PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,44 MBSHA-256 Hash: 0196E57ABB0FAA12DADD8387334DE1A363D7B15D8E7ECBED90A272D94408E67E SHA-1 Hash: 9A0DF55C9BE104048173D05FCEF89B1460D21B92 MD5 Hash: 1955BC94616375959A3E9F67B17DD8A8 Imphash: 1C46E63756C8F98E2786B1AA1899845A MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 46BC8 SizeOfHeaders: 400 SizeOfImage: 17F000 ImageBase: 400000 Architecture: x86 ExportTable: 157450 ImportTable: 157520 IAT: 136000 Characteristics: 102 TimeDateStamp: 67AAA43E Date: 11/02/2025 1:13:34 File Type: EXE Number Of Sections: 7 ASLR: Enabled Section Names: .text, .rdata, .data, .gfids, .tls, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 134600 | 1000 | 134577 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
134A00 | 26800 | 136000 | 26778 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
15B200 | 7800 | 15D000 | 10590 |
|
|
| .gfids | 0x40000040 Initialized Data Readable |
162A00 | 200 | 16E000 | 64 |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
162C00 | 200 | 16F000 | 9 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
162E00 | 2800 | 170000 | 2620 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
165600 | B400 | 173000 | B298 |
|
|
| Description |
| LegalCopyright: Copyright (C) 2023 FileVersion: 1.0.0.0 ProductVersion: 1.0.0.0 Language: Chinese (Peoples Republic of China) (ID=0x804) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 45FC8 Code -> E801050000E98EFEFFFFFF25F4685300558BEC56FF75088BF1E8FA62FFFFC706346B53008BC65E5DC20400836104008BC183 Assembler |CALL 0X4470CE |JMP 0X446A60 |JMP DWORD PTR [0X5368F4] |PUSH EBP |MOV EBP, ESP |PUSH ESI |PUSH DWORD PTR [EBP + 8] |MOV ESI, ECX |CALL 0X43CEE0 |MOV DWORD PTR [ESI], 0X536B34 |MOV EAX, ESI |POP ESI |POP EBP |RET 4 |AND DWORD PTR [ECX + 4], 0 |MOV EAX, ECX |
| Signatures |
| Rich Signature Analyzer: Code -> 6B6E964B2F0FF8182F0FF8182F0FF81826776B183B0FF818B851FC192E0FF8189851F9192D0FF8188251FB19200FF8188251FC19220FF818BD51FD192D0FF8188251F9192B0FF8188251FD190C0FF818FC7DF919320FF8182F0FF918A90DF8189851F119040FF8189851F8192E0FF818985107182E0FF8182F0F6F182E0FF8189851FA192E0FF818526963682F0FF818 Footprint md5 Hash -> AF239DF9362AA2B50C6B2E21AD86C062 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Compiler: Microsoft Visual C ++ 6 DLL Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2013-2017)[EXE32] • PE: compiler: Microsoft Visual C/C++(2015 v.14.0)[-] • PE: linker: Microsoft Linker(14.0, Visual Studio 2015 14.0*)[-] • Entropy: 6.7025 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| SOFTWARE\%s SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| DeviceDriver.exe api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-utility-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-filesystem-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll VCRUNTIME140.dll HID.DLL YJXUI.dll IMM32.dll gdiplus.dll WINMM.dll MSVCP140.dll SHLWAPI.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll USER32.dll KERNEL32.dll SETUPAPI.dll atlthunk.dll .dat PRAGMA %Q.dat @.dat Temp |
| File Access (UNICODE) |
| control.exe DeviceDriver.exe Rkernel32.dll |
| SQL Queries |
| SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = %q_rowid SELECT * FROM %Q.%Q SELECT nodeno FROM %q.%q_rowid WHERE rowid = ?1 SELECT parentnode FROM %q.%q_parent WHERE nodeno = ?1 SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1 SELECT length(data) FROM %q.%q_node WHERE nodeno = 1 SELECT 1 FROM "%w".%s WHERE name NOT LIKE sqliteX_%% ESCAPE X AND sql NOT LIKE create virtual%% AND sqlite_rename_test(%Q, sql, type, name, %d)=NULL SELECT 1 FROM temp.%s WHERE name NOT LIKE sqliteX_%% ESCAPE X AND sql NOT LIKE create virtual%% AND sqlite_rename_test(%Q, sql, type, name, 1)=NULL SELECT tbl,idx,stat FROM %Q.sqlite_stat1 SELECT sql FROM "%w".sqlite_master WHERE type=tableAND name<>sqlite_sequence AND coalesce(rootpage,1)>0 SELECT sql FROM "%w".sqlite_master WHERE type=index SELECT NOT EXISTS(SELECT docid FROM %Q.%q_content WHERE rowid!=?) SELECT (SELECT max(idx) FROM %Q.%q_segdir WHERE level = ?) + 1 SELECT coalesce((SELECT max(blockid) FROM %Q.%q_segments) + 1, 1) SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level = ? ORDER BY idx ASC SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level BETWEEN ? AND ?ORDER BY level DESC, idx ASC SELECT count(*) FROM %Q.%q_segdir WHERE level = ? SELECT max(level) FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? SELECT size FROM %Q.%q_docsize WHERE docid=? SELECT value FROM %Q.%q_stat WHERE id=? SELECT ? UNION SELECT level / (1024 * ?) FROM %Q.%q_segdir SELECT level, count(*) AS cnt FROM %Q.%q_segdirGROUP BY level HAVING cnt>=? ORDER BY (level %% 1024) ASC LIMIT 1 SELECT 2 * total(1 + leaves_end_block - start_block)FROM %Q.%q_segdir WHERE level = ? AND idx < ? SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level = ? AND idx = ? SELECT 1 FROM %Q.%q_segments WHERE blockid=? AND block IS NULL SELECT idx FROM %Q.%q_segdir WHERE level=? ORDER BY 1 ASC SELECT max( level %% 1024 ) FROM %Q.%q_segdir SELECT level, idx, end_block FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? ORDER BY level DESC, idx ASC SELECT data FROM %Q.%q_node WHERE nodeno=? SELECT parentnode FROM %Q.%q_parent WHERE nodeno=?1 SELECT nodeno FROM %Q.%q_rowid WHERE rowid=?1 SELECT count(*) FROM %Q.%q%s SELECT * FROM %Q.%q_rowid SELECT k, v FROM %Q.%q_config SELECT pgno FROM %q.%q_idx WHERE segid=? AND term<=? ORDER BY term DESC LIMIT 1 SELECT segid, term, (pgno>>1), (pgno&1) FROM %Q.%q_idx WHERE segid=%d SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s SELECT %s FROM %s T WHERE T.%Q >= ? AND T.%Q <= ? ORDER BY T.%Q ASC SELECT %s FROM %s T WHERE T.%Q <= ? AND T.%Q >= ? ORDER BY T.%Q DESC SELECT %s FROM %s T WHERE T.%Q=? SELECT sz FROM %Q.%q_docsize WHERE id=? SELECT %s FROM %s AS T SELECT count(*) FROM %Q.%q_%s SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH *id SELECT pw=sqlite_crypt(?1,pw), isAdmin FROM "%w".sqlite_user WHERE uname=?2 SELECT value FROM t_configdata WHERE profile = ? and key = ? SELECT * FROM t_profile_data SELECT profile FROM t_profile_data WHERE status = ? SELECT * FROM t_key_macro_data WHERE profile = ? and fn_layer = ? and key_code = ? SELECT * FROM t_key_macro_data WHERE profile = ? and fn_layer = ? SELECT mode FROM t_light_data WHERE profile = ? and status = ? SELECT * FROM t_light_data WHERE profile = ? AND mode = ? SELECT * FROM t_light_data WHERE profile = ? SELECT * FROM t_macro_data WHERE macro_id = ? SELECT * FROM t_macro_data SELECT * FROM t_macrorecord WHERE macro_id = ? ORDER BY record_index ASC INSERT INTO "%w"."%w_node"VALUES(1,zeroblob(%d)) INSERT INTO %Q.%s VALUES(index,%Q,%Q,%d,%Q); INSERT INTO %Q.%s VALUES(trigger,%Q,%Q,0,CREATE TRIGGER %q) INSERT INTO vacuum_db.||quote(name)|| SELECT*FROM"%w".||quote(name)FROM vacuum_db.sqlite_master WHERE type=tableAND coalesce(rootpage,1)>0 INSERT INTO vacuum_db.sqlite_master SELECT*FROM "%w".sqlite_master WHERE type IN(view,trigger) OR(type=tableAND rootpage=0) INSERT INTO %Q.%q_content VALUES(%s) INSERT INTO %q.%q_idx(segid,term,pgno) VALUES(?,?,?) INSERT INTO t_configdata(profile, key, value) VALUES (?, ?, ?); INSERT INTO t_config_data(profile, key, value) VALUES (?, ?, ?); INSERT INTO t_profile_data(name, status, app, type) VALUES (?, ?, ?, ?); INSERT INTO t_key_macro_data(profile, fn_layer, key_code, layout_value, layout_desc, macro_type, macro_value, macro_value2, macro_value3, macro_desc) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?); INSERT INTO t_macro_data(name, play_type, play_times, delay_type, delay_time) VALUES (?, ?, ?, ?, ?); INSERT INTO t_macrorecord(macro_id, type, record_index, desc, value, delay_time) VALUES (?, ?, ?, ?, ?, ?); CREATE TABLE x CREATE TABLE x(value,pointer hidden,count hidden,ctype hidden) CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN) CREATE TABLE IF NOT EXISTS %Q.%q_stat(id INTEGER PRIMARY KEY, value BLOB); CREATE TABLE %Q.%q_content(%s) CREATE TABLE %Q.%q_segments(blockid INTEGER PRIMARY KEY, block BLOB); CREATE TABLE %Q.%q_segdir(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx)); CREATE TABLE %Q.%q_docsize(docid INTEGER PRIMARY KEY, size BLOB); CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN) CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY,nodeno CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY,data); CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode); CREATE TABLE x(value,start hidden,stop hidden,step hidden) CREATE TABLE x(%s CREATE TABLE x(_shape CREATE TABLE x( CREATE TABLE %Q.%s(%s) CREATE TABLE CREATE TABLE %Q.sqlite_sequence(name,seq) CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text) CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN) CREATE TABLE x(input, token, start, end, position) CREATE TABLE %Q.%q_%q(%s)%s CREATE TABlE vocab(term, col, doc, cnt) CREATE TABlE vocab(term, doc, cnt) CREATE TABlE vocab(term, doc, col, offset) CREATE TABLE x(name,mode,mtime,data,path HIDDEN,dir HIDDEN) CREATE TABLE IF NOT EXISTS t_configdata(config_id INTEGER PRIMARY KEY AUTOINCREMENT,profile INTEGER, key TEXT, value TEXT) CREATE TABLE IF NOT EXISTS t_profile_data(profile INTEGER PRIMARY KEY AUTOINCREMENT,name TEXT, status INTEGER, app TEXT, type INTEGER) CREATE TABLE IF NOT EXISTS t_key_macro_data(key_id INTEGER PRIMARY KEY AUTOINCREMENT, profile INTEGER, fn_layer INTEGER, key_code INTEGER, layout_value INTEGER, layout_desc TEXT, macro_type INTEGER, macro_value INTEGER, macro_value2 INTEGER, macro_value3 INTEGER, macro_desc TEXT) CREATE TABLE IF NOT EXISTS t_key_otherdata(macro_value INTEGER PRIMARY KEY AUTOINCREMENT,macro_desc TEXT, param TEXT, type INTEGER) CREATE TABLE IF NOT EXISTS t_macro_data(macro_id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT, play_type INTEGER, play_times INTEGER, delay_type INTEGER, delay_time INTEGER) CREATE TABLE IF NOT EXISTS t_macrorecord(record_id INTEGER PRIMARY KEY AUTOINCREMENT,macro_id INTEGER, type INTEGER, record_index INTEGER, desc TEXT, value INTEGER, delay_time INTEGER) CREATE TABLE IF NOT EXISTS t_light_data(light_id INTEGER PRIMARY KEY AUTOINCREMENT,profile INTEGER, name TEXT, mode INTEGER, brightness INTEGER, speed INTEGER, direction INTEGER, colorful INTEGER, colorindex INTEGER, color_value INTEGER, config_func INTEGER, reserved INTEGER, status INTEGER) CREATE TABLE IF NOT EXISTS t_key_light_data(keylight_id INTEGER PRIMARY KEY AUTOINCREMENT, profile INTEGER, light_id INTEGER, key_code INTEGER, key_rgb INTEGER) DROP TABLE %q.%q_node;DROP TABLE %q.%q_rowid;DROP TABLE %q.%q_parent; DROP TABLE IF EXISTS %Q.%q_segments;DROP TABLE IF EXISTS %Q.%q_segdir;DROP TABLE IF EXISTS %Q.%q_docsize;DROP TABLE IF EXISTS %Q.%q_stat;%s DROP TABLE IF EXISTS %Q.%q_content; DROP TABLE to delete table %s DROP TABLE IF EXISTS %Q.%q_data;DROP TABLE IF EXISTS %Q.%q_idx;DROP TABLE IF EXISTS %Q.%q_config; DROP TABLE IF EXISTS %Q.%q_docsize; DROP TABLE IF EXISTS %Q.%q_content; DELETE FROM %q.%q_node WHERE nodeno = ?1 DELETE FROM %q.%q_rowid WHERE rowid = ?1 DELETE FROM %q.%q_parent WHERE nodeno = ?1 DELETE FROM %Q.%s WHERE %s=%Q DELETE FROM %Q.sqlite_sequence WHERE name=%Q DELETE FROM %Q.%s WHERE tbl_name=%Q and type!=trigger DELETE FROM %Q.%s WHERE name=%Q AND type=index DELETE FROM %Q.%s WHERE name=%Q AND type=trigger DELETE FROM %Q.%q_content WHERE rowid = ? DELETE FROM %Q.%q_content DELETE FROM %Q.%q_segments DELETE FROM %Q.%q_segdir DELETE FROM %Q.%q_docsize DELETE FROM %Q.%q_stat DELETE FROM %Q.%q_segdir WHERE level = ? DELETE FROM %Q.%q_segments WHERE blockid BETWEEN ? AND ? DELETE FROM %Q.%q_docsize WHERE docid = ? DELETE FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? DELETE FROM %Q.%q_segdir WHERE level = ? AND idx = ? DELETE FROM %q.%q_data WHERE id>=? AND id<=? DELETE FROM %q.%q_idx WHERE segid=? DELETE FROM %Q.%q_content WHERE id=? DELETE FROM %Q.%q_docsize WHERE id=? DELETE FROM %Q.%q_data;DELETE FROM %Q.%q_idx; DELETE FROM %Q.%q_docsize; DELETE FROM t_configdata DELETE FROM t_profile_data DELETE FROM t_key_macro_data DELETE FROM t_key_otherdata DELETE FROM t_macro_data DELETE FROM t_macrorecord DELETE FROM t_light_data DELETE FROM t_key_light_data DELETE FROM t_customlight_data DELETE FROM t_customrgb_data DELETE FROM t_musiclayer_data DELETE FROM sqlite_sequence DELETE FROM t_key_macro_data WHERE profile = ? and fn_layer = ? and key_code = ? DELETE FROM t_key_macro_data WHERE profile = ? DELETE FROM t_macro_data WHERE macro_id = ? DELETE FROM t_macrorecord WHERE macro_id = ? |
| Interest's Words |
| exec unescape attrib start cipher shutdown systeminfo ping replace |
| Interest's Words (UNICODE) |
| start pause |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Antivirus Software (gdata) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Keyboard Key (Num 0) |
| Text | Unicode | Keyboard Key (Num 1) |
| Text | Unicode | Keyboard Key (Num 2) |
| Text | Unicode | Keyboard Key (Num 3) |
| Text | Unicode | Keyboard Key (Num 4) |
| Text | Unicode | Keyboard Key (Num 5) |
| Text | Unicode | Keyboard Key (Num 6) |
| Text | Unicode | Keyboard Key (Num 7) |
| Text | Unicode | Keyboard Key (Num 8) |
| Text | Unicode | Keyboard Key (Num 9) |
| Text | Unicode | Keyboard Key (Num -) |
| Text | Unicode | Keyboard Key (Num +) |
| Text | Unicode | Keyboard Key (Num Del) |
| Text | Unicode | Keyboard Key (Num *) |
| Text | Unicode | Keyboard Key (Page Down) |
| Text | Unicode | Keyboard Key (Scroll) |
| Text | Unicode | Keyboard Key (Num Lock) |
| Text | Unicode | Keyboard Key (Backspace) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\2052 | 1702B0 | EA8 | 1630B0 | 2800000030000000600000000100080000000000800A00000000000000000000000100000000000000000000FFFFFF001430 | (...0...........................................0 |
| \ICON\2\2052 | 171170 | EA8 | 163F70 | 2800000030000000600000000100080000000000800A00000000000000000000000100000000000000000000FFFFFF001430 | (...0...........................................0 |
| \MENU\109\2052 | 172030 | 50 | 164E30 | 0000000010008765F64E28002600460029000000800069000090FA512800260058002900000090002E5EA952280026004800290000008000680073518E4E280026004100290020002E002E002E000000 | .......e.N(.&.F.).....i....Q(.&.X.).......R(.&.H.).....h.sQ.N(.&.A.). ......... |
| \DIALOG\103\2052 | 172090 | 130 | 164E90 | 0100FFFF0000000000000000C800C880040000000000AA003E000000000073518E4E20004400650076006900630065004400 | ........................>.....sQ.N .D.e.v.i.c.e.D. |
| \STRING\7\2052 | 172350 | 50 | 165150 | 00000000000000000000000000000C00440065007600690063006500440072006900760065007200000000000000000000000C0044004500560049004300450044005200490056004500520000000000 | ................D.e.v.i.c.e.D.r.i.v.e.r.............D.E.V.I.C.E.D.R.I.V.E.R..... |
| \ACCELERATOR\109\2052 | 172080 | 10 | 164E80 | 10003F006800000090002F0068000000 | ..?.h...../.h... |
| \GROUP_ICON\107\2052 | 171158 | 14 | 163F58 | 0000010001003030000001000800A80E00000100 | ......00............ |
| \GROUP_ICON\108\2052 | 172018 | 14 | 164E18 | 0000010001003030000001000800A80E00000200 | ......00............ |
| \VERSION\1\2052 | 1721C0 | 18C | 164FC0 | 8C0134000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 1723A0 | 280 | 1651A0 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • 1.0.0.0 • api-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-convert-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • *.xml • @.tls • atlthunk.dll • DeviceDriver.exe • %s\config.xml • %slanguage\%d.lan • www.speedlink.com • sysbtn_restore.png • control.exe • sysbtn_maximize.png • icon\icon_rec.png • %s\%s-%d.xml • icon\icon_stop_rec.png • background.png • logo\logo.png • sysbtn_close.png • sysbtn_min.png • icon\icon_charge.png • icon\icon_battery_bkg.png • icon\icon_batteryvalue.png • 1.2.0.1 • img_state.png • icon\tab_key.png • icon\tab_macro.png • icon\tab_dpi.png • icon\tab_set.png • img_combobox.png • device\img_mouse.png • img_key_bkg.png • img_button.png • img_area3.png • btn_reset.png • img_help.png • img_area2.png • img_dpi_bar.png • img_btn_subtract.png • img_btn_addvalue.png • btn_radiobox.png • img_area_content.png • btn_checkbox.png • btn_more.png • icon\icon_record.png • img_edit.png • img_recorditem_down.png • img_recorditem_up.png • img_slider_bar.png • img_switch_btn_on.png • img_switch_btn_off.png • Emoji\wechat_emoji_%02d.png • bk_prompt.png • loading.gif • Rkernel32.dll • \bin\DeviceDriver.pdb • .bss • .tls • KERNEL32.dll • COMDLG32.dll • MSVCP140.dll • floorapi-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-filesystem-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll • api-ms-win-crt-utility-l1-1-0.dll • api-ms-win-crt-time-l1-1-0.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 491 | 5361E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4A7 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F0 | 5361E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 8A7 | 5361E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 9CD | 5362C8 | .text | CALL [static] | Indirect call to absolute memory address |
| BAD | 5362C8 | .text | CALL [static] | Indirect call to absolute memory address |
| CCF | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| DE3 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| E95 | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| F95 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 160A | 53670C | .text | CALL [static] | Indirect call to absolute memory address |
| 293B | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 2A61 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AD7 | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 2CE1 | 536230 | .text | CALL [static] | Indirect call to absolute memory address |
| 36CB | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 37A8 | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 384A | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E37 | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 3FA4 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FF5 | 5361D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4028 | 5361D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 40C9 | 5361CC | .text | CALL [static] | Indirect call to absolute memory address |
| 4154 | 5361CC | .text | CALL [static] | Indirect call to absolute memory address |
| 415E | 5368B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 42A8 | 536234 | .text | CALL [static] | Indirect call to absolute memory address |
| 4318 | 536234 | .text | CALL [static] | Indirect call to absolute memory address |
| 449C | 536398 | .text | CALL [static] | Indirect call to absolute memory address |
| 49B7 | 536234 | .text | CALL [static] | Indirect call to absolute memory address |
| 4A73 | 536234 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B1A | 536230 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B3B | 536230 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B86 | 536234 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C3B | 536398 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CAA | 5361CC | .text | CALL [static] | Indirect call to absolute memory address |
| 4CDC | 5361CC | .text | CALL [static] | Indirect call to absolute memory address |
| 4EFC | 53622C | .text | CALL [static] | Indirect call to absolute memory address |
| 4F17 | 53622C | .text | CALL [static] | Indirect call to absolute memory address |
| 4F46 | 536398 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FA3 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FB0 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FBD | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FC8 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FF1 | 536234 | .text | CALL [static] | Indirect call to absolute memory address |
| 5076 | 536230 | .text | CALL [static] | Indirect call to absolute memory address |
| 50CC | 536398 | .text | CALL [static] | Indirect call to absolute memory address |
| 5360 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5375 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5382 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 538F | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 539A | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 53D0 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 53E8 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 53F5 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5402 | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 540D | 5367D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 54B8 | 53622C | .text | CALL [static] | Indirect call to absolute memory address |
| 55DB | 536064 | .text | CALL [static] | Indirect call to absolute memory address |
| 5621 | 5368B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5745 | 5367D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5754 | 5367CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 5761 | 5367D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5770 | 5367CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 577D | 5367D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 578C | 5367CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 5795 | 536398 | .text | CALL [static] | Indirect call to absolute memory address |
| 57C9 | 53622C | .text | CALL [static] | Indirect call to absolute memory address |
| 57E3 | 53622C | .text | CALL [static] | Indirect call to absolute memory address |
| 5830 | 53622C | .text | CALL [static] | Indirect call to absolute memory address |
| 59BE | 53684C | .text | CALL [static] | Indirect call to absolute memory address |
| 59FC | 536844 | .text | CALL [static] | Indirect call to absolute memory address |
| 5A52 | 536068 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B4B | 536060 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B5B | 536118 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B69 | 5361EC | .text | CALL [static] | Indirect call to absolute memory address |
| 5BBB | 5361F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5BE0 | 5361FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5C1F | 536104 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C3B | 5361C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C6A | 5361C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5E71 | 5361F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5F58 | 5367D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5F64 | 5367CC | .text | CALL [static] | Indirect call to absolute memory address |
| 5FA1 | 5367D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5FAD | 5367CC | .text | CALL [static] | Indirect call to absolute memory address |
| 5FC1 | 5367D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5FCD | 5367CC | .text | CALL [static] | Indirect call to absolute memory address |
| 610B | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 62CD | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 63AB | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 6522 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 658F | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 6663 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 66F1 | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 6916 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6941 | 536230 | .text | CALL [static] | Indirect call to absolute memory address |
| 6B0B | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 6BF0 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C57 | 5361DC | .text | CALL [static] | Indirect call to absolute memory address |
| 6D13 | 5361D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E342-4E35F | N/A | .text | Unusual BP Cave, count: 30 |
| 8D3A2-8D3BF | N/A | .text | Unusual BP Cave, count: 30 |
| F1DED-F1E0F | N/A | .text | Unusual BP Cave, count: 35 |
| 1172AC-1172DF | N/A | .text | Unusual BP Cave, count: 52 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 926634 | 61,371% |
| Null Byte Code | 194269 | 12,8665% |
© 2026 All rights reserved.