.dll
.dat
Temp
File Access (UNICODE)
msvcrt.dllrand_sadvapi32.dll
Interest's Words
JFIF
exec
attrib
start
pause
ping
expand
pushd
replace
setx
URLs
https://gcc.gnu.org/bugs/):
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii WinAPI Sockets (bind)
Text Ascii WinAPI Sockets (connect)
Text Unicode WinAPI Sockets (connect)
Text Ascii Anti-Analysis VM (IsDebuggerPresent)
Text Ascii Anti-Analysis VM (GetVersion)
Text Ascii Stealth (GetThreadContext)
Text Ascii Stealth (SetThreadContext)
Text Ascii Stealth (ReleaseSemaphore)
Text Ascii Stealth (CloseHandle)
Text Ascii Stealth (VirtualProtect)
Text Ascii Execution (ResumeThread)
Text Ascii Execution (CreateSemaphoreA)
Text Ascii Execution (CreateEventA)
Text Ascii Keyboard Key (Scroll)
Text Ascii Unauthorized movement of funds or data (Transfer)
Intelligent String
• .bss
• @.bss
• @.tls
• lib.com
• screenshot%03i.png
• IMAGE: Invalid file dataIMAGE: Missing file extension.png.PNG.bmp.BMP.gif.GIF.qoi.QOI.dds.DDS
• IMAGE: Image pixel format must be R8G8B8 or R8G8B8A8.raw
• Text with inserted string is longer than internal buffer, use TextInserExt().ttf.otf
• IMAGE: glTF data URI is not a valid image.png%s/%simage\/pngimage/pngimage\/jpegimage/jpeg.jpg
• .mtl
• MODEL: [%s] IQM file version not supported (%i)MODEL: [%s] mesh name (%s), material (%s).glb.vox
• MODEL: [%s] M3D data loaded successfully: %i animations, %i bones, %i skins.gltf;.glb
• msvcrt.dll
• rand_sadvapi32.dll
• 0GDI32.dll
• main.cpp
• .tls
Flow Anomalies
Offset FlowVA Section Description
C32 N/A .text CALL QWORD PTR [RIP+0x182448]
C47 N/A .text CALL QWORD PTR [RIP+0x1824CB]
CFF N/A .text JMP QWORD PTR [RIP+0x182333]
7CA2 N/A .text CALL QWORD PTR [RIP+0xFE858]
80B8 N/A .text CALL QWORD PTR [RIP+0xFE442]
80D2 N/A .text CALL QWORD PTR [RIP+0xFE428]
80EC N/A .text CALL QWORD PTR [RIP+0xFE40E]
8106 N/A .text CALL QWORD PTR [RIP+0xFE3F4]
8120 N/A .text CALL QWORD PTR [RIP+0xFE3DA]
813A N/A .text CALL QWORD PTR [RIP+0xFE3C0]
8154 N/A .text CALL QWORD PTR [RIP+0xFE3A6]
816E N/A .text CALL QWORD PTR [RIP+0xFE38C]
834E N/A .text CALL QWORD PTR [RIP+0xFE1AC]
8368 N/A .text CALL QWORD PTR [RIP+0xFE192]
8382 N/A .text CALL QWORD PTR [RIP+0xFE178]
8B67 N/A .text CALL QWORD PTR [RIP+0xFD993]
8F01 N/A .text CALL QWORD PTR [RIP+0xFD5F9]
8F1B N/A .text CALL QWORD PTR [RIP+0xFD5DF]
90D0 N/A .text CALL QWORD PTR [RIP+0xFD42A]
90EA N/A .text CALL QWORD PTR [RIP+0xFD410]
91FC N/A .text CALL QWORD PTR [RIP+0xFD2FE]
A010 N/A .text CALL QWORD PTR [RIP+0x16D5F2]
A26E N/A .text CALL QWORD PTR [RIP+0x16D38C]
D3B6 N/A .text CALL QWORD PTR [RIP+0x168F0C]
D613 N/A .text CALL QWORD PTR [RIP+0x16ABEF]
D62A N/A .text CALL QWORD PTR [RIP+0x16AAE8]
D644 N/A .text CALL QWORD PTR [RIP+0x16AACE]
D65B N/A .text CALL QWORD PTR [RIP+0x16AAB7]
D675 N/A .text CALL QWORD PTR [RIP+0x16AA9D]
D685 N/A .text CALL QWORD PTR [RIP+0x169095]
D69A N/A .text CALL QWORD PTR [RIP+0x169080]
D6B1 N/A .text CALL QWORD PTR [RIP+0x16AAB1]
D6D3 N/A .text CALL QWORD PTR [RIP+0x16A12F]
D6F0 N/A .text CALL QWORD PTR [RIP+0x16AA72]
D73F N/A .text CALL QWORD PTR [RIP+0x16A923]
D74F N/A .text CALL QWORD PTR [RIP+0x16AA13]
D764 N/A .text CALL QWORD PTR [RIP+0x16A41E]
D779 N/A .text CALL QWORD PTR [RIP+0x16A509]
D78E N/A .text CALL QWORD PTR [RIP+0x16A3F4]
D7A3 N/A .text CALL QWORD PTR [RIP+0x16A4DF]
D7B8 N/A .text CALL QWORD PTR [RIP+0x16A50A]
D7CD N/A .text CALL QWORD PTR [RIP+0x16A4F5]
D7E2 N/A .text CALL QWORD PTR [RIP+0x16A3A0]
D7F7 N/A .text CALL QWORD PTR [RIP+0x16A48B]
D815 N/A .text CALL QWORD PTR [RIP+0x16A6FD]
D833 N/A .text CALL QWORD PTR [RIP+0x16A567]
D844 N/A .text CALL QWORD PTR [RIP+0x16A556]
D855 N/A .text CALL QWORD PTR [RIP+0x16A32D]
D86A N/A .text CALL QWORD PTR [RIP+0x16A418]
D87A N/A .text CALL QWORD PTR [RIP+0x1693A8]
D894 N/A .text CALL QWORD PTR [RIP+0x169726]
D8AE N/A .text CALL QWORD PTR [RIP+0x16970C]
D8C8 N/A .text CALL QWORD PTR [RIP+0x1696F2]
D8D3 N/A .text CALL QWORD PTR [RIP+0x16A2AF]
D8ED N/A .text CALL QWORD PTR [RIP+0x1696CD]
D8FD N/A .text CALL QWORD PTR [RIP+0x169A25]
D91F N/A .text CALL QWORD PTR [RIP+0x169F43]
D943 N/A .text CALL QWORD PTR [RIP+0x16A23F]
D958 N/A .text CALL QWORD PTR [RIP+0x16A32A]
D9C8 N/A .text CALL QWORD PTR [RIP+0x16A5F2]
D9DD N/A .text CALL QWORD PTR [RIP+0x16A61D]
DA90 N/A .text CALL QWORD PTR [RIP+0x16B012]
DAF0 N/A .text CALL QWORD PTR [RIP+0x16A6B2]
DB00 N/A .text CALL QWORD PTR [RIP+0x16A6A2]
DB6C N/A .text CALL QWORD PTR [RIP+0x16A586]
DB77 N/A .text CALL QWORD PTR [RIP+0x16A0FB]
DB82 N/A .text CALL QWORD PTR [RIP+0x16A0F0]
DB8D N/A .text CALL QWORD PTR [RIP+0x16A0E5]
DB98 N/A .text CALL QWORD PTR [RIP+0x16A0DA]
DBA3 N/A .text CALL QWORD PTR [RIP+0x16A54F]
DBB2 N/A .text CALL QWORD PTR [RIP+0x16A1B0]
DBC1 N/A .text CALL QWORD PTR [RIP+0x16A1A1]
DBD0 N/A .text CALL QWORD PTR [RIP+0x16A192]
DBDF N/A .text CALL QWORD PTR [RIP+0x16A183]
DBEE N/A .text CALL QWORD PTR [RIP+0x16A174]
DC09 N/A .text CALL QWORD PTR [RIP+0x16A0C9]
DC43 N/A .text CALL QWORD PTR [RIP+0x16A09F]
DCA1 N/A .text CALL QWORD PTR [RIP+0x169021]
DDC5 N/A .text CALL QWORD PTR [RIP+0x16A39D]
DE17 N/A .text CALL QWORD PTR [RIP+0x169C53]
DE50 N/A .text CALL QWORD PTR [RIP+0x169C4A]
DE76 N/A .text CALL QWORD PTR [RIP+0x169BF4]
DE94 N/A .text CALL QWORD PTR [RIP+0x169C06]
DEB3 N/A .text CALL QWORD PTR [RIP+0x16A2AF]
DEDE N/A .text CALL QWORD PTR [RIP+0x169B8C]
DEFB N/A .text CALL QWORD PTR [RIP+0x169B9F]
DF20 N/A .text CALL QWORD PTR [RIP+0x169B4A]
DF33 N/A .text CALL QWORD PTR [RIP+0x16A26F]
DF4D N/A .text CALL QWORD PTR [RIP+0x16A255]
DF64 N/A .text CALL QWORD PTR [RIP+0x16A23E]
DF7E N/A .text CALL QWORD PTR [RIP+0x16A224]
DFA4 N/A .text CALL QWORD PTR [RIP+0x16A1FE]
DFBE N/A .text CALL QWORD PTR [RIP+0x16A074]
DFE4 N/A .text CALL QWORD PTR [RIP+0x16A1BE]
DFFE N/A .text CALL QWORD PTR [RIP+0x16A034]
E01A N/A .text CALL QWORD PTR [RIP+0x16A0D8]
E03A N/A .text CALL QWORD PTR [RIP+0x16A0B8]
E04A N/A .text CALL QWORD PTR [RIP+0x169B28]
E05A N/A .text CALL QWORD PTR [RIP+0x169C18]
E074 N/A .text CALL QWORD PTR [RIP+0x169BCE]
31399-313BF N/A .text Unusual NOPS Space, count: 39
88598-885BF N/A .text Unusual NOPS Space, count: 40
C4C11-C4C3F N/A .text Unusual NOPS Space, count: 47
D0DD7-D0DFF N/A .text Unusual NOPS Space, count: 41
F329A-F32BF N/A .text Unusual NOPS Space, count: 38
15DEC0 1400D18F0 .rdata TLS Callback | Pointer to D18F0 - 0xD0EF0 .text
15DEC8 1400D19A9 .rdata TLS Callback | Pointer to D19A9 - 0xD0FA9 .text
15DED0 1400E6D60 .rdata TLS Callback | Pointer to E6D60 - 0xE6360 .text
15E200 140001000 .pdata ExceptionHook | Pointer to 1000 - 0x600 .text + UnwindInfo: .xdata
15E20C 140001017 .pdata ExceptionHook | Pointer to 1017 - 0x617 .text + UnwindInfo: .xdata
15E218 140001046 .pdata ExceptionHook | Pointer to 1046 - 0x646 .text + UnwindInfo: .xdata
15E224 140001075 .pdata ExceptionHook | Pointer to 1075 - 0x675 .text + UnwindInfo: .xdata
15E230 140001398 .pdata ExceptionHook | Pointer to 1398 - 0x998 .text + UnwindInfo: .xdata
15E23C 14000149C .pdata ExceptionHook | Pointer to 149C - 0xA9C .text + UnwindInfo: .xdata
15E248 1400015DB .pdata ExceptionHook | Pointer to 15DB - 0xBDB .text + UnwindInfo: .xdata
15E254 140001600 .pdata ExceptionHook | Pointer to 1600 - 0xC00 .text + UnwindInfo: .xdata
15E260 140001610 .pdata ExceptionHook | Pointer to 1610 - 0xC10 .text + UnwindInfo: .xdata
15E26C 140001620 .pdata ExceptionHook | Pointer to 1620 - 0xC20 .text + UnwindInfo: .xdata
15E278 1400016D0 .pdata ExceptionHook | Pointer to 16D0 - 0xCD0 .text + UnwindInfo: .xdata
15E284 140001710 .pdata ExceptionHook | Pointer to 1710 - 0xD10 .text + UnwindInfo: .xdata
15E290 140002480 .pdata ExceptionHook | Pointer to 2480 - 0x1A80 .text + UnwindInfo: .xdata
15E29C 140002830 .pdata ExceptionHook | Pointer to 2830 - 0x1E30 .text + UnwindInfo: .xdata
15E2A8 14000295A .pdata ExceptionHook | Pointer to 295A - 0x1F5A .text + UnwindInfo: .xdata
15E2B4 1400029C2 .pdata ExceptionHook | Pointer to 29C2 - 0x1FC2 .text + UnwindInfo: .xdata
15E2C0 140002A8D .pdata ExceptionHook | Pointer to 2A8D - 0x208D .text + UnwindInfo: .xdata
15E2CC 140002B58 .pdata ExceptionHook | Pointer to 2B58 - 0x2158 .text + UnwindInfo: .xdata
15E2D8 140002CE1 .pdata ExceptionHook | Pointer to 2CE1 - 0x22E1 .text + UnwindInfo: .xdata
15E2E4 1400033E8 .pdata ExceptionHook | Pointer to 33E8 - 0x29E8 .text + UnwindInfo: .xdata
15E2F0 140003476 .pdata ExceptionHook | Pointer to 3476 - 0x2A76 .text + UnwindInfo: .xdata
15E2FC 140003AD2 .pdata ExceptionHook | Pointer to 3AD2 - 0x30D2 .text + UnwindInfo: .xdata
15E308 140003C0F .pdata ExceptionHook | Pointer to 3C0F - 0x320F .text + UnwindInfo: .xdata
15E314 140003D98 .pdata ExceptionHook | Pointer to 3D98 - 0x3398 .text + UnwindInfo: .xdata
15E320 140003FCC .pdata ExceptionHook | Pointer to 3FCC - 0x35CC .text + UnwindInfo: .xdata
15E32C 140004356 .pdata ExceptionHook | Pointer to 4356 - 0x3956 .text + UnwindInfo: .xdata
15E338 1400049FE .pdata ExceptionHook | Pointer to 49FE - 0x3FFE .text + UnwindInfo: .xdata
15E344 140004B02 .pdata ExceptionHook | Pointer to 4B02 - 0x4102 .text + UnwindInfo: .xdata
15E350 140004E66 .pdata ExceptionHook | Pointer to 4E66 - 0x4466 .text + UnwindInfo: .xdata
15E35C 140004EE1 .pdata ExceptionHook | Pointer to 4EE1 - 0x44E1 .text + UnwindInfo: .xdata
15E368 140004F09 .pdata ExceptionHook | Pointer to 4F09 - 0x4509 .text + UnwindInfo: .xdata
15E374 140004F31 .pdata ExceptionHook | Pointer to 4F31 - 0x4531 .text + UnwindInfo: .xdata
15E380 140004F77 .pdata ExceptionHook | Pointer to 4F77 - 0x4577 .text + UnwindInfo: .xdata
15E38C 140004F9F .pdata ExceptionHook | Pointer to 4F9F - 0x459F .text + UnwindInfo: .xdata
15E398 140004FE5 .pdata ExceptionHook | Pointer to 4FE5 - 0x45E5 .text + UnwindInfo: .xdata
15E3A4 14000502B .pdata ExceptionHook | Pointer to 502B - 0x462B .text + UnwindInfo: .xdata
15E3B0 140005053 .pdata ExceptionHook | Pointer to 5053 - 0x4653 .text + UnwindInfo: .xdata
15E3BC 140005099 .pdata ExceptionHook | Pointer to 5099 - 0x4699 .text + UnwindInfo: .xdata
15E3C8 1400050C1 .pdata ExceptionHook | Pointer to 50C1 - 0x46C1 .text + UnwindInfo: .xdata
15E3D4 1400050E9 .pdata ExceptionHook | Pointer to 50E9 - 0x46E9 .text + UnwindInfo: .xdata
15E3E0 140005111 .pdata ExceptionHook | Pointer to 5111 - 0x4711 .text + UnwindInfo: .xdata
15E3EC 140005179 .pdata ExceptionHook | Pointer to 5179 - 0x4779 .text + UnwindInfo: .xdata
15E3F8 1400058CC .pdata ExceptionHook | Pointer to 58CC - 0x4ECC .text + UnwindInfo: .xdata
15E404 1400058F4 .pdata ExceptionHook | Pointer to 58F4 - 0x4EF4 .text + UnwindInfo: .xdata
15E410 14000595C .pdata ExceptionHook | Pointer to 595C - 0x4F5C .text + UnwindInfo: .xdata
15E41C 1400059C4 .pdata ExceptionHook | Pointer to 59C4 - 0x4FC4 .text + UnwindInfo: .xdata
15E428 140005A0A .pdata ExceptionHook | Pointer to 5A0A - 0x500A .text + UnwindInfo: .xdata
15E434 140005A50 .pdata ExceptionHook | Pointer to 5A50 - 0x5050 .text + UnwindInfo: .xdata
15E440 140005BD9 .pdata ExceptionHook | Pointer to 5BD9 - 0x51D9 .text + UnwindInfo: .xdata
15E44C 140005C1F .pdata ExceptionHook | Pointer to 5C1F - 0x521F .text + UnwindInfo: .xdata
15E458 140005DBB .pdata ExceptionHook | Pointer to 5DBB - 0x53BB .text + UnwindInfo: .xdata
15E464 140005E23 .pdata ExceptionHook | Pointer to 5E23 - 0x5423 .text + UnwindInfo: .xdata
15E470 140005E7E .pdata ExceptionHook | Pointer to 5E7E - 0x547E .text + UnwindInfo: .xdata
15E47C 140005EC4 .pdata ExceptionHook | Pointer to 5EC4 - 0x54C4 .text + UnwindInfo: .xdata
15E488 140005EEC .pdata ExceptionHook | Pointer to 5EEC - 0x54EC .text + UnwindInfo: .xdata
15E494 140006062 .pdata ExceptionHook | Pointer to 6062 - 0x5662 .text + UnwindInfo: .xdata
15E4A0 14000632E .pdata ExceptionHook | Pointer to 632E - 0x592E .text + UnwindInfo: .xdata
15E4AC 140006356 .pdata ExceptionHook | Pointer to 6356 - 0x5956 .text + UnwindInfo: .xdata
15E4B8 14000637E .pdata ExceptionHook | Pointer to 637E - 0x597E .text + UnwindInfo: .xdata
15E4C4 1400063A6 .pdata ExceptionHook | Pointer to 63A6 - 0x59A6 .text + UnwindInfo: .xdata
15E4D0 1400063EC .pdata ExceptionHook | Pointer to 63EC - 0x59EC .text + UnwindInfo: .xdata
15E4DC 14000647A .pdata ExceptionHook | Pointer to 647A - 0x5A7A .text + UnwindInfo: .xdata
15E4E8 1400064C0 .pdata ExceptionHook | Pointer to 64C0 - 0x5AC0 .text + UnwindInfo: .xdata
15E4F4 1400064E8 .pdata ExceptionHook | Pointer to 64E8 - 0x5AE8 .text + UnwindInfo: .xdata
15E500 14000678E .pdata ExceptionHook | Pointer to 678E - 0x5D8E .text + UnwindInfo: .xdata
15E50C 140006846 .pdata ExceptionHook | Pointer to 6846 - 0x5E46 .text + UnwindInfo: .xdata
15E518 1400068A1 .pdata ExceptionHook | Pointer to 68A1 - 0x5EA1 .text + UnwindInfo: .xdata
15E524 1400068C9 .pdata ExceptionHook | Pointer to 68C9 - 0x5EC9 .text + UnwindInfo: .xdata
15E530 1400068F1 .pdata ExceptionHook | Pointer to 68F1 - 0x5EF1 .text + UnwindInfo: .xdata
15E53C 140006937 .pdata ExceptionHook | Pointer to 6937 - 0x5F37 .text + UnwindInfo: .xdata
15E548 140006C3C .pdata ExceptionHook | Pointer to 6C3C - 0x623C .text + UnwindInfo: .xdata
15E554 140006C64 .pdata ExceptionHook | Pointer to 6C64 - 0x6264 .text + UnwindInfo: .xdata
15E560 140006CF2 .pdata ExceptionHook | Pointer to 6CF2 - 0x62F2 .text + UnwindInfo: .xdata
15E56C 140006D38 .pdata ExceptionHook | Pointer to 6D38 - 0x6338 .text + UnwindInfo: .xdata
15E578 140006DDD .pdata ExceptionHook | Pointer to 6DDD - 0x63DD .text + UnwindInfo: .xdata
15E584 140006E45 .pdata ExceptionHook | Pointer to 6E45 - 0x6445 .text + UnwindInfo: .xdata
15E590 140006EA0 .pdata ExceptionHook | Pointer to 6EA0 - 0x64A0 .text + UnwindInfo: .xdata
15E59C 140006EC8 .pdata ExceptionHook | Pointer to 6EC8 - 0x64C8 .text + UnwindInfo: .xdata
15E5A8 140006F23 .pdata ExceptionHook | Pointer to 6F23 - 0x6523 .text + UnwindInfo: .xdata
15E5B4 140006F8B .pdata ExceptionHook | Pointer to 6F8B - 0x658B .text + UnwindInfo: .xdata
15E5C0 140007069 .pdata ExceptionHook | Pointer to 7069 - 0x6669 .text + UnwindInfo: .xdata
15E5CC 1400070D1 .pdata ExceptionHook | Pointer to 70D1 - 0x66D1 .text + UnwindInfo: .xdata
15E5D8 1400071C2 .pdata ExceptionHook | Pointer to 71C2 - 0x67C2 .text + UnwindInfo: .xdata
15E5E4 14000767C .pdata ExceptionHook | Pointer to 767C - 0x6C7C .text + UnwindInfo: .xdata
15E5F0 14000768D .pdata ExceptionHook | Pointer to 768D - 0x6C8D .text + UnwindInfo: .xdata
15E5FC 1400077D3 .pdata ExceptionHook | Pointer to 77D3 - 0x6DD3 .text + UnwindInfo: .xdata
15E608 140007846 .pdata ExceptionHook | Pointer to 7846 - 0x6E46 .text + UnwindInfo: .xdata
15E614 140007D9D .pdata ExceptionHook | Pointer to 7D9D - 0x739D .text + UnwindInfo: .xdata
15E620 140007DDB .pdata ExceptionHook | Pointer to 7DDB - 0x73DB .text + UnwindInfo: .xdata
15E62C 140007E33 .pdata ExceptionHook | Pointer to 7E33 - 0x7433 .text + UnwindInfo: .xdata
15E638 140007FD7 .pdata ExceptionHook | Pointer to 7FD7 - 0x75D7 .text + UnwindInfo: .xdata
15E644 140008355 .pdata ExceptionHook | Pointer to 8355 - 0x7955 .text + UnwindInfo: .xdata
15E650 1400083A9 .pdata ExceptionHook | Pointer to 83A9 - 0x79A9 .text + UnwindInfo: .xdata
15E65C 1400083FC .pdata ExceptionHook | Pointer to 83FC - 0x79FC .text + UnwindInfo: .xdata
15E668 1400083FD .pdata ExceptionHook | Pointer to 83FD - 0x79FD .text + UnwindInfo: .xdata
15E674 14000840B .pdata ExceptionHook | Pointer to 840B - 0x7A0B .text + UnwindInfo: .xdata
15E680 14000842A .pdata ExceptionHook | Pointer to 842A - 0x7A2A .text + UnwindInfo: .xdata
15E68C 140008449 .pdata ExceptionHook | Pointer to 8449 - 0x7A49 .text + UnwindInfo: .xdata
15E698 140008468 .pdata ExceptionHook | Pointer to 8468 - 0x7A68 .text + UnwindInfo: .xdata
15E6A4 14000848F .pdata ExceptionHook | Pointer to 848F - 0x7A8F .text + UnwindInfo: .xdata
1A1C00 N/A *Overlay* 2E66696C650000004F000000FEFF000067016372 | .file...O.......g.cr
Extra Analysis
Metric Value Percentage
Ascii Code 1539405 65,7365%
Null Byte Code 472488 20,1764%
NOP Cave Found 0x9090909090 Block Count: 1152 | Total: 0,123%
© 2026 All rights reserved.