PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 3,39 MB SHA-256 Hash: 1665D4E1DBC57B60224C8C0F599E16FA022C4B0201C6FB65762E5CB7F18E3EE4 SHA-1 Hash: 339EB325D969C68C10304597538DC0C50A842743 MD5 Hash: F3B0B20A3A9B23BFBBCAF0FFFECB1ECE Imphash: 5F2665CAC9EDEA1A8368FE318C6E01EF MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 169584 SizeOfHeaders: 400 SizeOfImage: 36D000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 2A3EC4 IAT: 16F000 Characteristics: 22 TimeDateStamp: 6843461D Date: 06/06/2025 19:48:45 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 16D600 | 1000 | 16D453 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
16DA00 | 139000 | 16F000 | 138E24 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
2A6A00 | AE200 | 2A8000 | B2BE8 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
354C00 | EC00 | 35B000 | EB50 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
363800 | 200 | 36A000 | 1E8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
363A00 | 1400 | 36B000 | 1348 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 168984 Code -> 4883EC28E83F0600004883C428E97AFEFFFFCCCC4883EC284D8B4138488BCA498BD1E80D000000B8010000004883C428C3CC Assembler |SUB RSP, 0X28 |CALL 0X140169BCC |ADD RSP, 0X28 |JMP 0X140169410 |INT3 |INT3 |SUB RSP, 0X28 |MOV R8, QWORD PTR [R9 + 0X38] |MOV RCX, RDX |MOV RDX, R9 |CALL 0X1401695B8 |MOV EAX, 1 |ADD RSP, 0X28 |RET |INT3 |
| Signatures |
| Rich Signature Analyzer: Code -> E283CABEA6E2A4EDA6E2A4EDA6E2A4EDAF9A37EDBEE2A4EDC06A59EDAFE2A4EDC06AA7ECA2E2A4EDC06AA0ECACE2A4EDC06AA1EC83E2A4EDC06AA5ECA0E2A4ED2092A0ECCFE2A4ED259BA0ECBCE2A4EDD263A5ECBAE2A4ED74B038EDAFE2A4EDA6E2A5EDBFE0A4ED216BADECB5E2A4ED216B5BEDA7E2A4ED216BA6ECA7E2A4ED52696368A6E2A4ED Footprint md5 Hash -> 704886052E00103B2EEE6F5F19AB9B7E • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 6.96524 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| ADVAPI32.DLL | CryptAcquireContextA | Acquires a cryptographic provider context. |
| ADVAPI32.DLL | CryptReleaseContext | Releases a cryptographic provider context. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| KERNEL32.DLL | VirtualAllocEx | Allocates memory within the virtual address space of another process. |
| KERNEL32.DLL | VirtualProtectEx | Changes the protection on a region of memory in another process. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | recv | Receives data from a network socket. |
| URLMON.DLL | URLDownloadToFileA | Download a file from the internet and save it to a local file. |
| ADVAPI32.DLL | CryptEncrypt | Performs a cryptographic operation on data in a data block. |
| ADVAPI32.DLL | RegGetValueA | Reads data from a registry value. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| File Access |
| //95.214.24.117/svchost2.exe \svchost2.exe \svchost.exe //95.214.24.117/svchost.exe api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll api-ms-win-crt-multibyte-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-filesystem-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-utility-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll VCRUNTIME140.dll VCRUNTIME140_1.dll dwmapi.dll D3DCOMPILER_43.dll IMM32.dll urlmon.dll ntdll.dll WLDAP32.dll CRYPT32.dll Normaliz.dll WS2_32.dll MSVCP140.dll ole32.dll SHELL32.dll ADVAPI32.dll USER32.dll KERNEL32.dll d3d11.dll d3dx11_43.dll d3dx9_43.dll xinput1_1.dll xinput1_3.dll xinput1_4.dll xinput1_2.dll xinput9_1_0.dll secur32.dll security.dll failed to load WS2_32.DLL iphlpapi.dll .dat @.dat imgui_log.txt .txt Failed to open CitizenFX.ini imgui.ini Temp |
| File Access (UNICODE) |
| FiveM_GameProcess.exe FiveM_b\d{4}_GTAProcess\.exe FiveM_GTAProcess.exe FiveM_b\d{4}_GameProcess\.exe app\CitizenFX.ini Temp AppData |
| Interest's Words |
| rcpt to: smtp Encrypt Decrypt Encryption PassWord exec attrib start pause cipher hostname shutdown ping replace |
| URLs |
| http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt http://www.microsoft.com/pkiops/docs/primarycps.htm http://www.microsoft.com/Typography http://95.214.24.117/svchost.exe http://95.214.24.117/svchost2.exe https://curl.haxx.se/docs/http-cookies.html ftp://%s:%s@%s |
| URLs (UNICODE) |
| http://scripts.sil.org/OFLThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFLThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFL https://github.com/itfoundry/Poppins) https://github.com/EkType/Baloo2) |
| IP Addresses |
| 127.0.0.1 2.5.29.17 2.5.4.10 2.5.4.11 2.5.4.12 2.5.4.13 2.5.4.17 2.5.4.41 2.5.4.42 2.5.4.43 2.5.4.44 2.5.4.45 2.5.4.46 2.5.4.65 2.5.4.72 2.5.29.18 2.5.29.19 95.214.24.117 |
| Known IP/Domains |
| Google DNS - 8.8.8.8 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Unicode escape - \u00 - (Common Unicode escape sequences) |
| Text | Ascii | Encryption (Microsoft Unified Security Protocol Provider) |
| Text | Ascii | Privileges (SeTcbPrivilege) |
| Text | Ascii | Keyboard Key (Left Windows) |
| Text | Ascii | Keyboard Key (Right Windows) |
| Text | Ascii | Keyboard Key (Right Shift) |
| Text | Ascii | Keyboard Key (Page Down) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (Num Lock) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Threat focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\1\1033 | 36A060 | 188 | 363860 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-convert-l1-1-0.dll • api-ms-win-crt-utility-l1-1-0.dll • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • xinput1_2.dll • xinput9_1_0.dll • %s.%s.tmp • https://curl.haxx.se/docs/http-cookies.html • .gif • .jpg • .png • .svg • .txt • .htm • application/pdf.xml • %s://%sfile • iphlpapi.dll • LOGIN %s %s • failed to resume file:// transfer • WS2_32.DLL • file://%s%s%s • machinelogin • Couldnt read a file:// file • Login denied • security.dll • secur32.dll • 2.5.29.17 • 2.5.4.10 • 2.5.4.11 • 2.5.4.12 • 2.5.4.13 • 2.5.4.17 • 2.5.4.41 • 2.5.4.42 • 2.5.4.43 • 2.5.4.44 • 2.5.4.45 • 2.5.4.46 • 2.5.4.65 • 2.5.4.72 • 2.5.29.18 • 2.5.29.19 • LOGIN • .cfg • invalid string: control character U+0000 (NUL) must be escaped to \u0000 • invalid string: control character U+0002 (STX) must be escaped to \u0002 • invalid string: control character U+0001 (SOH) must be escaped to \u0001 • invalid string: control character U+0004 (EOT) must be escaped to \u0004 • invalid string: control character U+0003 (ETX) must be escaped to \u0003 • invalid string: control character U+0006 (ACK) must be escaped to \u0006 • invalid string: control character U+0005 (ENQ) must be escaped to \u0005 • invalid string: control character U+0008 (BS) must be escaped to \u0008 or \b • invalid string: control character U+0007 (BEL) must be escaped to \u0007 • invalid string: control character U+000A (LF) must be escaped to \u000A or \n • invalid string: control character U+0009 (HT) must be escaped to \u0009 or \t • invalid string: control character U+000C (FF) must be escaped to \u000C or \f • invalid string: control character U+000B (VT) must be escaped to \u000B • invalid string: control character U+000E (SO) must be escaped to \u000E • invalid string: control character U+000D (CR) must be escaped to \u000D or \r • invalid string: control character U+0010 (DLE) must be escaped to \u0010 • invalid string: control character U+000F (SI) must be escaped to \u000F • invalid string: control character U+0012 (DC2) must be escaped to \u0012 • invalid string: control character U+0011 (DC1) must be escaped to \u0011 • invalid string: control character U+0014 (DC4) must be escaped to \u0014 • invalid string: control character U+0013 (DC3) must be escaped to \u0013 • invalid string: control character U+0016 (SYN) must be escaped to \u0016 • invalid string: control character U+0015 (NAK) must be escaped to \u0015 • invalid string: control character U+0018 (CAN) must be escaped to \u0018 • invalid string: control character U+0017 (ETB) must be escaped to \u0017 • invalid string: control character U+001A (SUB) must be escaped to \u001A • invalid string: control character U+0019 (EM) must be escaped to \u0019 • invalid string: control character U+001C (FS) must be escaped to \u001C • invalid string: control character U+001B (ESC) must be escaped to \u001B • invalid string: control character U+001E (RS) must be escaped to \u001E • invalid string: control character U+001D (GS) must be escaped to \u001Dinvalid string: ill-formed UTF-8 byte • invalid string: control character U+001F (US) must be escaped to \u001Fvector<bool> too long • 8A8A8A8A8A8A8A553>636377*@F632410=7R"6..O=3AT?;343)3266A<@.3)11))22*,3CrhZYL-bUL70"A2<3<3<3<3<307070TQ=3=36.A2A21)rhZ=3\3=370704040""A2A29!9!<3<3.(>3:613)70A2A2A2A25.222220333**330B**:1332.8333"$3MMM3342HC2!!!!! //)2253:3.D.*)3))****A0124%.&3**QP[=2DJ:3-433>K>2C2A27*0*91F5OM:3:23388A3+&23*A**iC?4N@7.K@H9]M1*IBA2B9B9jZO=VFiC7*. • I:\ND47*6+K<:2L:L:"RC7.>3>4>4:2G;7070TQ40A0RC1*1)>4>4A2A27+5.5.5.:2I@63TQSL6.\R\R=2D>222222UY!28A • 2003 & 2007, Ralph Hancock & John Hudson. This layout logic for Biblical Hebrew is open source software under the MIT License; see embedded license description for details.TahomaRegularMicrosoft Tahoma RegularVersion 7.00Tahoma is a trademark of the Microsoft group of companies.Matthew Carterhttp://www.microsoft.com/typographyMicrosoft supplied font. You may use this font to create, display, and print content as permitted by the license terms or terms of use, of the Microsoft product, service, or content in which this font was included. You may only (i) embed this font in content as permitted by the embedding restrictions included in this font; and (ii) temporarily download this font to a printer or other output device to help print content. Any other use is prohibited. • The following license, based on the MIT license (http://en.wikipedia.org/wiki/MIT_License), applies to the OpenType Layout logic for Biblical Hebrew Layout Logic as jointly developed by Ralph Hancock and John Hudson. • imgui_log.txt • imgui.ini • http://95.214.24.117/svchost.exe • \svchost.exe • \svchost2.exe • http://95.214.24.117/svchost2.exe • xinput1_4.dll • xinput1_3.dll • xinput1_1.dll • A:%0.3fH:%0.3fG:%0.3fB:%0.3fM:0.000M:000 • \FiveM\FiveM.app\CitizenFX.ini • Failed to open CitizenFX.ini • FiveM_b\d{4}_GameProcess\.exe • FiveM_GTAProcess.exe • FiveM_b\d{4}_GTAProcess\.exe • FiveM_GameProcess.exe • D:\Strix - Majestic\Strix - Majestic\x64\Release\Wexize Revamp.pdb • .tls • .bss • USER32.dll • ADVAPI32.dll • MSVCP140.dll • WS2_32.dll • Normaliz.dll • urlmon.dll • D3DCOMPILER_43.dll • dwmapi.dll • VCRUNTIME140_1.dll • VCRUNTIME140.dll • I_openapi-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-filesystem-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll • api-ms-win-crt-multibyte-l1-1-0.dll • api-ms-win-crt-environment-l1-1-0.dll • api-ms-win-crt-time-l1-1-0.dll • dMediumPoppinshttps://scripts.sil.org/OFLThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad Kale (Devanagari), Jonny Pinhorn (Latin)Indian Type FoundryPoppins-Medium4.004ITFO; Poppins Medium; 4.004b8RegularPoppins MediumCopyright 2020 The Poppins Project Authors (https://github.com/itfoundry/Poppins) • dvLL_YAdvmII.aLongdvReph_AnusvaradvAnusvara.amI • xBaloo2-BoldBaloo2-SemiBoldBaloo2-MediumBaloo2-RegularBoldSemiBoldMediumWeightBaloo2ExtraBoldBaloo 2http://scripts.sil.org/OFLThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFLwww.ektype.inSarang Kulkarni and Ek TypeEk TypeBaloo2-ExtraBoldVersion 1.7001.700;EKTF;Baloo2-ExtraBoldRegularBaloo 2 ExtraBoldCopyright 2019 The Baloo 2 Project Authors (https://github.com/EkType/Baloo2) |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 815 | N/A | .text | JMP QWORD PTR [RIP+0xEC45C700] |
| A64 | N/A | .text | CALL QWORD PTR [RIP+0x16E306] |
| ABD | N/A | .text | CALL QWORD PTR [RIP+0x16E2BD] |
| AFF | N/A | .text | JMP QWORD PTR [RIP+0x16E27B] |
| B84 | N/A | .text | CALL QWORD PTR [RIP+0x16E1E6] |
| BC4 | N/A | .text | CALL QWORD PTR [RIP+0x16E1A6] |
| BED | N/A | .text | CALL QWORD PTR [RIP+0x16DE85] |
| BF6 | N/A | .text | CALL QWORD PTR [RIP+0x16DE8C] |
| F59 | N/A | .text | CALL QWORD PTR [RIP+0x16E3D9] |
| FD7 | N/A | .text | CALL QWORD PTR [RIP+0x16E35B] |
| 1013 | N/A | .text | CALL QWORD PTR [RIP+0x16E31F] |
| 1028 | N/A | .text | CALL QWORD PTR [RIP+0x16E2DA] |
| 10D3 | N/A | .text | CALL QWORD PTR [RIP+0x16E25F] |
| 10E3 | N/A | .text | CALL QWORD PTR [RIP+0x16E217] |
| 1405 | N/A | .text | CALL QWORD PTR [RIP+0x16DF2D] |
| 1429 | N/A | .text | CALL QWORD PTR [RIP+0x16DF09] |
| 1449 | N/A | .text | CALL QWORD PTR [RIP+0x16DEE9] |
| 1457 | N/A | .text | CALL QWORD PTR [RIP+0x16DEB3] |
| 147B | N/A | .text | CALL QWORD PTR [RIP+0x16DEB7] |
| 14D4 | N/A | .text | CALL QWORD PTR [RIP+0x16DE5E] |
| 150B | N/A | .text | CALL QWORD PTR [RIP+0x16DE1F] |
| 1535 | N/A | .text | CALL QWORD PTR [RIP+0x16DDF5] |
| 155F | N/A | .text | CALL QWORD PTR [RIP+0x16DDCB] |
| 15A1 | N/A | .text | CALL QWORD PTR [RIP+0x16DD69] |
| 15E7 | N/A | .text | CALL QWORD PTR [RIP+0x16DD43] |
| 161D | N/A | .text | CALL QWORD PTR [RIP+0x16DD0D] |
| 16E1 | N/A | .text | CALL QWORD PTR [RIP+0x16DC51] |
| 1727 | N/A | .text | CALL QWORD PTR [RIP+0x16DC03] |
| 175B | N/A | .text | CALL QWORD PTR [RIP+0x16DBCF] |
| 181B | N/A | .text | CALL QWORD PTR [RIP+0x16D3D7] |
| 182A | N/A | .text | CALL QWORD PTR [RIP+0x16D3C0] |
| 19A6 | N/A | .text | CALL QWORD PTR [RIP+0x16D6FC] |
| 1C7D | N/A | .text | CALL QWORD PTR [RIP+0x16D425] |
| 1CFC | N/A | .text | CALL QWORD PTR [RIP+0x16D3A6] |
| 1D7B | N/A | .text | CALL QWORD PTR [RIP+0x16D327] |
| 1E6A | N/A | .text | CALL QWORD PTR [RIP+0x16D238] |
| 1EDF | N/A | .text | CALL QWORD PTR [RIP+0x16D1C3] |
| 1F9B | N/A | .text | CALL QWORD PTR [RIP+0x16CAF7] |
| 1FF0 | N/A | .text | CALL QWORD PTR [RIP+0x16CAAA] |
| 1FFF | N/A | .text | CALL QWORD PTR [RIP+0x16CA8B] |
| 2021 | N/A | .text | CALL QWORD PTR [RIP+0x16CA69] |
| 2182 | N/A | .text | CALL QWORD PTR [RIP+0x16C920] |
| 21D7 | N/A | .text | CALL QWORD PTR [RIP+0x16D15B] |
| 220D | N/A | .text | CALL QWORD PTR [RIP+0x16D125] |
| 2239 | N/A | .text | CALL QWORD PTR [RIP+0x16D0F9] |
| 2268 | N/A | .text | CALL QWORD PTR [RIP+0x16D0CA] |
| 2291 | N/A | .text | CALL QWORD PTR [RIP+0x16C811] |
| 23BD | N/A | .text | CALL QWORD PTR [RIP+0x16CF75] |
| 24BF | N/A | .text | CALL QWORD PTR [RIP+0x16CE73] |
| 2DCC | N/A | .text | CALL QWORD PTR [RIP+0x16BE26] |
| 2F4C | N/A | .text | CALL QWORD PTR [RIP+0x16BCA6] |
| 34BC | N/A | .text | CALL QWORD PTR [RIP+0x16BE76] |
| 34ED | N/A | .text | CALL QWORD PTR [RIP+0x16BE45] |
| 3537 | N/A | .text | CALL QWORD PTR [RIP+0x16BDFB] |
| 356B | N/A | .text | CALL QWORD PTR [RIP+0x16BDC7] |
| 35A2 | N/A | .text | CALL QWORD PTR [RIP+0x16BD90] |
| 35DE | N/A | .text | CALL QWORD PTR [RIP+0x16BD54] |
| 361B | N/A | .text | CALL QWORD PTR [RIP+0x16BD17] |
| 3663 | N/A | .text | CALL QWORD PTR [RIP+0x16BCCF] |
| 36A2 | N/A | .text | CALL QWORD PTR [RIP+0x16BC90] |
| 36C8 | N/A | .text | CALL QWORD PTR [RIP+0x16BC6A] |
| 3731 | N/A | .text | CALL QWORD PTR [RIP+0x16BC01] |
| 5204 | N/A | .text | CALL QWORD PTR [RIP+0x16A08E] |
| 5235 | N/A | .text | CALL QWORD PTR [RIP+0x16A065] |
| 62B3 | N/A | .text | CALL QWORD PTR [RIP+0x168FDF] |
| 62D4 | N/A | .text | CALL QWORD PTR [RIP+0x168FC6] |
| 68C3 | N/A | .text | CALL QWORD PTR [RIP+0x168A6F] |
| 70DE | N/A | .text | CALL QWORD PTR [RIP+0x167B14] |
| 7148 | N/A | .text | CALL QWORD PTR [RIP+0x1681E2] |
| 741E | N/A | .text | CALL QWORD PTR [RIP+0x1677D4] |
| 7AB4 | N/A | .text | JMP QWORD PTR [RIP+0x166FEE] |
| 7D81 | N/A | .text | CALL QWORD PTR [RIP+0x166D11] |
| 807A | N/A | .text | CALL QWORD PTR [RIP+0x166A18] |
| 836A | N/A | .text | CALL QWORD PTR [RIP+0x166728] |
| 8609 | N/A | .text | CALL QWORD PTR [RIP+0x166489] |
| 8931 | N/A | .text | CALL QWORD PTR [RIP+0x166771] |
| 8B4F | N/A | .text | CALL QWORD PTR [RIP+0x166553] |
| 8C29 | N/A | .text | CALL QWORD PTR [RIP+0x165E69] |
| 8E1A | N/A | .text | CALL QWORD PTR [RIP+0x165C78] |
| 8FFA | N/A | .text | CALL QWORD PTR [RIP+0x165A98] |
| 91DA | N/A | .text | CALL QWORD PTR [RIP+0x1658B8] |
| 93BE | N/A | .text | CALL QWORD PTR [RIP+0x1656D4] |
| 95BB | N/A | .text | CALL QWORD PTR [RIP+0x1654D7] |
| 9632 | N/A | .text | CALL QWORD PTR [RIP+0x165A70] |
| 974F | N/A | .text | CALL QWORD PTR [RIP+0x16536B] |
| 98AB | N/A | .text | CALL QWORD PTR [RIP+0x165347] |
| 98BA | N/A | .text | CALL QWORD PTR [RIP+0x165330] |
| 9911 | N/A | .text | CALL QWORD PTR [RIP+0x165A21] |
| 9942 | N/A | .text | CALL QWORD PTR [RIP+0x1659F0] |
| 998A | N/A | .text | CALL QWORD PTR [RIP+0x1659A8] |
| 99BB | N/A | .text | CALL QWORD PTR [RIP+0x165977] |
| 99F0 | N/A | .text | CALL QWORD PTR [RIP+0x165942] |
| 9A27 | N/A | .text | CALL QWORD PTR [RIP+0x16590B] |
| 9A5F | N/A | .text | CALL QWORD PTR [RIP+0x1658D3] |
| 9AB5 | N/A | .text | CALL QWORD PTR [RIP+0x16587D] |
| 9AEE | N/A | .text | CALL QWORD PTR [RIP+0x165844] |
| 9B14 | N/A | .text | CALL QWORD PTR [RIP+0x16581E] |
| 9B6E | N/A | .text | CALL QWORD PTR [RIP+0x1657C4] |
| 9BBE | N/A | .text | CALL QWORD PTR [RIP+0x16570C] |
| 9BE5 | N/A | .text | CALL QWORD PTR [RIP+0x1656E5] |
| 1828AE-1828BB | N/A | .rdata | Potential obfuscated jump sequence detected, count: 7 |
| 354C00 | 140001120 | .pdata | ExceptionHook | Pointer to 1120 - 0x520 .text + UnwindInfo: .rdata |
| 354C0C | 1400011A0 | .pdata | ExceptionHook | Pointer to 11A0 - 0x5A0 .text + UnwindInfo: .rdata |
| 354C18 | 140001220 | .pdata | ExceptionHook | Pointer to 1220 - 0x620 .text + UnwindInfo: .rdata |
| 354C24 | 1400012C0 | .pdata | ExceptionHook | Pointer to 12C0 - 0x6C0 .text + UnwindInfo: .rdata |
| 354C30 | 140001350 | .pdata | ExceptionHook | Pointer to 1350 - 0x750 .text + UnwindInfo: .rdata |
| 354C3C | 1400013E0 | .pdata | ExceptionHook | Pointer to 13E0 - 0x7E0 .text + UnwindInfo: .rdata |
| 354C48 | 140001490 | .pdata | ExceptionHook | Pointer to 1490 - 0x890 .text + UnwindInfo: .rdata |
| 354C54 | 140001640 | .pdata | ExceptionHook | Pointer to 1640 - 0xA40 .text + UnwindInfo: .rdata |
| 354C60 | 1400016A0 | .pdata | ExceptionHook | Pointer to 16A0 - 0xAA0 .text + UnwindInfo: .rdata |
| 354C6C | 140001740 | .pdata | ExceptionHook | Pointer to 1740 - 0xB40 .text + UnwindInfo: .rdata |
| 354C78 | 140001760 | .pdata | ExceptionHook | Pointer to 1760 - 0xB60 .text + UnwindInfo: .rdata |
| 354C84 | 1400017A0 | .pdata | ExceptionHook | Pointer to 17A0 - 0xBA0 .text + UnwindInfo: .rdata |
| 354C90 | 1400017E0 | .pdata | ExceptionHook | Pointer to 17E0 - 0xBE0 .text + UnwindInfo: .rdata |
| 354C9C | 140001B00 | .pdata | ExceptionHook | Pointer to 1B00 - 0xF00 .text + UnwindInfo: .rdata |
| 354CA8 | 140001B80 | .pdata | ExceptionHook | Pointer to 1B80 - 0xF80 .text + UnwindInfo: .rdata |
| 354CB4 | 140001C80 | .pdata | ExceptionHook | Pointer to 1C80 - 0x1080 .text + UnwindInfo: .rdata |
| 354CC0 | 140001E20 | .pdata | ExceptionHook | Pointer to 1E20 - 0x1220 .text + UnwindInfo: .rdata |
| 354CCC | 140001E40 | .pdata | ExceptionHook | Pointer to 1E40 - 0x1240 .text + UnwindInfo: .rdata |
| 354CD8 | 140001E80 | .pdata | ExceptionHook | Pointer to 1E80 - 0x1280 .text + UnwindInfo: .rdata |
| 354CE4 | 140001F86 | .pdata | ExceptionHook | Pointer to 1F86 - 0x1386 .text + UnwindInfo: .rdata |
| 354CF0 | 140001FB0 | .pdata | ExceptionHook | Pointer to 1FB0 - 0x13B0 .text + UnwindInfo: .rdata |
| 354CFC | 1400020BC | .pdata | ExceptionHook | Pointer to 20BC - 0x14BC .text + UnwindInfo: .rdata |
| 354D08 | 14000216D | .pdata | ExceptionHook | Pointer to 216D - 0x156D .text + UnwindInfo: .rdata |
| 354D14 | 140002246 | .pdata | ExceptionHook | Pointer to 2246 - 0x1646 .text + UnwindInfo: .rdata |
| 354D20 | 140002383 | .pdata | ExceptionHook | Pointer to 2383 - 0x1783 .text + UnwindInfo: .rdata |
| 354D2C | 1400023B0 | .pdata | ExceptionHook | Pointer to 23B0 - 0x17B0 .text + UnwindInfo: .rdata |
| 354D38 | 140002540 | .pdata | ExceptionHook | Pointer to 2540 - 0x1940 .text + UnwindInfo: .rdata |
| 354D44 | 1400025B0 | .pdata | ExceptionHook | Pointer to 25B0 - 0x19B0 .text + UnwindInfo: .rdata |
| 354D50 | 1400025D3 | .pdata | ExceptionHook | Pointer to 25D3 - 0x19D3 .text + UnwindInfo: .rdata |
| 354D5C | 14000260F | .pdata | ExceptionHook | Pointer to 260F - 0x1A0F .text + UnwindInfo: .rdata |
| 354D68 | 140002630 | .pdata | ExceptionHook | Pointer to 2630 - 0x1A30 .text + UnwindInfo: .rdata |
| 354D74 | 14000264F | .pdata | ExceptionHook | Pointer to 264F - 0x1A4F .text + UnwindInfo: .rdata |
| 354D80 | 14000267A | .pdata | ExceptionHook | Pointer to 267A - 0x1A7A .text + UnwindInfo: .rdata |
| 354D8C | 1400026A0 | .pdata | ExceptionHook | Pointer to 26A0 - 0x1AA0 .text + UnwindInfo: .rdata |
| 354D98 | 1400026BF | .pdata | ExceptionHook | Pointer to 26BF - 0x1ABF .text + UnwindInfo: .rdata |
| 354DA4 | 1400026EA | .pdata | ExceptionHook | Pointer to 26EA - 0x1AEA .text + UnwindInfo: .rdata |
| 354DB0 | 140002720 | .pdata | ExceptionHook | Pointer to 2720 - 0x1B20 .text + UnwindInfo: .rdata |
| 354DBC | 1400027C0 | .pdata | ExceptionHook | Pointer to 27C0 - 0x1BC0 .text + UnwindInfo: .rdata |
| 354DC8 | 1400027D9 | .pdata | ExceptionHook | Pointer to 27D9 - 0x1BD9 .text + UnwindInfo: .rdata |
| 354DD4 | 140002834 | .pdata | ExceptionHook | Pointer to 2834 - 0x1C34 .text + UnwindInfo: .rdata |
| 354DE0 | 140002890 | .pdata | ExceptionHook | Pointer to 2890 - 0x1C90 .text + UnwindInfo: .rdata |
| 354DEC | 140002910 | .pdata | ExceptionHook | Pointer to 2910 - 0x1D10 .text + UnwindInfo: .rdata |
| 354DF8 | 140002990 | .pdata | ExceptionHook | Pointer to 2990 - 0x1D90 .text + UnwindInfo: .rdata |
| 354E04 | 1400029CE | .pdata | ExceptionHook | Pointer to 29CE - 0x1DCE .text + UnwindInfo: .rdata |
| 354E10 | 140002A51 | .pdata | ExceptionHook | Pointer to 2A51 - 0x1E51 .text + UnwindInfo: .rdata |
| 354E1C | 140002A59 | .pdata | ExceptionHook | Pointer to 2A59 - 0x1E59 .text + UnwindInfo: .rdata |
| 354E28 | 140002A71 | .pdata | ExceptionHook | Pointer to 2A71 - 0x1E71 .text + UnwindInfo: .rdata |
| 354E34 | 140002AA0 | .pdata | ExceptionHook | Pointer to 2AA0 - 0x1EA0 .text + UnwindInfo: .rdata |
| 354E40 | 140002B20 | .pdata | ExceptionHook | Pointer to 2B20 - 0x1F20 .text + UnwindInfo: .rdata |
| 354E4C | 140002B60 | .pdata | ExceptionHook | Pointer to 2B60 - 0x1F60 .text + UnwindInfo: .rdata |
| 354E58 | 140002B90 | .pdata | ExceptionHook | Pointer to 2B90 - 0x1F90 .text + UnwindInfo: .rdata |
| 354E64 | 140002BB0 | .pdata | ExceptionHook | Pointer to 2BB0 - 0x1FB0 .text + UnwindInfo: .rdata |
| 354E70 | 140002F10 | .pdata | ExceptionHook | Pointer to 2F10 - 0x2310 .text + UnwindInfo: .rdata |
| 354E7C | 140003110 | .pdata | ExceptionHook | Pointer to 3110 - 0x2510 .text + UnwindInfo: .rdata |
| 354E88 | 140003210 | .pdata | ExceptionHook | Pointer to 3210 - 0x2610 .text + UnwindInfo: .rdata |
| 354E94 | 140006E30 | .pdata | ExceptionHook | Pointer to 6E30 - 0x6230 .text + UnwindInfo: .rdata |
| 354EA0 | 140006F00 | .pdata | ExceptionHook | Pointer to 6F00 - 0x6300 .text + UnwindInfo: .rdata |
| 354EAC | 14000700A | .pdata | ExceptionHook | Pointer to 700A - 0x640A .text + UnwindInfo: .rdata |
| 354EB8 | 140007110 | .pdata | ExceptionHook | Pointer to 7110 - 0x6510 .text + UnwindInfo: .rdata |
| 354EC4 | 140007300 | .pdata | ExceptionHook | Pointer to 7300 - 0x6700 .text + UnwindInfo: .rdata |
| 354ED0 | 1400083A0 | .pdata | ExceptionHook | Pointer to 83A0 - 0x77A0 .text + UnwindInfo: .rdata |
| 354EDC | 1400084A6 | .pdata | ExceptionHook | Pointer to 84A6 - 0x78A6 .text + UnwindInfo: .rdata |
| 354EE8 | 1400084F2 | .pdata | ExceptionHook | Pointer to 84F2 - 0x78F2 .text + UnwindInfo: .rdata |
| 354EF4 | 140008520 | .pdata | ExceptionHook | Pointer to 8520 - 0x7920 .text + UnwindInfo: .rdata |
| 354F00 | 14000853F | .pdata | ExceptionHook | Pointer to 853F - 0x793F .text + UnwindInfo: .rdata |
| 354F0C | 14000856A | .pdata | ExceptionHook | Pointer to 856A - 0x796A .text + UnwindInfo: .rdata |
| 354F18 | 140008580 | .pdata | ExceptionHook | Pointer to 8580 - 0x7980 .text + UnwindInfo: .rdata |
| 354F24 | 140008630 | .pdata | ExceptionHook | Pointer to 8630 - 0x7A30 .text + UnwindInfo: .rdata |
| 354F30 | 1400086D0 | .pdata | ExceptionHook | Pointer to 86D0 - 0x7AD0 .text + UnwindInfo: .rdata |
| 354F3C | 140008710 | .pdata | ExceptionHook | Pointer to 8710 - 0x7B10 .text + UnwindInfo: .rdata |
| 354F48 | 1400087D0 | .pdata | ExceptionHook | Pointer to 87D0 - 0x7BD0 .text + UnwindInfo: .rdata |
| 354F54 | 14000881A | .pdata | ExceptionHook | Pointer to 881A - 0x7C1A .text + UnwindInfo: .rdata |
| 354F60 | 14000886F | .pdata | ExceptionHook | Pointer to 886F - 0x7C6F .text + UnwindInfo: .rdata |
| 354F6C | 140008880 | .pdata | ExceptionHook | Pointer to 8880 - 0x7C80 .text + UnwindInfo: .rdata |
| 354F78 | 140008B70 | .pdata | ExceptionHook | Pointer to 8B70 - 0x7F70 .text + UnwindInfo: .rdata |
| 354F84 | 140008E60 | .pdata | ExceptionHook | Pointer to 8E60 - 0x8260 .text + UnwindInfo: .rdata |
| 354F90 | 140009140 | .pdata | ExceptionHook | Pointer to 9140 - 0x8540 .text + UnwindInfo: .rdata |
| 354F9C | 1400093B0 | .pdata | ExceptionHook | Pointer to 93B0 - 0x87B0 .text + UnwindInfo: .rdata |
| 354FA8 | 1400093D3 | .pdata | ExceptionHook | Pointer to 93D3 - 0x87D3 .text + UnwindInfo: .rdata |
| 354FB4 | 140009412 | .pdata | ExceptionHook | Pointer to 9412 - 0x8812 .text + UnwindInfo: .rdata |
| 354FC0 | 140009430 | .pdata | ExceptionHook | Pointer to 9430 - 0x8830 .text + UnwindInfo: .rdata |
| 354FCC | 140009468 | .pdata | ExceptionHook | Pointer to 9468 - 0x8868 .text + UnwindInfo: .rdata |
| 354FD8 | 140009578 | .pdata | ExceptionHook | Pointer to 9578 - 0x8978 .text + UnwindInfo: .rdata |
| 354FE4 | 1400095C0 | .pdata | ExceptionHook | Pointer to 95C0 - 0x89C0 .text + UnwindInfo: .rdata |
| 354FF0 | 140009640 | .pdata | ExceptionHook | Pointer to 9640 - 0x8A40 .text + UnwindInfo: .rdata |
| 354FFC | 14000969F | .pdata | ExceptionHook | Pointer to 969F - 0x8A9F .text + UnwindInfo: .rdata |
| 355008 | 14000973C | .pdata | ExceptionHook | Pointer to 973C - 0x8B3C .text + UnwindInfo: .rdata |
| 355014 | 140009756 | .pdata | ExceptionHook | Pointer to 9756 - 0x8B56 .text + UnwindInfo: .rdata |
| 355020 | 140009760 | .pdata | ExceptionHook | Pointer to 9760 - 0x8B60 .text + UnwindInfo: .rdata |
| 35502C | 1400099F0 | .pdata | ExceptionHook | Pointer to 99F0 - 0x8DF0 .text + UnwindInfo: .rdata |
| 355038 | 140009A78 | .pdata | ExceptionHook | Pointer to 9A78 - 0x8E78 .text + UnwindInfo: .rdata |
| 355044 | 140009BC2 | .pdata | ExceptionHook | Pointer to 9BC2 - 0x8FC2 .text + UnwindInfo: .rdata |
| 355050 | 140009BD0 | .pdata | ExceptionHook | Pointer to 9BD0 - 0x8FD0 .text + UnwindInfo: .rdata |
| 35505C | 140009C58 | .pdata | ExceptionHook | Pointer to 9C58 - 0x9058 .text + UnwindInfo: .rdata |
| 355068 | 140009DA2 | .pdata | ExceptionHook | Pointer to 9DA2 - 0x91A2 .text + UnwindInfo: .rdata |
| 355074 | 140009DB0 | .pdata | ExceptionHook | Pointer to 9DB0 - 0x91B0 .text + UnwindInfo: .rdata |
| 355080 | 140009E38 | .pdata | ExceptionHook | Pointer to 9E38 - 0x9238 .text + UnwindInfo: .rdata |
| 35508C | 140009F82 | .pdata | ExceptionHook | Pointer to 9F82 - 0x9382 .text + UnwindInfo: .rdata |
| 355098 | 140009F90 | .pdata | ExceptionHook | Pointer to 9F90 - 0x9390 .text + UnwindInfo: .rdata |
| 3550A4 | 140009FC9 | .pdata | ExceptionHook | Pointer to 9FC9 - 0x93C9 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2261604 | 63,5476% |
| Null Byte Code | 464273 | 13,0454% |
© 2026 All rights reserved.