PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,11 MB SHA-256 Hash: 1E216CED513116C95B6632DCD928041184AE2CE3D41765EB800B5F208F4C543B SHA-1 Hash: 7B4D5A4D155055F5CE1B8CE4A3077786BE2C713D MD5 Hash: 8F79A339F87F38C776A55D34152A3DB3 Imphash: 4C7304AD792BAEC7F44357E083EDA7B8 MajorOSVersion: 10 MinorOSVersion: 0 CheckSum: 00125956 EntryPoint (rva): 92000 SizeOfHeaders: 1000 SizeOfImage: 118000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: FB400 ImportTable: FFDE4 IAT: E8C18 Characteristics: 2022 TimeDateStamp: 137C0EB Date: 25/08/1970 11:18:03 File Type: DLL Number Of Sections: 9 ASLR: Disabled Section Names (Optional Header): .text, .ndr64, fothk, .rdata, .data, .pdata, .didat, .rsrc, .reloc Number Of Executable Sections: 3 Subsystem: Windows Console |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | D4000 | 1000 | D3CB9 |
|
|
| .ndr64 | 0x60000020 Code Executable Readable |
D5000 | 7000 | D5000 | 696B |
|
|
| fothk | 0x60000020 Code Executable Readable |
DC000 | 1000 | DC000 | 1000 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
DD000 | 26000 | DD000 | 25CA2 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
103000 | 1000 | 103000 | 15E0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
104000 | A000 | 105000 | 9744 |
|
|
| .didat | 0xC0000040 Initialized Data Readable Writeable |
10E000 | 1000 | 10F000 | 290 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
10F000 | 6000 | 110000 | 5860 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
115000 | 2000 | 116000 | 184C |
|
|
| Description |
| OriginalFilename: rpcrt4.dll CompanyName: Microsoft Corporation LegalCopyright: Microsoft Corporation. All rights reserved. ProductName: Microsoft Windows Operating System FileVersion: 10.0.26100.8875 (WinBuild.160101.0800) FileDescription: Remote Procedure Call Runtime ProductVersion: 10.0.26100.8875 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 15,41 KB |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 92000 Code -> 48895C2408574883EC208BFA498BD8BA010000003BFA74194C8BC38BD7E81E000000488B5C24300FB6C04883C4205FC3CCE8 Assembler |MOV QWORD PTR [RSP + 8], RBX |PUSH RDI |SUB RSP, 0X20 |MOV EDI, EDX |MOV RBX, R8 |MOV EDX, 1 |CMP EDI, EDX |JE 0X180092031 |MOV R8, RBX |MOV EDX, EDI |CALL 0X180092040 |MOV RBX, QWORD PTR [RSP + 0X30] |MOVZX EAX, AL |ADD RSP, 0X20 |POP RDI |RET |INT3 |
| Signatures |
| Rich Signature Analyzer: Code -> 8B2F5AFBCF4E34A8CF4E34A8CF4E34A8C636A7A8F74E34A8B6CF35A9CA4E34A8CF4E35A86B4F34A8CF4E34A8CE4E34A8B6CF30A9C34E34A8B6CF37A9CA4E34A8B6CF3CA9634E34A8B6CF34A9CE4E34A8B6CFCBA8CE4E34A8B6CF36A9CE4E34A852696368CF4E34A8 Footprint md5 Hash -> DF72808D5FD06BFFA97242643B33417E • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): linker: Microsoft Linker(14.38**)[-] • PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.24184 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| Ws2_32.DLL | socket | Possible Call API By Name | Create a communication endpoint for networking applications. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | QueueUserAPC | Queues an APC for thread execution. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegDeleteKeyExA | Deletes a registry key. |
| ADVAPI32.DLL | RegGetValueA | Reads data from a registry value. |
| ADVAPI32.DLL | RegGetValueW | Reads data from a registry value. |
| ET Functions (carving) |
| Original Name -> RPCRT4.dll I_RpcBindingInqCurrentModifiedId I_RpcFixTransferSyntax I_RpcFwThisIsTheManager I_RpcInitFwImports I_RpcInitHttpImports I_RpcInitImports I_RpcInitNdrImports I_RpcMgmtQueryDedicatedThreadPool I_RpcOpenClientThread I_RpcServerTurnOnOffKeepalives I_RpcVerifierCorruptionExpected NdrFullPointerFree NdrFullPointerInsertRefId NdrFullPointerQueryPointer NdrFullPointerQueryRefId NdrpClientCall2 RpcCertMatchPrincipalName pfnFreeRoutines pfnMarshallRoutines pfnSizeRoutines pfnUnmarshallRoutines CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface CreateProxyFromTypeInfo CreateStubFromTypeInfo DceErrorInqTextA DceErrorInqTextW DllGetClassObject DllRegisterServer IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy I_RpcAllocate I_RpcAsyncAbortCall I_RpcAsyncSetHandle I_RpcBCacheAllocate I_RpcBCacheFree I_RpcBindingCopy I_RpcBindingCreateNP I_RpcBindingHandleToAsyncHandle I_RpcBindingInqClientTokenAttributes I_RpcBindingInqDynamicEndpoint RPCRT4.I_RpcBindingInqDynamicEndpointW I_RpcBindingInqDynamicEndpointA I_RpcBindingInqDynamicEndpointW I_RpcBindingInqLocalClientPID I_RpcBindingInqMarshalledTargetInfo I_RpcBindingInqSecurityContext I_RpcBindingInqSecurityContextKeyInfo I_RpcBindingInqTransportType I_RpcBindingInqWireIdForSnego I_RpcBindingIsClientLocal I_RpcBindingIsServerLocal I_RpcBindingSetPrivateOption I_RpcBindingToStaticStringBindingW I_RpcCertProcessAndProvision I_RpcClearMutex I_RpcCompleteAndFree I_RpcDeleteMutex I_RpcEnableWmiTrace I_RpcExceptionFilter I_RpcFilterDCOMActivation I_RpcFree I_RpcFreeBuffer I_RpcFreePipeBuffer I_RpcFreeSystemHandle I_RpcFreeSystemHandleCollection I_RpcGetBuffer I_RpcGetBufferWithObject I_RpcGetCurrentCallHandle I_RpcGetDefaultSD I_RpcGetExtendedError I_RpcGetPortAllocationData I_RpcGetSystemHandle I_RpcIfInqTransferSyntaxes I_RpcLogEvent I_RpcMapWin32Status I_RpcMarshalBindingHandleAndInterfaceForNDF I_RpcMgmtEnableDedicatedThreadPool I_RpcNDRCGetWireRepresentation I_RpcNDRSContextEmergencyCleanup I_RpcNegotiateTransferSyntax I_RpcNsBindingSetEntryName RPCRT4.I_RpcNsBindingSetEntryNameW I_RpcNsBindingSetEntryNameA I_RpcNsBindingSetEntryNameW I_RpcNsInterfaceExported I_RpcNsInterfaceUnexported I_RpcOpenClientProcess I_RpcParseSecurity I_RpcPauseExecution I_RpcReallocPipeBuffer I_RpcReceive I_RpcRecordCalloutFailure I_RpcRequestMutex I_RpcSNCHOption I_RpcSend I_RpcSendReceive I_RpcServerAllocateIpPort I_RpcServerCheckClientRestriction I_RpcServerDisableExceptionFilter I_RpcServerGetAssociationID I_RpcServerInqAddressChangeFn I_RpcServerInqLocalConnAddress I_RpcServerInqRemoteConnAddress I_RpcServerInqTransportType I_RpcServerIsClientDisconnected I_RpcServerRegisterForwardFunction I_RpcServerSetAddressChangeFn I_RpcServerStartService I_RpcServerSubscribeForDisconnectNotification I_RpcServerSubscribeForDisconnectNotification2 I_RpcServerUnsubscribeForDisconnectNotification I_RpcServerUseProtseq2A I_RpcServerUseProtseq2W I_RpcServerUseProtseqEp2A I_RpcServerUseProtseqEp2W I_RpcSessionStrictContextHandle I_RpcSetDCOMAppId I_RpcSetSystemHandle I_RpcSsDontSerializeContext I_RpcSystemFunction001 I_RpcSystemHandleTypeSpecificWork I_RpcTransConnectionAllocatePacket I_RpcTransConnectionFreePacket I_RpcTransConnectionReallocPacket I_RpcTransDatagramAllocate I_RpcTransDatagramAllocate2 I_RpcTransDatagramFree I_RpcTransGetThreadEvent I_RpcTransGetThreadEventThreadOptional I_RpcTransIoCancelled I_RpcTransServerNewConnection I_RpcTurnOnEEInfoPropagation I_UuidCreate MesBufferHandleReset MesDecodeBufferHandleCreate MesDecodeIncrementalHandleCreate MesEncodeDynBufferHandleCreate MesEncodeFixedBufferHandleCreate MesEncodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset MesInqProcEncodingId NDRCContextBinding NDRCContextMarshall NDRCContextUnmarshall NDRSContextMarshall NDRSContextMarshall2 NDRSContextMarshallEx NDRSContextUnmarshall NDRSContextUnmarshall2 NDRSContextUnmarshallEx Ndr64AsyncClientCall Ndr64AsyncServerCall64 Ndr64AsyncServerCallAll Ndr64DcomAsyncClientCall Ndr64DcomAsyncStubCall NdrAllocate NdrAsyncClientCall NdrAsyncServerCall NdrByteCountPointerBufferSize NdrByteCountPointerFree NdrByteCountPointerMarshall NdrByteCountPointerUnmarshall NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrClearOutParameters NdrClientCall2 NdrClientCall3 NdrClientContextMarshall NdrClientContextUnmarshall NdrClientInitialize NdrClientInitializeNew NdrComplexArrayBufferSize NdrComplexArrayFree NdrComplexArrayMarshall NdrComplexArrayMemorySize NdrComplexArrayUnmarshall NdrComplexStructBufferSize NdrComplexStructFree NdrComplexStructMarshall NdrComplexStructMemorySize NdrComplexStructUnmarshall NdrConformantArrayBufferSize NdrConformantArrayFree NdrConformantArrayMarshall NdrConformantArrayMemorySize NdrConformantArrayUnmarshall NdrConformantStringBufferSize NdrConformantStringMarshall NdrConformantStringMemorySize NdrConformantStringUnmarshall NdrConformantStructBufferSize NdrConformantStructFree NdrConformantStructMarshall NdrConformantStructMemorySize NdrConformantStructUnmarshall NdrConformantVaryingArrayBufferSize NdrConformantVaryingArrayFree NdrConformantVaryingArrayMarshall NdrConformantVaryingArrayMemorySize NdrConformantVaryingArrayUnmarshall NdrConformantVaryingStructBufferSize NdrConformantVaryingStructFree NdrConformantVaryingStructMarshall NdrConformantVaryingStructMemorySize NdrConformantVaryingStructUnmarshall NdrContextHandleInitialize NdrContextHandleSize NdrConvert NdrConvert2 NdrCorrelationFree NdrCorrelationInitialize NdrCorrelationPass NdrCreateServerInterfaceFromStub NdrDcomAsyncClientCall NdrDcomAsyncStubCall NdrDllCanUnloadNow NdrDllGetClassObject NdrDllRegisterProxy NdrDllUnregisterProxy NdrEncapsulatedUnionBufferSize NdrEncapsulatedUnionFree NdrEncapsulatedUnionMarshall NdrEncapsulatedUnionMemorySize NdrEncapsulatedUnionUnmarshall NdrFixedArrayBufferSize NdrFixedArrayFree NdrFixedArrayMarshall NdrFixedArrayMemorySize NdrFixedArrayUnmarshall NdrFreeBuffer NdrFullPointerXlatFree NdrFullPointerXlatInit NdrGetBaseInterfaceFromStub NdrGetBuffer NdrGetDcomProtocolVersion NdrGetSimpleTypeBufferAlignment NdrGetSimpleTypeBufferSize NdrGetSimpleTypeMemorySize NdrGetTypeFlags NdrGetUserMarshalInfo NdrInterfacePointerBufferSize NdrInterfacePointerFree NdrInterfacePointerMarshall NdrInterfacePointerMemorySize NdrInterfacePointerUnmarshall NdrMapCommAndFaultStatus NdrMesProcEncodeDecode NdrMesProcEncodeDecode2 NdrMesProcEncodeDecode3 NdrMesSimpleTypeAlignSize NdrMesSimpleTypeAlignSizeAll NdrMesSimpleTypeDecode NdrMesSimpleTypeDecodeAll NdrMesSimpleTypeEncode NdrMesSimpleTypeEncodeAll NdrMesTypeAlignSize NdrMesTypeAlignSize2 NdrMesTypeAlignSize3 NdrMesTypeDecode NdrMesTypeDecode2 NdrMesTypeDecode3 NdrMesTypeEncode NdrMesTypeEncode2 NdrMesTypeEncode3 NdrMesTypeFree2 NdrMesTypeFree3 NdrNonConformantStringBufferSize NdrNonConformantStringMarshall NdrNonConformantStringMemorySize NdrNonConformantStringUnmarshall NdrNonEncapsulatedUnionBufferSize NdrNonEncapsulatedUnionFree NdrNonEncapsulatedUnionMarshall NdrNonEncapsulatedUnionMemorySize NdrNonEncapsulatedUnionUnmarshall NdrNsGetBuffer NdrNsSendReceive NdrOleAllocate NdrOleFree NdrOutInit NdrPartialIgnoreClientBufferSize NdrPartialIgnoreClientMarshall NdrPartialIgnoreServerInitialize NdrPartialIgnoreServerUnmarshall NdrPointerBufferSize NdrPointerFree NdrPointerMarshall NdrPointerMemorySize NdrPointerUnmarshall NdrProxyErrorHandler NdrProxyFreeBuffer NdrProxyGetBuffer NdrProxyInitialize NdrProxySendReceive NdrRangeUnmarshall NdrRpcSmClientAllocate NdrRpcSmClientFree NdrRpcSmSetClientToOsf NdrRpcSsDefaultAllocate NdrRpcSsDefaultFree NdrRpcSsDisableAllocate NdrRpcSsEnableAllocate NdrSendReceive NdrServerCall2 NdrServerCallAll NdrServerCallNdr64 NdrServerContextMarshall NdrServerContextNewMarshall NdrServerContextNewUnmarshall NdrServerContextUnmarshall NdrServerInitialize NdrServerInitializeMarshall NdrServerInitializeNew NdrServerInitializePartial NdrServerInitializeUnmarshall NdrSimpleStructBufferSize NdrSimpleStructFree NdrSimpleStructMarshall NdrSimpleStructMemorySize NdrSimpleStructUnmarshall NdrSimpleTypeMarshall NdrSimpleTypeUnmarshall NdrStubCall2 NdrStubCall3 NdrStubForwardingFunction NdrStubGetBuffer NdrStubInitialize NdrStubInitializeMarshall NdrTypeFlags NdrTypeFree NdrTypeMarshall NdrTypeSize NdrTypeUnmarshall NdrUnmarshallBasetypeInline NdrUserMarshalBufferSize NdrUserMarshalFree NdrUserMarshalMarshall NdrUserMarshalMemorySize NdrUserMarshalSimpleTypeConvert NdrUserMarshalUnmarshall NdrVaryingArrayBufferSize NdrVaryingArrayFree NdrVaryingArrayMarshall NdrVaryingArrayMemorySize NdrVaryingArrayUnmarshall NdrXmitOrRepAsBufferSize NdrXmitOrRepAsFree NdrXmitOrRepAsMarshall NdrXmitOrRepAsMemorySize NdrXmitOrRepAsUnmarshall NdrpCreateProxy NdrpCreateStub NdrpGetProcFormatString NdrpGetTypeFormatString NdrpGetTypeGenCookie NdrpMemoryIncrement NdrpReleaseTypeFormatString NdrpReleaseTypeGenCookie NdrpVarVtOfTypeDesc RpcAsyncAbortCall RpcAsyncCancelCall RpcAsyncCompleteCall RpcAsyncGetCallStatus RpcAsyncInitializeHandle RpcAsyncRegisterInfo RpcBindingBind RpcBindingCopy RpcBindingCreateA RpcBindingCreateW RpcBindingFree RpcBindingFromStringBindingA RpcBindingFromStringBindingW RpcBindingInqAuthClientA RpcBindingInqAuthClientExA RpcBindingInqAuthClientExW RpcBindingInqAuthClientW RpcBindingInqAuthInfoA RpcBindingInqAuthInfoExA RpcBindingInqAuthInfoExW RpcBindingInqAuthInfoW RpcBindingInqMaxCalls RpcBindingInqObject RpcBindingInqOption RpcBindingReset RpcBindingServerFromClient RpcBindingSetAuthInfoA RpcBindingSetAuthInfoExA RpcBindingSetAuthInfoExW RpcBindingSetAuthInfoW RpcBindingSetObject • EXPORT FUNCTIONS > 400 |
| Windows REG |
| Software\Microsoft\Rpc\SecurityService Software\Microsoft\Rpc System\CurrentControlSet\Services\Rpc\Linkage System\CurrentControlSet\Services\Rpc |
| Windows REG (UNICODE) |
| Software\Microsoft\Rpc\Extensions Software\Policies\Microsoft\Windows NT\Rpc Software\Microsoft\Rpc Software\Microsoft\Rpc\Internet Software\Microsoft\Rpc\SystemParameter001 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\HvSocket\Addresses System\CurrentControlSet\Control\SecurityProviders |
| File Access |
| api-ms-win-core-delayload-l1-1-0.dll KERNELBASE.dll api-ms-win-core-threadpool-l1-2-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-downlevel-shlwapi-l1-1-0.dll api-ms-win-core-apiquery-l1-1-0.dll api-ms-win-security-base-l1-1-0.dll api-ms-win-core-threadpool-legacy-l1-1-0.dll api-ms-win-core-timezone-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-string-l1-1-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-processenvironment-l1-1-0.dll api-ms-win-core-namedpipe-l1-1-0.dll api-ms-win-core-misc-l1-1-0.dll api-ms-win-core-heap-l2-1-0.dll api-ms-win-core-memory-l1-1-0.dll api-ms-win-core-localization-l1-2-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-registry-l1-1-0.dll api-ms-win-core-io-l1-1-0.dll api-ms-win-core-interlocked-l1-1-0.dll api-ms-win-core-heap-l1-1-0.dll api-ms-win-core-handle-l1-1-0.dll api-ms-win-core-errorhandling-l1-1-2.dll api-ms-win-core-errorhandling-l1-1-0.dll ntdll.dll RPCRT4.dll bcryptPrimitives.dll api-ms-win-security-sddl-l1-1-0.dll ext-ms-win-authz-context-l1-1-0.dll IPHLPAPI.DLL WS2_32.dll SspiCli.dll api-ms-win-security-lsalookup-l1-1-0.dll ext-ms-win-rpc-ssl-l1-1-0.dll ext-ms-win-core-winrt-remote-l1-1-0.dll .dat @.dat Temp |
| File Access (UNICODE) |
| rpcrt4.dll lsass.exe lsasrv.dll sspicli.dll verifier.dll RpcShim.dll @rpcrt4.dll Temp |
| Interest's Words |
| Encrypt Decrypt exec attrib start pause shutdown systeminfo replace route |
| Interest's Words (UNICODE) |
| start pause |
| URLs |
| http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt http://www.microsoft.com/windows0 http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt http://www.microsoft.com/pkiops/Docs/Repository.htm |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Technique used to insert code into a vulnerable application (Injection) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Unicode | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Ascii | Abuse of power for personal gain or unethical purposes (Corruption) |
| Text | Unicode | Abuse of power for personal gain or unethical purposes (Corruption) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \MUI\1\1033 | 115778 | E8 | 114778 | CDFECDFEE80000000000010000000000110000000000000002000000711D161EB08484C2A03B4CC6B562048FEF43FFEBC8FB | ............................q........;L..b...C.... |
| \WEVT_TEMPLATE\1\1033 | 1104B8 | 52BA | 10F4B8 | 4352494DB85200000500010003000000322BD56A09D6E94BAE07CE8DAE937E394C000000C7D7AEF498A82746B05344A7CAA1 | CRIM.R..........2+.j...K......~9L.........’F.SD... |
| \VERSION\1\1033 | 110110 | 3A8 | 10F110 | A40334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • rpcrt4.dll • \pipe\epmapper • @rpcrt4.dll • lsass.exe • ext-ms-win-rpc-ssl-l1-1-0.dll • api-ms-win-security-lsalookup-l1-1-0.dll • SspiCli.dll • WS2_32.dll • IPHLPAPI.DLL • ext-ms-win-authz-context-l1-1-0.dll • api-ms-win-security-sddl-l1-1-0.dll • bcryptPrimitives.dll • RpcShim.dll • verifier.dll • 127.0.0.1 • sspicli.dll • lsasrv.dll • rpcrt4.pdb • .bss • api-ms-win-core-errorhandling-l1-1-0.dll • api-ms-win-core-errorhandling-l1-1-2.dll • HeapAllocapi-ms-win-core-heap-l1-1-0.dll • api-ms-win-core-libraryloader-l1-2-0.dll • TransactNamedPipeapi-ms-win-core-namedpipe-l1-1-0.dll • api-ms-win-core-synch-l1-2-0.dll • api-ms-win-core-sysinfo-l1-1-0.dll • api-ms-win-core-timezone-l1-1-0.dll • api-ms-win-security-base-l1-1-0.dll • QueryPerformanceCounterapi-ms-win-core-profile-l1-1-0.dll • api-ms-win-core-delayload-l1-1-0.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 194D | N/A | .text | CALL QWORD PTR [RIP+0xE7AD5] |
| 19E6 | N/A | .text | CALL QWORD PTR [RIP+0xE7A3C] |
| 19FD | N/A | .text | CALL QWORD PTR [RIP+0xE7A25] |
| 1BCF | N/A | .text | CALL QWORD PTR [RIP+0xE7853] |
| 1BEE | N/A | .text | CALL QWORD PTR [RIP+0xE7834] |
| 1C09 | N/A | .text | CALL QWORD PTR [RIP+0xE7819] |
| 1F3F | N/A | .text | CALL QWORD PTR [RIP+0xE74E3] |
| 211A | N/A | .text | CALL QWORD PTR [RIP+0xE6E68] |
| 254C | N/A | .text | CALL QWORD PTR [RIP+0xE6ED6] |
| 2564 | N/A | .text | CALL QWORD PTR [RIP+0xE6EBE] |
| 2583 | N/A | .text | CALL QWORD PTR [RIP+0xE6E9F] |
| 2DE3 | N/A | .text | CALL QWORD PTR [RIP+0xE619F] |
| 34FF | N/A | .text | CALL QWORD PTR [RIP+0xE5F23] |
| 3613 | N/A | .text | CALL QWORD PTR [RIP+0xE5E0F] |
| 392F | N/A | .text | CALL QWORD PTR [RIP+0xE581B] |
| 399C | N/A | .text | CALL QWORD PTR [RIP+0xE5816] |
| 3A55 | N/A | .text | CALL QWORD PTR [RIP+0xE5CBD] |
| 3AEE | N/A | .text | CALL QWORD PTR [RIP+0xE5C24] |
| 3B1E | N/A | .text | CALL QWORD PTR [RIP+0xE562C] |
| 3BCE | N/A | .text | CALL QWORD PTR [RIP+0xE55E4] |
| 3C1D | N/A | .text | CALL QWORD PTR [RIP+0xE552D] |
| 3C4C | N/A | .text | CALL QWORD PTR [RIP+0xE54FE] |
| 3C66 | N/A | .text | CALL QWORD PTR [RIP+0xE54E4] |
| 3CD4 | N/A | .text | CALL QWORD PTR [RIP+0xE58AE] |
| 3CF7 | N/A | .text | CALL QWORD PTR [RIP+0xE54BB] |
| 3DC9 | N/A | .text | CALL QWORD PTR [RIP+0xE5949] |
| 3E44 | N/A | .text | CALL QWORD PTR [RIP+0xE536E] |
| 3EA6 | N/A | .text | CALL QWORD PTR [RIP+0xE530C] |
| 3EF7 | N/A | .text | CALL QWORD PTR [RIP+0xE581B] |
| 3F77 | N/A | .text | CALL QWORD PTR [RIP+0xE523B] |
| 3FAA | N/A | .text | CALL QWORD PTR [RIP+0xE5768] |
| 3FE3 | N/A | .text | CALL QWORD PTR [RIP+0xE51CF] |
| 3FFA | N/A | .text | CALL QWORD PTR [RIP+0xE5718] |
| 40A9 | N/A | .text | CALL QWORD PTR [RIP+0xE5109] |
| 4127 | N/A | .text | CALL QWORD PTR [RIP+0xE55EB] |
| 4148 | N/A | .text | CALL QWORD PTR [RIP+0xE4DFA] |
| 428A | N/A | .text | CALL QWORD PTR [RIP+0xE4F28] |
| 42B9 | N/A | .text | CALL QWORD PTR [RIP+0xE5459] |
| 43B9 | N/A | .text | CALL QWORD PTR [RIP+0xE4DF9] |
| 43DB | N/A | .text | CALL QWORD PTR [RIP+0xE5337] |
| 43FD | N/A | .text | CALL QWORD PTR [RIP+0xE5315] |
| 450F | N/A | .text | CALL QWORD PTR [RIP+0xE4CA3] |
| 4546 | N/A | .text | CALL QWORD PTR [RIP+0xE51CC] |
| 4577 | N/A | .text | CALL QWORD PTR [RIP+0xE519B] |
| 45E9 | N/A | .text | CALL QWORD PTR [RIP+0xE5129] |
| 4606 | N/A | .text | CALL QWORD PTR [RIP+0xE510C] |
| 47C1 | N/A | .text | CALL QWORD PTR [RIP+0xE49F1] |
| 47E5 | N/A | .text | CALL QWORD PTR [RIP+0xE4F2D] |
| 48D8 | N/A | .text | CALL QWORD PTR [RIP+0xE4E3A] |
| 497A | N/A | .text | CALL QWORD PTR [RIP+0xE4838] |
| 499F | N/A | .text | CALL QWORD PTR [RIP+0xE4D73] |
| 4A56 | N/A | .text | CALL QWORD PTR [RIP+0xE475C] |
| 4AA7 | N/A | .text | CALL QWORD PTR [RIP+0xE4C6B] |
| 4AC6 | N/A | .text | CALL QWORD PTR [RIP+0xE4C4C] |
| 4BFD | N/A | .text | CALL QWORD PTR [RIP+0xE433D] |
| 4DF6 | N/A | .text | CALL QWORD PTR [RIP+0xE43BC] |
| 4E66 | N/A | .text | CALL QWORD PTR [RIP+0xE48AC] |
| 4EB1 | N/A | .text | CALL QWORD PTR [RIP+0xE4301] |
| 4F6D | N/A | .text | CALL QWORD PTR [RIP+0xE47A5] |
| 4FFF | N/A | .text | CALL QWORD PTR [RIP+0xE4713] |
| 5096 | N/A | .text | CALL QWORD PTR [RIP+0xE467C] |
| 50E2 | N/A | .text | CALL QWORD PTR [RIP+0xE4630] |
| 5117 | N/A | .text | CALL QWORD PTR [RIP+0xE3D1B] |
| 5125 | N/A | .text | CALL QWORD PTR [RIP+0xE3CED] |
| 5163 | N/A | .text | CALL QWORD PTR [RIP+0xE404F] |
| 5199 | N/A | .text | CALL QWORD PTR [RIP+0xE4579] |
| 521E | N/A | .text | CALL QWORD PTR [RIP+0xE44F4] |
| 53B7 | N/A | .text | CALL QWORD PTR [RIP+0xE3DFB] |
| 53D2 | N/A | .text | CALL QWORD PTR [RIP+0xE4340] |
| 5420 | N/A | .text | CALL QWORD PTR [RIP+0xE42F2] |
| 549E | N/A | .text | CALL QWORD PTR [RIP+0xE3D14] |
| 550D | N/A | .text | CALL QWORD PTR [RIP+0xE4205] |
| 5520 | N/A | .text | CALL QWORD PTR [RIP+0xE3A1A] |
| 5560 | N/A | .text | CALL QWORD PTR [RIP+0xE41B2] |
| 55A7 | N/A | .text | CALL QWORD PTR [RIP+0xE416B] |
| 55DB | N/A | .text | CALL QWORD PTR [RIP+0xE3BD7] |
| 5613 | N/A | .text | CALL QWORD PTR [RIP+0xE40FF] |
| 5666 | N/A | .text | CALL QWORD PTR [RIP+0xE40AC] |
| 568A | N/A | .text | CALL QWORD PTR [RIP+0xE4088] |
| 56AD | N/A | .text | CALL QWORD PTR [RIP+0xE4065] |
| 56F7 | N/A | .text | CALL QWORD PTR [RIP+0xE3ABB] |
| 571D | N/A | .text | CALL QWORD PTR [RIP+0xE3FF5] |
| 574F | N/A | .text | CALL QWORD PTR [RIP+0xE3FC3] |
| 5760 | N/A | .text | CALL QWORD PTR [RIP+0xE365A] |
| 594B | N/A | .text | CALL QWORD PTR [RIP+0xE3867] |
| 59F3 | N/A | .text | CALL QWORD PTR [RIP+0xE3D1F] |
| 5A29 | N/A | .text | CALL QWORD PTR [RIP+0xE3511] |
| 5A38 | N/A | .text | CALL QWORD PTR [RIP+0xE3CDA] |
| 5B0E | N/A | .text | CALL QWORD PTR [RIP+0xE342C] |
| 5C08 | N/A | .text | CALL QWORD PTR [RIP+0xE35AA] |
| 5C75 | N/A | .text | CALL QWORD PTR [RIP+0xE3A9D] |
| 5CA6 | N/A | .text | CALL QWORD PTR [RIP+0xE350C] |
| 5CC1 | N/A | .text | CALL QWORD PTR [RIP+0xE3A51] |
| 5CF8 | N/A | .text | CALL QWORD PTR [RIP+0xE3A1A] |
| 61E8 | N/A | .text | CALL QWORD PTR [RIP+0xE2FCA] |
| 61FD | N/A | .text | CALL QWORD PTR [RIP+0xE3515] |
| 6227 | N/A | .text | CALL QWORD PTR [RIP+0xE2F8B] |
| 6269 | N/A | .text | CALL QWORD PTR [RIP+0xE34A9] |
| 652B | N/A | .text | CALL QWORD PTR [RIP+0x108CDF] |
| 664C | N/A | .text | CALL QWORD PTR [RIP+0xE2B66] |
| DC015-DCFFF | N/A | fothk | Unusual BP Cave, count: 4075 |
| 104000 | 180001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x1010 .text + UnwindInfo: .rdata |
| 10400C | 180001040 | .pdata | ExceptionHook | Pointer to 1040 - 0x1040 .text + UnwindInfo: .rdata |
| 104018 | 180001AD0 | .pdata | ExceptionHook | Pointer to 1AD0 - 0x1AD0 .text + UnwindInfo: .rdata |
| 104024 | 180001C20 | .pdata | ExceptionHook | Pointer to 1C20 - 0x1C20 .text + UnwindInfo: .rdata |
| 104030 | 180002090 | .pdata | ExceptionHook | Pointer to 2090 - 0x2090 .text + UnwindInfo: .rdata |
| 10403C | 180002290 | .pdata | ExceptionHook | Pointer to 2290 - 0x2290 .text + UnwindInfo: .rdata |
| 104048 | 1800022C0 | .pdata | ExceptionHook | Pointer to 22C0 - 0x22C0 .text + UnwindInfo: .rdata |
| 104054 | 1800023A0 | .pdata | ExceptionHook | Pointer to 23A0 - 0x23A0 .text + UnwindInfo: .rdata |
| 104060 | 1800023DC | .pdata | ExceptionHook | Pointer to 23DC - 0x23DC .text + UnwindInfo: .rdata |
| 10406C | 18000242C | .pdata | ExceptionHook | Pointer to 242C - 0x242C .text + UnwindInfo: .rdata |
| 104078 | 18000259C | .pdata | ExceptionHook | Pointer to 259C - 0x259C .text + UnwindInfo: .rdata |
| 104084 | 1800027B4 | .pdata | ExceptionHook | Pointer to 27B4 - 0x27B4 .text + UnwindInfo: .rdata |
| 104090 | 18000294C | .pdata | ExceptionHook | Pointer to 294C - 0x294C .text + UnwindInfo: .rdata |
| 10409C | 180002B2C | .pdata | ExceptionHook | Pointer to 2B2C - 0x2B2C .text + UnwindInfo: .rdata |
| 1040A8 | 180002B60 | .pdata | ExceptionHook | Pointer to 2B60 - 0x2B60 .text + UnwindInfo: .rdata |
| 1040B4 | 180002CBC | .pdata | ExceptionHook | Pointer to 2CBC - 0x2CBC .text + UnwindInfo: .rdata |
| 1040C0 | 180002D90 | .pdata | ExceptionHook | Pointer to 2D90 - 0x2D90 .text + UnwindInfo: .rdata |
| 1040CC | 180002E20 | .pdata | ExceptionHook | Pointer to 2E20 - 0x2E20 .text + UnwindInfo: .rdata |
| 1040D8 | 1800031F0 | .pdata | ExceptionHook | Pointer to 31F0 - 0x31F0 .text + UnwindInfo: .rdata |
| 1040E4 | 180003260 | .pdata | ExceptionHook | Pointer to 3260 - 0x3260 .text + UnwindInfo: .rdata |
| 1040F0 | 180003384 | .pdata | ExceptionHook | Pointer to 3384 - 0x3384 .text + UnwindInfo: .rdata |
| 1040FC | 180003410 | .pdata | ExceptionHook | Pointer to 3410 - 0x3410 .text + UnwindInfo: .rdata |
| 104108 | 1800034A8 | .pdata | ExceptionHook | Pointer to 34A8 - 0x34A8 .text + UnwindInfo: .rdata |
| 104114 | 180003518 | .pdata | ExceptionHook | Pointer to 3518 - 0x3518 .text + UnwindInfo: .rdata |
| 104120 | 18000353B | .pdata | ExceptionHook | Pointer to 353B - 0x353B .text + UnwindInfo: .rdata |
| 10412C | 180003588 | .pdata | ExceptionHook | Pointer to 3588 - 0x3588 .text + UnwindInfo: .rdata |
| 104138 | 18000362D | .pdata | ExceptionHook | Pointer to 362D - 0x362D .text + UnwindInfo: .rdata |
| 104144 | 180003667 | .pdata | ExceptionHook | Pointer to 3667 - 0x3667 .text + UnwindInfo: .rdata |
| 104150 | 1800036A1 | .pdata | ExceptionHook | Pointer to 36A1 - 0x36A1 .text + UnwindInfo: .rdata |
| 10415C | 1800036F5 | .pdata | ExceptionHook | Pointer to 36F5 - 0x36F5 .text + UnwindInfo: .rdata |
| 104168 | 180003746 | .pdata | ExceptionHook | Pointer to 3746 - 0x3746 .text + UnwindInfo: .rdata |
| 104174 | 180003780 | .pdata | ExceptionHook | Pointer to 3780 - 0x3780 .text + UnwindInfo: .rdata |
| 104180 | 1800037B7 | .pdata | ExceptionHook | Pointer to 37B7 - 0x37B7 .text + UnwindInfo: .rdata |
| 10418C | 180003804 | .pdata | ExceptionHook | Pointer to 3804 - 0x3804 .text + UnwindInfo: .rdata |
| 104198 | 1800038D0 | .pdata | ExceptionHook | Pointer to 38D0 - 0x38D0 .text + UnwindInfo: .rdata |
| 1041A4 | 18000396C | .pdata | ExceptionHook | Pointer to 396C - 0x396C .text + UnwindInfo: .rdata |
| 1041B0 | 180003C08 | .pdata | ExceptionHook | Pointer to 3C08 - 0x3C08 .text + UnwindInfo: .rdata |
| 1041BC | 180003C80 | .pdata | ExceptionHook | Pointer to 3C80 - 0x3C80 .text + UnwindInfo: .rdata |
| 1041C8 | 180003F24 | .pdata | ExceptionHook | Pointer to 3F24 - 0x3F24 .text + UnwindInfo: .rdata |
| 1041D4 | 180003F50 | .pdata | ExceptionHook | Pointer to 3F50 - 0x3F50 .text + UnwindInfo: .rdata |
| 1041E0 | 180004040 | .pdata | ExceptionHook | Pointer to 4040 - 0x4040 .text + UnwindInfo: .rdata |
| 1041EC | 180004140 | .pdata | ExceptionHook | Pointer to 4140 - 0x4140 .text + UnwindInfo: .rdata |
| 1041F8 | 180004170 | .pdata | ExceptionHook | Pointer to 4170 - 0x4170 .text + UnwindInfo: .rdata |
| 104204 | 180004314 | .pdata | ExceptionHook | Pointer to 4314 - 0x4314 .text + UnwindInfo: .rdata |
| 104210 | 1800044A8 | .pdata | ExceptionHook | Pointer to 44A8 - 0x44A8 .text + UnwindInfo: .rdata |
| 10421C | 180004680 | .pdata | ExceptionHook | Pointer to 4680 - 0x4680 .text + UnwindInfo: .rdata |
| 104228 | 180004768 | .pdata | ExceptionHook | Pointer to 4768 - 0x4768 .text + UnwindInfo: .rdata |
| 104234 | 180004794 | .pdata | ExceptionHook | Pointer to 4794 - 0x4794 .text + UnwindInfo: .rdata |
| 104240 | 180004A20 | .pdata | ExceptionHook | Pointer to 4A20 - 0x4A20 .text + UnwindInfo: .rdata |
| 10424C | 180004C8C | .pdata | ExceptionHook | Pointer to 4C8C - 0x4C8C .text + UnwindInfo: .rdata |
| 104258 | 180004D64 | .pdata | ExceptionHook | Pointer to 4D64 - 0x4D64 .text + UnwindInfo: .rdata |
| 104264 | 18000532C | .pdata | ExceptionHook | Pointer to 532C - 0x532C .text + UnwindInfo: .rdata |
| 104270 | 18000538C | .pdata | ExceptionHook | Pointer to 538C - 0x538C .text + UnwindInfo: .rdata |
| 10427C | 180005470 | .pdata | ExceptionHook | Pointer to 5470 - 0x5470 .text + UnwindInfo: .rdata |
| 104288 | 180005824 | .pdata | ExceptionHook | Pointer to 5824 - 0x5824 .text + UnwindInfo: .rdata |
| 104294 | 180005918 | .pdata | ExceptionHook | Pointer to 5918 - 0x5918 .text + UnwindInfo: .rdata |
| 1042A0 | 180005A70 | .pdata | ExceptionHook | Pointer to 5A70 - 0x5A70 .text + UnwindInfo: .rdata |
| 1042AC | 180005B2C | .pdata | ExceptionHook | Pointer to 5B2C - 0x5B2C .text + UnwindInfo: .rdata |
| 1042B8 | 180005BE0 | .pdata | ExceptionHook | Pointer to 5BE0 - 0x5BE0 .text + UnwindInfo: .rdata |
| 1042C4 | 180005D44 | .pdata | ExceptionHook | Pointer to 5D44 - 0x5D44 .text + UnwindInfo: .rdata |
| 1042D0 | 180005D68 | .pdata | ExceptionHook | Pointer to 5D68 - 0x5D68 .text + UnwindInfo: .rdata |
| 1042DC | 180005EBC | .pdata | ExceptionHook | Pointer to 5EBC - 0x5EBC .text + UnwindInfo: .rdata |
| 1042E8 | 180005EF0 | .pdata | ExceptionHook | Pointer to 5EF0 - 0x5EF0 .text + UnwindInfo: .rdata |
| 1042F4 | 180005FA4 | .pdata | ExceptionHook | Pointer to 5FA4 - 0x5FA4 .text + UnwindInfo: .rdata |
| 104300 | 180005FF8 | .pdata | ExceptionHook | Pointer to 5FF8 - 0x5FF8 .text + UnwindInfo: .rdata |
| 10430C | 180006028 | .pdata | ExceptionHook | Pointer to 6028 - 0x6028 .text + UnwindInfo: .rdata |
| 104318 | 1800060E8 | .pdata | ExceptionHook | Pointer to 60E8 - 0x60E8 .text + UnwindInfo: .rdata |
| 104324 | 180006140 | .pdata | ExceptionHook | Pointer to 6140 - 0x6140 .text + UnwindInfo: .rdata |
| 104330 | 1800061C0 | .pdata | ExceptionHook | Pointer to 61C0 - 0x61C0 .text + UnwindInfo: .rdata |
| 10433C | 180006288 | .pdata | ExceptionHook | Pointer to 6288 - 0x6288 .text + UnwindInfo: .rdata |
| 104348 | 1800062F8 | .pdata | ExceptionHook | Pointer to 62F8 - 0x62F8 .text + UnwindInfo: .rdata |
| 104354 | 180006358 | .pdata | ExceptionHook | Pointer to 6358 - 0x6358 .text + UnwindInfo: .rdata |
| 104360 | 180006390 | .pdata | ExceptionHook | Pointer to 6390 - 0x6390 .text + UnwindInfo: .rdata |
| 10436C | 1800063D8 | .pdata | ExceptionHook | Pointer to 63D8 - 0x63D8 .text + UnwindInfo: .rdata |
| 104378 | 180006424 | .pdata | ExceptionHook | Pointer to 6424 - 0x6424 .text + UnwindInfo: .rdata |
| 104384 | 180006470 | .pdata | ExceptionHook | Pointer to 6470 - 0x6470 .text + UnwindInfo: .rdata |
| 104390 | 1800064B4 | .pdata | ExceptionHook | Pointer to 64B4 - 0x64B4 .text + UnwindInfo: .rdata |
| 10439C | 180006558 | .pdata | ExceptionHook | Pointer to 6558 - 0x6558 .text + UnwindInfo: .rdata |
| 1043A8 | 180006580 | .pdata | ExceptionHook | Pointer to 6580 - 0x6580 .text + UnwindInfo: .rdata |
| 1043B4 | 18000660C | .pdata | ExceptionHook | Pointer to 660C - 0x660C .text + UnwindInfo: .rdata |
| 1043C0 | 180006634 | .pdata | ExceptionHook | Pointer to 6634 - 0x6634 .text + UnwindInfo: .rdata |
| 1043CC | 180006740 | .pdata | ExceptionHook | Pointer to 6740 - 0x6740 .text + UnwindInfo: .rdata |
| 1043D8 | 180006778 | .pdata | ExceptionHook | Pointer to 6778 - 0x6778 .text + UnwindInfo: .rdata |
| 1043E4 | 180006C20 | .pdata | ExceptionHook | Pointer to 6C20 - 0x6C20 .text + UnwindInfo: .rdata |
| 1043F0 | 180006E64 | .pdata | ExceptionHook | Pointer to 6E64 - 0x6E64 .text + UnwindInfo: .rdata |
| 1043FC | 18000710C | .pdata | ExceptionHook | Pointer to 710C - 0x710C .text + UnwindInfo: .rdata |
| 104408 | 180007214 | .pdata | ExceptionHook | Pointer to 7214 - 0x7214 .text + UnwindInfo: .rdata |
| 104414 | 180007514 | .pdata | ExceptionHook | Pointer to 7514 - 0x7514 .text + UnwindInfo: .rdata |
| 104420 | 180007638 | .pdata | ExceptionHook | Pointer to 7638 - 0x7638 .text + UnwindInfo: .rdata |
| 10442C | 180007678 | .pdata | ExceptionHook | Pointer to 7678 - 0x7678 .text + UnwindInfo: .rdata |
| 104438 | 1800077B4 | .pdata | ExceptionHook | Pointer to 77B4 - 0x77B4 .text + UnwindInfo: .rdata |
| 104444 | 180007824 | .pdata | ExceptionHook | Pointer to 7824 - 0x7824 .text + UnwindInfo: .rdata |
| 104450 | 1800078A0 | .pdata | ExceptionHook | Pointer to 78A0 - 0x78A0 .text + UnwindInfo: .rdata |
| 10445C | 180007910 | .pdata | ExceptionHook | Pointer to 7910 - 0x7910 .text + UnwindInfo: .rdata |
| 104468 | 180007970 | .pdata | ExceptionHook | Pointer to 7970 - 0x7970 .text + UnwindInfo: .rdata |
| 104474 | 1800079A8 | .pdata | ExceptionHook | Pointer to 79A8 - 0x79A8 .text + UnwindInfo: .rdata |
| 104480 | 180007A38 | .pdata | ExceptionHook | Pointer to 7A38 - 0x7A38 .text + UnwindInfo: .rdata |
| 10448C | 180007A80 | .pdata | ExceptionHook | Pointer to 7A80 - 0x7A80 .text + UnwindInfo: .rdata |
| 104498 | 180007AE0 | .pdata | ExceptionHook | Pointer to 7AE0 - 0x7AE0 .text + UnwindInfo: .rdata |
| 1044A4 | 180007B18 | .pdata | ExceptionHook | Pointer to 7B18 - 0x7B18 .text + UnwindInfo: .rdata |
| D5000-DBFFF | D5000 | .ndr64 | Executable section anomaly, first bytes: CCCCCCCCCCCCCCCC |
| DC000-DCFFF | DC000 | fothk | Executable section anomaly, first bytes: CCCCCCCCCCCCCCCC |
| 117000 | N/A | *Overlay* | A04D00000002020030824D9206092A864886F70D | .M......0.M...*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 680203 | 58,5042% |
| Null Byte Code | 219657 | 18,8927% |
© 2026 All rights reserved.