PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,22 MB SHA-256 Hash: 654F33DE039DA0DE1797CDDB0E1DB8EE9E0AA65DB4D4C3881D888893D9987568 SHA-1 Hash: F63DE90D0FC5DE1A16D8A68F472E1F373B1BAE49 MD5 Hash: D5339A8DD02123502D2FE1337C828E2C Imphash: 3F175EDEA93FA7A76A78004D12DE2235 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): CFD74 SizeOfHeaders: 400 SizeOfImage: 145000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 127E50 ImportTable: 127EA8 IAT: FE000 Characteristics: 2022 TimeDateStamp: 6AC79D7E Date: 08/10/2026 13:41:18 File Type: DLL Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, _RDATA, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | FCC00 | 1000 | FCAF0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
FD000 | 2B400 | FE000 | 2B36E |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
128400 | 4400 | 12A000 | BBAC |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
12C800 | B000 | 136000 | AEF0 |
|
|
| _RDATA | 0x40000040 Initialized Data Readable |
137800 | 200 | 141000 | FC |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
137A00 | 200 | 142000 | F8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
137C00 | 1400 | 143000 | 126C |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - CF174 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8630300004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X1800CFD95 |CALL 0X1800D00F8 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> 86E5C944C284A717C284A717C284A717D6EFA316D684A717D6EFA416D284A717D6EFA2167384A71790F1A2168684A71790F1A316CD84A71790F1A416C884A717D6EFA616CF84A717C284A6170184A7170EF1AE16C684A7170EF1A716C384A7170EF15817C384A7170EF1A516C384A71752696368C284A717 Footprint md5 Hash -> 59018B67AC7C287C02A7961ECDD37B5B • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.29**)[-] • Entropy: 6.46693 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| ADVAPI32.DLL | CryptDecrypt | Performs a cryptographic operation on data in a data block. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| WININET.DLL | InternetConnectA | Opens an File Transfer Protocol (FTP) or HTTP session for a given site. |
| WININET.DLL | InternetOpenA | Initializes an application’s use of the WinINet functions. |
| WININET.DLL | InternetOpenW | Initializes an application’s use of the WinINet functions. |
| WININET.DLL | InternetReadFile | Reads data from an Internet resource. |
| ET Functions (carving) |
| Original Name -> STEALERDLL.dll Main Save |
| Windows REG |
| Software\Microsoft\Windows\Shell\MuiCache SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Thunderbird.exe SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched SOFTWARE\Martin Prikryl\WinSCP 2\Sessions SOFTWARE\Martin Prikryl\WinSCP 2\Sessions\ Software\Microsoft\Office Software\Microsoft\Windows Messaging Subsystem\Profiles Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache system\Profiles |
| File Access |
| monero-wallet-gui.exe WinSCP.exe SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Thunderbird.exe Thunderbird.exe SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe firefox.exe bcrypt.dll WININET.dll SHELL32.dll ADVAPI32.dll KERNEL32.dll CRYPT32.dll STEALERDLL.dll nss3.dll .dat @.dat WinSCP.ini ).zip Temp Exec - netsh wlan show profiles |
| File Access (UNICODE) |
| (null).exe mscoree.dll |
| SQL Queries |
| SELECT name, rootpage, sql FROM %q.%s WHERE %s ORDER BY rowid SELECT tbl,idx,stat FROM %Q.sqlite_stat1 SELECT name, rootpage, sql FROM %q.%s ORDER BY rowid SELECT CREATE TABLE vacuum_db. || substr(sql,14)FROM sqlite_master WHERE type=table AND name!=sqlite_sequenceAND coalesce(rootpage,1)>0 SELECT CREATE INDEX vacuum_db. || substr(sql,14) FROM sqlite_master WHERE sql LIKE CREATE INDEX % SELECT CREATE UNIQUE INDEX vacuum_db. || substr(sql,21)FROM sqlite_master WHERE sql LIKE CREATE UNIQUE INDEX % SELECT INSERT INTO vacuum_db. || quote(name) || SELECT * FROM main. || quote(name) || ;FROM main.sqlite_master WHERE type = table AND name!=sqlite_sequenceAND coalesce(rootpage,1)>0 SELECT DELETE FROM vacuum_db. || quote(name) || ; FROM vacuum_db.sqlite_master WHERE name=sqlite_sequence SELECT INSERT INTO vacuum_db. || quote(name) || SELECT * FROM main. || quote(name) || ; FROM vacuum_db.sqlite_master WHERE name==sqlite_sequence; SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_masterWHERE type=view OR type=trigger OR (type=table AND rootpage=0) INSERT INTO %Q.%s VALUES(index,%Q,%Q,%d,%Q); INSERT INTO %Q.%s VALUES(trigger,%Q,%Q,0,CREATE TRIGGER %q) INSERT INTO vacuum_db. || quote(name) || SELECT * FROM main. || quote(name) || ;FROM main.sqlite_master WHERE type = table AND name!=sqlite_sequenceAND coalesce(rootpage,1)>0 INSERT INTO vacuum_db. || quote(name) || SELECT * FROM main. || quote(name) || ; FROM vacuum_db.sqlite_master WHERE name==sqlite_sequence; INSERT INTO vacuum_db.sqlite_masterSELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_masterWHERE type=view OR type=trigger OR (type=table AND rootpage=0) CREATE TABLE %Q.%s(%s) CREATE TABLE CREATE TABLE %Q.sqlite_sequence(name,seq) CREATE TABLE vacuum_db. || substr(sql,14)FROM sqlite_master WHERE type=table AND name!=sqlite_sequenceAND coalesce(rootpage,1)>0 CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text) DROP TABLE to delete table %s DELETE FROM %Q.%s WHERE %s=%Q DELETE FROM %Q.sqlite_sequence WHERE name=%Q DELETE FROM %Q.%s WHERE tbl_name=%Q and type!=trigger DELETE FROM %Q.%s WHERE name=%Q AND type=index DELETE FROM vacuum_db. || quote(name) || ; FROM vacuum_db.sqlite_master WHERE name=sqlite_sequence |
| Interest's Words |
| outlook smtp Stealer Encrypt Decrypt PassWord exec powershell netsh attrib start hostname shutdown systeminfo ping replace |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Encryption (Base64Decode) |
| Text | Ascii | Threat designed to steal sensitive information from a system (Stealer) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Ascii | Abuse of power for personal gain or unethical purposes (Corruption) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 142060 | 91 | 137A60 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • .exe • .cmd • .bat • .com • mscoree.dll • 3.8.7.4 • _*.cab • makecab /F • \logins.json • nss3.dll • firefox.exe • Thunderbird.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Thunderbird.exe • .purple\accounts.xml • \.purple\accounts.xml • im|Psi|Psi\profiles\default\accounts.xml • WinSCP.ini • WinSCP.exe • FileZilla\sitemanager.xml • .xml • netsh wlan show profiles • Monero\wallets\).zip • monero-wallet-gui.exe • D:\NewA\StealerDLL\Release.x64\STEALERDLL.pdb • .bss • KERNEL32.dll • bcrypt.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 23AE | N/A | .text | CALL QWORD PTR [RIP+0x128014] |
| 24C2 | N/A | .text | CALL QWORD PTR [RIP+0x127F58] |
| 24CD | N/A | .text | CALL QWORD PTR [RIP+0x127EAD] |
| 25C7 | N/A | .text | CALL QWORD PTR [RIP+0x127DBB] |
| 25E6 | N/A | .text | CALL QWORD PTR [RIP+0x127D94] |
| 25F4 | N/A | .text | CALL QWORD PTR [RIP+0x127D86] |
| 2602 | N/A | .text | CALL QWORD PTR [RIP+0x127D78] |
| 2610 | N/A | .text | CALL QWORD PTR [RIP+0x127D6A] |
| 27F9 | N/A | .text | CALL QWORD PTR [RIP+0x127BD9] |
| 47E6 | N/A | .text | CALL QWORD PTR [RIP+0x125BCC] |
| 47F7 | N/A | .text | CALL QWORD PTR [RIP+0x125BCB] |
| 4848 | N/A | .text | CALL QWORD PTR [RIP+0x125B8A] |
| 48A2 | N/A | .text | CALL QWORD PTR [RIP+0x125B10] |
| 48B3 | N/A | .text | CALL QWORD PTR [RIP+0x125B0F] |
| 4931 | N/A | .text | CALL QWORD PTR [RIP+0x125AA1] |
| 496F | N/A | .text | CALL QWORD PTR [RIP+0x125A43] |
| 4980 | N/A | .text | CALL QWORD PTR [RIP+0x125A42] |
| 49D9 | N/A | .text | CALL QWORD PTR [RIP+0x1259F9] |
| 4B06 | N/A | .text | JMP QWORD PTR [RIP+0x1258AC] |
| 4B16 | N/A | .text | JMP QWORD PTR [RIP+0x1258A4] |
| 4B26 | N/A | .text | JMP QWORD PTR [RIP+0x12589C] |
| 4B36 | N/A | .text | JMP QWORD PTR [RIP+0x125894] |
| 4B46 | N/A | .text | JMP QWORD PTR [RIP+0x12588C] |
| 4B93 | N/A | .text | CALL QWORD PTR [RIP+0xF8B47] |
| 4BC5 | N/A | .text | CALL QWORD PTR [RIP+0x125E55] |
| 4C17 | N/A | .text | CALL QWORD PTR [RIP+0xF899B] |
| 4C92 | N/A | .text | CALL QWORD PTR [RIP+0xF8A48] |
| 4CB9 | N/A | .text | CALL QWORD PTR [RIP+0xF88F9] |
| 4CD1 | N/A | .text | JMP QWORD PTR [RIP+0xF8A41] |
| 4D03 | N/A | .text | CALL QWORD PTR [RIP+0xF8A27] |
| 4D21 | N/A | .text | JMP QWORD PTR [RIP+0xF89C1] |
| 4D60 | N/A | .text | CALL QWORD PTR [RIP+0x125662] |
| 4D79 | N/A | .text | CALL QWORD PTR [RIP+0x125659] |
| 4D92 | N/A | .text | CALL QWORD PTR [RIP+0x125630] |
| 4DD1 | N/A | .text | CALL QWORD PTR [RIP+0x1255F1] |
| 4E00 | N/A | .text | CALL QWORD PTR [RIP+0x1255D2] |
| 4EA7 | N/A | .text | CALL QWORD PTR [RIP+0x12552B] |
| 4EC9 | N/A | .text | CALL QWORD PTR [RIP+0x1254F9] |
| 4F27 | N/A | .text | CALL QWORD PTR [RIP+0x12549B] |
| 4F2F | N/A | .text | CALL QWORD PTR [RIP+0x125453] |
| 4FA7 | N/A | .text | CALL QWORD PTR [RIP+0x12542B] |
| 4FC4 | N/A | .text | CALL QWORD PTR [RIP+0x1253FE] |
| 4FF0 | N/A | .text | CALL QWORD PTR [RIP+0x125372] |
| 5006 | N/A | .text | CALL QWORD PTR [RIP+0x125374] |
| 5056 | N/A | .text | CALL QWORD PTR [RIP+0x12537C] |
| 506B | N/A | .text | JMP QWORD PTR [RIP+0x1252F7] |
| 50F8 | N/A | .text | CALL QWORD PTR [RIP+0x1252CA] |
| 516E | N/A | .text | CALL QWORD PTR [RIP+0x125264] |
| 5185 | N/A | .text | CALL QWORD PTR [RIP+0x12524D] |
| 51B0 | N/A | .text | CALL QWORD PTR [RIP+0x125212] |
| 51B9 | N/A | .text | CALL QWORD PTR [RIP+0x1251C1] |
| 522F | N/A | .text | CALL QWORD PTR [RIP+0x125193] |
| 5281 | N/A | .text | JMP QWORD PTR [RIP+0x125151] |
| 5299 | N/A | .text | CALL QWORD PTR [RIP+0x1250E1] |
| 52AD | N/A | .text | CALL QWORD PTR [RIP+0x125115] |
| 5313 | N/A | .text | CALL QWORD PTR [RIP+0x125057] |
| 5330 | N/A | .text | JMP QWORD PTR [RIP+0x1250A2] |
| 5336 | N/A | .text | CALL QWORD PTR [RIP+0x125034] |
| 5351 | N/A | .text | JMP QWORD PTR [RIP+0x125029] |
| 5364 | N/A | .text | CALL QWORD PTR [RIP+0x125016] |
| 53A6 | N/A | .text | CALL QWORD PTR [RIP+0x12501C] |
| 53AF | N/A | .text | CALL QWORD PTR [RIP+0x124FCB] |
| 53F8 | N/A | .text | CALL QWORD PTR [RIP+0x124F72] |
| 5410 | N/A | .text | JMP QWORD PTR [RIP+0x124FC2] |
| 5416 | N/A | .text | CALL QWORD PTR [RIP+0x124F54] |
| 5469 | N/A | .text | CALL QWORD PTR [RIP+0x124F11] |
| 551B | N/A | .text | CALL QWORD PTR [RIP+0x124E5F] |
| 5526 | N/A | .text | CALL QWORD PTR [RIP+0x124E5C] |
| 5561 | N/A | .text | CALL QWORD PTR [RIP+0x124E61] |
| 55CF | N/A | .text | CALL QWORD PTR [RIP+0x124E03] |
| 55EC | N/A | .text | CALL QWORD PTR [RIP+0x124DD6] |
| 560A | N/A | .text | CALL QWORD PTR [RIP+0x124D68] |
| 5637 | N/A | .text | CALL QWORD PTR [RIP+0x124D3B] |
| 5648 | N/A | .text | CALL QWORD PTR [RIP+0x124D32] |
| 567C | N/A | .text | CALL QWORD PTR [RIP+0x124D56] |
| 5689 | N/A | .text | CALL QWORD PTR [RIP+0x124CE9] |
| 7A87 | N/A | .text | CALL QWORD PTR [RIP+0x122A3B] |
| 7B09 | N/A | .text | CALL QWORD PTR [RIP+0x1228A9] |
| 7B1A | N/A | .text | CALL QWORD PTR [RIP+0x1228A8] |
| 7B7D | N/A | .text | CALL QWORD PTR [RIP+0x122835] |
| 7B8E | N/A | .text | CALL QWORD PTR [RIP+0x122834] |
| 7B9E | N/A | .text | CALL QWORD PTR [RIP+0x122834] |
| 7CA6 | N/A | .text | CALL QWORD PTR [RIP+0x12272C] |
| 8210 | N/A | .text | CALL QWORD PTR [RIP+0x12216A] |
| 9671 | N/A | .text | CALL QWORD PTR [RIP+0x120D09] |
| 9D78 | N/A | .text | CALL QWORD PTR [RIP+0x120C2A] |
| 9DC1 | N/A | .text | CALL QWORD PTR [RIP+0x120BE1] |
| 9E3D | N/A | .text | CALL QWORD PTR [RIP+0x120C55] |
| 9E88 | N/A | .text | CALL QWORD PTR [RIP+0x120C0A] |
| 9F05 | N/A | .text | CALL QWORD PTR [RIP+0x120755] |
| 9F3E | N/A | .text | CALL QWORD PTR [RIP+0x120A04] |
| A09D | N/A | .text | CALL QWORD PTR [RIP+0x12049D] |
| A0B3 | N/A | .text | CALL QWORD PTR [RIP+0x120967] |
| A0BD | N/A | .text | CALL QWORD PTR [RIP+0x12047D] |
| A0DD | N/A | .text | CALL QWORD PTR [RIP+0x120685] |
| A1E9 | N/A | .text | CALL QWORD PTR [RIP+0x1207E9] |
| A1F3 | N/A | .text | CALL QWORD PTR [RIP+0x12056F] |
| A1FE | N/A | .text | CALL QWORD PTR [RIP+0x120564] |
| A230 | N/A | .text | CALL QWORD PTR [RIP+0x1207EA] |
| A379 | N/A | .text | CALL QWORD PTR [RIP+0x120731] |
| 12C800 | 180001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 12C80C | 180001030 | .pdata | ExceptionHook | Pointer to 1030 - 0x430 .text + UnwindInfo: .rdata |
| 12C818 | 180001060 | .pdata | ExceptionHook | Pointer to 1060 - 0x460 .text + UnwindInfo: .rdata |
| 12C824 | 180001090 | .pdata | ExceptionHook | Pointer to 1090 - 0x490 .text + UnwindInfo: .rdata |
| 12C830 | 1800010C0 | .pdata | ExceptionHook | Pointer to 10C0 - 0x4C0 .text + UnwindInfo: .rdata |
| 12C83C | 1800010F0 | .pdata | ExceptionHook | Pointer to 10F0 - 0x4F0 .text + UnwindInfo: .rdata |
| 12C848 | 180001120 | .pdata | ExceptionHook | Pointer to 1120 - 0x520 .text + UnwindInfo: .rdata |
| 12C854 | 180001150 | .pdata | ExceptionHook | Pointer to 1150 - 0x550 .text + UnwindInfo: .rdata |
| 12C860 | 180001180 | .pdata | ExceptionHook | Pointer to 1180 - 0x580 .text + UnwindInfo: .rdata |
| 12C86C | 1800011B0 | .pdata | ExceptionHook | Pointer to 11B0 - 0x5B0 .text + UnwindInfo: .rdata |
| 12C878 | 1800011E0 | .pdata | ExceptionHook | Pointer to 11E0 - 0x5E0 .text + UnwindInfo: .rdata |
| 12C884 | 180001210 | .pdata | ExceptionHook | Pointer to 1210 - 0x610 .text + UnwindInfo: .rdata |
| 12C890 | 180001240 | .pdata | ExceptionHook | Pointer to 1240 - 0x640 .text + UnwindInfo: .rdata |
| 12C89C | 180001270 | .pdata | ExceptionHook | Pointer to 1270 - 0x670 .text + UnwindInfo: .rdata |
| 12C8A8 | 1800012A0 | .pdata | ExceptionHook | Pointer to 12A0 - 0x6A0 .text + UnwindInfo: .rdata |
| 12C8B4 | 1800012D0 | .pdata | ExceptionHook | Pointer to 12D0 - 0x6D0 .text + UnwindInfo: .rdata |
| 12C8C0 | 180001300 | .pdata | ExceptionHook | Pointer to 1300 - 0x700 .text + UnwindInfo: .rdata |
| 12C8CC | 180001330 | .pdata | ExceptionHook | Pointer to 1330 - 0x730 .text + UnwindInfo: .rdata |
| 12C8D8 | 180001360 | .pdata | ExceptionHook | Pointer to 1360 - 0x760 .text + UnwindInfo: .rdata |
| 12C8E4 | 180001390 | .pdata | ExceptionHook | Pointer to 1390 - 0x790 .text + UnwindInfo: .rdata |
| 12C8F0 | 1800013C0 | .pdata | ExceptionHook | Pointer to 13C0 - 0x7C0 .text + UnwindInfo: .rdata |
| 12C8FC | 1800013F0 | .pdata | ExceptionHook | Pointer to 13F0 - 0x7F0 .text + UnwindInfo: .rdata |
| 12C908 | 180001420 | .pdata | ExceptionHook | Pointer to 1420 - 0x820 .text + UnwindInfo: .rdata |
| 12C914 | 180001450 | .pdata | ExceptionHook | Pointer to 1450 - 0x850 .text + UnwindInfo: .rdata |
| 12C920 | 180001480 | .pdata | ExceptionHook | Pointer to 1480 - 0x880 .text + UnwindInfo: .rdata |
| 12C92C | 1800014B0 | .pdata | ExceptionHook | Pointer to 14B0 - 0x8B0 .text + UnwindInfo: .rdata |
| 12C938 | 1800014E0 | .pdata | ExceptionHook | Pointer to 14E0 - 0x8E0 .text + UnwindInfo: .rdata |
| 12C944 | 180001510 | .pdata | ExceptionHook | Pointer to 1510 - 0x910 .text + UnwindInfo: .rdata |
| 12C950 | 180001540 | .pdata | ExceptionHook | Pointer to 1540 - 0x940 .text + UnwindInfo: .rdata |
| 12C95C | 180001570 | .pdata | ExceptionHook | Pointer to 1570 - 0x970 .text + UnwindInfo: .rdata |
| 12C968 | 1800015A0 | .pdata | ExceptionHook | Pointer to 15A0 - 0x9A0 .text + UnwindInfo: .rdata |
| 12C974 | 1800015D0 | .pdata | ExceptionHook | Pointer to 15D0 - 0x9D0 .text + UnwindInfo: .rdata |
| 12C980 | 180001600 | .pdata | ExceptionHook | Pointer to 1600 - 0xA00 .text + UnwindInfo: .rdata |
| 12C98C | 180001630 | .pdata | ExceptionHook | Pointer to 1630 - 0xA30 .text + UnwindInfo: .rdata |
| 12C998 | 180001660 | .pdata | ExceptionHook | Pointer to 1660 - 0xA60 .text + UnwindInfo: .rdata |
| 12C9A4 | 180001690 | .pdata | ExceptionHook | Pointer to 1690 - 0xA90 .text + UnwindInfo: .rdata |
| 12C9B0 | 1800016C0 | .pdata | ExceptionHook | Pointer to 16C0 - 0xAC0 .text + UnwindInfo: .rdata |
| 12C9BC | 1800016F0 | .pdata | ExceptionHook | Pointer to 16F0 - 0xAF0 .text + UnwindInfo: .rdata |
| 12C9C8 | 180001720 | .pdata | ExceptionHook | Pointer to 1720 - 0xB20 .text + UnwindInfo: .rdata |
| 12C9D4 | 180001750 | .pdata | ExceptionHook | Pointer to 1750 - 0xB50 .text + UnwindInfo: .rdata |
| 12C9E0 | 180001780 | .pdata | ExceptionHook | Pointer to 1780 - 0xB80 .text + UnwindInfo: .rdata |
| 12C9EC | 1800017B0 | .pdata | ExceptionHook | Pointer to 17B0 - 0xBB0 .text + UnwindInfo: .rdata |
| 12C9F8 | 1800017E0 | .pdata | ExceptionHook | Pointer to 17E0 - 0xBE0 .text + UnwindInfo: .rdata |
| 12CA04 | 180001810 | .pdata | ExceptionHook | Pointer to 1810 - 0xC10 .text + UnwindInfo: .rdata |
| 12CA10 | 180001840 | .pdata | ExceptionHook | Pointer to 1840 - 0xC40 .text + UnwindInfo: .rdata |
| 12CA1C | 180001870 | .pdata | ExceptionHook | Pointer to 1870 - 0xC70 .text + UnwindInfo: .rdata |
| 12CA28 | 1800018A0 | .pdata | ExceptionHook | Pointer to 18A0 - 0xCA0 .text + UnwindInfo: .rdata |
| 12CA34 | 1800018D0 | .pdata | ExceptionHook | Pointer to 18D0 - 0xCD0 .text + UnwindInfo: .rdata |
| 12CA40 | 180001900 | .pdata | ExceptionHook | Pointer to 1900 - 0xD00 .text + UnwindInfo: .rdata |
| 12CA4C | 180001930 | .pdata | ExceptionHook | Pointer to 1930 - 0xD30 .text + UnwindInfo: .rdata |
| 12CA58 | 180001960 | .pdata | ExceptionHook | Pointer to 1960 - 0xD60 .text + UnwindInfo: .rdata |
| 12CA64 | 180001990 | .pdata | ExceptionHook | Pointer to 1990 - 0xD90 .text + UnwindInfo: .rdata |
| 12CA70 | 1800019C0 | .pdata | ExceptionHook | Pointer to 19C0 - 0xDC0 .text + UnwindInfo: .rdata |
| 12CA7C | 1800019F0 | .pdata | ExceptionHook | Pointer to 19F0 - 0xDF0 .text + UnwindInfo: .rdata |
| 12CA88 | 180001A20 | .pdata | ExceptionHook | Pointer to 1A20 - 0xE20 .text + UnwindInfo: .rdata |
| 12CA94 | 180001A50 | .pdata | ExceptionHook | Pointer to 1A50 - 0xE50 .text + UnwindInfo: .rdata |
| 12CAA0 | 180001A80 | .pdata | ExceptionHook | Pointer to 1A80 - 0xE80 .text + UnwindInfo: .rdata |
| 12CAAC | 180001AB0 | .pdata | ExceptionHook | Pointer to 1AB0 - 0xEB0 .text + UnwindInfo: .rdata |
| 12CAB8 | 180001AE0 | .pdata | ExceptionHook | Pointer to 1AE0 - 0xEE0 .text + UnwindInfo: .rdata |
| 12CAC4 | 180001B10 | .pdata | ExceptionHook | Pointer to 1B10 - 0xF10 .text + UnwindInfo: .rdata |
| 12CAD0 | 180001B40 | .pdata | ExceptionHook | Pointer to 1B40 - 0xF40 .text + UnwindInfo: .rdata |
| 12CADC | 180001B70 | .pdata | ExceptionHook | Pointer to 1B70 - 0xF70 .text + UnwindInfo: .rdata |
| 12CAE8 | 180001BA0 | .pdata | ExceptionHook | Pointer to 1BA0 - 0xFA0 .text + UnwindInfo: .rdata |
| 12CAF4 | 180001BD0 | .pdata | ExceptionHook | Pointer to 1BD0 - 0xFD0 .text + UnwindInfo: .rdata |
| 12CB00 | 180001C00 | .pdata | ExceptionHook | Pointer to 1C00 - 0x1000 .text + UnwindInfo: .rdata |
| 12CB0C | 180001C30 | .pdata | ExceptionHook | Pointer to 1C30 - 0x1030 .text + UnwindInfo: .rdata |
| 12CB18 | 180001C60 | .pdata | ExceptionHook | Pointer to 1C60 - 0x1060 .text + UnwindInfo: .rdata |
| 12CB24 | 180001C90 | .pdata | ExceptionHook | Pointer to 1C90 - 0x1090 .text + UnwindInfo: .rdata |
| 12CB30 | 180001CC0 | .pdata | ExceptionHook | Pointer to 1CC0 - 0x10C0 .text + UnwindInfo: .rdata |
| 12CB3C | 180001CF0 | .pdata | ExceptionHook | Pointer to 1CF0 - 0x10F0 .text + UnwindInfo: .rdata |
| 12CB48 | 180001D20 | .pdata | ExceptionHook | Pointer to 1D20 - 0x1120 .text + UnwindInfo: .rdata |
| 12CB54 | 180001D50 | .pdata | ExceptionHook | Pointer to 1D50 - 0x1150 .text + UnwindInfo: .rdata |
| 12CB60 | 180001D80 | .pdata | ExceptionHook | Pointer to 1D80 - 0x1180 .text + UnwindInfo: .rdata |
| 12CB6C | 180001DB0 | .pdata | ExceptionHook | Pointer to 1DB0 - 0x11B0 .text + UnwindInfo: .rdata |
| 12CB78 | 180001DE0 | .pdata | ExceptionHook | Pointer to 1DE0 - 0x11E0 .text + UnwindInfo: .rdata |
| 12CB84 | 180001E10 | .pdata | ExceptionHook | Pointer to 1E10 - 0x1210 .text + UnwindInfo: .rdata |
| 12CB90 | 180001E40 | .pdata | ExceptionHook | Pointer to 1E40 - 0x1240 .text + UnwindInfo: .rdata |
| 12CB9C | 180001E70 | .pdata | ExceptionHook | Pointer to 1E70 - 0x1270 .text + UnwindInfo: .rdata |
| 12CBA8 | 180001EA0 | .pdata | ExceptionHook | Pointer to 1EA0 - 0x12A0 .text + UnwindInfo: .rdata |
| 12CBB4 | 180001ED0 | .pdata | ExceptionHook | Pointer to 1ED0 - 0x12D0 .text + UnwindInfo: .rdata |
| 12CBC0 | 180001F00 | .pdata | ExceptionHook | Pointer to 1F00 - 0x1300 .text + UnwindInfo: .rdata |
| 12CBCC | 180001F30 | .pdata | ExceptionHook | Pointer to 1F30 - 0x1330 .text + UnwindInfo: .rdata |
| 12CBD8 | 180001F60 | .pdata | ExceptionHook | Pointer to 1F60 - 0x1360 .text + UnwindInfo: .rdata |
| 12CBE4 | 180001F90 | .pdata | ExceptionHook | Pointer to 1F90 - 0x1390 .text + UnwindInfo: .rdata |
| 12CBF0 | 180001FC0 | .pdata | ExceptionHook | Pointer to 1FC0 - 0x13C0 .text + UnwindInfo: .rdata |
| 12CBFC | 180001FF0 | .pdata | ExceptionHook | Pointer to 1FF0 - 0x13F0 .text + UnwindInfo: .rdata |
| 12CC08 | 180002020 | .pdata | ExceptionHook | Pointer to 2020 - 0x1420 .text + UnwindInfo: .rdata |
| 12CC14 | 180002050 | .pdata | ExceptionHook | Pointer to 2050 - 0x1450 .text + UnwindInfo: .rdata |
| 12CC20 | 180002080 | .pdata | ExceptionHook | Pointer to 2080 - 0x1480 .text + UnwindInfo: .rdata |
| 12CC2C | 1800020B0 | .pdata | ExceptionHook | Pointer to 20B0 - 0x14B0 .text + UnwindInfo: .rdata |
| 12CC38 | 1800020E0 | .pdata | ExceptionHook | Pointer to 20E0 - 0x14E0 .text + UnwindInfo: .rdata |
| 12CC44 | 180002110 | .pdata | ExceptionHook | Pointer to 2110 - 0x1510 .text + UnwindInfo: .rdata |
| 12CC50 | 180002140 | .pdata | ExceptionHook | Pointer to 2140 - 0x1540 .text + UnwindInfo: .rdata |
| 12CC5C | 180002170 | .pdata | ExceptionHook | Pointer to 2170 - 0x1570 .text + UnwindInfo: .rdata |
| 12CC68 | 1800021A0 | .pdata | ExceptionHook | Pointer to 21A0 - 0x15A0 .text + UnwindInfo: .rdata |
| 12CC74 | 1800021D0 | .pdata | ExceptionHook | Pointer to 21D0 - 0x15D0 .text + UnwindInfo: .rdata |
| 12CC80 | 180002200 | .pdata | ExceptionHook | Pointer to 2200 - 0x1600 .text + UnwindInfo: .rdata |
| 12CC8C | 180002230 | .pdata | ExceptionHook | Pointer to 2230 - 0x1630 .text + UnwindInfo: .rdata |
| 12CC98 | 180002260 | .pdata | ExceptionHook | Pointer to 2260 - 0x1660 .text + UnwindInfo: .rdata |
| 12CCA4 | 180002290 | .pdata | ExceptionHook | Pointer to 2290 - 0x1690 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 800451 | 62,4353% |
| Null Byte Code | 193842 | 15,1197% |
© 2026 All rights reserved.