PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 352,00 KBSHA-256 Hash: 3F543719A819A9769D8F138A02544F93AF8B53EF1779A96BC2403715D9A55380 SHA-1 Hash: 56552BAF3571686239DC10298F80B6909B535491 MD5 Hash: CE66F800E2C6D2D911537ECAF5D7A793 Imphash: AA9E7E1BD35E47C6DE05DF960241A986 MajorOSVersion: 10 MinorOSVersion: 0 CheckSum: 000656AE EntryPoint (rva): 19C0 SizeOfHeaders: 1000 SizeOfImage: 5A000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 309C0 IAT: 298D8 Characteristics: 22 TimeDateStamp: 3BC4C43A Date: 10/10/2001 21:57:14 File Type: EXE Number Of Sections: 8 ASLR: Disabled Section Names (Optional Header): .text, fothk, .rdata, .data, .pdata, .didat, .rsrc, .reloc Number Of Executable Sections: 2 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | 27000 | 1000 | 267E2 |
|
|
| fothk | 0x60000020 Code Executable Readable |
28000 | 1000 | 28000 | 1000 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
29000 | B000 | 29000 | A6C8 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
34000 | 1000 | 34000 | 2740 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
35000 | 2000 | 37000 | 1218 |
|
|
| .didat | 0xC0000040 Initialized Data Readable Writeable |
37000 | 1000 | 39000 | F8 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
38000 | 1F000 | 3A000 | 1E1D0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
57000 | 1000 | 59000 | 35C |
|
|
| Description |
| OriginalFilename: NOTEPAD.EXE CompanyName: Microsoft Corporation LegalCopyright: Microsoft Corporation. All rights reserved. ProductName: Microsoft Windows Operating System FileVersion: 10.0.26100.8972 (WinBuild.160101.0800) FileDescription: Notepad ProductVersion: 10.0.26100.8972 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 19C0 Code -> 4883EC28E8CF0500004883C428E96EFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC66660F1F840000000000483B Assembler |SUB RSP, 0X28 |CALL 0X140001F98 |ADD RSP, 0X28 |JMP 0X140001840 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |NOP WORD PTR [RAX + RAX] |
| Signatures |
| Rich Signature Analyzer: Code -> 30763DF7741753A4741753A4741753A47D6FC0A42A1753A4741753A4751753A40D9657A57F1753A40D9650A5711753A40D9656A56B1753A40D9652A5731753A4741752A4101253A40D965BA5681753A40D96AEA4751753A40D96ACA4751753A40D9651A5751753A452696368741753A4 Footprint md5 Hash -> A17274417ECFBA953B50BA41F4B13B5E • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.38**)[-] • Entropy: 6.48265 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| ADVAPI32.DLL | DecryptFileW | Decrypt a file previously encrypted by the EncryptFile function, using Unicode characters for file paths. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| ADVAPI32.DLL | RegDeleteKeyExW | Deletes a registry key. |
| ADVAPI32.DLL | RegGetValueW | Reads data from a registry value. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\Microsoft\Notepad Software\Microsoft\Notepad\DefaultFonts Software\Microsoft\Notepad\Autosave |
| File Access |
| api-ms-win-core-delayload-l1-1-0.dll api-ms-win-core-delayload-l1-1-1.dll COMCTL32.dll api-ms-win-core-winrt-error-l1-1-1.dll api-ms-win-core-winrt-error-l1-1-0.dll api-ms-win-core-interlocked-l1-1-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-core-processthreads-l1-1-1.dll api-ms-win-core-rtlsupport-l1-1-0.dll api-ms-win-core-libraryloader-l1-2-1.dll api-ms-win-base-util-l1-1-0.dll api-ms-win-eventing-provider-l1-1-0.dll api-ms-win-core-windowserrorreporting-l1-1-3.dll api-ms-win-core-string-obsolete-l1-1-0.dll api-ms-win-shcore-scaling-l1-1-1.dll api-ms-win-core-heap-obsolete-l1-1-0.dll api-ms-win-core-registry-l2-1-0.dll api-ms-win-core-memory-l1-1-0.dll api-ms-win-shcore-path-l1-1-0.dll api-ms-win-core-datetime-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll api-ms-win-core-localization-obsolete-l1-2-0.dll api-ms-win-core-psapi-l1-1-0.dll api-ms-win-core-string-l1-1-0.dll api-ms-win-core-processenvironment-l1-1-0.dll api-ms-win-security-base-l1-1-0.dll api-ms-win-shcore-obsolete-l1-1-0.dll api-ms-win-core-file-l1-1-0.dll api-ms-win-core-heap-l2-1-0.dll api-ms-win-core-winrt-l1-1-0.dll api-ms-win-core-registry-l1-1-0.dll api-ms-win-core-winrt-string-l1-1-0.dll api-ms-win-core-shlwapi-legacy-l1-1-0.dll api-ms-win-core-largeinteger-l1-1-0.dll api-ms-win-core-registry-l1-1-1.dll api-ms-win-core-com-l1-1-0.dll api-ms-win-core-handle-l1-1-0.dll api-ms-win-core-debug-l1-1-0.dll api-ms-win-core-localization-l1-2-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-threadpool-l1-2-0.dll api-ms-win-core-errorhandling-l1-1-0.dll api-ms-win-core-heap-l1-1-0.dll api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll USER32.dll GDI32.dll comdlg32.dll urlmon.dll SHELL32.dll PROPSYS.dll ADVAPI32.dll .dat @.dat Temp |
| File Access (UNICODE) |
| NOTEPAD.EXE WindowsNotepad_8wekyb3d8bbwe\notepad.exe kernelbase.dll ntdll.dll Windows.Sys ApplicationModel.Dat %s%c*.txt *.txt |
| Interest's Words |
| Encrypt Decrypt Encryption exec attrib start sdelete shutdown systeminfo ping replace |
| Interest's Words (UNICODE) |
| Encrypt Encryption start replace |
| URLs |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| URLs (UNICODE) |
| https://go.microsoft.com/fwlink/?LinkId=834783 https://go.microsoft.com/fwlink/p/?linkid=838060 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Unicode | Unauthorized movement of funds or data (Transfer) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \EDPENLIGHTENEDAPPINFOID\MICROSOFTEDPENLIGHTENEDAPPINFO\1033 | 3AC58 | 2 | 38C58 | 0100 | .. |
| \EDPPERMISSIVEAPPINFOID\MICROSOFTEDPPERMISSIVEAPPINFO\1033 | 3AC60 | 2 | 38C60 | 0100 | .. |
| \MUI\1\1033 | 58090 | 140 | 56090 | CDFECDFE400100000000010000000000110000000000000002000000B37F7BA775DCF389E111B7C7B984EDDF9B1F97402220 | ....@.........................{.u..............@" |
| \ICON\1\1033 | 3AC68 | 668 | 38C68 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\2\1033 | 3B2D0 | 2E8 | 392D0 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\3\1033 | 3B5B8 | 1E8 | 395B8 | 2800000018000000300000000100040000000000200100000000000000000000000000000000000000000000000080000080 | (.......0........... ............................. |
| \ICON\4\1033 | 3B7A0 | 128 | 397A0 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\5\1033 | 3B8C8 | EA8 | 398C8 | 2800000030000000600000000100080000000000000900000000000000000000000100000001000000000000002B4E000531 | (...0.......................................+N..1 |
| \ICON\6\1033 | 3C770 | 8A8 | 3A770 | 28000000200000004000000001000800000000000004000000000000000000000001000000010000000000000A3C5900123B | (... ...@....................................<Y..; |
| \ICON\7\1033 | 3D018 | 6C8 | 3B018 | 2800000018000000300000000100080000000000400200000000000000000000000100000001000000000000295067002754 | (.......0...........@.......................)Pg.’T |
| \ICON\8\1033 | 3D6E0 | 568 | 3B6E0 | 2800000010000000200000000100080000000000000100000000000000000000000100000001000000000000534F45005652 | (....... ...................................SOE.VR |
| \ICON\9\1033 | 3DC48 | 11958 | 3BC48 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000017352474200AECE1CE900000004 | .PNG........IHDR.............\r.f....sRGB......... |
| \ICON\10\1033 | 4F5A0 | 25A8 | 4D5A0 | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\11\1033 | 51B48 | 10A8 | 4FB48 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\12\1033 | 52BF0 | 988 | 50BF0 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\13\1033 | 53578 | 468 | 51578 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \ICON\14\1033 | 53AA0 | A48 | 51AA0 | 280000001A000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... |
| \ICON\15\1033 | 544E8 | 708 | 524E8 | 2800000015000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... |
| \ICON\16\1033 | 54BF0 | 4A8 | 52BF0 | 2800000011000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... |
| \ICON\17\1033 | 550C8 | A48 | 530C8 | 280000001A0000003000000001002000000000000000000000000000000000000000000000000000ACACAC599F9F9FDC9696 | (.......0..... ............................Y...... |
| \ICON\18\1033 | 55B10 | 708 | 53B10 | 28000000150000002800000001002000000000000000000000000000000000000000000000000000ACACAC599F9F9FDC9696 | (.......(..... ............................Y...... |
| \ICON\19\1033 | 56218 | 4A8 | 54218 | 28000000110000002000000001002000000000000000000000000000000000000000000000000000ACACAC45B1B1B1FF9696 | (....... ..... ............................E...... |
| \ICON\20\1033 | 566F0 | A48 | 546F0 | 280000001A0000003000000001002000000000000000000000000000000000000000000000000000ACACAC599F9F9FDC9696 | (.......0..... ............................Y...... |
| \ICON\21\1033 | 57138 | 708 | 55138 | 28000000150000002800000001002000000000000000000000000000000000000000000000000000ACACAC599F9F9FDC9696 | (.......(..... ............................Y...... |
| \ICON\22\1033 | 57840 | 4A8 | 55840 | 28000000110000002000000001002000000000000000000000000000000000000000000000000000ACACAC45B1B1B1FF9696 | (....... ..... ............................E...... |
| \GROUP_ICON\2\1033 | 539E0 | BC | 519E0 | 000001000D0030301000010004006806000001002020100001000400E802000002001818100001000400E801000003001010 | ......00......h..... ............................ |
| \GROUP_ICON\300\1033 | 55098 | 30 | 53098 | 0000010003001A18000001002000480A00000E001514000001002000080700000F001110000001002000A80400001000 | ............ .H........... ............. ....... |
| \GROUP_ICON\301\1033 | 566C0 | 30 | 546C0 | 0000010003001A18000001002000480A0000110015140000010020000807000012001110000001002000A80400001300 | ............ .H........... ............. ....... |
| \GROUP_ICON\302\1033 | 57CE8 | 30 | 55CE8 | 0000010003001A18000001002000480A0000140015140000010020000807000015001110000001002000A80400001600 | ............ .H........... ............. ....... |
| \VERSION\1\1033 | 57D18 | 374 | 55D18 | 700334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | p.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 3A770 | 4E4 | 38770 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • api-ms-win-core-libraryloader-l1-2-1.dll • api-ms-win-base-util-l1-1-0.dll • api-ms-win-eventing-provider-l1-1-0.dll • api-ms-win-core-heap-obsolete-l1-1-0.dll • api-ms-win-core-registry-l2-1-0.dll • api-ms-win-core-memory-l1-1-0.dll • api-ms-win-shcore-path-l1-1-0.dll • api-ms-win-core-datetime-l1-1-0.dll • api-ms-win-core-psapi-l1-1-0.dll • api-ms-win-core-string-l1-1-0.dll • api-ms-win-core-processenvironment-l1-1-0.dll • api-ms-win-security-base-l1-1-0.dll • api-ms-win-shcore-obsolete-l1-1-0.dll • api-ms-win-core-file-l1-1-0.dll • api-ms-win-core-heap-l2-1-0.dll • api-ms-win-core-winrt-l1-1-0.dll • api-ms-win-core-registry-l1-1-0.dll • api-ms-win-core-winrt-string-l1-1-0.dll • api-ms-win-core-shlwapi-legacy-l1-1-0.dll • api-ms-win-core-largeinteger-l1-1-0.dll • api-ms-win-core-registry-l1-1-1.dll • api-ms-win-core-com-l1-1-0.dll • api-ms-win-core-handle-l1-1-0.dll • api-ms-win-core-debug-l1-1-0.dll • api-ms-win-core-localization-l1-2-0.dll • api-ms-win-core-processthreads-l1-1-0.dll • api-ms-win-core-threadpool-l1-2-0.dll • api-ms-win-core-errorhandling-l1-1-0.dll • api-ms-win-core-heap-l1-1-0.dll • ADVAPI32.dll • COMDLG32.dll • PROPSYS.dll • SHELL32.dll • WINSPOOL.DRV • urlmon.dll • ntdll.dll • kernelbase.dll • ms-windows-store://pdp/?PFN=Microsoft.WindowsNotepad_8wekyb3d8bbwe • shell\osshell\accesory\notepad\banner.cpp • ?Windows.Foundation.Uri • *.txt • shell\osshell\accesory\notepad\notepad.cpp • feedback-hub://?tabid=2&contextid=1010 • https://go.microsoft.com/fwlink/?LinkId=834783 • .log • .txt • https://go.microsoft.com/fwlink/p/?linkid=838060 • shell\osshell\accesory\notepad\nprestart.cpp • \Microsoft\WindowsApps\Microsoft.WindowsNotepad_8wekyb3d8bbwe\notepad.exe • comdlg32.dll • shell\osshell\accesory\common\edpapphelper\edpapphelper.cpp • .bss • kCreateDialogIndirectParamW • USER32.dll • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-core-synch-l1-1-0.dll • api-ms-win-core-localization-obsolete-l1-2-0.dll • api-ms-win-core-sysinfo-l1-1-0.dll • api-ms-win-shcore-scaling-l1-1-1.dll • api-ms-win-core-string-obsolete-l1-1-0.dll • api-ms-win-core-windowserrorreporting-l1-1-3.dll • api-ms-win-core-rtlsupport-l1-1-0.dll • api-ms-win-core-processthreads-l1-1-1.dll • api-ms-win-core-profile-l1-1-0.dll • api-ms-win-core-interlocked-l1-1-0.dll • api-ms-win-core-winrt-error-l1-1-0.dll • api-ms-win-core-winrt-error-l1-1-1.dll • api-ms-win-core-delayload-l1-1-1.dll • api-ms-win-core-delayload-l1-1-0.dll • <windowsSettings xmlns:ws2="http://schemas.microsoft.com/SMI/2016/WindowsSettings"> • NOTEPAD.EXE |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 1369 | N/A | .text | CALL QWORD PTR [RIP+0x29079] |
| 13B1 | N/A | .text | CALL QWORD PTR [RIP+0x28D69] |
| 13E7 | N/A | .text | CALL QWORD PTR [RIP+0x28D33] |
| 1CBF | N/A | .text | CALL QWORD PTR [RIP+0x280C3] |
| 1CC8 | N/A | .text | CALL QWORD PTR [RIP+0x280B2] |
| 1CCE | N/A | .text | CALL QWORD PTR [RIP+0x282E4] |
| 1CE2 | N/A | .text | JMP QWORD PTR [RIP+0x282E8] |
| 1CFE | N/A | .text | CALL QWORD PTR [RIP+0x282F4] |
| 1DF1 | N/A | .text | CALL QWORD PTR [RIP+0x28201] |
| 1EA6 | N/A | .text | CALL QWORD PTR [RIP+0x281FC] |
| 1EBE | N/A | .text | CALL QWORD PTR [RIP+0x281DC] |
| 1EF5 | N/A | .text | CALL QWORD PTR [RIP+0x281B5] |
| 1F29 | N/A | .text | CALL QWORD PTR [RIP+0x28179] |
| 1F43 | N/A | .text | CALL QWORD PTR [RIP+0x28157] |
| 1F7A | N/A | .text | CALL QWORD PTR [RIP+0x28130] |
| 1FC9 | N/A | .text | CALL QWORD PTR [RIP+0x281E1] |
| 1FD7 | N/A | .text | CALL QWORD PTR [RIP+0x27FFB] |
| 1FE3 | N/A | .text | CALL QWORD PTR [RIP+0x27FFF] |
| 1FF3 | N/A | .text | CALL QWORD PTR [RIP+0x28017] |
| 207C | N/A | .text | JMP QWORD PTR [RIP+0x27E36] |
| 211C | N/A | .text | CALL QWORD PTR [RIP+0x27ED6] |
| 2149 | N/A | .text | CALL QWORD PTR [RIP+0x27F59] |
| 216B | N/A | .text | CALL QWORD PTR [RIP+0x27F2F] |
| 21BC | N/A | .text | CALL QWORD PTR [RIP+0x27EEE] |
| 2210 | N/A | .text | CALL QWORD PTR [RIP+0x27B2A] |
| 222D | N/A | .text | CALL QWORD PTR [RIP+0x27B55] |
| 2238 | N/A | .text | CALL QWORD PTR [RIP+0x27B42] |
| 2284 | N/A | .text | CALL QWORD PTR [RIP+0x27D56] |
| 22BA | N/A | .text | CALL QWORD PTR [RIP+0x27C58] |
| 2314 | N/A | .text | JMP QWORD PTR [RIP+0x27A6E] |
| 2478 | N/A | .text | JMP QWORD PTR [RIP+0xFFF3FF0] |
| 285C | N/A | .text | JMP QWORD PTR [RIP+0x27B3E] |
| 2868 | N/A | .text | JMP QWORD PTR [RIP+0x27B2A] |
| 2874 | N/A | .text | JMP QWORD PTR [RIP+0x27B16] |
| 2880 | N/A | .text | JMP QWORD PTR [RIP+0x27B22] |
| 288C | N/A | .text | JMP QWORD PTR [RIP+0x27AD6] |
| 2898 | N/A | .text | JMP QWORD PTR [RIP+0x27A8A] |
| 28A4 | N/A | .text | JMP QWORD PTR [RIP+0x27A6E] |
| 28B0 | N/A | .text | JMP QWORD PTR [RIP+0x27A5A] |
| 28BC | N/A | .text | JMP QWORD PTR [RIP+0x27A3E] |
| 28C8 | N/A | .text | JMP QWORD PTR [RIP+0x27A7A] |
| 28D4 | N/A | .text | JMP QWORD PTR [RIP+0x27A5E] |
| 28E0 | N/A | .text | JMP QWORD PTR [RIP+0x27A3A] |
| 28EC | N/A | .text | JMP QWORD PTR [RIP+0x27A16] |
| 28F8 | N/A | .text | JMP QWORD PTR [RIP+0x279FA] |
| 2904 | N/A | .text | JMP QWORD PTR [RIP+0x27A26] |
| 2910 | N/A | .text | JMP QWORD PTR [RIP+0x2793A] |
| 291C | N/A | .text | JMP QWORD PTR [RIP+0x27936] |
| 2928 | N/A | .text | JMP QWORD PTR [RIP+0x27932] |
| 2934 | N/A | .text | JMP QWORD PTR [RIP+0x2792E] |
| 2940 | N/A | .text | JMP QWORD PTR [RIP+0x2792A] |
| 294C | N/A | .text | JMP QWORD PTR [RIP+0x27926] |
| 2958 | N/A | .text | JMP QWORD PTR [RIP+0x27922] |
| 2964 | N/A | .text | JMP QWORD PTR [RIP+0x2791E] |
| 2970 | N/A | .text | JMP QWORD PTR [RIP+0x2791A] |
| 297C | N/A | .text | JMP QWORD PTR [RIP+0x27916] |
| 2988 | N/A | .text | JMP QWORD PTR [RIP+0x27922] |
| 2994 | N/A | .text | JMP QWORD PTR [RIP+0x2791E] |
| 29A0 | N/A | .text | JMP QWORD PTR [RIP+0x27922] |
| 29AC | N/A | .text | JMP QWORD PTR [RIP+0x2791E] |
| 29B8 | N/A | .text | JMP QWORD PTR [RIP+0x2791A] |
| 29C4 | N/A | .text | JMP QWORD PTR [RIP+0x27916] |
| 29D0 | N/A | .text | JMP QWORD PTR [RIP+0x27912] |
| 29DC | N/A | .text | JMP QWORD PTR [RIP+0x279E6] |
| 29E8 | N/A | .text | JMP QWORD PTR [RIP+0x27902] |
| 2FCF | N/A | .text | CALL QWORD PTR [RIP+0x27183] |
| 300A | N/A | .text | CALL QWORD PTR [RIP+0x27128] |
| 304A | N/A | .text | CALL QWORD PTR [RIP+0x27108] |
| 3062 | N/A | .text | CALL QWORD PTR [RIP+0x270D0] |
| 31FA | N/A | .text | CALL QWORD PTR [RIP+0x26B98] |
| 344E | N/A | .text | CALL QWORD PTR [RIP+0x26B84] |
| 3557 | N/A | .text | CALL QWORD PTR [RIP+0x267E3] |
| 35E7 | N/A | .text | CALL QWORD PTR [RIP+0x2675B] |
| 36D2 | N/A | .text | CALL QWORD PTR [RIP+0x26900] |
| 37CC | N/A | .text | CALL QWORD PTR [RIP+0x2656E] |
| 385C | N/A | .text | CALL QWORD PTR [RIP+0x264E6] |
| 3AD1 | N/A | .text | CALL QWORD PTR [RIP+0x26359] |
| 3AE5 | N/A | .text | CALL QWORD PTR [RIP+0x2635D] |
| 3B56 | N/A | .text | CALL QWORD PTR [RIP+0x262D4] |
| 3B6A | N/A | .text | CALL QWORD PTR [RIP+0x262D8] |
| 3C34 | N/A | .text | CALL QWORD PTR [RIP+0x261F6] |
| 3C48 | N/A | .text | CALL QWORD PTR [RIP+0x261FA] |
| 3C62 | N/A | .text | CALL QWORD PTR [RIP+0x261C8] |
| 3C76 | N/A | .text | CALL QWORD PTR [RIP+0x261CC] |
| 3C96 | N/A | .text | CALL QWORD PTR [RIP+0x2653C] |
| 3CAA | N/A | .text | CALL QWORD PTR [RIP+0x26518] |
| 3CB9 | N/A | .text | CALL QWORD PTR [RIP+0x26501] |
| 3D6C | N/A | .text | CALL QWORD PTR [RIP+0x260BE] |
| 3D80 | N/A | .text | CALL QWORD PTR [RIP+0x260C2] |
| 3D93 | N/A | .text | CALL QWORD PTR [RIP+0x263D7] |
| 3E0E | N/A | .text | CALL QWORD PTR [RIP+0x2601C] |
| 3E22 | N/A | .text | CALL QWORD PTR [RIP+0x26020] |
| 3E67 | N/A | .text | CALL QWORD PTR [RIP+0x25FC3] |
| 3E7B | N/A | .text | CALL QWORD PTR [RIP+0x25FC7] |
| 3E8A | N/A | .text | CALL QWORD PTR [RIP+0x262E0] |
| 3EBB | N/A | .text | CALL QWORD PTR [RIP+0x25F6F] |
| 3ECF | N/A | .text | CALL QWORD PTR [RIP+0x25F73] |
| 3EDF | N/A | .text | CALL QWORD PTR [RIP+0x2628B] |
| 3F04 | N/A | .text | CALL QWORD PTR [RIP+0x262CE] |
| 3F15 | N/A | .text | CALL QWORD PTR [RIP+0x262AD] |
| 2812-282F | N/A | .text | Unusual BP Cave, count: 30 |
| 28015-28FFF | N/A | fothk | Unusual BP Cave, count: 4075 |
| 35000 | 140001008 | .pdata | ExceptionHook | Pointer to 1008 - 0x1008 .text + UnwindInfo: .rdata |
| 3500C | 140001094 | .pdata | ExceptionHook | Pointer to 1094 - 0x1094 .text + UnwindInfo: .rdata |
| 35018 | 1400011BC | .pdata | ExceptionHook | Pointer to 11BC - 0x11BC .text + UnwindInfo: .rdata |
| 35024 | 140001260 | .pdata | ExceptionHook | Pointer to 1260 - 0x1260 .text + UnwindInfo: .rdata |
| 35030 | 1400012DC | .pdata | ExceptionHook | Pointer to 12DC - 0x12DC .text + UnwindInfo: .rdata |
| 3503C | 1400013A0 | .pdata | ExceptionHook | Pointer to 13A0 - 0x13A0 .text + UnwindInfo: .rdata |
| 35048 | 1400016D0 | .pdata | ExceptionHook | Pointer to 16D0 - 0x16D0 .text + UnwindInfo: .rdata |
| 35054 | 140001720 | .pdata | ExceptionHook | Pointer to 1720 - 0x1720 .text + UnwindInfo: .rdata |
| 35060 | 140001750 | .pdata | ExceptionHook | Pointer to 1750 - 0x1750 .text + UnwindInfo: .rdata |
| 3506C | 140001800 | .pdata | ExceptionHook | Pointer to 1800 - 0x1800 .text + UnwindInfo: .rdata |
| 35078 | 140001820 | .pdata | ExceptionHook | Pointer to 1820 - 0x1820 .text + UnwindInfo: .rdata |
| 35084 | 140001840 | .pdata | ExceptionHook | Pointer to 1840 - 0x1840 .text + UnwindInfo: .rdata |
| 35090 | 1400019C0 | .pdata | ExceptionHook | Pointer to 19C0 - 0x19C0 .text + UnwindInfo: .rdata |
| 3509C | 1400019F0 | .pdata | ExceptionHook | Pointer to 19F0 - 0x19F0 .text + UnwindInfo: .rdata |
| 350A8 | 140001A14 | .pdata | ExceptionHook | Pointer to 1A14 - 0x1A14 .text + UnwindInfo: .rdata |
| 350B4 | 140001A54 | .pdata | ExceptionHook | Pointer to 1A54 - 0x1A54 .text + UnwindInfo: .rdata |
| 350C0 | 140001A94 | .pdata | ExceptionHook | Pointer to 1A94 - 0x1A94 .text + UnwindInfo: .rdata |
| 350CC | 140001B28 | .pdata | ExceptionHook | Pointer to 1B28 - 0x1B28 .text + UnwindInfo: .rdata |
| 350D8 | 140001BC8 | .pdata | ExceptionHook | Pointer to 1BC8 - 0x1BC8 .text + UnwindInfo: .rdata |
| 350E4 | 140001BF4 | .pdata | ExceptionHook | Pointer to 1BF4 - 0x1BF4 .text + UnwindInfo: .rdata |
| 350F0 | 140001C24 | .pdata | ExceptionHook | Pointer to 1C24 - 0x1C24 .text + UnwindInfo: .rdata |
| 350FC | 140001C64 | .pdata | ExceptionHook | Pointer to 1C64 - 0x1C64 .text + UnwindInfo: .rdata |
| 35108 | 140001C90 | .pdata | ExceptionHook | Pointer to 1C90 - 0x1C90 .text + UnwindInfo: .rdata |
| 35114 | 140001CB4 | .pdata | ExceptionHook | Pointer to 1CB4 - 0x1CB4 .text + UnwindInfo: .rdata |
| 35120 | 140001CF0 | .pdata | ExceptionHook | Pointer to 1CF0 - 0x1CF0 .text + UnwindInfo: .rdata |
| 3512C | 140001DC8 | .pdata | ExceptionHook | Pointer to 1DC8 - 0x1DC8 .text + UnwindInfo: .rdata |
| 35138 | 140001DE4 | .pdata | ExceptionHook | Pointer to 1DE4 - 0x1DE4 .text + UnwindInfo: .rdata |
| 35144 | 140001E88 | .pdata | ExceptionHook | Pointer to 1E88 - 0x1E88 .text + UnwindInfo: .rdata |
| 35150 | 140001F0C | .pdata | ExceptionHook | Pointer to 1F0C - 0x1F0C .text + UnwindInfo: .rdata |
| 3515C | 140001F98 | .pdata | ExceptionHook | Pointer to 1F98 - 0x1F98 .text + UnwindInfo: .rdata |
| 35168 | 1400020AC | .pdata | ExceptionHook | Pointer to 20AC - 0x20AC .text + UnwindInfo: .rdata |
| 35174 | 140002100 | .pdata | ExceptionHook | Pointer to 2100 - 0x2100 .text + UnwindInfo: .rdata |
| 35180 | 140002268 | .pdata | ExceptionHook | Pointer to 2268 - 0x2268 .text + UnwindInfo: .rdata |
| 3518C | 1400022B4 | .pdata | ExceptionHook | Pointer to 22B4 - 0x22B4 .text + UnwindInfo: .rdata |
| 35198 | 140002320 | .pdata | ExceptionHook | Pointer to 2320 - 0x2320 .text + UnwindInfo: .rdata |
| 351A4 | 140002384 | .pdata | ExceptionHook | Pointer to 2384 - 0x2384 .text + UnwindInfo: .rdata |
| 351B0 | 1400023D0 | .pdata | ExceptionHook | Pointer to 23D0 - 0x23D0 .text + UnwindInfo: .rdata |
| 351BC | 140002418 | .pdata | ExceptionHook | Pointer to 2418 - 0x2418 .text + UnwindInfo: .rdata |
| 351C8 | 1400025EC | .pdata | ExceptionHook | Pointer to 25EC - 0x25EC .text + UnwindInfo: .rdata |
| 351D4 | 140002630 | .pdata | ExceptionHook | Pointer to 2630 - 0x2630 .text + UnwindInfo: .rdata |
| 351E0 | 140002698 | .pdata | ExceptionHook | Pointer to 2698 - 0x2698 .text + UnwindInfo: .rdata |
| 351EC | 140002700 | .pdata | ExceptionHook | Pointer to 2700 - 0x2700 .text + UnwindInfo: .rdata |
| 351F8 | 140002760 | .pdata | ExceptionHook | Pointer to 2760 - 0x2760 .text + UnwindInfo: .rdata |
| 35204 | 1400027A4 | .pdata | ExceptionHook | Pointer to 27A4 - 0x27A4 .text + UnwindInfo: .rdata |
| 35210 | 1400027CC | .pdata | ExceptionHook | Pointer to 27CC - 0x27CC .text + UnwindInfo: .rdata |
| 3521C | 140002830 | .pdata | ExceptionHook | Pointer to 2830 - 0x2830 .text + UnwindInfo: .rdata |
| 35228 | 1400029F4 | .pdata | ExceptionHook | Pointer to 29F4 - 0x29F4 .text + UnwindInfo: .rdata |
| 35234 | 140002A5C | .pdata | ExceptionHook | Pointer to 2A5C - 0x2A5C .text + UnwindInfo: .rdata |
| 35240 | 140002AA3 | .pdata | ExceptionHook | Pointer to 2AA3 - 0x2AA3 .text + UnwindInfo: .rdata |
| 3524C | 140002B40 | .pdata | ExceptionHook | Pointer to 2B40 - 0x2B40 .text + UnwindInfo: .rdata |
| 35258 | 140002C5B | .pdata | ExceptionHook | Pointer to 2C5B - 0x2C5B .text + UnwindInfo: .rdata |
| 35264 | 140002CF8 | .pdata | ExceptionHook | Pointer to 2CF8 - 0x2CF8 .text + UnwindInfo: .rdata |
| 35270 | 140002E01 | .pdata | ExceptionHook | Pointer to 2E01 - 0x2E01 .text + UnwindInfo: .rdata |
| 3527C | 140002EB0 | .pdata | ExceptionHook | Pointer to 2EB0 - 0x2EB0 .text + UnwindInfo: .rdata |
| 35288 | 140002F50 | .pdata | ExceptionHook | Pointer to 2F50 - 0x2F50 .text + UnwindInfo: .rdata |
| 35294 | 140002F80 | .pdata | ExceptionHook | Pointer to 2F80 - 0x2F80 .text + UnwindInfo: .rdata |
| 352A0 | 140002FB0 | .pdata | ExceptionHook | Pointer to 2FB0 - 0x2FB0 .text + UnwindInfo: .rdata |
| 352AC | 140003030 | .pdata | ExceptionHook | Pointer to 3030 - 0x3030 .text + UnwindInfo: .rdata |
| 352B8 | 1400030E8 | .pdata | ExceptionHook | Pointer to 30E8 - 0x30E8 .text + UnwindInfo: .rdata |
| 352C4 | 14000312C | .pdata | ExceptionHook | Pointer to 312C - 0x312C .text + UnwindInfo: .rdata |
| 352D0 | 140003158 | .pdata | ExceptionHook | Pointer to 3158 - 0x3158 .text + UnwindInfo: .rdata |
| 352DC | 1400031D8 | .pdata | ExceptionHook | Pointer to 31D8 - 0x31D8 .text + UnwindInfo: .rdata |
| 352E8 | 14000329C | .pdata | ExceptionHook | Pointer to 329C - 0x329C .text + UnwindInfo: .rdata |
| 352F4 | 1400032F0 | .pdata | ExceptionHook | Pointer to 32F0 - 0x32F0 .text + UnwindInfo: .rdata |
| 35300 | 140003350 | .pdata | ExceptionHook | Pointer to 3350 - 0x3350 .text + UnwindInfo: .rdata |
| 3530C | 1400033AC | .pdata | ExceptionHook | Pointer to 33AC - 0x33AC .text + UnwindInfo: .rdata |
| 35318 | 140003624 | .pdata | ExceptionHook | Pointer to 3624 - 0x3624 .text + UnwindInfo: .rdata |
| 35324 | 1400038C8 | .pdata | ExceptionHook | Pointer to 38C8 - 0x38C8 .text + UnwindInfo: .rdata |
| 35330 | 140003AA4 | .pdata | ExceptionHook | Pointer to 3AA4 - 0x3AA4 .text + UnwindInfo: .rdata |
| 3533C | 140003B20 | .pdata | ExceptionHook | Pointer to 3B20 - 0x3B20 .text + UnwindInfo: .rdata |
| 35348 | 140003BA4 | .pdata | ExceptionHook | Pointer to 3BA4 - 0x3BA4 .text + UnwindInfo: .rdata |
| 35354 | 140003CDC | .pdata | ExceptionHook | Pointer to 3CDC - 0x3CDC .text + UnwindInfo: .rdata |
| 35360 | 140003DC4 | .pdata | ExceptionHook | Pointer to 3DC4 - 0x3DC4 .text + UnwindInfo: .rdata |
| 3536C | 140003FA0 | .pdata | ExceptionHook | Pointer to 3FA0 - 0x3FA0 .text + UnwindInfo: .rdata |
| 35378 | 140004008 | .pdata | ExceptionHook | Pointer to 4008 - 0x4008 .text + UnwindInfo: .rdata |
| 35384 | 1400040C8 | .pdata | ExceptionHook | Pointer to 40C8 - 0x40C8 .text + UnwindInfo: .rdata |
| 35390 | 140004180 | .pdata | ExceptionHook | Pointer to 4180 - 0x4180 .text + UnwindInfo: .rdata |
| 3539C | 1400041F0 | .pdata | ExceptionHook | Pointer to 41F0 - 0x41F0 .text + UnwindInfo: .rdata |
| 353A8 | 140004230 | .pdata | ExceptionHook | Pointer to 4230 - 0x4230 .text + UnwindInfo: .rdata |
| 353B4 | 140004264 | .pdata | ExceptionHook | Pointer to 4264 - 0x4264 .text + UnwindInfo: .rdata |
| 353C0 | 14000468C | .pdata | ExceptionHook | Pointer to 468C - 0x468C .text + UnwindInfo: .rdata |
| 353CC | 140004ACC | .pdata | ExceptionHook | Pointer to 4ACC - 0x4ACC .text + UnwindInfo: .rdata |
| 353D8 | 140004CB4 | .pdata | ExceptionHook | Pointer to 4CB4 - 0x4CB4 .text + UnwindInfo: .rdata |
| 353E4 | 140004D94 | .pdata | ExceptionHook | Pointer to 4D94 - 0x4D94 .text + UnwindInfo: .rdata |
| 353F0 | 140004E74 | .pdata | ExceptionHook | Pointer to 4E74 - 0x4E74 .text + UnwindInfo: .rdata |
| 353FC | 140004F24 | .pdata | ExceptionHook | Pointer to 4F24 - 0x4F24 .text + UnwindInfo: .rdata |
| 35408 | 140004F4C | .pdata | ExceptionHook | Pointer to 4F4C - 0x4F4C .text + UnwindInfo: .rdata |
| 35414 | 140005230 | .pdata | ExceptionHook | Pointer to 5230 - 0x5230 .text + UnwindInfo: .rdata |
| 35420 | 1400052B0 | .pdata | ExceptionHook | Pointer to 52B0 - 0x52B0 .text + UnwindInfo: .rdata |
| 3542C | 1400052E0 | .pdata | ExceptionHook | Pointer to 52E0 - 0x52E0 .text + UnwindInfo: .rdata |
| 35438 | 140005460 | .pdata | ExceptionHook | Pointer to 5460 - 0x5460 .text + UnwindInfo: .rdata |
| 35444 | 1400054A4 | .pdata | ExceptionHook | Pointer to 54A4 - 0x54A4 .text + UnwindInfo: .rdata |
| 35450 | 14000576C | .pdata | ExceptionHook | Pointer to 576C - 0x576C .text + UnwindInfo: .rdata |
| 3545C | 1400057D8 | .pdata | ExceptionHook | Pointer to 57D8 - 0x57D8 .text + UnwindInfo: .rdata |
| 35468 | 140005830 | .pdata | ExceptionHook | Pointer to 5830 - 0x5830 .text + UnwindInfo: .rdata |
| 35474 | 140005974 | .pdata | ExceptionHook | Pointer to 5974 - 0x5974 .text + UnwindInfo: .rdata |
| 35480 | 140005A6C | .pdata | ExceptionHook | Pointer to 5A6C - 0x5A6C .text + UnwindInfo: .rdata |
| 3548C | 140005B38 | .pdata | ExceptionHook | Pointer to 5B38 - 0x5B38 .text + UnwindInfo: .rdata |
| 35498 | 140005E90 | .pdata | ExceptionHook | Pointer to 5E90 - 0x5E90 .text + UnwindInfo: .rdata |
| 354A4 | 140005F6C | .pdata | ExceptionHook | Pointer to 5F6C - 0x5F6C .text + UnwindInfo: .rdata |
| 28000-28FFF | 28000 | fothk | Executable section anomaly, first bytes: CCCCCCCCCCCCCCCC |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 193870 | 53,7858% |
| Null Byte Code | 81927 | 22,7292% |
© 2026 All rights reserved.