PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,13 MB SHA-256 Hash: DCF5704BC1CEB9B46896C8C08A6C2448E1908111FE4AD829E25F3DA61B26CDAF SHA-1 Hash: D41727A19A51997F4BCD6B7D2FBFFBCC5D255D2D MD5 Hash: 9E2427ADE47040CB01DFB8ACA9602DF7 Imphash: 4C7304AD792BAEC7F44357E083EDA7B8 MajorOSVersion: 10 MinorOSVersion: 0 CheckSum: 0012B9CC EntryPoint (rva): 91EE0 SizeOfHeaders: 1000 SizeOfImage: 118000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: FB460 ImportTable: FFE44 IAT: E8C18 Characteristics: 2022 TimeDateStamp: A1DC87E6 Date: 20/01/2056 9:01:26 File Type: DLL Number Of Sections: 9 ASLR: Disabled Section Names (Optional Header): .text, .ndr64, fothk, .rdata, .data, .pdata, .didat, .rsrc, .reloc Number Of Executable Sections: 3 Subsystem: Windows Console |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | D4000 | 1000 | D3DA9 |
|
|
| .ndr64 | 0x60000020 Code Executable Readable |
D5000 | 7000 | D5000 | 696B |
|
|
| fothk | 0x60000020 Code Executable Readable |
DC000 | 1000 | DC000 | 1000 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
DD000 | 26000 | DD000 | 25D02 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
103000 | 1000 | 103000 | 15F8 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
104000 | A000 | 105000 | 9720 |
|
|
| .didat | 0xC0000040 Initialized Data Readable Writeable |
10E000 | 1000 | 10F000 | 290 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
10F000 | 6000 | 110000 | 5860 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
115000 | 2000 | 116000 | 1858 |
|
|
| Description |
| OriginalFilename: rpcrt4.dll CompanyName: Microsoft Corporation LegalCopyright: Microsoft Corporation. All rights reserved. ProductName: Microsoft Windows Operating System FileVersion: 10.0.26100.9549 (WinBuild.160101.0800) FileDescription: Remote Procedure Call Runtime ProductVersion: 10.0.26100.9549 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 35,20 KB |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 91EE0 Code -> 48895C2408574883EC208BFA498BD8BA010000003BFA74194C8BC38BD7E81E000000488B5C24300FB6C04883C4205FC3CCE8 Assembler |MOV QWORD PTR [RSP + 8], RBX |PUSH RDI |SUB RSP, 0X20 |MOV EDI, EDX |MOV RBX, R8 |MOV EDX, 1 |CMP EDI, EDX |JE 0X180091F11 |MOV R8, RBX |MOV EDX, EDI |CALL 0X180091F20 |MOV RBX, QWORD PTR [RSP + 0X30] |MOVZX EAX, AL |ADD RSP, 0X20 |POP RDI |RET |INT3 |
| Signatures |
| Rich Signature Analyzer: Code -> 8B2F5AFBCF4E34A8CF4E34A8CF4E34A8C636A7A8F74E34A8B6CF35A9CA4E34A8CF4E35A86B4F34A8CF4E34A8CE4E34A8B6CF30A9C34E34A8B6CF37A9CA4E34A8B6CF3CA9634E34A8B6CF34A9CE4E34A8B6CFCBA8CE4E34A8B6CF36A9CE4E34A852696368CF4E34A8 Footprint md5 Hash -> DF72808D5FD06BFFA97242643B33417E • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): linker: Microsoft Linker(14.38**)[-] • PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.2783 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| Ws2_32.DLL | socket | Possible Call API By Name | Create a communication endpoint for networking applications. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | QueueUserAPC | Queues an APC for thread execution. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegDeleteKeyExA | Deletes a registry key. |
| ADVAPI32.DLL | RegGetValueA | Reads data from a registry value. |
| ADVAPI32.DLL | RegGetValueW | Reads data from a registry value. |
| ET Functions (carving) |
| Original Name -> RPCRT4.dll I_RpcBindingInqCurrentModifiedId I_RpcFixTransferSyntax I_RpcFwThisIsTheManager I_RpcInitFwImports I_RpcInitHttpImports I_RpcInitImports I_RpcInitNdrImports I_RpcMgmtQueryDedicatedThreadPool I_RpcOpenClientThread I_RpcServerTurnOnOffKeepalives I_RpcVerifierCorruptionExpected NdrFullPointerFree NdrFullPointerInsertRefId NdrFullPointerQueryPointer NdrFullPointerQueryRefId NdrpClientCall2 RpcCertMatchPrincipalName pfnFreeRoutines pfnMarshallRoutines pfnSizeRoutines pfnUnmarshallRoutines CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface CreateProxyFromTypeInfo CreateStubFromTypeInfo DceErrorInqTextA DceErrorInqTextW DllGetClassObject DllRegisterServer IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy I_RpcAllocate I_RpcAsyncAbortCall I_RpcAsyncSetHandle I_RpcBCacheAllocate I_RpcBCacheFree I_RpcBindingCopy I_RpcBindingCreateNP I_RpcBindingHandleToAsyncHandle I_RpcBindingInqClientTokenAttributes I_RpcBindingInqDynamicEndpoint RPCRT4.I_RpcBindingInqDynamicEndpointW I_RpcBindingInqDynamicEndpointA I_RpcBindingInqDynamicEndpointW I_RpcBindingInqLocalClientPID I_RpcBindingInqMarshalledTargetInfo I_RpcBindingInqSecurityContext I_RpcBindingInqSecurityContextKeyInfo I_RpcBindingInqTransportType I_RpcBindingInqWireIdForSnego I_RpcBindingIsClientLocal I_RpcBindingIsServerLocal I_RpcBindingSetPrivateOption I_RpcBindingToStaticStringBindingW I_RpcCertProcessAndProvision I_RpcClearMutex I_RpcCompleteAndFree I_RpcDeleteMutex I_RpcEnableWmiTrace I_RpcExceptionFilter I_RpcFilterDCOMActivation I_RpcFree I_RpcFreeBuffer I_RpcFreePipeBuffer I_RpcFreeSystemHandle I_RpcFreeSystemHandleCollection I_RpcGetBuffer I_RpcGetBufferWithObject I_RpcGetCurrentCallHandle I_RpcGetDefaultSD I_RpcGetExtendedError I_RpcGetPortAllocationData I_RpcGetSystemHandle I_RpcIfInqTransferSyntaxes I_RpcLogEvent I_RpcMapWin32Status I_RpcMarshalBindingHandleAndInterfaceForNDF I_RpcMgmtEnableDedicatedThreadPool I_RpcNDRCGetWireRepresentation I_RpcNDRSContextEmergencyCleanup I_RpcNegotiateTransferSyntax I_RpcNsBindingSetEntryName RPCRT4.I_RpcNsBindingSetEntryNameW I_RpcNsBindingSetEntryNameA I_RpcNsBindingSetEntryNameW I_RpcNsInterfaceExported I_RpcNsInterfaceUnexported I_RpcOpenClientProcess I_RpcParseSecurity I_RpcPauseExecution I_RpcReallocPipeBuffer I_RpcReceive I_RpcRecordCalloutFailure I_RpcRequestMutex I_RpcSNCHOption I_RpcSend I_RpcSendReceive I_RpcServerAllocateIpPort I_RpcServerCheckClientRestriction I_RpcServerDisableExceptionFilter I_RpcServerGetAssociationID I_RpcServerInqAddressChangeFn I_RpcServerInqLocalConnAddress I_RpcServerInqRemoteConnAddress I_RpcServerInqTransportType I_RpcServerIsClientDisconnected I_RpcServerRegisterForwardFunction I_RpcServerSetAddressChangeFn I_RpcServerStartService I_RpcServerSubscribeForDisconnectNotification I_RpcServerSubscribeForDisconnectNotification2 I_RpcServerUnsubscribeForDisconnectNotification I_RpcServerUseProtseq2A I_RpcServerUseProtseq2W I_RpcServerUseProtseqEp2A I_RpcServerUseProtseqEp2W I_RpcSessionStrictContextHandle I_RpcSetDCOMAppId I_RpcSetSystemHandle I_RpcSsDontSerializeContext I_RpcSystemFunction001 I_RpcSystemHandleTypeSpecificWork I_RpcTransConnectionAllocatePacket I_RpcTransConnectionFreePacket I_RpcTransConnectionReallocPacket I_RpcTransDatagramAllocate I_RpcTransDatagramAllocate2 I_RpcTransDatagramFree I_RpcTransGetThreadEvent I_RpcTransGetThreadEventThreadOptional I_RpcTransIoCancelled I_RpcTransServerNewConnection I_RpcTurnOnEEInfoPropagation I_UuidCreate MesBufferHandleReset MesDecodeBufferHandleCreate MesDecodeIncrementalHandleCreate MesEncodeDynBufferHandleCreate MesEncodeFixedBufferHandleCreate MesEncodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset MesInqProcEncodingId NDRCContextBinding NDRCContextMarshall NDRCContextUnmarshall NDRSContextMarshall NDRSContextMarshall2 NDRSContextMarshallEx NDRSContextUnmarshall NDRSContextUnmarshall2 NDRSContextUnmarshallEx Ndr64AsyncClientCall Ndr64AsyncServerCall64 Ndr64AsyncServerCallAll Ndr64DcomAsyncClientCall Ndr64DcomAsyncStubCall NdrAllocate NdrAsyncClientCall NdrAsyncServerCall NdrByteCountPointerBufferSize NdrByteCountPointerFree NdrByteCountPointerMarshall NdrByteCountPointerUnmarshall NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrClearOutParameters NdrClientCall2 NdrClientCall3 NdrClientContextMarshall NdrClientContextUnmarshall NdrClientInitialize NdrClientInitializeNew NdrComplexArrayBufferSize NdrComplexArrayFree NdrComplexArrayMarshall NdrComplexArrayMemorySize NdrComplexArrayUnmarshall NdrComplexStructBufferSize NdrComplexStructFree NdrComplexStructMarshall NdrComplexStructMemorySize NdrComplexStructUnmarshall NdrConformantArrayBufferSize NdrConformantArrayFree NdrConformantArrayMarshall NdrConformantArrayMemorySize NdrConformantArrayUnmarshall NdrConformantStringBufferSize NdrConformantStringMarshall NdrConformantStringMemorySize NdrConformantStringUnmarshall NdrConformantStructBufferSize NdrConformantStructFree NdrConformantStructMarshall NdrConformantStructMemorySize NdrConformantStructUnmarshall NdrConformantVaryingArrayBufferSize NdrConformantVaryingArrayFree NdrConformantVaryingArrayMarshall NdrConformantVaryingArrayMemorySize NdrConformantVaryingArrayUnmarshall NdrConformantVaryingStructBufferSize NdrConformantVaryingStructFree NdrConformantVaryingStructMarshall NdrConformantVaryingStructMemorySize NdrConformantVaryingStructUnmarshall NdrContextHandleInitialize NdrContextHandleSize NdrConvert NdrConvert2 NdrCorrelationFree NdrCorrelationInitialize NdrCorrelationPass NdrCreateServerInterfaceFromStub NdrDcomAsyncClientCall NdrDcomAsyncStubCall NdrDllCanUnloadNow NdrDllGetClassObject NdrDllRegisterProxy NdrDllUnregisterProxy NdrEncapsulatedUnionBufferSize NdrEncapsulatedUnionFree NdrEncapsulatedUnionMarshall NdrEncapsulatedUnionMemorySize NdrEncapsulatedUnionUnmarshall NdrFixedArrayBufferSize NdrFixedArrayFree NdrFixedArrayMarshall NdrFixedArrayMemorySize NdrFixedArrayUnmarshall NdrFreeBuffer NdrFullPointerXlatFree NdrFullPointerXlatInit NdrGetBaseInterfaceFromStub NdrGetBuffer NdrGetDcomProtocolVersion NdrGetSimpleTypeBufferAlignment NdrGetSimpleTypeBufferSize NdrGetSimpleTypeMemorySize NdrGetTypeFlags NdrGetUserMarshalInfo NdrInterfacePointerBufferSize NdrInterfacePointerFree NdrInterfacePointerMarshall NdrInterfacePointerMemorySize NdrInterfacePointerUnmarshall NdrMapCommAndFaultStatus NdrMesProcEncodeDecode NdrMesProcEncodeDecode2 NdrMesProcEncodeDecode3 NdrMesSimpleTypeAlignSize NdrMesSimpleTypeAlignSizeAll NdrMesSimpleTypeDecode NdrMesSimpleTypeDecodeAll NdrMesSimpleTypeEncode NdrMesSimpleTypeEncodeAll NdrMesTypeAlignSize NdrMesTypeAlignSize2 NdrMesTypeAlignSize3 NdrMesTypeDecode NdrMesTypeDecode2 NdrMesTypeDecode3 NdrMesTypeEncode NdrMesTypeEncode2 NdrMesTypeEncode3 NdrMesTypeFree2 NdrMesTypeFree3 NdrNonConformantStringBufferSize NdrNonConformantStringMarshall NdrNonConformantStringMemorySize NdrNonConformantStringUnmarshall NdrNonEncapsulatedUnionBufferSize NdrNonEncapsulatedUnionFree NdrNonEncapsulatedUnionMarshall NdrNonEncapsulatedUnionMemorySize NdrNonEncapsulatedUnionUnmarshall NdrNsGetBuffer NdrNsSendReceive NdrOleAllocate NdrOleFree NdrOutInit NdrPartialIgnoreClientBufferSize NdrPartialIgnoreClientMarshall NdrPartialIgnoreServerInitialize NdrPartialIgnoreServerUnmarshall NdrPointerBufferSize NdrPointerFree NdrPointerMarshall NdrPointerMemorySize NdrPointerUnmarshall NdrProxyErrorHandler NdrProxyFreeBuffer NdrProxyGetBuffer NdrProxyInitialize NdrProxySendReceive NdrRangeUnmarshall NdrRpcSmClientAllocate NdrRpcSmClientFree NdrRpcSmSetClientToOsf NdrRpcSsDefaultAllocate NdrRpcSsDefaultFree NdrRpcSsDisableAllocate NdrRpcSsEnableAllocate NdrSendReceive NdrServerCall2 NdrServerCallAll NdrServerCallNdr64 NdrServerContextMarshall NdrServerContextNewMarshall NdrServerContextNewUnmarshall NdrServerContextUnmarshall NdrServerInitialize NdrServerInitializeMarshall NdrServerInitializeNew NdrServerInitializePartial NdrServerInitializeUnmarshall NdrSimpleStructBufferSize NdrSimpleStructFree NdrSimpleStructMarshall NdrSimpleStructMemorySize NdrSimpleStructUnmarshall NdrSimpleTypeMarshall NdrSimpleTypeUnmarshall NdrStubCall2 NdrStubCall3 NdrStubForwardingFunction NdrStubGetBuffer NdrStubInitialize NdrStubInitializeMarshall NdrTypeFlags NdrTypeFree NdrTypeMarshall NdrTypeSize NdrTypeUnmarshall NdrUnmarshallBasetypeInline NdrUserMarshalBufferSize NdrUserMarshalFree NdrUserMarshalMarshall NdrUserMarshalMemorySize NdrUserMarshalSimpleTypeConvert NdrUserMarshalUnmarshall NdrVaryingArrayBufferSize NdrVaryingArrayFree NdrVaryingArrayMarshall NdrVaryingArrayMemorySize NdrVaryingArrayUnmarshall NdrXmitOrRepAsBufferSize NdrXmitOrRepAsFree NdrXmitOrRepAsMarshall NdrXmitOrRepAsMemorySize NdrXmitOrRepAsUnmarshall NdrpCreateProxy NdrpCreateStub NdrpGetProcFormatString NdrpGetTypeFormatString NdrpGetTypeGenCookie NdrpMemoryIncrement NdrpReleaseTypeFormatString NdrpReleaseTypeGenCookie NdrpVarVtOfTypeDesc RpcAsyncAbortCall RpcAsyncCancelCall RpcAsyncCompleteCall RpcAsyncGetCallStatus RpcAsyncInitializeHandle RpcAsyncRegisterInfo RpcBindingBind RpcBindingCopy RpcBindingCreateA RpcBindingCreateW RpcBindingFree RpcBindingFromStringBindingA RpcBindingFromStringBindingW RpcBindingInqAuthClientA RpcBindingInqAuthClientExA RpcBindingInqAuthClientExW RpcBindingInqAuthClientW RpcBindingInqAuthInfoA RpcBindingInqAuthInfoExA RpcBindingInqAuthInfoExW RpcBindingInqAuthInfoW RpcBindingInqMaxCalls RpcBindingInqObject RpcBindingInqOption RpcBindingReset RpcBindingServerFromClient RpcBindingSetAuthInfoA RpcBindingSetAuthInfoExA RpcBindingSetAuthInfoExW RpcBindingSetAuthInfoW RpcBindingSetObject • EXPORT FUNCTIONS > 400 |
| Windows REG |
| Software\Microsoft\Rpc\SecurityService Software\Microsoft\Rpc System\CurrentControlSet\Services\Rpc\Linkage System\CurrentControlSet\Services\Rpc |
| Windows REG (UNICODE) |
| Software\Microsoft\Rpc\Extensions Software\Policies\Microsoft\Windows NT\Rpc Software\Microsoft\Rpc Software\Microsoft\Rpc\Internet Software\Microsoft\Rpc\SystemParameter001 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\HvSocket\Addresses System\CurrentControlSet\Control\SecurityProviders |
| File Access |
| api-ms-win-core-delayload-l1-1-0.dll KERNELBASE.dll api-ms-win-core-threadpool-l1-2-0.dll api-ms-win-core-profile-l1-1-0.dll api-ms-win-downlevel-shlwapi-l1-1-0.dll api-ms-win-core-apiquery-l1-1-0.dll api-ms-win-security-base-l1-1-0.dll api-ms-win-core-threadpool-legacy-l1-1-0.dll api-ms-win-core-timezone-l1-1-0.dll api-ms-win-core-sysinfo-l1-1-0.dll api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-synch-l1-1-0.dll api-ms-win-core-string-l1-1-0.dll api-ms-win-core-processthreads-l1-1-0.dll api-ms-win-core-processenvironment-l1-1-0.dll api-ms-win-core-namedpipe-l1-1-0.dll api-ms-win-core-misc-l1-1-0.dll api-ms-win-core-heap-l2-1-0.dll api-ms-win-core-memory-l1-1-0.dll api-ms-win-core-localization-l1-2-0.dll api-ms-win-core-libraryloader-l1-2-0.dll api-ms-win-core-registry-l1-1-0.dll api-ms-win-core-io-l1-1-0.dll api-ms-win-core-interlocked-l1-1-0.dll api-ms-win-core-heap-l1-1-0.dll api-ms-win-core-handle-l1-1-0.dll api-ms-win-core-errorhandling-l1-1-2.dll api-ms-win-core-errorhandling-l1-1-0.dll ntdll.dll RPCRT4.dll bcryptPrimitives.dll api-ms-win-security-sddl-l1-1-0.dll ext-ms-win-authz-context-l1-1-0.dll IPHLPAPI.DLL WS2_32.dll SspiCli.dll api-ms-win-security-lsalookup-l1-1-0.dll ext-ms-win-rpc-ssl-l1-1-0.dll ext-ms-win-core-winrt-remote-l1-1-0.dll .dat @.dat Temp |
| File Access (UNICODE) |
| rpcrt4.dll lsass.exe lsasrv.dll sspicli.dll verifier.dll RpcShim.dll @rpcrt4.dll Temp |
| Interest's Words |
| Encrypt Decrypt exec attrib start pause shutdown systeminfo replace route |
| Interest's Words (UNICODE) |
| start pause |
| URLs |
| http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Production%20PCA%202026%20RSA2048-SHA256.crl http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Production%20PCA%202026%20RSA2048-SHA256.crt http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt http://www.microsoft.com/windows0 http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt http://www.microsoft.com/pkiops/Docs/Repository.htm http://www.microsoft.com/pkiops/crl/Windows%20Production%20PCA%202023.crl http://www.microsoft.com/pkiops/certs/Windows%20Production%20PCA%202023.crt |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Technique used to insert code into a vulnerable application (Injection) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Unicode | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Ascii | Abuse of power for personal gain or unethical purposes (Corruption) |
| Text | Unicode | Abuse of power for personal gain or unethical purposes (Corruption) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \MUI\1\1033 | 115778 | E8 | 114778 | CDFECDFEE80000000000010000000000110000000000000002000000711D161EB08484C2A03B4CC6B562048FEF43FFEBC8FB | ............................q........;L..b...C.... |
| \WEVT_TEMPLATE\1\1033 | 1104B8 | 52BA | 10F4B8 | 4352494DB85200000500010003000000322BD56A09D6E94BAE07CE8DAE937E394C000000C7D7AEF498A82746B05344A7CAA1 | CRIM.R..........2+.j...K......~9L.........’F.SD... |
| \VERSION\1\1033 | 110110 | 3A8 | 10F110 | A40334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • rpcrt4.dll • \pipe\epmapper • @rpcrt4.dll • lsass.exe • ext-ms-win-rpc-ssl-l1-1-0.dll • api-ms-win-security-lsalookup-l1-1-0.dll • SspiCli.dll • WS2_32.dll • IPHLPAPI.DLL • ext-ms-win-authz-context-l1-1-0.dll • api-ms-win-security-sddl-l1-1-0.dll • bcryptPrimitives.dll • RpcShim.dll • verifier.dll • 127.0.0.1 • sspicli.dll • lsasrv.dll • rpcrt4.pdb • .bss • api-ms-win-core-errorhandling-l1-1-0.dll • api-ms-win-core-errorhandling-l1-1-2.dll • HeapAllocapi-ms-win-core-heap-l1-1-0.dll • api-ms-win-core-libraryloader-l1-2-0.dll • TransactNamedPipeapi-ms-win-core-namedpipe-l1-1-0.dll • api-ms-win-core-synch-l1-2-0.dll • api-ms-win-core-sysinfo-l1-1-0.dll • api-ms-win-core-timezone-l1-1-0.dll • api-ms-win-security-base-l1-1-0.dll • QueryPerformanceCounterapi-ms-win-core-profile-l1-1-0.dll • api-ms-win-core-delayload-l1-1-0.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 194D | N/A | .text | CALL QWORD PTR [RIP+0xE7AD5] |
| 19E6 | N/A | .text | CALL QWORD PTR [RIP+0xE7A3C] |
| 19FD | N/A | .text | CALL QWORD PTR [RIP+0xE7A25] |
| 1BCF | N/A | .text | CALL QWORD PTR [RIP+0xE7853] |
| 1BEE | N/A | .text | CALL QWORD PTR [RIP+0xE7834] |
| 1C09 | N/A | .text | CALL QWORD PTR [RIP+0xE7819] |
| 1F3F | N/A | .text | CALL QWORD PTR [RIP+0xE74E3] |
| 211A | N/A | .text | CALL QWORD PTR [RIP+0xE6E68] |
| 254C | N/A | .text | CALL QWORD PTR [RIP+0xE6ED6] |
| 2564 | N/A | .text | CALL QWORD PTR [RIP+0xE6EBE] |
| 2583 | N/A | .text | CALL QWORD PTR [RIP+0xE6E9F] |
| 2DE3 | N/A | .text | CALL QWORD PTR [RIP+0xE619F] |
| 34FF | N/A | .text | CALL QWORD PTR [RIP+0xE5F23] |
| 3613 | N/A | .text | CALL QWORD PTR [RIP+0xE5E0F] |
| 59C6 | N/A | .text | CALL QWORD PTR [RIP+0xE35A4] |
| 5A25 | N/A | .text | CALL QWORD PTR [RIP+0xE3A65] |
| 5A62 | N/A | .text | CALL QWORD PTR [RIP+0xE3A20] |
| 5A75 | N/A | .text | CALL QWORD PTR [RIP+0xE3855] |
| 5AB5 | N/A | .text | CALL QWORD PTR [RIP+0xE3285] |
| 5AD4 | N/A | .text | CALL QWORD PTR [RIP+0xE3256] |
| 5B17 | N/A | .text | CALL QWORD PTR [RIP+0xE345B] |
| 5B79 | N/A | .text | CALL QWORD PTR [RIP+0xE31A9] |
| 5B8E | N/A | .text | CALL QWORD PTR [RIP+0xE30D4] |
| 5F11 | N/A | .text | CALL QWORD PTR [RIP+0xE3059] |
| 5F2A | N/A | .text | CALL QWORD PTR [RIP+0xE3048] |
| 5F74 | N/A | .text | CALL QWORD PTR [RIP+0xE2FFE] |
| 5F87 | N/A | .text | CALL QWORD PTR [RIP+0xE2F9B] |
| 75C6 | N/A | .text | CALL QWORD PTR [RIP+0xE1C1C] |
| B5BA | N/A | .text | CALL QWORD PTR [RIP+0xDDCD0] |
| 222DF | N/A | .text | CALL QWORD PTR [RIP+0xC6E6B] |
| 2234C | N/A | .text | CALL QWORD PTR [RIP+0xC6E66] |
| 22405 | N/A | .text | CALL QWORD PTR [RIP+0xC730D] |
| 2249E | N/A | .text | CALL QWORD PTR [RIP+0xC7274] |
| 224CE | N/A | .text | CALL QWORD PTR [RIP+0xC6C7C] |
| 2257E | N/A | .text | CALL QWORD PTR [RIP+0xC6C34] |
| 225CD | N/A | .text | CALL QWORD PTR [RIP+0xC6B7D] |
| 225FC | N/A | .text | CALL QWORD PTR [RIP+0xC6B4E] |
| 22616 | N/A | .text | CALL QWORD PTR [RIP+0xC6B34] |
| 22684 | N/A | .text | CALL QWORD PTR [RIP+0xC6EFE] |
| 226A7 | N/A | .text | CALL QWORD PTR [RIP+0xC6B0B] |
| 22779 | N/A | .text | CALL QWORD PTR [RIP+0xC6F99] |
| 227F4 | N/A | .text | CALL QWORD PTR [RIP+0xC69BE] |
| 22856 | N/A | .text | CALL QWORD PTR [RIP+0xC695C] |
| 228A7 | N/A | .text | CALL QWORD PTR [RIP+0xC6E6B] |
| 22927 | N/A | .text | CALL QWORD PTR [RIP+0xC688B] |
| 2295A | N/A | .text | CALL QWORD PTR [RIP+0xC6DB8] |
| 22993 | N/A | .text | CALL QWORD PTR [RIP+0xC681F] |
| 229AA | N/A | .text | CALL QWORD PTR [RIP+0xC6D68] |
| 22A59 | N/A | .text | CALL QWORD PTR [RIP+0xC6759] |
| 22AD7 | N/A | .text | CALL QWORD PTR [RIP+0xC6C3B] |
| 22AF8 | N/A | .text | CALL QWORD PTR [RIP+0xC644A] |
| 22C3A | N/A | .text | CALL QWORD PTR [RIP+0xC6578] |
| 22C69 | N/A | .text | CALL QWORD PTR [RIP+0xC6AA9] |
| 22D69 | N/A | .text | CALL QWORD PTR [RIP+0xC6449] |
| 22D8B | N/A | .text | CALL QWORD PTR [RIP+0xC6987] |
| 22DAD | N/A | .text | CALL QWORD PTR [RIP+0xC6965] |
| 22EBF | N/A | .text | CALL QWORD PTR [RIP+0xC62F3] |
| 22EF6 | N/A | .text | CALL QWORD PTR [RIP+0xC681C] |
| 22F27 | N/A | .text | CALL QWORD PTR [RIP+0xC67EB] |
| 22F99 | N/A | .text | CALL QWORD PTR [RIP+0xC6779] |
| 22FB6 | N/A | .text | CALL QWORD PTR [RIP+0xC675C] |
| 23171 | N/A | .text | CALL QWORD PTR [RIP+0xC6041] |
| 23195 | N/A | .text | CALL QWORD PTR [RIP+0xC657D] |
| 23288 | N/A | .text | CALL QWORD PTR [RIP+0xC648A] |
| 2332A | N/A | .text | CALL QWORD PTR [RIP+0xC5E88] |
| 2334F | N/A | .text | CALL QWORD PTR [RIP+0xC63C3] |
| 23406 | N/A | .text | CALL QWORD PTR [RIP+0xC5DAC] |
| 23457 | N/A | .text | CALL QWORD PTR [RIP+0xC62BB] |
| 23476 | N/A | .text | CALL QWORD PTR [RIP+0xC629C] |
| 235AD | N/A | .text | CALL QWORD PTR [RIP+0xC598D] |
| 237A6 | N/A | .text | CALL QWORD PTR [RIP+0xC5A0C] |
| 23816 | N/A | .text | CALL QWORD PTR [RIP+0xC5EFC] |
| 23861 | N/A | .text | CALL QWORD PTR [RIP+0xC5951] |
| 2391D | N/A | .text | CALL QWORD PTR [RIP+0xC5DF5] |
| 239AF | N/A | .text | CALL QWORD PTR [RIP+0xC5D63] |
| 23A46 | N/A | .text | CALL QWORD PTR [RIP+0xC5CCC] |
| 23A92 | N/A | .text | CALL QWORD PTR [RIP+0xC5C80] |
| 23AC7 | N/A | .text | CALL QWORD PTR [RIP+0xC536B] |
| 23AD5 | N/A | .text | CALL QWORD PTR [RIP+0xC533D] |
| 23B13 | N/A | .text | CALL QWORD PTR [RIP+0xC569F] |
| 23B49 | N/A | .text | CALL QWORD PTR [RIP+0xC5BC9] |
| 23BCE | N/A | .text | CALL QWORD PTR [RIP+0xC5B44] |
| 23D67 | N/A | .text | CALL QWORD PTR [RIP+0xC544B] |
| 23D82 | N/A | .text | CALL QWORD PTR [RIP+0xC5990] |
| 23DD0 | N/A | .text | CALL QWORD PTR [RIP+0xC5942] |
| 23E4E | N/A | .text | CALL QWORD PTR [RIP+0xC5364] |
| 23EBD | N/A | .text | CALL QWORD PTR [RIP+0xC5855] |
| 23ED0 | N/A | .text | CALL QWORD PTR [RIP+0xC506A] |
| 23F10 | N/A | .text | CALL QWORD PTR [RIP+0xC5802] |
| 23F57 | N/A | .text | CALL QWORD PTR [RIP+0xC57BB] |
| 23F8B | N/A | .text | CALL QWORD PTR [RIP+0xC5227] |
| 23FC3 | N/A | .text | CALL QWORD PTR [RIP+0xC574F] |
| 24016 | N/A | .text | CALL QWORD PTR [RIP+0xC56FC] |
| 2403A | N/A | .text | CALL QWORD PTR [RIP+0xC56D8] |
| 2405D | N/A | .text | CALL QWORD PTR [RIP+0xC56B5] |
| 240A7 | N/A | .text | CALL QWORD PTR [RIP+0xC510B] |
| 240CD | N/A | .text | CALL QWORD PTR [RIP+0xC5645] |
| 240FF | N/A | .text | CALL QWORD PTR [RIP+0xC5613] |
| 24110 | N/A | .text | CALL QWORD PTR [RIP+0xC4CAA] |
| 242FB | N/A | .text | CALL QWORD PTR [RIP+0xC4EB7] |
| DC015-DCFFF | N/A | fothk | Unusual BP Cave, count: 4075 |
| 104000 | 180001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x1010 .text + UnwindInfo: .rdata |
| 10400C | 180001040 | .pdata | ExceptionHook | Pointer to 1040 - 0x1040 .text + UnwindInfo: .rdata |
| 104018 | 180001AD0 | .pdata | ExceptionHook | Pointer to 1AD0 - 0x1AD0 .text + UnwindInfo: .rdata |
| 104024 | 180001C20 | .pdata | ExceptionHook | Pointer to 1C20 - 0x1C20 .text + UnwindInfo: .rdata |
| 104030 | 180002090 | .pdata | ExceptionHook | Pointer to 2090 - 0x2090 .text + UnwindInfo: .rdata |
| 10403C | 180002290 | .pdata | ExceptionHook | Pointer to 2290 - 0x2290 .text + UnwindInfo: .rdata |
| 104048 | 1800022C0 | .pdata | ExceptionHook | Pointer to 22C0 - 0x22C0 .text + UnwindInfo: .rdata |
| 104054 | 1800023A0 | .pdata | ExceptionHook | Pointer to 23A0 - 0x23A0 .text + UnwindInfo: .rdata |
| 104060 | 1800023DC | .pdata | ExceptionHook | Pointer to 23DC - 0x23DC .text + UnwindInfo: .rdata |
| 10406C | 18000242C | .pdata | ExceptionHook | Pointer to 242C - 0x242C .text + UnwindInfo: .rdata |
| 104078 | 18000259C | .pdata | ExceptionHook | Pointer to 259C - 0x259C .text + UnwindInfo: .rdata |
| 104084 | 1800027B4 | .pdata | ExceptionHook | Pointer to 27B4 - 0x27B4 .text + UnwindInfo: .rdata |
| 104090 | 18000294C | .pdata | ExceptionHook | Pointer to 294C - 0x294C .text + UnwindInfo: .rdata |
| 10409C | 180002B2C | .pdata | ExceptionHook | Pointer to 2B2C - 0x2B2C .text + UnwindInfo: .rdata |
| 1040A8 | 180002B60 | .pdata | ExceptionHook | Pointer to 2B60 - 0x2B60 .text + UnwindInfo: .rdata |
| 1040B4 | 180002CBC | .pdata | ExceptionHook | Pointer to 2CBC - 0x2CBC .text + UnwindInfo: .rdata |
| 1040C0 | 180002D90 | .pdata | ExceptionHook | Pointer to 2D90 - 0x2D90 .text + UnwindInfo: .rdata |
| 1040CC | 180002E20 | .pdata | ExceptionHook | Pointer to 2E20 - 0x2E20 .text + UnwindInfo: .rdata |
| 1040D8 | 1800031F0 | .pdata | ExceptionHook | Pointer to 31F0 - 0x31F0 .text + UnwindInfo: .rdata |
| 1040E4 | 180003260 | .pdata | ExceptionHook | Pointer to 3260 - 0x3260 .text + UnwindInfo: .rdata |
| 1040F0 | 180003384 | .pdata | ExceptionHook | Pointer to 3384 - 0x3384 .text + UnwindInfo: .rdata |
| 1040FC | 180003410 | .pdata | ExceptionHook | Pointer to 3410 - 0x3410 .text + UnwindInfo: .rdata |
| 104108 | 1800034A8 | .pdata | ExceptionHook | Pointer to 34A8 - 0x34A8 .text + UnwindInfo: .rdata |
| 104114 | 180003518 | .pdata | ExceptionHook | Pointer to 3518 - 0x3518 .text + UnwindInfo: .rdata |
| 104120 | 18000353B | .pdata | ExceptionHook | Pointer to 353B - 0x353B .text + UnwindInfo: .rdata |
| 10412C | 180003588 | .pdata | ExceptionHook | Pointer to 3588 - 0x3588 .text + UnwindInfo: .rdata |
| 104138 | 18000362D | .pdata | ExceptionHook | Pointer to 362D - 0x362D .text + UnwindInfo: .rdata |
| 104144 | 180003667 | .pdata | ExceptionHook | Pointer to 3667 - 0x3667 .text + UnwindInfo: .rdata |
| 104150 | 1800036A1 | .pdata | ExceptionHook | Pointer to 36A1 - 0x36A1 .text + UnwindInfo: .rdata |
| 10415C | 1800036F5 | .pdata | ExceptionHook | Pointer to 36F5 - 0x36F5 .text + UnwindInfo: .rdata |
| 104168 | 180003746 | .pdata | ExceptionHook | Pointer to 3746 - 0x3746 .text + UnwindInfo: .rdata |
| 104174 | 180003780 | .pdata | ExceptionHook | Pointer to 3780 - 0x3780 .text + UnwindInfo: .rdata |
| 104180 | 1800037B7 | .pdata | ExceptionHook | Pointer to 37B7 - 0x37B7 .text + UnwindInfo: .rdata |
| 10418C | 180003804 | .pdata | ExceptionHook | Pointer to 3804 - 0x3804 .text + UnwindInfo: .rdata |
| 104198 | 1800038D0 | .pdata | ExceptionHook | Pointer to 38D0 - 0x38D0 .text + UnwindInfo: .rdata |
| 1041A4 | 180003AF0 | .pdata | ExceptionHook | Pointer to 3AF0 - 0x3AF0 .text + UnwindInfo: .rdata |
| 1041B0 | 180003B60 | .pdata | ExceptionHook | Pointer to 3B60 - 0x3B60 .text + UnwindInfo: .rdata |
| 1041BC | 180003BD0 | .pdata | ExceptionHook | Pointer to 3BD0 - 0x3BD0 .text + UnwindInfo: .rdata |
| 1041C8 | 180003C4C | .pdata | ExceptionHook | Pointer to 3C4C - 0x3C4C .text + UnwindInfo: .rdata |
| 1041D4 | 180003CB0 | .pdata | ExceptionHook | Pointer to 3CB0 - 0x3CB0 .text + UnwindInfo: .rdata |
| 1041E0 | 180003D30 | .pdata | ExceptionHook | Pointer to 3D30 - 0x3D30 .text + UnwindInfo: .rdata |
| 1041EC | 180003DC0 | .pdata | ExceptionHook | Pointer to 3DC0 - 0x3DC0 .text + UnwindInfo: .rdata |
| 1041F8 | 180003F70 | .pdata | ExceptionHook | Pointer to 3F70 - 0x3F70 .text + UnwindInfo: .rdata |
| 104204 | 180004020 | .pdata | ExceptionHook | Pointer to 4020 - 0x4020 .text + UnwindInfo: .rdata |
| 104210 | 180004090 | .pdata | ExceptionHook | Pointer to 4090 - 0x4090 .text + UnwindInfo: .rdata |
| 10421C | 1800040D0 | .pdata | ExceptionHook | Pointer to 40D0 - 0x40D0 .text + UnwindInfo: .rdata |
| 104228 | 180004130 | .pdata | ExceptionHook | Pointer to 4130 - 0x4130 .text + UnwindInfo: .rdata |
| 104234 | 180004172 | .pdata | ExceptionHook | Pointer to 4172 - 0x4172 .text + UnwindInfo: .rdata |
| 104240 | 1800044A7 | .pdata | ExceptionHook | Pointer to 44A7 - 0x44A7 .text + UnwindInfo: .rdata |
| 10424C | 1800044B7 | .pdata | ExceptionHook | Pointer to 44B7 - 0x44B7 .text + UnwindInfo: .rdata |
| 104258 | 180004521 | .pdata | ExceptionHook | Pointer to 4521 - 0x4521 .text + UnwindInfo: .rdata |
| 104264 | 180004593 | .pdata | ExceptionHook | Pointer to 4593 - 0x4593 .text + UnwindInfo: .rdata |
| 104270 | 1800045C0 | .pdata | ExceptionHook | Pointer to 45C0 - 0x45C0 .text + UnwindInfo: .rdata |
| 10427C | 180004607 | .pdata | ExceptionHook | Pointer to 4607 - 0x4607 .text + UnwindInfo: .rdata |
| 104288 | 18000469F | .pdata | ExceptionHook | Pointer to 469F - 0x469F .text + UnwindInfo: .rdata |
| 104294 | 1800046CA | .pdata | ExceptionHook | Pointer to 46CA - 0x46CA .text + UnwindInfo: .rdata |
| 1042A0 | 18000499A | .pdata | ExceptionHook | Pointer to 499A - 0x499A .text + UnwindInfo: .rdata |
| 1042AC | 1800049A5 | .pdata | ExceptionHook | Pointer to 49A5 - 0x49A5 .text + UnwindInfo: .rdata |
| 1042B8 | 1800049AE | .pdata | ExceptionHook | Pointer to 49AE - 0x49AE .text + UnwindInfo: .rdata |
| 1042C4 | 1800049B6 | .pdata | ExceptionHook | Pointer to 49B6 - 0x49B6 .text + UnwindInfo: .rdata |
| 1042D0 | 180004B70 | .pdata | ExceptionHook | Pointer to 4B70 - 0x4B70 .text + UnwindInfo: .rdata |
| 1042DC | 180004BA5 | .pdata | ExceptionHook | Pointer to 4BA5 - 0x4BA5 .text + UnwindInfo: .rdata |
| 1042E8 | 180004D9D | .pdata | ExceptionHook | Pointer to 4D9D - 0x4D9D .text + UnwindInfo: .rdata |
| 1042F4 | 180004D9E | .pdata | ExceptionHook | Pointer to 4D9E - 0x4D9E .text + UnwindInfo: .rdata |
| 104300 | 180004E62 | .pdata | ExceptionHook | Pointer to 4E62 - 0x4E62 .text + UnwindInfo: .rdata |
| 10430C | 180004EC3 | .pdata | ExceptionHook | Pointer to 4EC3 - 0x4EC3 .text + UnwindInfo: .rdata |
| 104318 | 180004EF1 | .pdata | ExceptionHook | Pointer to 4EF1 - 0x4EF1 .text + UnwindInfo: .rdata |
| 104324 | 180004F69 | .pdata | ExceptionHook | Pointer to 4F69 - 0x4F69 .text + UnwindInfo: .rdata |
| 104330 | 180004F76 | .pdata | ExceptionHook | Pointer to 4F76 - 0x4F76 .text + UnwindInfo: .rdata |
| 10433C | 180004F81 | .pdata | ExceptionHook | Pointer to 4F81 - 0x4F81 .text + UnwindInfo: .rdata |
| 104348 | 180004F8B | .pdata | ExceptionHook | Pointer to 4F8B - 0x4F8B .text + UnwindInfo: .rdata |
| 104354 | 180004FDA | .pdata | ExceptionHook | Pointer to 4FDA - 0x4FDA .text + UnwindInfo: .rdata |
| 104360 | 180005071 | .pdata | ExceptionHook | Pointer to 5071 - 0x5071 .text + UnwindInfo: .rdata |
| 10436C | 18000507C | .pdata | ExceptionHook | Pointer to 507C - 0x507C .text + UnwindInfo: .rdata |
| 104378 | 1800050C3 | .pdata | ExceptionHook | Pointer to 50C3 - 0x50C3 .text + UnwindInfo: .rdata |
| 104384 | 1800050CB | .pdata | ExceptionHook | Pointer to 50CB - 0x50CB .text + UnwindInfo: .rdata |
| 104390 | 180005442 | .pdata | ExceptionHook | Pointer to 5442 - 0x5442 .text + UnwindInfo: .rdata |
| 10439C | 180005471 | .pdata | ExceptionHook | Pointer to 5471 - 0x5471 .text + UnwindInfo: .rdata |
| 1043A8 | 180005660 | .pdata | ExceptionHook | Pointer to 5660 - 0x5660 .text + UnwindInfo: .rdata |
| 1043B4 | 1800056B0 | .pdata | ExceptionHook | Pointer to 56B0 - 0x56B0 .text + UnwindInfo: .rdata |
| 1043C0 | 180005700 | .pdata | ExceptionHook | Pointer to 5700 - 0x5700 .text + UnwindInfo: .rdata |
| 1043CC | 180005750 | .pdata | ExceptionHook | Pointer to 5750 - 0x5750 .text + UnwindInfo: .rdata |
| 1043D8 | 1800057C0 | .pdata | ExceptionHook | Pointer to 57C0 - 0x57C0 .text + UnwindInfo: .rdata |
| 1043E4 | 180005820 | .pdata | ExceptionHook | Pointer to 5820 - 0x5820 .text + UnwindInfo: .rdata |
| 1043F0 | 1800058B0 | .pdata | ExceptionHook | Pointer to 58B0 - 0x58B0 .text + UnwindInfo: .rdata |
| 1043FC | 180005900 | .pdata | ExceptionHook | Pointer to 5900 - 0x5900 .text + UnwindInfo: .rdata |
| 104408 | 180005944 | .pdata | ExceptionHook | Pointer to 5944 - 0x5944 .text + UnwindInfo: .rdata |
| 104414 | 180005BE0 | .pdata | ExceptionHook | Pointer to 5BE0 - 0x5BE0 .text + UnwindInfo: .rdata |
| 104420 | 180005C44 | .pdata | ExceptionHook | Pointer to 5C44 - 0x5C44 .text + UnwindInfo: .rdata |
| 10442C | 180005CC0 | .pdata | ExceptionHook | Pointer to 5CC0 - 0x5CC0 .text + UnwindInfo: .rdata |
| 104438 | 180005CD6 | .pdata | ExceptionHook | Pointer to 5CD6 - 0x5CD6 .text + UnwindInfo: .rdata |
| 104444 | 180005CE3 | .pdata | ExceptionHook | Pointer to 5CE3 - 0x5CE3 .text + UnwindInfo: .rdata |
| 104450 | 180005D0B | .pdata | ExceptionHook | Pointer to 5D0B - 0x5D0B .text + UnwindInfo: .rdata |
| 10445C | 180005D19 | .pdata | ExceptionHook | Pointer to 5D19 - 0x5D19 .text + UnwindInfo: .rdata |
| 104468 | 180005D20 | .pdata | ExceptionHook | Pointer to 5D20 - 0x5D20 .text + UnwindInfo: .rdata |
| 104474 | 180005D40 | .pdata | ExceptionHook | Pointer to 5D40 - 0x5D40 .text + UnwindInfo: .rdata |
| 104480 | 180005EE0 | .pdata | ExceptionHook | Pointer to 5EE0 - 0x5EE0 .text + UnwindInfo: .rdata |
| 10448C | 180005FC0 | .pdata | ExceptionHook | Pointer to 5FC0 - 0x5FC0 .text + UnwindInfo: .rdata |
| 104498 | 1800061AC | .pdata | ExceptionHook | Pointer to 61AC - 0x61AC .text + UnwindInfo: .rdata |
| 1044A4 | 18000627C | .pdata | ExceptionHook | Pointer to 627C - 0x627C .text + UnwindInfo: .rdata |
| D5000-DBFFF | D5000 | .ndr64 | Executable section anomaly, first bytes: CCCCCCCCCCCCCCCC |
| DC000-DCFFF | DC000 | fothk | Executable section anomaly, first bytes: CCCCCCCCCCCCCCCC |
| 117000 | N/A | *Overlay* | D09C00000002020030829CBD06092A864886F70D | ........0.....*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 694308 | 58,694% |
| Null Byte Code | 221456 | 18,721% |
© 2026 All rights reserved.