PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,37 MBSHA-256 Hash: 9F6E3BC31DC5D53BDD281A5BC0D280373EA5B2A7EB4CB9606F4046652F7C3A52 SHA-1 Hash: E8955B32C47B50CC290179D21B7AB16ED24452EF MD5 Hash: 05829347EED449AEE564DFD00418FC8D Imphash: B4A9220E1633BC138A7F88ECECAA9727 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00165CC8 EntryPoint (rva): 403800 SizeOfHeaders: 400 SizeOfImage: 409000 ImageBase: 400000 Architecture: x86 ExportTable: 3CF000 ImportTable: 408000 Characteristics: 30F TimeDateStamp: 44760000 Date: 25/05/2006 19:05:36 File Type: EXE Number Of Sections: 5 ASLR: Disabled Section Names: pec1, .rsrc, pec2, pec3, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 2,66 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| pec1 | 0xE0000020 Code Executable Readable Writeable |
400 | 10E600 | 1000 | 33B000 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
10EA00 | 1B400 | 33C000 | 69000 |
|
|
| pec2 | 0xC0000040 Initialized Data Readable Writeable |
129E00 | 0 | 3A5000 | 2A000 |
|
|
| pec3 | 0xC0000040 Initialized Data Readable Writeable |
129E00 | 34E00 | 3CF000 | 39000 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
15EC00 | 600 | 408000 | 1000 |
|
|
| Description |
| FileVersion: 2.2.1.562 ProductVersion: 2.2.0.0 Language: English (United States) (ID=0x409) CodePage: Western European (Windows 1252) (0x4E4) |
| Entry Point |
The section number (4) - (pec3) have the Entry Point Information -> EntryPoint (calculated) - 15E600 Code -> EB066814190000C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F90400087DD8B85E690400001853390400066C7 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |JMP 0X803808 |PUSH 0X1914 |RET |PUSHFD |PUSHAD |CALL 0X803811 |XOR EAX, EAX |MOV EAX, ESP |ADD EAX, 4 |XCHG EAX, EBX |MOV ESP, EBX |MOV EBX, DWORD PTR [EBX - 4] |SUB EBX, 0X40903F |XCHG EBP, EBX |MOV EAX, DWORD PTR [EBP + 0X4090E6] |ADD DWORD PTR [EBP + 0X409033], EAX |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Duplicate Sections |
| Section .rsrc duplicate 2 times |
| Packer/Compiler |
| Detect It Easy (die) • PE: packer: PECompact(1.68-1.84)[-] • PE: compiler: Borland C++(Builder)[-] • PE: linker: Turbo Linker(5.0)[-] • Entropy: 7.83634 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| File Access |
| OLEAUT32.DLL OLE32.DLL IMM32.DLL WINMM.DLL USER32.DLL SHELL32.DLL GDI32.DLL COMDLG32.DLL COMCTL32.DLL VERSION.DLL ADVAPI32.DLL KERNEL32.DLL Temp |
| File Access (UNICODE) |
| Temp |
| Interest's Words |
| ToolBar cscript exec start sdelete expand replace setx |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Entry Point | Hex Pattern | AHTeam EP Protector 0.3 - 0.41 - FEUERRADER |
| Entry Point | Hex Pattern | NeoLite v2.0 |
| Entry Point | Hex Pattern | PECompact v1.10b2 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\0 | 345274 | 134 | 117C74 | 07E19C04283302202209406A010500CE0210ECFF83847A180FC0081FF0803FFC89FE027F11FF12F725F31B04E448F40A6DB0 | ....(3. ".@j..........z.......?.........%....H..m. |
| \CURSOR\2\0 | 3453A8 | 134 | 117DA8 | A81C058908999D10BD208ACD3DE00A54461BFE3F951E04D459104D504418A01C059814B8FFAA00F8FDC809F895F08294E077 | ......... ..=..TF..?....Y.MPD....................w |
| \CURSOR\3\0 | 3454DC | 134 | 117EDC | 8819FE0801B6535C593ACA023921CED64101A9DE02A2FC1A8284F893023FEAF01AA380E02309C091C421FC08013F1A0961CD | ......S\Y:..9!..A............?..........!...?..a. |
| \CURSOR\4\0 | 345610 | 134 | 118010 | 22A2C7398347373A4E2A1ECA38970A3F1EDB796D4C54524C9753F3C032C6A2A914FBF728CD289A223A24A3148FFD1AC989C0 | "..9.G7:N*..8..?..ymLTRL.S..2......(.(.":$........ |
| \CURSOR\5\0 | 345744 | 134 | 118144 | A20A15344314643F650D0A4A4633D2EC16D0C54A4446090A943492BA8D0AB24A036395270AE70A37E4EE553B93F31C16DC2A | ...4C.d?e..JF3.....JDF...4.....J.c.’...7..U;.....* |
| \CURSOR\6\0 | 345878 | 134 | 118278 | 6DBB7FAC0CBDD94EF8B20C2918A1139391B6281E4FEE8FA20A6F4FD40AB74FDA0A364FA20A6A4F0A354A130A5C764F7EA00A | m......N...)......(.O....oO...O..6O..jO.5J..\vO~.. |
| \CURSOR\7\0 | 3459AC | 134 | 1183AC | F5F80A37FD98213A9B8F9B2826FF0A6A98008AAA6ED6104488F88BE7FA099FD2A314D0A6E8525B91D0FEF808890768B2711C | ...7..!:...(&..j....n..D.............R[.......h.q. |
| \CURSOR\8\0 | 345AE0 | 134 | 1184E0 | E3A2247FA308C40803751B387A1F4C289ACE94747920E6464CAC018BA477C8BE43DF22E833AA00E9C219035505280694676A | ..$......u.8z.L(...ty .FL....w..C.".3......U.(..gj |
| \BITMAP\BBABORT\0 | 345C14 | 1D0 | 118614 | E30E3E39D15ACF94607DBF465500654444BD545C231D3CD14CCE080E4D0A53C9190961C16EC173490565C172C169C1663A79 | ..>9.Z..}.FU.eDD.T\.<.L...M.S...a.n.sI.e.r.i.f:y |
| \BITMAP\BBALL\0 | 345DE4 | 1E4 | 1187E4 | A138B930518F6AE8232E82439D6A9C3038144C2DBD487F66784552281252291E90638A6C503B32766D728C4461A3B37EA358 | .8.0Q.j...C.j.08.L-.H.fxER(.R)..c.lP;2vmr.Da..~.X |
| \BITMAP\BBCANCEL\0 | 345FC8 | 1D0 | 1189C8 | 4C9D2D4450E54614A24850B16C4D61D069A3C674A246F26462A64C41ACF379F2E2092857E8C96E98A50598B3E20B8D5D23AA | L.-DP.F..HP.lMa.i..t.F.db.LA..y...(W..n........]. |
| \BITMAP\BBCLOSE\0 | 346198 | 1D0 | 118B98 | 051DA737D2C5936A40796125650839CE6F73B2331840824793307528D149BEF4CF4F166232349541CC40486872EED451E465 | ...7...j@ya%e.9.os.3.@.G.0u(.I...O.b24.A.@Hhr..Q.e |
| \BITMAP\BBHELP\0 | 346368 | 1D0 | 118D68 | 59633A519672C36C5C65E443C4AFB42313C5BC2D0B064F369DD61D8D01146450E42387CA6A1B658209950D2BC69966E28B6C | Yc:Q.r.l\e.C......-..O6......dP...j.e....+..f..l |
| \BITMAP\BBIGNORE\0 | 346538 | 1D0 | 118F38 | 958A76112D942444A06A0928039CBF25F216A09C6FA40454A38D6510571BC2C5C489DE2426906789988D06A31C4C8F6FD41F | ..v.-.$D.j.(...%....o..T..e.W......$&.g......L.o.. |
| \BITMAP\BBNO\0 | 346708 | 1D0 | 119108 | 531920FAD064AC21A61AAD21AB122427362E0438F1CE2874B978BFFBD5367E958A0CD729DDC170453F7935289574A6888A74 | S. ..d.!...!..$’6..8..(t.x...6~....)..pE?y5(.t...t |
| \BITMAP\BBOK\0 | 3468D8 | 1D0 | 1192D8 | D8326B51079709C7D06CB9FA9CA27290BAD3A1ACEA7009449FC89500FC4E1B3DE32F8FDE52BA90A4F5045352A882F2D134AC | .2kQ.....l....r......p.D.....N.=./..R.....SR....4. |
| \BITMAP\BBRETRY\0 | 346AA8 | 1D0 | 1194A8 | 1BC7B2A58D8B641EB13472429BE58717EA00FE50634F42C55C2742C2BC2A8EA04C74B11DE5F1B3EA962A4E856F6AE7784597 | ......d..4rB.......PcOB.\’B..*..Lt.......*N.oj.xE. |
| \BITMAP\BBYES\0 | 346C78 | 1D0 | 119678 | D7F140E915911A1C9E539450F1223109D9664E45A2D19410527C5474FC5BEED1659414A38F1668F354247F692F368A502315 | ..@......S.P."1..fNE....R|Tt.[..e.....h.T$.i/6.P. |
| \BITMAP\CLOSE\1032 | 346E48 | 4C | 119848 | 8A286C70B5B1020B46B570D055057DBF955206176719924163923E0A89044219ABAE2804072A08612A6254C00201094E75286D47B50F7068739F785334980B0952657C67ACD972AA367C8D4A | .(lp....F.p.U.}..R..g..Ac.>...B...(..*.a*bT....Nu(mG..phs.xS4...Re|g..r.6|.J |
| \BITMAP\CLOSED\0 | 346E94 | D8 | 119894 | 2D7109264C19AA2F9C5407742BCF1E636B1410295A950954367704F04FFF231F115C946A74D4CEFE8A6C0937F0024F4BF844 | -q.&L../.T.t+..ck..)Z..T6w..O...\.jt....l.7..OK.D |
| \BITMAP\LEAF\0 | 346F6C | D8 | 11996C | F05104A81301040D1846582040E26F62A981DD4C4448E86EEBE541BF082565502FD9027848141912871D41F54C0553643911 | .Q.......FX @.ob...LDH.n..A..%eP/..xH.....A.L.Sd9. |
| \BITMAP\MINUS\0 | 347044 | D8 | 119A44 | 709B6F737FCBA91C4D2409477502466592193898C7025140023820082B0FCA4819FBEC1B1CEF18371FE60B2379881314C429 | p.os....M$.Gu.Fe..8...Q@.8 .+..H.......7...y....) |
| \BITMAP\OPEN\0 | 34711C | D8 | 119B1C | 08027409EDCFA791110B0ACBA1150FEFE73EA718131F3B06B7EF9500BBF78DE1010D0BC79B0EAB109F4E6E14F074A902AA0C | ..t..............>....;..................Nn..t.... |
| \BITMAP\PLUS\0 | 3471F4 | D8 | 119BF4 | A5B5C5D5E5F5005666768696A6B6C600D6E6F63747576777008797A7B7C7D7E7F76E11E43457B8D14AB8F3EA35AB41052131 | .......Vfv.........7GWgw.........n..4W..J...5.A.!1 |
| \BITMAP\PREVIEWGLYPH\0 | 3472CC | E8 | 119CCC | F0C4895C8DF14600BE5FDDF57E9713CB001FABBD6809F45B1A1C7F846FC09AA37D3763DC00FA2E1B6CACED789977830FB91F | ...\..F.._..~.......h..[....o...}7c.....l..x.w.... |
| \BITMAP\TCCALENDAR\1033 | 3473B4 | 188 | 119DB4 | 5C7EA9879D9777004FC1C963F270C30600506DAF76C25C59B12A84B7BC0A9BDBEF5D0042B0AFCCC100CDC9CBB30B2197D507 | \~....w.O..c.p...Pm.v.\Y.*.......].B..........!... |
| \BITMAP\TCDIRECTORYOUTLINE\1033 | 34753C | 188 | 119F3C | 768478A55F8288B600E7A747FA43E3C77F000495291FF452492F00FFD2338EA9029A1C00E786B41739C61AD1F82403F608B7 | v.x._......G.C......)..RI/...3..........9....$.... |
| \BITMAP\TCGAUGE\1033 | 3476C4 | 188 | 11A0C4 | 006AEDDBEAB4B3D42C0C716B67BDA66D0FFEAAE6B1636ECCC9993511FCF26470F002FA4E742D0CDF4819781D8C0FF5807347 | .j......,.qkg..m.....cn...5...dp...Nt-..H.x.....sG |
| \BITMAP\TPERFORMANCEGRAPH\1033 | 34784C | 188 | 11A24C | C450AD424474F53B280559D2941311F695B33E2E8230505DB1060C28C28220517561A53907370705081238C3E888405BB55D | .P.BDt.;(.Y.......>..0P]...(.. Qua.9.7....8...@[.] |
| \ICON\1\1049 | 33DB2C | 128 | 11052C | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\2\1049 | 33DC54 | 1E8 | 110654 | 2800000018000000300000000100040000000000200100000000000000000000000000000000000000000000000080000080 | (.......0........... ............................. |
| \ICON\3\1049 | 33DE3C | 2E8 | 11083C | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\4\1049 | 33E124 | 668 | 110B24 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\5\1049 | 33E78C | 568 | 11118C | 280000001000000020000000010008000000000000010000000000000000000000010000000100000000000098656500966E | (....... ....................................ee..n |
| \ICON\6\1049 | 33ECF4 | 6C8 | 1116F4 | 2800000018000000300000000100080000000000400200000000000000000000000100000001000000000000986565009769 | (.......0...........@........................ee..i |
| \ICON\7\1049 | 33F3BC | 8A8 | 111DBC | 280000002000000040000000010008000000000000040000000000000000000000010000000100000000000098656500966B | (... ...@....................................ee..k |
| \ICON\8\1049 | 33FC64 | EA8 | 112664 | 2800000030000000600000000100080000000000000900000000000000000000000100000001000000000000956767009866 | (...0.......................................gg..f |
| \ICON\9\1049 | 340B0C | 468 | 11350C | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000003F2A | (....... ..... .....@...........................?* |
| \ICON\10\1049 | 340F74 | 988 | 113974 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\11\1049 | 3418FC | 10A8 | 1142FC | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\12\1049 | 3429A4 | 25A8 | 1153A4 | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \DIALOG\DLGTEMPLATE\0 | 3479D4 | 52 | 11A3D4 | 378485AB5801F3291A94A4B476045C950560284757665D380652E246C048586878880098A8B8C8D8E8F83900495969798999A9B900C9D9E9F92A3A4A5A006A7A8A9AAABACADA2EEAFA19EC1B001669632DE3 | 7...X..)....v.\..(GWf]8.R.F.HXhx.........9.IYiy.........*:JZ.jz..............ic-. |
| \STRING\4077\0 | 347A28 | 60 | 11A428 | 0400F3A1D96F6BDAF62200FEE7EA03E5D1775C1EBEE6A7C75627FF01A9B27FF8DEFD0141E9D7BAF7DCD48C1ECAC408F500364FFA3BDFA83D3A01F75EFB9A9FF958CCFEA660C92C477BF50703A75EEBDF735318182B1308D4D9003FE8EF7EA0F4 | .....ok..".......w\.....V’.........A.............6O.;..=:......X....,G{......sS..+.....?..~.. |
| \STRING\4078\0 | 347A88 | 438 | 11A488 | EBDD037BEE6A7FE56298FA9B2700FD1DEFD41E9D7BAF077DCD4FFCAC3C4853606408A3BDFA8303D3AF75EFB9A91818958908 | ...{.j..b...’.......{..}.O..<HSd........u........ |
| \STRING\4079\0 | 347EC0 | 144 | 11A8C0 | 5A15C3D899B2011DB46DF08A360900C7FD1FE97F83A80D008F0A9E9D2BB72E01FAF707EFFCE4246D30A394205F01F46BFE51 | Z........m..6...............+.........$m0.. _..k.Q |
| \STRING\4080\0 | 348004 | E8 | 11AA04 | DBD88B9CC0347E6500E5CB5DC6687C292B07A749A838C590739E835F0A787F6F765A806B7DD0DFF97663E9F479DA07AB46DE | .....4~e...].h|)+..I.8..s.._.x.ovZ.k}...vc..y...F. |
| \STRING\4081\0 | 3480EC | 280 | 11AAEC | 65029F4F7B9D206CD5E04DE400276AAE971A8580B800FAF3EC075857EA4A02DCCB5F17869540793A01794D49CD7A606FE88F | e..O{. l..M..’j...........XW.J..._...@y:.yMI.zo.. |
| \STRING\4082\0 | 34836C | 218 | 11AD6C | 5EEA20703A00A6E2E07BF78D1AA9073D5189AE06F0FFD3BAEF00E5EC709FDC2F91C3E6B500733B8A47C66D95A4009B145026 | . p:....{.....=Q...........p../.....s;.G.m.....P& |
| \STRING\4083\0 | 348584 | 3F4 | 11AF84 | AF7B007D7614CA1883E112E0A0E00A005053A4379CCBBAF30009B0FAD8C85B287C0F2434A688BE813CA993C6A7D47A1400B3 | .{.}v...........PS.7..........[(|.$4....<.....z... |
| \STRING\4084\0 | 348978 | 3DC | 11B378 | 6534D40F350053293E479C704E9600B3D5B6AED6F33C0F00ED1D6AA69A49C7A73E97480FBE2F2B41C6528A2A303838B84ABC | e4..5.S)>G.pN........<....j..I..>.H../+A.R.*088.J. |
| \STRING\4085\0 | 348D54 | 4E4 | 11B754 | F5B7750C00B6DA20788EB4C03000A1EA5FF795B9BC9F0D537B07E262F0A0FAF0F0008FCA98EB78E1D7080373E904957246E8 | ..u.... x...0..._......S{..b..........x....s...rF. |
| \STRING\4086\0 | 349238 | 4B0 | 11BC38 | 316803635698301AF590D7EDC700F2E812F9898FC66E017D9FD8B84DB98DE8315D0093DA39EA4A3C65240051492D5E59F1D5 | 1h.cV.0..............n.}...M...1]...9.J<e$.QI-Y.. |
| \STRING\4087\0 | 3496E8 | F4 | 11C0E8 | 48823A981EA046D8F28B0770A39B4B5B6104ED55E6A0673071E8004F1FB3A4D0C33DB070671F3EAE20C0FC8F9F4DBD73ECB8 | H.:...F....p..K[a..U..g0q..O.....=.pg.>. ....M.s.. |
| \STRING\4088\0 | 3497DC | C4 | 11C1DC | B9FAD21DA4530362FE4FD78F6A83C1CABDE858741CAA722AC43FA09E806AFA7800FEF218701D16F5B6783700FCDE9D7994F8 | .....S.b.O..j.....Xt..r*.?...j.x....p....x7....y.. |
| \STRING\4089\0 | 3498A0 | 2C0 | 11C2A0 | 55A893492007DC10482A78608B8208FE01B7F7248E8DBA1EDC763700295DF1DBA62A28711E991AD8FEBB47804D593D2D0D55 | U..I ...H*x.......$.....v7.)]...*(q......G.MY=-.U |
| \STRING\4090\0 | 349B60 | 3AC | 11C560 | A55E014F2751948E40B2FCF6D000346CC88ACE7D8F7600D967DC2128D3911AE687A0FDE4014FCA9F6F4D5BF8FC86851DE521 | ..O’Q..@.....4l...}.v..g.!(.........O..oM[......! |
| \STRING\4091\0 | 349F0C | 388 | 11C90C | 1900D6AAA5F80A4837E51DBF1EE2801645246A04D400790E3D22B9863FAC00856315EECFD9E7D609A673E49E20325964790E | .......H7.......E$j...y.="..?...c........s.. 2Ydy. |
| \STRING\4092\0 | 34A294 | 2F0 | 11CC94 | 5072056F64756374EDAFAF43B4216891109F0B4101DA03A309E36C37126E4E3F870708F561ECAA6BD0BEA79BDA0EA223FC1E | Pr.oduct...C.!h....A......l7.nN?....a..k......... |
| \STRING\4093\0 | 34A584 | 3FC | 11CF84 | 8A46837E02DA0948584512786563222B0711AA175509AA3A7C97449C1286586EAA1B73E24ADC42C864119F09574308850264 | .F.~...HXE.xec"+....U..:|.D...Xn..s.J.B.d...WC...d |
| \STRING\4094\0 | 34A980 | 3B0 | 11D380 | 69763F2464693861D3068D781C06249769EAB80431BA5AF2E03A4398C86D7A57A8AA66F92398C504C7D044183768CFCB5AAA | iv?$di8a...x..$.i...1.Z..:C..mzW..f......D.7h..Z. |
| \STRING\4095\0 | 34AD30 | 44C | 11D730 | C50D546BBE312F7DD33A0A46541F2963277646188A347C6E281219A57A7C9FE2BC01A674B4874F443934A06DB43F68A14201 | ..Tk.1/}.:.FT.)c’vF..4|n(...z|.....t..OD94.m.?h.B. |
| \STRING\4096\0 | 34B17C | 528 | 11DB7C | ADDEECFEAE5B9FFFA4597828AE3889393B20882F5F140A30C43A971C5F4403396E3FA0916C8E20F0BF95861353B85C51423A | .....[...Yx(.8.9; ./_..0.:.._D.9n?..l. .....S.\QB: |
| \RCDATA\DVCLAL\0 | 34B6A4 | 10 | 11E0A4 | 4DE7BA6E770F1B272DF396AC04A1162E | M..nw..’-....... |
| \RCDATA\TFRMABOUT\0 | 34B6B4 | 4337 | 11E0B4 | 8D375E95C39DF5D5712960F4AE179C9411127B532E73C445726D1738D1172974FB88017D910EA269BB72235DBAC2E5E4FFA7 | .7.....q).......{S.s.Erm.8..)t...}...i.r]...... |
| \RCDATA\TFRMANALYSISLEGEND\0 | 34F9EC | 460 | 1223EC | 2FEC7257A55279F2169EB1530C2DF678FE5C25581170EBD27DD10092BB9D91453CEAB1BF7A77DBA4A93F8569AB05D7AE1DC3 | /.rW.Ry....S.-.x.\%X.p..}......E<...zw...?.i...... |
| \RCDATA\TFRMANALYSISOPTIONS\0 | 34FE4C | C6D | 12284C | 11196D2014626AB838CA3E771A23A5EE7D6115153AF2AA4BD57A5E95DF2FB5719FF4B97811AE4C2D1F7CBFBD7AE8E154984F | ..m .bj.8.>w...}a..:..K.z../.q...x..L-.|..z..T.O |
| \RCDATA\TFRMARCHDESIGN\0 | 350ABC | EA5 | 1234BC | B5AD728A3C534D527CE32D77DADADD5230D78440A396B51A0E9A968A1737F9318FFA77DAE9E57D4913130F8B646420AEB819 | ..r.<SMR|.-w...R0..@.........7.1..w...}I....dd ... |
| \RCDATA\TFRMARCHOPTIONS\0 | 351964 | 2F3D | 124364 | F3C4694D6A4A802AACFFA396ED4780529F0C5380D4F9630057A880BAF74AFC3BA7491BD9DD2861BD4502281FF93300D28BB1 | ..iMjJ.*.....G.R..S...c.W....J.;.I...(a.E.(..3.... |
| \RCDATA\TFRMBACKUPFORECAST\0 | 3548A4 | 429 | 1272A4 | 335AFBC7EEEBD9EFE551F4093B876EB7903B7F785AB55E08A6912554529CC9B675D6327AC9137495396FBB5DE411D9E10901 | 3Z.......Q..;.n..;.xZ....%TR...u.2z..t.9o.]...... |
| \RCDATA\TFRMBULK\0 | 354CD0 | A23 | 1276D0 | D092731D1110C1BC26BDC5A12704240F392AAE9CBE64771E68ABFCC935A2FEF8D9D494AD24AEEF1AFACA60F7C59D153B941D | ..s.....&...’.$.9*...dw.h...5.......$.........;.. |
| \RCDATA\TFRMCOLOPT\0 | 3556F4 | 403B | 1280F4 | 2ABFD33F80FA61EA218489E4BA12FCB68D02F222BEB42A0665120C6200B5FE552A726200AA930980997045762902930A068A | *..?..a.!.........."..*.e..b...U*rb......pEv)..... |
| \RCDATA\TFRMCONFMATRIXOPTIONS\0 | 359730 | 926 | 12C130 | 21A93D0041A93D0061A93D0081A93D00A1A93D00C1A93D00E1A93D0001AA3D0021AA3D0041AA3D0061AA3D0081AA3D00A1AA | !.=.A.=.a.=...=...=...=...=...=.!.=.A.=.a.=...=... |
| \RCDATA\TFRMEXIMPORT\0 | 35A058 | 8E4 | 12CA58 | CC013E00FE013E002A023E0059023E007A023E009B023E00BD023E0011033E003B033E005D033E0082033E00B1033E00E903 | ..>...>.*.>.Y.>.z.>...>...>...>.;.>.].>...>...>... |
| \RCDATA\TFRMGASETUP\0 | 35A93C | 8C0 | 12D33C | 73733E008F733E00CB733E00E0733E0010743E0025743E0058743E0079743E009E743E00CF743E00F1743E0018753E004B75 | ss>..s>..s>..s>..t>.%t>.Xt>.yt>..t>..t>..t>..u>.Ku |
| \RCDATA\TFRMGRAPHFOROPT\0 | 35B1FC | 859 | 12DBFC | B6EF3E00DAEF3E000FF03E0035F03E006DF03E0097F03E00F7F03E0062F13E00C2F13E00FFF13E0048F23E0093F23E00BAF2 | ..>...>...>.5.>.m.>...>...>.b.>...>...>.H.>...>... |
| \RCDATA\TFRMINPSELECTION\0 | 35BA58 | 17FB | 12E458 | 2C593F0062593F008E593F00A6593F00BC593F00F4593F002A5A3F006C5A3F00B65A3F00F45A3F00165B3F003E5B3F00665B | ,Y?.bY?..Y?..Y?..Y?..Y?.*Z?.lZ?..Z?..Z?..[?.>[?.f[ |
| \RCDATA\TFRMINPSELOPTIONS\0 | 35D254 | B1C | 12FC54 | A0A01000E0A0100024A1100044A110005CA1100008A21000B4A21000C0A21000CCA21000D8A21000E4A21000F0A2100008A3 | ........$...D...\................................. |
| \RCDATA\TFRMJOGOPT\0 | 35DD70 | 644 | 130770 | 20FB110008FC110044FC110050FC1100CCFC110018FD110004FF1100F00012004801120070011200B4011200C40112009007 | .......D...P...................H...p............. |
| \RCDATA\TFRMLOSSMATRIX\0 | 35E3B4 | 8AE | 130DB4 | 801B1300A41B1300001C1300281C1300841C1300B81C1300181D1300441D13007C1D13000C1E13004C1E1300701E13007C1E | ............(...............D...|.......L...p...|. |
| \RCDATA\TFRMMAIN\0 | 35EC64 | 30347 | 131664 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMNETDESCR\0 | 38EFAC | 480 | 1619AC | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMNETPROPERTIES\0 | 38F42C | BB8 | 161E2C | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMNETSET\0 | 38FFE4 | 4323 | 1629E4 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMNETSETOPTIONS\0 | 394308 | 643 | 166D08 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMOUTERRWEIGHTS\0 | 39494C | 546 | 16734C | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMPREFERENCES\0 | 394E94 | D55 | 167894 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMPROGRESS\0 | 395BEC | 2DD | 1685EC | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMPROJECTPROPERTIES\0 | 395ECC | 62F | 1688CC | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMQUERY\0 | 3964FC | EC1 | 168EFC | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMREGISTER\0 | 3973C0 | A48 | 169DC0 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMRESPGRAPHOPTIONS\0 | 397E08 | 97A | 16A808 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMRETDETAILS\0 | 398784 | 1F02 | 16B184 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMSUBSETS\0 | 39A688 | 255D | 16D088 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMTESTERRORS\0 | 39CBE8 | 38C | 16F5E8 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMTIMESER\0 | 39CF74 | 6B9 | 16F974 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMTIP\0 | 39D630 | 1201 | 170030 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMTRAINLOG\0 | 39E834 | 578 | 171234 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMTRAINOPTIONS\0 | 39EDAC | 3E83 | 1717AC | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \RCDATA\TFRMVIEWS\0 | 3A2C30 | 16EB | 175630 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\TEE_CURSOR_HAND\0 | 3A431C | 14 | 176D1C | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32761\0 | 3A4330 | 14 | 176D30 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32762\0 | 3A4344 | 14 | 176D44 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32763\0 | 3A4358 | 14 | 176D58 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32764\0 | 3A436C | 14 | 176D6C | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32765\0 | 3A4380 | 14 | 176D80 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32766\0 | 3A4394 | 14 | 176D94 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_CURSOR\32767\0 | 3A43A8 | 14 | 176DA8 | 2CDE130038DE13001CDF130044DF13006CDF130000E0130068E0130018E1130040E1130090E1130098E11300A0E1130000E2 | ,...8.......D...l.......h.......@................. |
| \GROUP_ICON\MAINICON\1049 | 344F4C | AE | 11794C | 000001000C0010101000010004002801000001001818100001000400E801000002002020100001000400E802000003003030 | ..............(................... ............00 |
| \VERSION\1\1033 | 344FFC | 278 | 1179FC | 780234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000200 | x.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • tuis.u%9 @g • 2.2.1.562 • 2.2.0.0 • KERNEL32.DLL |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 5F0F | 5A952859 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 16170 | 5A952859 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 17440 | 6C3E24A0 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 1AC87 | 6C3E24A0 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 277BA | 6C3E24A0 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 2A47F | E2C670F | pec1 | CALL [static] | Indirect call to absolute memory address |
| 2DDB6 | C6348C1 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 2E69C | C6348C1 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 31444 | 5720D93A | pec1 | CALL [static] | Indirect call to absolute memory address |
| 31D81 | 211034F1 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 340C0 | 211034F1 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 39F15 | 211034F1 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 3F261 | 7462F75C | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 434A7 | 141C0311 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 46247 | 771C5263 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 49106 | 771C5263 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 4C2F1 | 771C5263 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 4DA10 | 63A8033B | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 58763 | 54EEAB9D | pec1 | CALL [static] | Indirect call to absolute memory address |
| 5B71E | 231837AE | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 61F5D | 231837AE | pec1 | CALL [static] | Indirect call to absolute memory address |
| 65D1B | 231837AE | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 723A4 | 14AF135F | pec1 | CALL [static] | Indirect call to absolute memory address |
| 72DEC | 14AF135F | pec1 | CALL [static] | Indirect call to absolute memory address |
| 805A0 | 1C0C353E | pec1 | CALL [static] | Indirect call to absolute memory address |
| 80CF1 | 6ECC45DD | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 81B5A | 7B249FA9 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 81DD1 | 7B249FA9 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 831E8 | 57ADF36C | pec1 | CALL [static] | Indirect call to absolute memory address |
| 86C1B | 152AB80F | pec1 | CALL [static] | Indirect call to absolute memory address |
| 8844D | 152AB80F | pec1 | CALL [static] | Indirect call to absolute memory address |
| 89176 | 32280DC | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 89761 | 32280DC | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 8E5D5 | 526632DF | pec1 | CALL [static] | Indirect call to absolute memory address |
| 8F59D | 526632DF | pec1 | CALL [static] | Indirect call to absolute memory address |
| 921A2 | 1E0CD2B4 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 947FF | 1E0CD2B4 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 94E67 | 1E0CD2B4 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 9920F | 1E0CD2B4 | pec1 | CALL [static] | Indirect call to absolute memory address |
| 9E269 | 1E0CD2B4 | pec1 | CALL [static] | Indirect call to absolute memory address |
| A25E8 | 1E0CD2B4 | pec1 | CALL [static] | Indirect call to absolute memory address |
| A275E | 45506529 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| A858F | 45506529 | pec1 | CALL [static] | Indirect call to absolute memory address |
| B2F0F | 45506529 | pec1 | CALL [static] | Indirect call to absolute memory address |
| B5B45 | 45506529 | pec1 | CALL [static] | Indirect call to absolute memory address |
| B7308 | 58C7EC14 | pec1 | CALL [static] | Indirect call to absolute memory address |
| BE0AC | 7B109E14 | pec1 | CALL [static] | Indirect call to absolute memory address |
| BF8FC | 5F7632E6 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| C4234 | 5F7632E6 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| C6F54 | 5F7632E6 | pec1 | CALL [static] | Indirect call to absolute memory address |
| CB161 | 2A186D9C | pec1 | CALL [static] | Indirect call to absolute memory address |
| D173C | 2A186D9C | pec1 | CALL [static] | Indirect call to absolute memory address |
| D2C3A | 6545515C | pec1 | CALL [static] | Indirect call to absolute memory address |
| D72AB | 6545515C | pec1 | JMP [static] | Indirect jump to absolute memory address |
| DAE1A | 6545515C | pec1 | CALL [static] | Indirect call to absolute memory address |
| E28B3 | 6545515C | pec1 | JMP [static] | Indirect jump to absolute memory address |
| ED6A2 | 3EF1D898 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| EE945 | 6208EA5C | pec1 | CALL [static] | Indirect call to absolute memory address |
| F12CF | 6208EA5C | pec1 | JMP [static] | Indirect jump to absolute memory address |
| F2CBF | 5DFC4A41 | pec1 | CALL [static] | Indirect call to absolute memory address |
| F3C00 | 10306C80 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| F8B1F | 10306C80 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| FE501 | 2E21CD80 | pec1 | CALL [static] | Indirect call to absolute memory address |
| FF747 | 2E21CD80 | pec1 | CALL [static] | Indirect call to absolute memory address |
| FF890 | 2E21CD80 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 1097F0 | 2E21CD80 | pec1 | JMP [static] | Indirect jump to absolute memory address |
| 10C69B | D0E6E6D | pec1 | CALL [static] | Indirect call to absolute memory address |
| 127156 | D0E6E6D | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 128012 | D0E6E6D | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 128218 | D0E6E6D | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 129A11 | 7D5D7A81 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 132275 | 1602D400 | pec3 | CALL [static] | Indirect call to absolute memory address |
| 400-10E9FF | 1000 | pec1 | Executable section anomaly, first bytes: 00E0B03175630A20 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1041488 | 72,4157% |
| Null Byte Code | 38974 | 2,7099% |
© 2026 All rights reserved.