PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,70 MB SHA-256 Hash: F4414B3375C9FC6AA249082A8F0304EEB3AF1BD8354AC7ACC0A2F568F4A8C626 SHA-1 Hash: 4AE56394B2C9EF5A054C58B71A885A1F1A71088B MD5 Hash: BCE00404472F870CA3E5D6A456700A69 Imphash: 038A0AFB6170F0ACE811DA062F88CB86 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 001BF6B0 EntryPoint (rva): CF630 SizeOfHeaders: 1000 SizeOfImage: 1B9000 ImageBase: 10000000 Architecture: x86 ExportTable: 1942F0 ImportTable: 190854 IAT: 110000 Characteristics: 2102 TimeDateStamp: 56D4D7FF Date: 29/02/2016 23:45:03 File Type: DLL Number Of Sections: 5 ASLR: Disabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | 10F000 | 1000 | 10E8EF |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
110000 | 85000 | 110000 | 84753 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
195000 | 7000 | 195000 | C588 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
19C000 | 4000 | 1A2000 | 35B8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1A0000 | 13000 | 1A6000 | 127CA |
|
|
| Description |
| OriginalFilename: nkcCore3.DLL LegalCopyright: Copyright (C) 2006 FileDescription: nkcCore3 DLL ProductVersion: 3. 0. 0. 6 Language: Japanese (Japan) (ID=0x411) CodePage: Unicode (UTF-16 LE) (0x4B0) Unusual Chars Found In Description File - (Polymorphic patterns or unicode characters) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - CF630 Code -> 558BEC837D0C017505E8825401008B4510508B4D0C518B550852E81100000083C40C5DC20C00CCCCCCCCCCCCCCCCCCCC558B Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X100CF63E |CALL 0X100E4AC0 |MOV EAX, DWORD PTR [EBP + 0X10] |PUSH EAX |MOV ECX, DWORD PTR [EBP + 0XC] |PUSH ECX |MOV EDX, DWORD PTR [EBP + 8] |PUSH EDX |CALL 0X100CF660 |ADD ESP, 0XC |POP EBP |RET 0XC |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |PUSH EBP |
| Signatures |
| Rich Signature Analyzer: Code -> E42DBDA3A04CD3F0A04CD3F0A04CD3F063438CF0A74CD3F063438EF0B74CD3F0A04CD2F0504ED3F03788ADF0A44CD3F0878AAEF0BE4CD3F0878ABEF01F4CD3F04853D9F0944CD3F0878ABDF0654CD3F0878AA9F0A14CD3F0878AAFF0A14CD3F0878AABF0A14CD3F052696368A04CD3F0 Footprint md5 Hash -> 17C41604B5F343E3A3C7D2EC57ECDF27 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE: library: MFC(-)[static] • PE: compiler: Microsoft Visual C++(2005)[-] • PE: protection: Rainbow Sentinel dongle reference(-)[-] • PE: protection: Sentinel SuperPro dongle reference(-)[-] • PE: linker: Microsoft Linker(8.0 or 11.0)[-] • Entropy: 6.48218 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | IsBadReadPtr | Checks whether memory is readable. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | OpenEventA | Opens an existing event object. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | WSAStartup | Initializes the Winsock networking library. |
| Ws2_32.DLL | WSACleanup | Releases Winsock networking resources. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | listen | Puts a socket into listening mode. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegDeleteKeyA | Used to delete a subkey and its values from the Windows registry. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegDeleteValueA | Removes a named value from the specified registry key. Note that value names are not case sensitive. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| Windows REG |
| SOFTWARE\Noritsukoki\EZ Controller\InstallInfo SOFTWARE\NoritsuKoki\EZ Controller\InstallInfo SOFTWARE\Noritsukoki\NMPS\SettingModule\InstallInfo Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 Software\Microsoft\Windows\CurrentVersion\Policies\Network Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Software\Microsoft\Windows NT\CurrentVersion\NetworkCards System\CurrentControlSet\Control\ProductOptions SYSTEM\CurrentControlSet\Services\SENTINEL SYSTEM\CurrentControlSet\Services\SNTNLUSB Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - NoRun |
| File Access |
| inetmib1.dll snmpapi.dll wintrust.dll NETAPI32.DLL wsock32.dll nkcCore380.dll WS2_32.dll OLEAUT32.dll ole32.dll SHLWAPI.dll SHELL32.dll ADVAPI32.dll comdlg32.dll GDI32.dll USER32.dll KERNEL32.dll OLEACC.dll MSPDB80.DLL mscoree.dll mscoree.dll mfcm80d.dll UxTheme.dll comdlg32.dll comctl32.dll %s%s.dll ntdll.dll SNTNLUSB.SYS SENTINEL.SYS spserv.dat spnserv.dat @.dat SYSTEM.INI .INI MSG_JAPANESE.ini MSG_ENGLISH.ini Temp |
| File Access (UNICODE) |
| nkcCore3.DLL GetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLL |
| Interest's Words |
| PADDINGX ToolBar PassWord exec attrib start hostname systeminfo ping openfiles replace |
| Interest's Words (UNICODE) |
| start expand |
| URLs |
| http://www.w3.org/XML/1998/namespace |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Antivirus Software (gdata) |
| Text | Ascii | Keyboard Key (LBUTTON) |
| Text | Ascii | Keyboard Key (MBUTTON) |
| Text | Ascii | Keyboard Key (RBUTTON) |
| Text | Ascii | Keyboard Key (Scroll) |
| Entry Point | Hex Pattern | MEW 10 packer v1.0 - Northfox |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1041 | 1A2A78 | 134 | 19CA78 | 020002002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\1041 | 1A2BAC | B4 | 19CBAC | 010001002800000010000000200000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(....... ..................................... |
| \CURSOR\3\1041 | 1A2C60 | 134 | 19CC60 | 0F0014002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1041 | 1A2D94 | 134 | 19CD94 | 100008002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1041 | 1A2EC8 | 134 | 19CEC8 | 0A000E002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1041 | 1A2FFC | 134 | 19CFFC | 15000E002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1041 | 1A3130 | 134 | 19D130 | 0C0012002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\8\1041 | 1A3264 | 134 | 19D264 | 140012002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\9\1041 | 1A3398 | 134 | 19D398 | 0C000B002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\10\1041 | 1A34CC | 134 | 19D4CC | 13000A002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\11\1041 | 1A3600 | 134 | 19D600 | 10000F002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\12\1041 | 1A3734 | 134 | 19D734 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\13\1041 | 1A3868 | 134 | 19D868 | 0F000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\14\1041 | 1A399C | 134 | 19D99C | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\15\1041 | 1A3AD0 | 134 | 19DAD0 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\16\1041 | 1A3C04 | 134 | 19DC04 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \BITMAP\30994\1041 | 1A3D38 | B8 | 19DD38 | 280000000C0000000A0000000100040000000000500000000000000000000000000000000000000000000000000080000080 | (...................P............................. |
| \BITMAP\30996\1041 | 1A3DF0 | 144 | 19DDF0 | 28000000210000000B0000000100040000000000DC0000000000000000000000000000000000000000000000000080000080 | (...!............................................. |
| \DIALOG\8000\0 | 1A3F34 | 112 | 19DF34 | C000C0800000000005000000000018018C0000000000D130B930EF30FC30C9308D8AEF5300000C002DFF33FF200030FFB430 | .......................0.0.0.0.0...S....-.3. .0..0 |
| \DIALOG\8001\0 | 1A4048 | 1FA | 19E048 | C000C080000000000A00000000001E018C0000000000AA30FC30CA30FC30D130B930EF30FC30C9302D8A9A5B00000C002DFF | .......................0.0.0.0.0.0.0.0.0-..[....-. |
| \DIALOG\30721\1041 | 1A4244 | E8 | 19E244 | C400C88000000000050009001A00B700460000000000B0658F89000008004D00530020005300680065006C006C0020004400 | ................F......e......M.S. .S.h.e.l.l. .D. |
| \DIALOG\30734\1041 | 1A432C | 34 | 19E32C | C800C88000000000000009001A00B700460000000000000008004D00530020005300680065006C006C00200044006C0067000000 | ................F.........M.S. .S.h.e.l.l. .D.l.g... |
| \STRING\3841\1041 | 1A4360 | 62 | 19E360 | 02008B954F3008000D544D529230D84E51306630DD4F585B0E005930793066306E30D530A130A430EB30200028002A002E002A002900020021714C9800000000070021714C986E30D530A130A430EB30000000000000000000000000000000000000 | ....O0...TMR.0.NQ0f0.OX[..Y0y0f0n0.0.0.0.0 .(.*...*.)...!qL.......!qL.n0.0.0.0.0.................. |
| \STRING\3842\1041 | 1A43C4 | 2E | 19E3C4 | 000007005E9768883A79280026004800290000000000000000000000000000000000000000000000000000000000 | .....h.:y(.&.H.)............................. |
| \STRING\3843\1041 | 1A43F4 | DC | 19E3F4 | 1000A830E930FC302000E130C330BB30FC30B8306F3042308A307E305B30933002301400B530DD30FC30C83055308C306630 | ...0.0.0 ..0.0.0.0.0o0B0.0~0[0.0.0...0.0.0.0U0.0f0 |
| \STRING\3857\1041 | 1A44D0 | 34A | 19E4D0 | 0B002171B9526A30D530A130A430EB300D546730593002301300C930AD30E530E130F330C83092308B954F30533068306B30 | ..!q.Rj0.0.0.0.0.Tg0Y0.0...0.0.0.0.0.0.0..O0S0h0k0 |
| \STRING\3858\1041 | 1A481C | 1BC | 19E81C | 0C0074657065923065519B52573066304F3060305530443002300C007065575B923065519B52573066304F30603055304430 | ..tepe.0eQ.RW0f0O00U0D0.0..peW[.0eQ.RW0f0O00U0D0 |
| \STRING\3859\1041 | 1A49D8 | 18E | 19E9D8 | 0E00884E1F6757306A304430D530A130A430EB30625F0F5F6730593002302B00250031000A0053306E30D530A130A430EB30 | ...N.gW0j0D0.0.0.0.0b_._g0Y0.0+.%.1...S0n0.0.0.0.0 |
| \STRING\3860\1041 | 1A4B68 | 74 | 19EB68 | 1C00250031003A002000250032000A0043006F006E00740069006E0075006500B930AF30EA30D730C83092309F5B4C882D4E | ..%.1.:. .%.2...C.o.n.t.i.n.u.e..0.0.0.0.0.0.[L.-N |
| \STRING\3865\1041 | 1A4BDC | 76 | 19EBDC | 0000000000000000000000000000000000000000000000001600F8664D30BC8F7F30025C2875D730ED30D130C630A3304B30 | ...........................fM0...0.\(u.0.0.0.0.0K0 |
| \STRING\3866\1041 | 1A4C54 | 8E | 19EC54 | 1600E130FC30EB302000B730B930C630E0302000B530DD30FC30C8309230AD8A7F30BC8F81307E305B30933002301300E130 | ...0.0.0 ..0.0.0.0 ..0.0.0.0.0...0...0~0[0.0.0...0 |
| \STRING\3867\1041 | 1A4CE4 | 2DC | 19ECE4 | 0D00A830E930FC306F3042308A307E305B309330673057305F300230190025003100200078306E30A230AF30BB30B9302D4E | ...0.0.0o0B0.0~0[0.0g0W0_0.0..%.1. .x0n0.0.0.0.0-N |
| \STRING\3868\1041 | 1A4FC0 | 160 | 19EFC0 | 0D00A830E930FC306F3042308A307E305B309330673057305F300230190025003100200078306E30A230AF30BB30B9302D4E | ...0.0.0o0B0.0~0[0.0g0W0_0.0..%.1. .x0n0.0.0.0.0-N |
| \STRING\3869\1041 | 1A5120 | 28 | 19F120 | 0400D430AF30BB30EB30000000000000000000000000000000000000000000000000000000000000 | ...0.0.0.0.............................. |
| \STRING\3887\1041 | 1A5148 | 2C | 19F148 | 00000200AA30D5300200AA30F3300200F76D0854000000000000000000000000000000000000000000000000 | .....0.0...0.0...m.T........................ |
| \GROUP_CURSOR\30977\1041 | 1A5174 | 22 | 19F174 | 00000200020020004000010001003401000001001000200001000100B40000000200 | ...... .@.....4....... ........... |
| \GROUP_CURSOR\30998\1041 | 1A5198 | 14 | 19F198 | 0000020001002000400001000100340100000800 | ...... .@.....4..... |
| \GROUP_CURSOR\30999\1041 | 1A51AC | 14 | 19F1AC | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\31000\1041 | 1A51C0 | 14 | 19F1C0 | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_CURSOR\31001\1041 | 1A51D4 | 14 | 19F1D4 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\31002\1041 | 1A51E8 | 14 | 19F1E8 | 0000020001002000400001000100340100000D00 | ...... .@.....4..... |
| \GROUP_CURSOR\31003\1041 | 1A51FC | 14 | 19F1FC | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\31004\1041 | 1A5210 | 14 | 19F210 | 0000020001002000400001000100340100000A00 | ...... .@.....4..... |
| \GROUP_CURSOR\31005\1041 | 1A5224 | 14 | 19F224 | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\31006\1041 | 1A5238 | 14 | 19F238 | 0000020001002000400001000100340100000900 | ...... .@.....4..... |
| \GROUP_CURSOR\31007\1041 | 1A524C | 14 | 19F24C | 0000020001002000400001000100340100000B00 | ...... .@.....4..... |
| \GROUP_CURSOR\31008\1041 | 1A5260 | 14 | 19F260 | 0000020001002000400001000100340100000C00 | ...... .@.....4..... |
| \GROUP_CURSOR\31009\1041 | 1A5274 | 14 | 19F274 | 0000020001002000400001000100340100000E00 | ...... .@.....4..... |
| \GROUP_CURSOR\31010\1041 | 1A5288 | 14 | 19F288 | 0000020001002000400001000100340100000F00 | ...... .@.....4..... |
| \GROUP_CURSOR\31011\1041 | 1A529C | 14 | 19F29C | 0000020001002000400001000100340100001000 | ...... .@.....4..... |
| \VERSION\1\1041 | 1A52B0 | 2B0 | 19F2B0 | B00234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\2\1033 | 1A5560 | 56 | 19F560 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C2F617373656D626C793E | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">..</assembly> |
| Intelligent String |
| • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlwin.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\output.c • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmini.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olereg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\barcool.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl6.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bardock.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\doccore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dockcont.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\tooltip.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp • KERNEL32.DLL • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\ccdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\docmgr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appdlg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\doctempl.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filelist.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winbtn.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\trckrect.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgprop.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_sp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pw.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_u.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl3.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp • GDI32.DLL • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dllmodul.cpp • .\nkcCore3.cpp • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\cstringt.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlexcept.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlsimpstr.h • MSG_ENGLISH.iniMSG_JAPANESE.ini • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlconv.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlalloc.h • http://www.w3.org/XML/1998/namespace • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp • hhctrl.ocx • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcomctl32.hInitCommonControls • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxdlgs.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxext.inl • kernel32.dll • ntdll.dll • %s%s.dll • comctl32.dll • comdlg32.dll • user32.dll • .CHM • .HLP • .INI • CDumpContext • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp • Unable to dump object in static release builds • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcommem.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp m_cause = • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppCArchive exception: %hs. • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppCArchiveException • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cppm_cause = • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cppUnknownCFile exception: %hs, File %s, OS error information = %ld. • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgfile.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\barcore.cpp • :%df:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgclr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl • CLSID\%1\InprocHandler32ole32.dll • mscoree.dllfaulted while dumping object at $%p, %u bytes long • faulted while dumping object at $%p, %u bytes long • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\timecore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oletyplb.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c • f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c • Object dump complete. • File Error(%d) : Dumping objects -> • _CrtMemDumpStatistics • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcscpy_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\malloc.h • f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcsncpy_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcscat_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tsplitpath_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tmakepath_s.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c • f:\dd\vctools\crt_bld\self_x86\crt\src\crtmbox.c • 6typname.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\input.c • F:\dd\vctools\crt_bld\SELF_X86\crt\src\ungetc_nolock.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\mbsncpy_s.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c • f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c • tzset.cTZ • f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c • ../include\strgtold12.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpcoll.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h • OLEACC.dll • KERNEL32.dll • DestroyWindowRCreateDialogIndirectParamA • USER32.dll • WINSPOOL.DRV • ADVAPI32.dll • WS2_32.dll • .\nkcChangePass.cpp • .\nkcCheckPass1.cpp • .\nkcCore3KeyCheck.cpp • Global\%s%s • 127.0.0.1 • spnserv.dat • spserv.dat • wintrust.dll • SENTINEL.SYS • SNTNLUSB.SYS • sntlconfig.xml |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 1740 | 1019B4A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 175C | 1011063C | .text | CALL [static] | Indirect call to absolute memory address |
| 176B | 10110640 | .text | CALL [static] | Indirect call to absolute memory address |
| 1779 | 10110644 | .text | CALL [static] | Indirect call to absolute memory address |
| 17D9 | 10110638 | .text | CALL [static] | Indirect call to absolute memory address |
| 1800 | 1019B4A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 181B | 10110634 | .text | CALL [static] | Indirect call to absolute memory address |
| 184A | 1019B4A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1851 | 10110634 | .text | CALL [static] | Indirect call to absolute memory address |
| 187C | 10110638 | .text | CALL [static] | Indirect call to absolute memory address |
| 18A3 | 1019B4A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 18B9 | 10110634 | .text | CALL [static] | Indirect call to absolute memory address |
| 18F0 | 1019B4A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 18F7 | 10110634 | .text | CALL [static] | Indirect call to absolute memory address |
| 2079 | 10110630 | .text | CALL [static] | Indirect call to absolute memory address |
| 21AF | 1011004C | .text | CALL [static] | Indirect call to absolute memory address |
| 2227 | 10110044 | .text | CALL [static] | Indirect call to absolute memory address |
| 2250 | 10110048 | .text | CALL [static] | Indirect call to absolute memory address |
| 2270 | 1011004C | .text | CALL [static] | Indirect call to absolute memory address |
| 2EC9 | 10110394 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F7E | 10110044 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F98 | 10110048 | .text | CALL [static] | Indirect call to absolute memory address |
| 3277 | 10110630 | .text | CALL [static] | Indirect call to absolute memory address |
| 350F | 10110990 | .text | CALL [static] | Indirect call to absolute memory address |
| 3752 | 10110044 | .text | CALL [static] | Indirect call to absolute memory address |
| 3778 | 10110048 | .text | CALL [static] | Indirect call to absolute memory address |
| 3785 | 1011004C | .text | CALL [static] | Indirect call to absolute memory address |
| 3930 | 1011062C | .text | JMP [static] | Indirect jump to absolute memory address |
| 39B2 | 10110628 | .text | CALL [static] | Indirect call to absolute memory address |
| 3A44 | 10110634 | .text | CALL [static] | Indirect call to absolute memory address |
| 3A70 | 10110624 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D30 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3D40 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3D4C | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D68 | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D90 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3DA0 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3DAC | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DC3 | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DE0 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3DF0 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3DFC | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E18 | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E40 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3E50 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3E5C | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E78 | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EA0 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3EB0 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3EBC | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EDD | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F00 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3F10 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3F1C | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F51 | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F70 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3F80 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3F8C | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FBC | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FE0 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 3FF0 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3FFC | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 401D | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 4040 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 4050 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 405B | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 406B | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 4090 | 1011062C | .text | CALL [static] | Indirect call to absolute memory address |
| 40A0 | 101105FC | .text | CALL [static] | Indirect call to absolute memory address |
| 40AC | 10110600 | .text | CALL [static] | Indirect call to absolute memory address |
| 40C8 | 10110604 | .text | CALL [static] | Indirect call to absolute memory address |
| 43B1 | 101105F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 44FD | 10110A14 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E49 | 10110A14 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E90 | 10110620 | .text | CALL [static] | Indirect call to absolute memory address |
| 4EC5 | 1011003C | .text | CALL [static] | Indirect call to absolute memory address |
| 4EDF | 10110040 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F64 | 10110620 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FCA | 10110038 | .text | CALL [static] | Indirect call to absolute memory address |
| 5005 | 101105D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 504F | 1011060C | .text | CALL [static] | Indirect call to absolute memory address |
| 5069 | 101105E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 507E | 1011004C | .text | CALL [static] | Indirect call to absolute memory address |
| 5278 | 10110624 | .text | CALL [static] | Indirect call to absolute memory address |
| 59C1 | 101105F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5A33 | 101105CC | .text | CALL [static] | Indirect call to absolute memory address |
| 5C9F | 101105C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5FEA | 101105C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 6009 | 101105C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 6091 | 101105C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 60A7 | 101105C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 60D6 | 101105BC | .text | CALL [static] | Indirect call to absolute memory address |
| 60DD | 101105F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 615C | 101105AC | .text | CALL [static] | Indirect call to absolute memory address |
| 621E | 101105B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 6240 | 101105F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 6252 | 101105F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 628A | 101105E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6297 | 10110624 | .text | CALL [static] | Indirect call to absolute memory address |
| 62A1 | 101105F4 | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1208323 | 67,8163% |
| Null Byte Code | 243153 | 13,6468% |
| NOP Cave Found | 0x9090909090 | Block Count: 677 | Total: 0,095% |
© 2026 All rights reserved.