Injected code address may not be in address ranges of loaded modules. In such cases, in the execution call history we would see plain EIP and RIP return addresses on stack traces. We call this pattern RIP Stack Trace partly because we have seen these addresses after something had gone wrong and a process crashed:
0:005> k ChildEBP RetAddr 02aec974 77655620 ntdll!KiFastSystemCallRet 02aec978 77683c62 ntdll!NtWaitForSingleObject+0xc 02aec9fc 77683d4b ntdll!RtlReportExceptionEx+0x14b 02aeca3c 7769fa87 ntdll!RtlReportException+0x3c 02aeca50 7769fb0d ntdll!RtlpTerminateFailureFilter+0x14 02aeca5c 775f9bdc ntdll!RtlReportCriticalFailure+0x6b 02aeca70 775f4067 ntdll!_EH4_CallFilterFunc+0x12 02aeca98 77655f79 ntdll!_except_handler4+0x8e 02aecabc 77655f4b ntdll!ExecuteHandler2+0x26 02aecb6c 77655dd7 ntdll!ExecuteHandler+0x24 02aecb6c 7769faf8 ntdll!KiUserExceptionDispatcher+0xf 02aecee0 776a0704 ntdll!RtlReportCriticalFailure+0x5b 02aecef0 776a07f2 ntdll!RtlpReportHeapFailure+0x21 02aecf24 7766b1a5 ntdll!RtlpLogHeapFailure+0xa1 02aecf6c 7765730a ntdll!RtlpCoalesceFreeBlocks+0x4b9 02aed064 77657545 ntdll!RtlpFreeHeap+0x1e2 02aed080 75e47e4b ntdll!RtlFreeHeap+0x14e 02aed0c8 77037277 kernel32!GlobalFree+0x47 02aed0dc 774b4a1f ole32!ReleaseStgMedium+0x124 02aed0f0 77517feb urlmon!ReleaseBindInfo+0x4c 02aed100 774d9a87 urlmon!CINet::ReleaseCNetObjects+0x3d 02aed118 774d93f0 urlmon!CINetHttp::OnWininetRequestHandleClosing+0x60 02aed12c 76432078 urlmon!CINet::CINetCallback+0x2de 02aed274 76438f5d wininet!InternetIndicateStatus+0xfc 02aed2a4 7643937a wininet!HANDLE_OBJECT::~HANDLE_OBJECT+0xc9 02aed2c0 7643916b wininet!INTERNET_CONNECT_HANDLE_OBJECT::~INTERNET_CONNECT_HANDLE_OBJECT+0x 209 02aed2cc 76438d5e wininet!HTTP_REQUEST_HANDLE_OBJECT::`vector deleting destructor'+0xd 02aed2dc 76434e72 wininet!HANDLE_OBJECT::Dereference+0x22 02aed2e8 76439419 wininet!DereferenceObject+0x21 02aed310 76439114 wininet!_InternetCloseHandle+0x9d 02aed330 0004aaaf wininet!InternetCloseHandle+0x11e WARNING: Frame IP not in any known module. Following frames may be wrong. 02aed33c 774c5d25 0×4aaaf 02aed358 774c5d95 urlmon!CINet::TerminateRequest+0×82 02aed364 774c5d7c urlmon!CINet::MyUnlockRequest+0×10 02aed370 774c5d63 urlmon!CINetProtImpl::UnlockRequest+0×10 02aed37c 774c5d49 urlmon!CINetEmbdFilter::UnlockRequest+0×11 02aed388 774b743d urlmon!CINet::UnlockRequest+0×13 02aed394 774b73e1 urlmon!COInetProt::UnlockRequest+0×11 02aed3a8 774b7530 urlmon!CTransaction::UnlockRequest+0×36 02aed3b4 774b74e0 urlmon!CTransData::~CTransData+0×3a 02aed3c0 774b74c9 urlmon!CTransData::`scalar 02aed3d8 774e221f urlmon!CTransData::Release+0×25 02aed3e0 774b6d0a urlmon!CReadOnlyStreamDirect::~CReadOnlyStreamDirect+0×1a 02aed3ec 774b7319 urlmon!CReadOnlyStreamDirect::`vector deleting destructor’+0xd 02aed404 774b72be urlmon!CReadOnlyStreamDirect::Release+0×25 02aed410 774b71f4 urlmon!CBinding::~CBinding+0xb9 02aed41c 774b71dd urlmon!CBinding::`scalar 02aed434 6b20b0e8 urlmon!CBinding::Release+0×25 02aed448 6b20b0ba mshtml!ATL::AtlComPtrAssign+0×2b 02aed458 6b20b8de mshtml!ATL::CComPtr<IBindCallbackInternal>::operator=+0×15 02aed464 6b20b8aa mshtml!CBindingXSSFilter::TearDown+0×2b 02aed46c 6b20b887 mshtml!BindingXSSFilter_TearDown+0×19 02aed478 6b0da61a mshtml!CStreamProxy::Passivate+0×12 02aed484 6b0ddf3a mshtml!CBaseFT::Release+0×1d 02aed4ac 6b0e0b70 mshtml!CDwnBindData::TerminateBind+0×11d 02aed4b8 6b11a2a9 mshtml!CDwnBindData::TerminateOnApt+0×14 02aed4ec 6b105066 mshtml!GlobalWndOnMethodCall+0xfb 02aed50c 7742fd72 mshtml!GlobalWndProc+0×183 02aed538 7742fe4a user32!InternalCallWinProc+0×23 02aed5b0 7743018d user32!UserCallWinProcCheckWow+0×14b 02aed614 7743022b user32!DispatchMessageWorker+0×322 02aed624 6ecac1d5 user32!DispatchMessageW+0xf 02aef72c 6ec5337e ieframe!CTabWindow::_TabWindowThreadProc+0×54c 02aef7e4 760f426d ieframe!LCIETab_ThreadProc+0×2c1 02aef7f4 75e4d0e9 iertutil!CIsoScope::RegisterThread+0xab 02aef800 776319bb kernel32!BaseThreadInitThunk+0xe 02aef840 7763198e ntdll!__RtlUserThreadStart+0×23 02aef858 00000000 ntdll!_RtlUserThreadStart+0×1b
However, such addresses need to be checked whether they belong to .NET CLR JIT code (Volume 3, page 132).