PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,71 MB SHA-256 Hash: 998A9E21DA98C98FB71A7868BBE3E751B19CFB7F72DCB888540FC9FB12A7C3D0 SHA-1 Hash: D4EEBFABC866AE78ECCF22F024019C5D488B706A MD5 Hash: 0FADDF4BF2D5D0F435B8F0048EC76C10 Imphash: 857DC463DC31B367EF16D64EE8E0646E MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 001C6252 EntryPoint (rva): D2680 SizeOfHeaders: 1000 SizeOfImage: 1BD000 ImageBase: 10000000 Architecture: x86 ExportTable: 197B40 ImportTable: 19401C IAT: 113000 Characteristics: 2102 TimeDateStamp: 56D4EEFC Date: 01/03/2016 1:23:08 File Type: DLL Number Of Sections: 5 ASLR: Disabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | 112000 | 1000 | 111C8F |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
113000 | 86000 | 113000 | 85250 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
199000 | 7000 | 199000 | C5E8 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1A0000 | 4000 | 1A6000 | 3658 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1A4000 | 13000 | 1AA000 | 128F6 |
|
|
| Description |
| OriginalFilename: nkcCore2.DLL LegalCopyright: Copyright (C) 2006 FileDescription: nkcCore2 DLL ProductVersion: 3. 0. 0. 6 Language: Japanese (Japan) (ID=0x411) CodePage: Unicode (UTF-16 LE) (0x4B0) Unusual Chars Found In Description File - (Polymorphic patterns or unicode characters) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - D2680 Code -> 558BEC837D0C017505E8B26C01008B4510508B4D0C518B550852E81100000083C40C5DC20C00CCCCCCCCCCCCCCCCCCCC558B Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X100D268E |CALL 0X100E9340 |MOV EAX, DWORD PTR [EBP + 0X10] |PUSH EAX |MOV ECX, DWORD PTR [EBP + 0XC] |PUSH ECX |MOV EDX, DWORD PTR [EBP + 8] |PUSH EDX |CALL 0X100D26B0 |ADD ESP, 0XC |POP EBP |RET 0XC |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |PUSH EBP |
| Signatures |
| Rich Signature Analyzer: Code -> 9B2DBDA3DF4CD3F0DF4CD3F0DF4CD3F01C438CF0D84CD3F01C438EF0C84CD3F0DF4CD2F0294ED3F04888ADF0DB4CD3F0F88AAEF0C14CD3F0F88ABEF0604CD3F03753D9F0EB4CD3F0F88ABDF01A4CD3F0F88AA9F0DE4CD3F0F88AAFF0DE4CD3F0F88AABF0DE4CD3F052696368DF4CD3F0 Footprint md5 Hash -> 5F75AE5B96A257A527CDAEA975FDF66F • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE: library: MFC(-)[static] • PE: compiler: Microsoft Visual C++(2005)[-] • PE: protection: Rainbow Sentinel dongle reference(-)[-] • PE: protection: Sentinel SuperPro dongle reference(-)[-] • PE: linker: Microsoft Linker(8.0 or 11.0)[-] • Entropy: 6.49319 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | IsBadReadPtr | Checks whether memory is readable. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | OpenEventA | Opens an existing event object. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | WSAStartup | Initializes the Winsock networking library. |
| Ws2_32.DLL | WSACleanup | Releases Winsock networking resources. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | listen | Puts a socket into listening mode. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegDeleteKeyA | Used to delete a subkey and its values from the Windows registry. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegDeleteValueA | Removes a named value from the specified registry key. Note that value names are not case sensitive. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| Windows REG |
| SOFTWARE\Noritsukoki\EZ Controller\InstallInfo SOFTWARE\NoritsuKoki\EZ Controller\InstallInfo SOFTWARE\Noritsukoki\NMPS\SettingModule\InstallInfo Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 Software\Microsoft\Windows\CurrentVersion\Policies\Network Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Software\Microsoft\Windows NT\CurrentVersion\NetworkCards System\CurrentControlSet\Control\ProductOptions SYSTEM\CurrentControlSet\Services\SENTINEL SYSTEM\CurrentControlSet\Services\SNTNLUSB Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - NoRun |
| File Access |
| inetmib1.dll snmpapi.dll wintrust.dll NETAPI32.DLL wsock32.dll nkcCore280.dll WS2_32.dll OLEAUT32.dll ole32.dll SHLWAPI.dll SHELL32.dll ADVAPI32.dll comdlg32.dll GDI32.dll USER32.dll KERNEL32.dll OLEACC.dll MSPDB80.DLL mscoree.dll mscoree.dll mfcm80d.dll UxTheme.dll comdlg32.dll comctl32.dll %s%s.dll ntdll.dll SNTNLUSB.SYS SENTINEL.SYS spserv.dat spnserv.dat nkcKey.dat @.dat SYSTEM.INI .INI MSG_JAPANESE.ini MSG_ENGLISH.ini %s\Common\MSG_%s.INI Temp |
| File Access (UNICODE) |
| nkcCore2.DLL GetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLL |
| Interest's Words |
| PADDINGX ToolBar PassWord exec attrib start hostname systeminfo ping openfiles replace |
| Interest's Words (UNICODE) |
| start expand |
| URLs |
| http://www.w3.org/XML/1998/namespace |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Antivirus Software (gdata) |
| Text | Ascii | Keyboard Key (LBUTTON) |
| Text | Ascii | Keyboard Key (MBUTTON) |
| Text | Ascii | Keyboard Key (RBUTTON) |
| Text | Ascii | Keyboard Key (Scroll) |
| Entry Point | Hex Pattern | MEW 10 packer v1.0 - Northfox |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1041 | 1A6A78 | 134 | 1A0A78 | 020002002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\1041 | 1A6BAC | B4 | 1A0BAC | 010001002800000010000000200000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(....... ..................................... |
| \CURSOR\3\1041 | 1A6C60 | 134 | 1A0C60 | 0F0014002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1041 | 1A6D94 | 134 | 1A0D94 | 100008002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1041 | 1A6EC8 | 134 | 1A0EC8 | 0A000E002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1041 | 1A6FFC | 134 | 1A0FFC | 15000E002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1041 | 1A7130 | 134 | 1A1130 | 0C0012002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\8\1041 | 1A7264 | 134 | 1A1264 | 140012002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\9\1041 | 1A7398 | 134 | 1A1398 | 0C000B002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\10\1041 | 1A74CC | 134 | 1A14CC | 13000A002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\11\1041 | 1A7600 | 134 | 1A1600 | 10000F002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\12\1041 | 1A7734 | 134 | 1A1734 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\13\1041 | 1A7868 | 134 | 1A1868 | 0F000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\14\1041 | 1A799C | 134 | 1A199C | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\15\1041 | 1A7AD0 | 134 | 1A1AD0 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\16\1041 | 1A7C04 | 134 | 1A1C04 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \BITMAP\30994\1041 | 1A7D38 | B8 | 1A1D38 | 280000000C0000000A0000000100040000000000500000000000000000000000000000000000000000000000000080000080 | (...................P............................. |
| \BITMAP\30996\1041 | 1A7DF0 | 144 | 1A1DF0 | 28000000210000000B0000000100040000000000DC0000000000000000000000000000000000000000000000000080000080 | (...!............................................. |
| \DIALOG\8000\0 | 1A7F34 | 112 | 1A1F34 | C000C0800000000005000000000018018C0000000000D130B930EF30FC30C9308D8AEF5300000C002DFF33FF200030FFB430 | .......................0.0.0.0.0...S....-.3. .0..0 |
| \DIALOG\8001\0 | 1A8048 | 1FA | 1A2048 | C000C080000000000A00000000001E018C0000000000AA30FC30CA30FC30D130B930EF30FC30C9302D8A9A5B00000C002DFF | .......................0.0.0.0.0.0.0.0.0-..[....-. |
| \DIALOG\30721\1041 | 1A8244 | E8 | 1A2244 | C400C88000000000050009001A00B700460000000000B0658F89000008004D00530020005300680065006C006C0020004400 | ................F......e......M.S. .S.h.e.l.l. .D. |
| \DIALOG\30734\1041 | 1A832C | 34 | 1A232C | C800C88000000000000009001A00B700460000000000000008004D00530020005300680065006C006C00200044006C0067000000 | ................F.........M.S. .S.h.e.l.l. .D.l.g... |
| \STRING\3841\1041 | 1A8360 | 62 | 1A2360 | 02008B954F3008000D544D529230D84E51306630DD4F585B0E005930793066306E30D530A130A430EB30200028002A002E002A002900020021714C9800000000070021714C986E30D530A130A430EB30000000000000000000000000000000000000 | ....O0...TMR.0.NQ0f0.OX[..Y0y0f0n0.0.0.0.0 .(.*...*.)...!qL.......!qL.n0.0.0.0.0.................. |
| \STRING\3842\1041 | 1A83C4 | 2E | 1A23C4 | 000007005E9768883A79280026004800290000000000000000000000000000000000000000000000000000000000 | .....h.:y(.&.H.)............................. |
| \STRING\3843\1041 | 1A83F4 | DC | 1A23F4 | 1000A830E930FC302000E130C330BB30FC30B8306F3042308A307E305B30933002301400B530DD30FC30C83055308C306630 | ...0.0.0 ..0.0.0.0.0o0B0.0~0[0.0.0...0.0.0.0U0.0f0 |
| \STRING\3857\1041 | 1A84D0 | 34A | 1A24D0 | 0B002171B9526A30D530A130A430EB300D546730593002301300C930AD30E530E130F330C83092308B954F30533068306B30 | ..!q.Rj0.0.0.0.0.Tg0Y0.0...0.0.0.0.0.0.0..O0S0h0k0 |
| \STRING\3858\1041 | 1A881C | 1BC | 1A281C | 0C0074657065923065519B52573066304F3060305530443002300C007065575B923065519B52573066304F30603055304430 | ..tepe.0eQ.RW0f0O00U0D0.0..peW[.0eQ.RW0f0O00U0D0 |
| \STRING\3859\1041 | 1A89D8 | 18E | 1A29D8 | 0E00884E1F6757306A304430D530A130A430EB30625F0F5F6730593002302B00250031000A0053306E30D530A130A430EB30 | ...N.gW0j0D0.0.0.0.0b_._g0Y0.0+.%.1...S0n0.0.0.0.0 |
| \STRING\3860\1041 | 1A8B68 | 74 | 1A2B68 | 1C00250031003A002000250032000A0043006F006E00740069006E0075006500B930AF30EA30D730C83092309F5B4C882D4E | ..%.1.:. .%.2...C.o.n.t.i.n.u.e..0.0.0.0.0.0.[L.-N |
| \STRING\3865\1041 | 1A8BDC | 76 | 1A2BDC | 0000000000000000000000000000000000000000000000001600F8664D30BC8F7F30025C2875D730ED30D130C630A3304B30 | ...........................fM0...0.\(u.0.0.0.0.0K0 |
| \STRING\3866\1041 | 1A8C54 | 8E | 1A2C54 | 1600E130FC30EB302000B730B930C630E0302000B530DD30FC30C8309230AD8A7F30BC8F81307E305B30933002301300E130 | ...0.0.0 ..0.0.0.0 ..0.0.0.0.0...0...0~0[0.0.0...0 |
| \STRING\3867\1041 | 1A8CE4 | 2DC | 1A2CE4 | 0D00A830E930FC306F3042308A307E305B309330673057305F300230190025003100200078306E30A230AF30BB30B9302D4E | ...0.0.0o0B0.0~0[0.0g0W0_0.0..%.1. .x0n0.0.0.0.0-N |
| \STRING\3868\1041 | 1A8FC0 | 160 | 1A2FC0 | 0D00A830E930FC306F3042308A307E305B309330673057305F300230190025003100200078306E30A230AF30BB30B9302D4E | ...0.0.0o0B0.0~0[0.0g0W0_0.0..%.1. .x0n0.0.0.0.0-N |
| \STRING\3869\1041 | 1A9120 | 28 | 1A3120 | 0400D430AF30BB30EB30000000000000000000000000000000000000000000000000000000000000 | ...0.0.0.0.............................. |
| \STRING\3887\1041 | 1A9148 | 2C | 1A3148 | 00000200AA30D5300200AA30F3300200F76D0854000000000000000000000000000000000000000000000000 | .....0.0...0.0...m.T........................ |
| \GROUP_CURSOR\30977\1041 | 1A9174 | 22 | 1A3174 | 00000200020020004000010001003401000001001000200001000100B40000000200 | ...... .@.....4....... ........... |
| \GROUP_CURSOR\30998\1041 | 1A9198 | 14 | 1A3198 | 0000020001002000400001000100340100000800 | ...... .@.....4..... |
| \GROUP_CURSOR\30999\1041 | 1A91AC | 14 | 1A31AC | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\31000\1041 | 1A91C0 | 14 | 1A31C0 | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_CURSOR\31001\1041 | 1A91D4 | 14 | 1A31D4 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\31002\1041 | 1A91E8 | 14 | 1A31E8 | 0000020001002000400001000100340100000D00 | ...... .@.....4..... |
| \GROUP_CURSOR\31003\1041 | 1A91FC | 14 | 1A31FC | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\31004\1041 | 1A9210 | 14 | 1A3210 | 0000020001002000400001000100340100000A00 | ...... .@.....4..... |
| \GROUP_CURSOR\31005\1041 | 1A9224 | 14 | 1A3224 | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\31006\1041 | 1A9238 | 14 | 1A3238 | 0000020001002000400001000100340100000900 | ...... .@.....4..... |
| \GROUP_CURSOR\31007\1041 | 1A924C | 14 | 1A324C | 0000020001002000400001000100340100000B00 | ...... .@.....4..... |
| \GROUP_CURSOR\31008\1041 | 1A9260 | 14 | 1A3260 | 0000020001002000400001000100340100000C00 | ...... .@.....4..... |
| \GROUP_CURSOR\31009\1041 | 1A9274 | 14 | 1A3274 | 0000020001002000400001000100340100000E00 | ...... .@.....4..... |
| \GROUP_CURSOR\31010\1041 | 1A9288 | 14 | 1A3288 | 0000020001002000400001000100340100000F00 | ...... .@.....4..... |
| \GROUP_CURSOR\31011\1041 | 1A929C | 14 | 1A329C | 0000020001002000400001000100340100001000 | ...... .@.....4..... |
| \VERSION\1\1041 | 1A92B0 | 350 | 1A32B0 | 500334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | P.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\2\1033 | 1A9600 | 56 | 1A3600 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C2F617373656D626C793E | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">..</assembly> |
| Intelligent String |
| • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlwin.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\output.c • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmini.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olereg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\barcool.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl6.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bardock.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\doccore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dockcont.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\tooltip.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp • KERNEL32.DLL • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\ccdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\docmgr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\doctempl.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filelist.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winbtn.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\trckrect.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgprop.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_sp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pw.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_u.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl3.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp • GDI32.DLL • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dllmodul.cpp • .\nkcCore2KeyCheck.cpp • .\nkcCore2.cpp • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\cstringt.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlexcept.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlsimpstr.h • %s\Common\MSG_%s.INI • nkcKey.dat • MSG_ENGLISH.iniMSG_JAPANESE.ini • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlconv.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlalloc.h • http://www.w3.org/XML/1998/namespace • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp • hhctrl.ocx • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcomctl32.hInitCommonControls • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxdlgs.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxext.inl • kernel32.dll • ntdll.dll • %s%s.dll • <comctl32.dll • ;<comdlg32.dll • user32.dll • .CHM • .HLP • .INI • CDumpContext • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp • Unable to dump object in static release builds • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcommem.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp m_cause = • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppCArchive exception: %hs. • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppCArchiveException • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cppm_cause = • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cppUnknownCFile exception: %hs, File %s, OS error information = %ld. • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgfile.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\barcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appdlg.cpp • :%df:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgclr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\timecore.cpp • CLSID\%1\InprocHandler32ole32.dll • mscoree.dllfaulted while dumping object at $%p, %u bytes long • faulted while dumping object at $%p, %u bytes long • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oletyplb.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c • f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c • Object dump complete. • File Error(%d) : Dumping objects -> • _CrtMemDumpStatistics • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcscpy_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\malloc.h • f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcsncpy_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcscat_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tsplitpath_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tmakepath_s.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c • f:\dd\vctools\crt_bld\self_x86\crt\src\crtmbox.c • ftypname.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\input.c • F:\dd\vctools\crt_bld\SELF_X86\crt\src\ungetc_nolock.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\mbsncpy_s.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c • f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c • tzset.cTZ • ../include\strgtold12.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpcoll.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h • OLEACC.dll • KERNEL32.dll • DestroyWindowRCreateDialogIndirectParamA • USER32.dll • WINSPOOL.DRV • ADVAPI32.dll • WS2_32.dll • .\nkcChangePass.cpp • .\nkcCheckPass1.cpp • Global\%s%s • 127.0.0.1 • spnserv.dat • spserv.dat • wintrust.dll • SENTINEL.SYS |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 1842 | 1011305C | .text | CALL [static] | Indirect call to absolute memory address |
| 1870 | 10113060 | .text | CALL [static] | Indirect call to absolute memory address |
| 18D5 | 10113064 | .text | CALL [static] | Indirect call to absolute memory address |
| 191C | 101133A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 199C | 10113394 | .text | CALL [static] | Indirect call to absolute memory address |
| 2491 | 1011305C | .text | CALL [static] | Indirect call to absolute memory address |
| 24BF | 10113060 | .text | CALL [static] | Indirect call to absolute memory address |
| 2525 | 10113064 | .text | CALL [static] | Indirect call to absolute memory address |
| 256D | 101133A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 25EB | 10113394 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AC0 | 1019F508 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2ADC | 10113654 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AEB | 10113658 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AF9 | 1011365C | .text | CALL [static] | Indirect call to absolute memory address |
| 2B59 | 10113650 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B80 | 1019F508 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B9B | 1011364C | .text | CALL [static] | Indirect call to absolute memory address |
| 2BCA | 1019F508 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BD1 | 1011364C | .text | CALL [static] | Indirect call to absolute memory address |
| 2C7C | 10113650 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CA3 | 1019F508 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CB9 | 1011364C | .text | CALL [static] | Indirect call to absolute memory address |
| 2CF0 | 1019F508 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CF7 | 1011364C | .text | CALL [static] | Indirect call to absolute memory address |
| 334B | 10113648 | .text | CALL [static] | Indirect call to absolute memory address |
| 40FF | 10113064 | .text | CALL [static] | Indirect call to absolute memory address |
| 4177 | 1011305C | .text | CALL [static] | Indirect call to absolute memory address |
| 41A0 | 10113060 | .text | CALL [static] | Indirect call to absolute memory address |
| 41C0 | 10113064 | .text | CALL [static] | Indirect call to absolute memory address |
| 44C4 | 10113044 | .text | CALL [static] | Indirect call to absolute memory address |
| 44DE | 10113630 | .text | CALL [static] | Indirect call to absolute memory address |
| 44E5 | 10113048 | .text | CALL [static] | Indirect call to absolute memory address |
| 4516 | 10113634 | .text | CALL [static] | Indirect call to absolute memory address |
| 451D | 10113638 | .text | CALL [static] | Indirect call to absolute memory address |
| 4560 | 10113050 | .text | CALL [static] | Indirect call to absolute memory address |
| 45AF | 10113054 | .text | CALL [static] | Indirect call to absolute memory address |
| 45F8 | 10113634 | .text | CALL [static] | Indirect call to absolute memory address |
| 45FF | 10113640 | .text | CALL [static] | Indirect call to absolute memory address |
| 4610 | 10113644 | .text | CALL [static] | Indirect call to absolute memory address |
| 4620 | 10113058 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B99 | 101133A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C8E | 1011305C | .text | CALL [static] | Indirect call to absolute memory address |
| 5CA8 | 10113060 | .text | CALL [static] | Indirect call to absolute memory address |
| 5F87 | 10113648 | .text | CALL [static] | Indirect call to absolute memory address |
| 621F | 10113990 | .text | CALL [static] | Indirect call to absolute memory address |
| 6432 | 1011305C | .text | CALL [static] | Indirect call to absolute memory address |
| 6458 | 10113060 | .text | CALL [static] | Indirect call to absolute memory address |
| 6465 | 10113064 | .text | CALL [static] | Indirect call to absolute memory address |
| 6840 | 1011362C | .text | JMP [static] | Indirect jump to absolute memory address |
| 68C2 | 10113628 | .text | CALL [static] | Indirect call to absolute memory address |
| 6954 | 1011364C | .text | CALL [static] | Indirect call to absolute memory address |
| 6980 | 10113624 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C30 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6C40 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6C4C | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C68 | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C90 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6CA0 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6CAC | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6CC3 | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6CE0 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6CF0 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6CFC | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D18 | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D40 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6D50 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6D5C | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D78 | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6DA0 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6DB0 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6DBC | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6DDD | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6E00 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6E10 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6E1C | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6E51 | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6E70 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6E80 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6E8C | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6EBC | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6EE0 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6EF0 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6EFC | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F1D | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F40 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6F50 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6F5B | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F6B | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F90 | 1011362C | .text | CALL [static] | Indirect call to absolute memory address |
| 6FA0 | 101135FC | .text | CALL [static] | Indirect call to absolute memory address |
| 6FAC | 10113600 | .text | CALL [static] | Indirect call to absolute memory address |
| 6FC8 | 10113604 | .text | CALL [static] | Indirect call to absolute memory address |
| 72B1 | 101135F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 73FD | 10113A2C | .text | CALL [static] | Indirect call to absolute memory address |
| 7D49 | 10113A2C | .text | CALL [static] | Indirect call to absolute memory address |
| 7D90 | 10113620 | .text | CALL [static] | Indirect call to absolute memory address |
| 7DC5 | 1011303C | .text | CALL [static] | Indirect call to absolute memory address |
| 7DDF | 10113040 | .text | CALL [static] | Indirect call to absolute memory address |
| 7E64 | 10113620 | .text | CALL [static] | Indirect call to absolute memory address |
| 7ECA | 10113038 | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1221196 | 67,9142% |
| Null Byte Code | 244905 | 13,6199% |
| NOP Cave Found | 0x9090909090 | Block Count: 677 | Total: 0,0941% |
© 2026 All rights reserved.