PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,61 MBSHA-256 Hash: 69C75848FBF88165F2E243E785BDB12B673C9051BA1B4E94E5AEF9B9F4532E30 SHA-1 Hash: F07F57920116F186CB03DC8000175615418C30C8 MD5 Hash: E3B23C9BCD915FF267CB816F99C78CC6 Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 288536 SizeOfHeaders: 200 SizeOfImage: 2A2000 ImageBase: 400000 Architecture: x86 ImportTable: 2884E3 IAT: 2000 Characteristics: 102 TimeDateStamp: ED20B9CB Date: 25/01/2096 15:48:27 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names: .text, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
200 | 286600 | 2000 | 2865D8 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
286800 | 14E00 | 28A000 | 14C0C |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
29B600 | 200 | 2A0000 | C |
|
|
| Description |
| OriginalFilename: Crm.Admin.dll CompanyName: Crm.Admin ProductName: Crm.Admin FileVersion: 26.7.20.4 FileDescription: Crm.Admin ProductVersion: 26.7.20.4+b8889fc95c5cb219ef4d0601bcfa225df17baa28 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 286736 Code -> FF25002040000000000003000000010000000200000004000000050000000600000007000000080000000900000000000000 Assembler |JMP DWORD PTR [0X402000] |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD EAX, DWORD PTR [EAX] |ADD BYTE PTR [EAX], AL |ADD DWORD PTR [EAX], EAX |ADD BYTE PTR [EAX], AL |ADD AL, BYTE PTR [EAX] |ADD BYTE PTR [EAX], AL |ADD AL, 0 |ADD BYTE PTR [EAX], AL |ADD EAX, 0X6000000 |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EDI], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], CL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [ECX], CL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual .NET - (You can use a decompiler for this...) • AnyCPU: False • Version: v4.0 Detect It Easy (die) • PE: library: .NET(v4.0.30319)[-] • PE: linker: Microsoft Linker(48.0)[-] • Entropy: 6.36492 |
| File Access |
| !DataContext.Exe mscoree.dll Crm.Admin.dll Info.Scr Info.Scr .Sys System.Windows.Sys 1/SelectedProcessedOrder.Dat ,*SelectedProcessedOrder.Dat FindOrdersRequest.Dat 9Client.Libs.Markup.Converters.Dat System.Windows.Controls.Dat SelectedUser.Dat System.Windows.Dat +System.Windows.Controls.Dat /System.Windows.Controls.Dat &System.Windows.Controls.Dat .System.Windows.Controls.Dat (&MyMasterOrderData.User.Dat %MyMasterOrderData.User.Dat %ProcessedOrder.Dat ProcessedOrder.Dat ProcessedOrder.Dat )Microsoft.Xaml.Behaviors.Core.Dat 0SelectedTaskTemplate.Dat SelectedTaskTemplate.Dat ,SelectedTaskTemplate.Dat &SelectedTaskTemplate.Dat (SelectedTaskTemplate.Dat 4SelectedTaskTemplate.Data.Dat 4SelectedTaskTemplate.Dat (SelectedTask.Dat SelectedTask.Dat SelectedTask.Dat $SelectedTask.Dat SelectedTask.Dat SelectedTask.Dat ,SelectedTask.Data.Dat ,SelectedTask.Dat SelectedTask.Data.Dat CurrentMonitoringModel.Dat 42SelectedProcessedUnsoldOrder.Dat /-SelectedProcessedOrder.Dat .,SelectedProcessedOrder.Dat *(SelectedProcessedOrder.Dat !SelectedProcessedOrder.Dat 20SelectedOrder.MyMasterOrder.User.Dat 1/SelectedOrder.MyMasterOrder.User.Dat *(SelectedCall.ProcessedInfo.Dat ,*SelectedCall.ProcessedInfo.Dat ?ProblemResolved.Problems.ProblemsView.Notification.Dat ProblemUpdated.Problems.ProblemsView.Notification.Dat NewProblem.Problems.ProblemsView.Notification.Dat DOrderRequestedDateChange.Orders.OrdersView.Notification.Dat 0NewReport.OrderReports.Notification.Dat TimelineItem.Dat ,System.Windows.Dat -DataContext.SelectedMasterGroupItem.Dat SelectedItem.Dat SelectedMasterGroupItem.Dat -SelectedMasterGroupItem.Dat !SelectedMasterGroupItem.Dat SelectedCandidate.Dat %SelectedCandidate.Dat 42SelectedCandidate.Dat 8SelectedCandidate.Dat *(SelectedCandidate.Dat 97SelectedCandidate.Dat 53SelectedCandidate.Dat 31SelectedCandidate.Dat 1/SelectedCandidate.Dat 0.SelectedCandidate.Dat /-SelectedCandidate.Dat SelectedCandidate.Dat 64SelectedCandidate.Dat )SelectedCandidate.Dat SelectedCandidate.Dat SelectedCandidate.Dat !SelectedCandidate.Dat SelectedCandidate.Dat SelectedCandidate.Dat MasterCreated.TimelineItem.Dat CandidateCreated.TimelineItem.Dat Grade.TimelineItem.Dat (OrderRejection.TimelineItem.Dat !Problem.TimelineItem.Dat DialogBoxService.Dat InputBoxService.Dat 1/SelectedIndicatorItem.Dat 3DataContext.SelectedIndicatorItem.Dat 0.SelectedIndicatorItem.Dat 53SelectedIndicatorItem.Dat SelectedIndicatorItem.Dat *(SelectedIndicatorItem.Dat 9ViceCodeCrm.Admin.Entities.Models.Dat 0Template.ContentControl.ReportBuilder.Dat SelectedStaff.DismissalData.Dat SelectedPayrollMethod.Dat UserHistory.Dat .MyMasterReviewActions.UserHistory.Dat 7UpdateFaq.MyMasterAdminActions.UserHistory.Dat DUpdateItemOfferMapping.MyMasterAdminActions.UserHistory.Dat LUpdateItemBrunchDisableMapping.MyMasterAdminActions.UserHistory.Dat 9UpdatePrice.MyMasterAdminActions.UserHistory.Dat BUpdateBranchActivity.MyMasterAdminActions.UserHistory.Dat ?UpdateCatalogItem.MyMasterAdminActions.UserHistory.Dat ?CreateCatalogItem.MyMasterAdminActions.UserHistory.Dat -MyMasterAdminActions.UserHistory.Dat 5CreateInvoice.InvoiceActions.UserHistory.Dat InvoiceActions.UserHistory.Dat RemoveMapping.PaymentAccountActions.UserHistory.Dat UpdateMapping.PaymentAccountActions.UserHistory.Dat 9AddMapping.PaymentAccountActions.UserHistory.Dat UpdateAccount.PaymentAccountActions.UserHistory.Dat 9AddAccount.PaymentAccountActions.UserHistory.Dat .PaymentAccountActions.UserHistory.Dat -MapOrderMasterAssign.UserHistory.Dat MakeMasterCall.UserHistory.Dat .MyMasterClearCashback.UserHistory.Dat $ConnectLead.UserHistory.Dat CreateLead.UserHistory.Dat (DeletePromocode.UserHistory.Dat (CreatePromocode.UserHistory.Dat +ProcessedCallOrder.UserHistory.Dat FindOrder.UserHistory.Dat SendSms.UserHistory.Dat %MakeLeadCall.UserHistory.Dat !MakeCall.UserHistory.Dat Offline.UserHistory.Dat Online.UserHistory.Dat HistoryFilter.Dat !SelectedGeneralRule.Dat %SelectedGeneralRule.Dat SelectedAssistant.Dat SelectedAssistant.Dat SelectedAssistant.Dat SelectedRule.Dat SelectedRule.Dat SelectedRule.Dat %SelectedRule.Dat )SelectedRule.Dat (SelectedRule.Dat !SelectedRule.Dat &SelectedRule.Dat SelectedRule.Dat SelectedRule.Dat SelectedRule.Dat SelectedRule.Dat %SelectedRule.Dat 0.SelectedRequestConditionsItem.Dat 42SelectedRequestConditionsItem.Dat 31SelectedRequestConditionsItem.Dat 64SelectedRequestConditionsItem.Dat 8SelectedRequestConditionsItem.Dat 97SelectedRequestConditionsItem.Dat SelectedAccount.Dat ,*SelectedEntityActionsItem.Dat 0.SelectedEntityActionsItem.Dat /-SelectedEntityActionsItem.Dat 20SelectedEntityActionsItem.Dat 64SelectedEntityActionsItem.Dat 53SelectedEntityActionsItem.Dat SelectedEntityActionsItem.Dat *(SelectedEntityActionsItem.Dat %SelectedEntityActionsItem.Dat 31SelectedEntityActionsItem.Dat Client.Libs.Api.Converters.Dat (Client.Libs.Api.Converters.Dat Client.Libs.Api.Converters.Dat )Client.Libs.Api.Converters.Dat System.ComponentModel.Dat System.Dat ViceCode.Lib.Extensions.Dat Client.Libs.Message.Dat SelectedMaster.Log &ViceCodeCrm.Admin.MVVM.Views.Log LViceCodeCrm.Admin.MVVM.ViewModels.Log BViceCodeCrm.Admin.MVVM.ViewModels.Log Temp |
| File Access (UNICODE) |
| Route.Log Admin.dll explorer.exe Temp |
| Interest's Words |
| ToolBar PassWord <head <div <input <link <header exec attrib start pause shutdown ping dism expand getmac replace route |
| Interest's Words (UNICODE) |
| PassWord exec attrib start ping dism route |
| URLs |
| http://schemas.microsoft.com/winfx/2006/xaml/presentation http://schemas.microsoft.com/winfx/2006/xaml http://vicecode.com/wpf/xaml http://schemas.openxmlformats.org/markup-compatibility/2006 http://schemas.microsoft.com/expression/blend/2008 http://schemas.microsoft.com/xaml/behaviors https://www.gsmarena.com? https://www.gsmarena.com |
| URLs (UNICODE) |
| https://yandex.ru/maps/2/russia/search/{0} https://2gis.ru/search/{0} https://yandex.ru/maps/2/russia/search/{0}4 https://2gis.ru/search/{0}M@ |
| IP Addresses |
| 26.7.20.4 226.7.20.4 9.0.16.0 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (accept) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | Encryption (FromBase64String) |
| Text | Ascii | Encryption (ToBase64String) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Unicode | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Technique to insert malicious code into a vulnerable application (Injection) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Unicode | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Unicode | Technique used to circumvent security measures (Bypass) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\0 | 28A280 | 2E8 | 286A80 | 2800000020000000400000000100040000000000800200000000000000000000100000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\2\0 | 28A578 | 128 | 286D78 | 2800000010000000200000000100040000000000C00000000000000000000000100000000000000000000000000080000080 | (....... ......................................... |
| \ICON\3\0 | 28A6B0 | EA8 | 286EB0 | 2800000030000000600000000100080000000000800A0000000000000000000000010000000000000000000019181700161B | (...0............................................ |
| \ICON\4\0 | 28B568 | 8A8 | 287D68 | 28000000200000004000000001000800000000008004000000000000000000000001000000000000000000001E2C3B002934 | (... ...@....................................,;.)4 |
| \ICON\5\0 | 28BE20 | 568 | 288620 | 280000001000000020000000010008000000000040010000000000000000000000010000000000000000000056705000657B | (....... ...........@.......................VpP.e{ |
| \ICON\6\0 | 28C398 | 7A79 | 288B98 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600007A404944415478DAEC5D059C14651B | .PNG........IHDR.............\r.f..z@IDATx..]...e. |
| \ICON\7\0 | 293E24 | 4228 | 290624 | 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000 | (...@......... ......B............................ |
| \ICON\8\0 | 29805C | 25A8 | 29485C | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\9\0 | 29A614 | 1A68 | 296E14 | 2800000028000000500000000100200000000000401A00000000000000000000000000000000000000000000000000000000 | (...(...P..... .....@............................. |
| \ICON\10\0 | 29C08C | 10A8 | 29888C | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\11\0 | 29D144 | 988 | 299944 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\12\0 | 29DADC | 6B8 | 29A2DC | 2800000014000000280000000100200000000000900600000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... |
| \ICON\13\0 | 29E1A4 | 468 | 29A9A4 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \GROUP_ICON\32512\0 | 29E61C | BC | 29AE1C | 000001000D002020100001000400E8020000010010101000010004002801000002003030000001000800A80E000003002020 | ...... ....................(.....00............ |
| \VERSION\1\0 | 29E6E8 | 324 | 29AEE8 | 240334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000700 | $.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\0 | 29EA1C | 1EA | 29B21C | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • Crm.Admin.dll • 26.7.20.4 • http://schemas.microsoft.com/expression/blend/2008 • http://schemas.openxmlformats.org/markup-compatibility/2006 • RNSystem.Xaml, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089:x,http://schemas.microsoft.com/winfx/2006/xaml • WSPresentationCore, Version=8.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\XPresentationFramework, Version=8.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35eaSystem.Windows.Controls.Ribbon, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089RNWindowsBase, Version=8.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35F9http://schemas.microsoft.com/winfx/2006/xaml/presentation • :x,http://schemas.microsoft.com/winfx/2006/xaml • http://schemas.microsoft.com/winfx/2006/xaml/presentation • RNSystem.Xaml, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089:x,http://schemas.microsoft.com/winfx/2006/xaml • WSPresentationCore, Version=8.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\XPresentationFramework, Version=8.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35eaSystem.Windows.Controls.Ribbon, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089RNWindowsBase, Version=8.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35F9http://schemas.microsoft.com/winfx/2006/xaml/presentation • a>clr-namespace:Client.Libs.Markup.Attached;assembly=Client.Libs • .txt • explorer.exe • https://yandex.ru/maps/2/russia/search/{0} • https://2gis.ru/search/{0} • !MasterUnassigned • .jpg • .png • .bmp • .gif • loginViewModel • y/Crm.Admin;component/mvvm/authorization/views/loginview.xaml • Login • .wav • .exe • _{1}{2}.jpg • icon.ico • 226.7.20.4+b8889fc95c5cb219ef4d0601bcfa225df17baa28 • BViceCodeCrm.Admin.MVVM.ViewModels.LoginViewModel+<LoginAsync>d__22 • LViceCodeCrm.Admin.MVVM.ViewModels.LoginViewModel+<BackgroundLoginAsync>d__23 • 8mvvm/hr/views/staffview.baml • 1Client.Libs.Markup.Converters.IgnoreNullConverter$IsAsync%ToolTip&Name'TargetNullValueF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • &ViceCodeCrm.Admin.MVVM.Views.LoginView • http://vicecode.com/wpf/xaml • TargetName !CheckedBackgroundBrush "Success.Border.Brush E930 $Neutral.20.Brush %Neutral.40.Brush &EA39 !'PermissionStatusCheckBoxStyle %(!UserPermissionStatusCheckBoxStyleBasedOn )Success.Surface.Light.Brush $* JobPermissionStatusCheckBoxStyle +Success.Alt.Surface.Brush ,Success.Alt.Border.BrushF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • _[Microsoft.Xaml.Behaviors, Version=1.1.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a3i+http://schemas.microsoft.com/xaml/behaviorsDmc;http://schemas.openxmlformats.org/markup-compatibility/2006:d2http://schemas.microsoft.com/expression/blend/2008UlibsenumsEclr-namespace:Client.Libs.MethodProcessing.Enums;assembly=Client.Libs8vm/clr-namespace:ViceCodeCrm.Admin.MVVM.ViewModels@e8clr-namespace:ViceCodeCrm.Dto.Enums;assembly=Client.Libs&crmhttp://vicecode.com/wpf/xaml • 8enums.clr-namespace:ViceCodeCrm.Admin.Entities.Enums • e:Client.Libs.Markup.Converters;assembly=Client.Libs:enums.clr-namespace:ViceCodeCrm.Admin.Entities.EnumsFmoduleEnums4clr-namespace:ViceCodeCrm.Admin.MVVM.HR.Models.Enums&crmhttp://vicecode.com/wpf/xaml • ucBclr-namespace:Client.Libs.Markup.UserControls;assembly=Client.Libs • behaviors?clr-namespace:Client.Libs.Markup.Behaviors;assembly=Client.Libs • m4clr-namespace:ViceCodeCrm.Admin.MVVM.MyMaster.Models • :Client.Libs.Markup.Converters.DBNameToDescriptionConverterCommandCommandParameter HDOrderRequestedDateChange.Orders.OrdersView.Notification.DataTemplate >:NewProblem.Problems.ProblemsView.Notification.DataTemplate B>ProblemUpdated.Problems.ProblemsView.Notification.DataTemplate C?ProblemResolved.Problems.ProblemsView.Notification.DataTemplateF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • ucontrolsBclr-namespace:Client.Libs.Markup.UserControls;assembly=Client.Libs • Height)Path Primary.Chip.BrushF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • InTwoHours "Style.Path.Marker.Master.Round "Style.Path.ItemHeaderSeparator Style.Ellipse.RouteNumber Neutral.50.Brush Neutral.10.Brush Style.GridView.Header.CollapsedF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • /Client.Libs.Markup.UserControls.AdvancedListBox $! AdvancedListBoxStyle.Transparent?BasedOnF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • 9ViceCodeCrm.Admin.MVVM.ReportSettings.Models.SubscriptionPadding BorderStyle.Card.ProcessedOrientationStringFormatPath5/Client.Libs.Markup.UserControls.AdvancedListBoxSelectedItemConverter>8Client.Libs.Markup.Converters.EnumToDescriptionConverter<6Client.Libs.Markup.Converters.IntListToStringConverterF9http://schemas.microsoft.com/winfx/2006/xaml/presentation • http://schemas.microsoft.com/winfx/2006/xaml • _CorExeMainmscoree.dll • 26.7.20.4+b8889fc95c5cb219ef4d0601bcfa225df17baa28 |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 1F534 | 120400 | .text | CALL [static] | Indirect call to absolute memory address |
| 57EBA | 120400 | .text | CALL [static] | Indirect call to absolute memory address |
| 828C7 | 120400 | .text | JMP [static] | Indirect jump to absolute memory address |
| BE142 | 1B510003 | .text | JMP [static] | Indirect jump to absolute memory address |
| C6A42 | 5038C | .text | CALL [static] | Indirect call to absolute memory address |
| C6A54 | 5039A | .text | CALL [static] | Indirect call to absolute memory address |
| 119E64 | 21049 | .text | CALL [static] | Indirect call to absolute memory address |
| 11BA50 | 1D420001 | .text | CALL [static] | Indirect call to absolute memory address |
| 11BA56 | 1D430002 | .text | CALL [static] | Indirect call to absolute memory address |
| 11E452 | 16670000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AC045 | 16670000 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1B396E | 16670000 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1B9D9D | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BECAF | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C07D6 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1C15D9 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1C41B9 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1C7058 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D84BC | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DA62E | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1DA8D3 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DCB78 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1E2E69 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E4948 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1E6AD7 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1E7857 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E8495 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1E880D | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F1784 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F3B0D | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F4088 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 20D341 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 21033D | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 217986 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 21AD8F | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 21DB70 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 21E519 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 226844 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 226BF3 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 22C1A7 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 22D032 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 234CCA | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 235B89 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 2365CF | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 2389C6 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 239EDF | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 23AAD4 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 23B354 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 23C0B3 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 244BF5 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 24720E | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 249C51 | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 24A40F | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 24A9CA | 46030400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 24C15A | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C2A2 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C3C6 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C4F2 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C63D | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C791 | 46030400 | .text | CALL [static] | Indirect call to absolute memory address |
| 24CBF6 | E0700 | .text | CALL [static] | Indirect call to absolute memory address |
| 25082F | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 25BCD9 | 150E2400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 260481 | 150E2400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 261ED2 | 150E2400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 263E26 | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 263F7C | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 2640AE | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 2641E8 | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 264341 | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 26448F | 150E2400 | .text | CALL [static] | Indirect call to absolute memory address |
| 2644FC | 150700 | .text | CALL [static] | Indirect call to absolute memory address |
| 26452D | 150700 | .text | CALL [static] | Indirect call to absolute memory address |
| 2645CC | 150700 | .text | CALL [static] | Indirect call to absolute memory address |
| 26472B | 150700 | .text | CALL [static] | Indirect call to absolute memory address |
| 264DBD | C0700 | .text | JMP [static] | Indirect jump to absolute memory address |
| 26B1C7 | 41112400 | .text | CALL [static] | Indirect call to absolute memory address |
| 26C255 | 440700 | .text | CALL [static] | Indirect call to absolute memory address |
| 26E14C | 440700 | .text | JMP [static] | Indirect jump to absolute memory address |
| 26FA70 | 2087D132 | .text | CALL [static] | Indirect call to absolute memory address |
| 271998 | 2087D132 | .text | CALL [static] | Indirect call to absolute memory address |
| 2735E0 | 2087D132 | .text | CALL [static] | Indirect call to absolute memory address |
| 279837 | 2087D132 | .text | CALL [static] | Indirect call to absolute memory address |
| 2802C0 | 2087D132 | .text | CALL [static] | Indirect call to absolute memory address |
| 284674 | 2087D132 | .text | JMP [static] | Indirect jump to absolute memory address |
| 286736 | 402000 | .text | JMP [static] | Indirect jump to absolute memory address |
| 28E8F6 | 8823F5D | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 292A23 | 25FFF551 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 292A27 | 25FFF451 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 292A2B | 24FEF451 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 292C33 | FFEF551 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 292F37 | 12FEF852 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 29313B | FFEF852 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 293213 | 26FEF752 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2934F7 | EFEF852 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 293723 | 24FEF551 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 29383B | EFEF752 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 293A37 | 12FEF853 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 295FB3 | 10FEF652 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 296117 | 25FEF752 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1745203 | 63,8315% |
| Null Byte Code | 511515 | 18,7089% |
© 2026 All rights reserved.