PESCAN.IO - Analysis Report

PESCAN.IO - Analysis Report Basic

File Structure

PE Chart Code

Header PE (light blue)

Executable sections (pink)

Non-executable sections (black)

External injected code (red)

File Structure in red = malformed or corrupted header

Chart Code For Other Files

Printable characters (blue)

Non-printable characters (black)

Information

Icon:

Size: 3,00 MB
SHA-256 Hash: 1247811224F2396BF5BACFA481E6FBC45D990E77E207D1B77823E412603C5334
SHA-1 Hash: 33EBD347BB54A86D3C8C89115352551A78854774
MD5 Hash: D353AB89F2585EBBEA7BD55310454BD7
Imphash: 5D4213AF2221E745E8CCCCE6095ECB4F
MajorOSVersion: 6
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 8BF438
SizeOfHeaders: 200
SizeOfImage: 914000
ImageBase: 0000000000400000
Architecture: x64
ExportTable: 8BF000
ImportTable: 8BF074
IAT: 8BF1A0
Characteristics: 222
TimeDateStamp: 667AE4B5
Date: 25/06/2024 15:39:33
File Type: EXE
Number Of Sections: 3
ASLR: Disabled
Section Names (Optional Header): .MPRESS1, .MPRESS2, .rsrc
Number Of Executable Sections: 2
Subsystem: Windows GUI
[Incomplete Binary or Compressor Packer - 6,08 MB Missing]

Sections Info

Section Name	Flags	ROffset	RSize	VOffset	VSize	Entropy	Chi2
.MPRESS1	0xE00000E0 Code Initialized Data Uninitialized Data Executable Readable Writeable	200	2AB800	1000	8BE000	7.9999	293.19
.MPRESS2	0xE00000E0 Code Initialized Data Uninitialized Data Executable Readable Writeable	2ABA00	1200	8BF000	11E4	5.4123	130705.44
.rsrc	0xC0000040 Initialized Data Readable Writeable	2ACC00	53000	8C1000	52FC8	7.5416	998370.6

Description

OriginalFilename: grimv1210_x64+22tr.exe
CompanyName: Home of Gamehacking
LegalCopyright: iNvIcTUs oRCuS
ProductName: Project1
FileVersion: 1.0.0.0
FileDescription: Grim Dawn v1.2.1.0 x64 +22 Trainer
ProductVersion: 1.0.0.0
Language: English (United States) (ID=0x409)
CodePage: Western European (Windows 1252) (0x4E4)

Entry Point

The section number (2) have the Entry Point
Information -> EntryPoint (calculated) - 2ABE38
Code -> 57565351524150488D05DE0A0000488B304803F0482BC0488BFE66ADC1E00C488BC850AD2BC84803F18BC857448BC1FFC98A

Assembler

|PUSH RDI

|PUSH RSI

|PUSH RBX

|PUSH RCX

|PUSH RDX

|PUSH R8

|LEA RAX, [RIP + 0XADE]

|MOV RSI, QWORD PTR [RAX]

|ADD RSI, RAX

|SUB RAX, RAX

|MOV RDI, RSI

|LODSW AX, WORD PTR [RSI]

|SHL EAX, 0XC

|MOV RCX, RAX

|PUSH RAX

|LODSD EAX, DWORD PTR [RSI]

|SUB ECX, EAX

|ADD RSI, RCX

|MOV ECX, EAX

|PUSH RDI

|MOV R8D, ECX

|DEC ECX

Signatures

Certificate - Digital Signature Not Found:
• The file is not signed

Packer/Compiler

Packer: MPress v2.x
Detect It Easy (die)
• PE+(64): packer: EP:MPRESS(1.27-2.12)[-]
• PE+(64): packer: MPRESS(2.19)[-]
• PE+(64): compiler: Borland Delphi(-)[-]
• Entropy: 7.98367

Suspicious Functions

Library	Function	Description
KERNEL32.DLL	GetModuleHandleA	Retrieves a handle to the specified module.
KERNEL32.DLL	GetProcAddress	Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
SHELL32.DLL	ShellExecuteW	Performs a run operation on a specific file.

File Access

Project1.exe
!Win64 .EXE
gdi32.dll
api-ms-win-crt-string-l1-1-0.dll
ole32.dll
advapi32.dll
WTSAPI32.DLL
oleaut32.dll
version.dll
user32.dll
shell32.dll
comctl32.dll
comdlg32.dll
winmm.dll

File Access (UNICODE)

grimv1210_x64+22tr.exe

Interest's Words

exec

URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings

Strings/Hex Code Found With The File Rules

Rule Type	Encoding	Matched (Word)
Text	Ascii	Keyboard Key ([UP])
Entry Point	Hex Pattern	Microsoft Visual C++ 8.0 (DLL)

Resources

Path	DataRVA	Size	FileOffset	Code	Text
\UNICODEDATA\CASE\0	5A3E94	968F	5A3094	N/A	N/A
\UNICODEDATA\CATEGORIES\0	5AD524	9EBB	5AC724	N/A	N/A
\UNICODEDATA\COMBINING\0	5B73E0	8D6	5B65E0	N/A	N/A
\UNICODEDATA\COMPOSITION\0	5B7CB8	B4BC	5B6EB8	N/A	N/A
\UNICODEDATA\DECOMPOSITION\0	5C3174	D91E	5C2374	N/A	N/A
\UNICODEDATA\NUMBERS\0	5D0A94	2035	5CFC94	N/A	N/A
\VCLSTYLE\DARKOUTLET\1033	5D2ACC	CE69	5D1CCC	N/A	N/A
\WAVE\1\1031	5DF938	1D15C	5DEB38	N/A	N/A
\WAVE\2\1031	5FCA94	1F58C	5FBC94	N/A	N/A
\WAVE\3\1031	61C020	2E456	61B220	N/A	N/A
\WAVE\4\1031	64A478	542B6	649678	N/A	N/A
\WAVE\5\1031	69E730	3DD14	69D930	N/A	N/A
\WAVE\6\1031	6DC444	F46EE	6DB644	N/A	N/A
\WAVE\7\1031	7D0B34	222DC	7CFD34	N/A	N/A
\CURSOR\1\1033	7F2E10	134	7F2010	N/A	N/A
\CURSOR\2\1033	7F2F44	134	7F2144	N/A	N/A
\CURSOR\3\1033	7F3078	134	7F2278	N/A	N/A
\CURSOR\4\1033	7F31AC	134	7F23AC	N/A	N/A
\CURSOR\5\1033	7F32E0	134	7F24E0	N/A	N/A
\CURSOR\6\1033	7F3414	134	7F2614	N/A	N/A
\CURSOR\7\1033	7F3548	134	7F2748	N/A	N/A
\CURSOR\8\1033	7F367C	134	7F287C	N/A	N/A
\ICON\1\1033	8C162C	1E9FF	2AD22C	89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000020004944415478DAECBDCB92645976	.PNG........IHDR.............\r.f.. .IDATx.....dYv
\ICON\2\1033	8E0054	11819	2CBC54	89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000020004944415478DAECBD7998245779	.PNG........IHDR.............\r.f.. .IDATx...y.$Wy
\ICON\3\1033	8F1898	10828	2DD498	2800000080000000000100000100200000000000000000000000000000000000000000000000000000000000000000000000	(............. ...................................
\ICON\4\1033	9020E8	4C28	2EDCE8	28000000800000000001000001000800000000000000000000000000000000000000000000000000000000002968E600185A	(...........................................)h...Z
\ICON\5\1033	906D38	468	2F2938	2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000003C62	(....... ..... .................................<b
\ICON\6\1033	9071C8	568	2F2DC8	28000000100000002000000001000800000000000000000000000000000000000000000000000000000000003476D1003A6D	(....... ...................................4v..:m
\ICON\7\1033	907758	10A8	2F3358	2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000	(... ...@..... ...................................
\ICON\8\1033	908828	8A8	2F4428	28000000200000004000000001000800000000000000000000000000000000000000000000000000000000003A7CD1003375	(... ...@...................................:\|..3u
\ICON\9\1033	9090F8	25A8	2F4CF8	2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000	(...0........ ...................................
\ICON\10\1033	90B6C8	EA8	2F72C8	28000000300000006000000001000800000000000000000000000000000000000000000000000000000000002D7BD4003A66	(...0......................................-{..:f
\ICON\11\1033	90C598	4228	2F8198	2800000040000000800000000100200000000000000000000000000000000000000000000000000000000000000000000000	(...@......... ...................................
\ICON\12\1033	9107E8	1628	2FC3E8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4052\0	843DDC	1F8	842FDC	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4053\0	843FD4	448	8431D4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4054\0	84441C	488	84361C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4055\0	8448A4	334	843AA4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4056\0	844BD8	268	843DD8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4057\0	844E40	1B4	844040	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4058\0	844FF4	120	8441F4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4059\0	845114	110	844314	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4060\0	845224	310	844424	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4061\0	845534	D4C	844734	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4062\0	846280	838	845480	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4063\0	846AB8	3D0	845CB8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4064\0	846E88	494	846088	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4065\0	84731C	674	84651C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4066\0	847990	868	846B90	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4067\0	8481F8	88C	8473F8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4068\0	848A84	7D0	847C84	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4069\0	849254	880	848454	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4070\0	849AD4	A4C	848CD4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4071\0	84A520	6FC	849720	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4072\0	84AC1C	500	849E1C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4073\0	84B11C	40C	84A31C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4074\0	84B528	4F4	84A728	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4075\0	84BA1C	24C	84AC1C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4076\0	84BC68	F8	84AE68	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4077\0	84BD60	168	84AF60	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4078\0	84BEC8	398	84B0C8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4079\0	84C260	5A0	84B460	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4080\0	84C800	4F0	84BA00	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4081\0	84CCF0	54C	84BEF0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4082\0	84D23C	360	84C43C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4083\0	84D59C	46C	84C79C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4084\0	84DA08	43C	84CC08	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4085\0	84DE44	77C	84D044	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4086\0	84E5C0	5BC	84D7C0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4087\0	84EB7C	408	84DD7C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4088\0	84EF84	418	84E184	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4089\0	84F39C	504	84E59C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4090\0	84F8A0	1B4	84EAA0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4091\0	84FA54	C4	84EC54	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4092\0	84FB18	22C	84ED18	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4093\0	84FD44	4C0	84EF44	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4094\0	850204	4C8	84F404	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4095\0	8506CC	31C	84F8CC	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\STRING\4096\0	8509E8	3A8	84FBE8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBABORT\1033	850D90	D5D	84FF90	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBABORT_DISABLED\1033	851AF0	D57	850CF0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBALL\1033	852848	CFC	851A48	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBALL_DISABLED\1033	853544	CD9	852744	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBCANCEL\1033	854220	D5D	853420	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBCANCEL_DISABLED\1033	854F80	D57	854180	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBCLOSE\1033	855CD8	C4E	854ED8	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBCLOSE_DISABLED\1033	856928	C4E	855B28	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBHELP\1033	857578	CB5	856778	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBHELP_DISABLED\1033	858230	CB0	857430	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBIGNORE\1033	858EE0	D56	8580E0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBIGNORE_DISABLED\1033	859C38	D47	858E38	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBNO\1033	85A980	DC2	859B80	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBNO_DISABLED\1033	85B744	DC5	85A944	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBOK\1033	85C50C	CF3	85B70C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBOK_DISABLED\1033	85D200	CED	85C400	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBRETRY\1033	85DEF0	DA9	85D0F0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBRETRY_DISABLED\1033	85EC9C	DA6	85DE9C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBYES\1033	85FA44	CF3	85EC44	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\BBYES_DISABLED\1033	860738	CED	85F938	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\DVCLAL\0	861428	10	860628	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\MSG_ERROR\1033	861438	148B	860638	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\MSG_INFO\1033	8628C4	111E	861AC4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\MSG_WARNING\1033	8639E4	D8C	862BE4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\PACKAGEINFO\0	864770	CA0	863970	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\PLATFORMTARGETS\1033	865410	4	864610	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\TFORM1\0	865414	3F737	864614	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\TFORM4\0	8A4B4C	8CE5	8A3D4C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_MOMENTUMDOTS_BLACK_64\1033	8AD834	3970	8ACA34	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_REFRESH_BLACK_64\1033	8B11A4	333D	8B03A4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_ROTATINGLINES_BLACK_64\1033	8B44E4	4D4E	8B36E4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_ROTATINGSECTOR_BLACK_64\1033	8B9234	E43	8B8434	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_SEARCHINDICATORS_AUDIO\1033	8BA078	BC3	8B9278	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_SEARCHINDICATORS_AUDIO_20X\1033	8BAC3C	C58	8B9E3C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_SEARCHINDICATORS_TEXT\1033	8BB894	BD1	8BAA94	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_SEARCHINDICATORS_TEXT_20X\1033	8BC468	CFA	8BB668	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\RCDATA\WINXCTRLS_SECTORRING_BLACK_64\1033	8BD164	117C	8BC364	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\CAT_DRAG_COPY\1033	8BE2E0	14	8BD4E0	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32761\1033	8BE2F4	14	8BD4F4	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32762\1033	8BE308	14	8BD508	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32763\1033	8BE31C	14	8BD51C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32764\1033	8BE330	14	8BD530	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32765\1033	8BE344	14	8BD544	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32766\1033	8BE358	14	8BD558	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_CURSOR\32767\1033	8BE36C	14	8BD56C	28000000400000008000000001000800000000000000000000000000000000000000000000000000000000003968BF003F6F	(...@.......................................9h..?o
\GROUP_ICON\MAINICON\1033	913470	AE	2FF070	000001000C000000000001002000FFE901000100000000000100080019180100020080800000010020002808010003008080	............ ........................... .(.......
\VERSION\1\1033	913560	318	2FF160	180334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000	..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\1033	9138B8	70D	2FF4B8	3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279	<?xml version="1.0" encoding="UTF-8" standalone="y

Intelligent String

• 1.0.0.0
• .LhZ
• PlaySoundWwinspool.drv
• ClosePrintercomdlg32.dll
• FindTextWcomctl32.dll
• ImageList_Addshell32.dll
• ShellExecuteWuser32.dll
• GetDCversion.dll
• memsetgdi32.dll
• grimv1210_x64+22tr.exe
• <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
• <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">system</dpiAwareness>

Flow Anomalies

Offset	FlowVA	Section	Description
BBE6	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xD939BE3C]
157D8	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x9BB5C0D4]
163AE	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x78AE5FDE]
283A9	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x7D3178BA]
2F848	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xE9429C6]
327CC	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x21232F03]
34DD2	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x8C4CFABC]
3AC25	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xD092BC76]
3D4A9	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xEEB25393]
3F9F8	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xD59D0E96]
43649	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xAEB3C04C]
45F4C	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x161F2FD3]
68FBB	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x38C8F8A7]
6C4CD	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x2171F7C7]
6D5D7	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x2D626D42]
72AD4	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xFEE26AE7]
72F47	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x910FC39C]
7F399	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x6D445388]
82882	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x5C18336B]
82FE0	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xE649434B]
891E2	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x4C1547B1]
8A868	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xE0A00CB]
8AD6B	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xE7A0032E]
9E6C0	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x8B24818B]
BD2F6	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x87AAF785]
C32A6	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xBA2A732]
C982B	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x9A8A2FA0]
CB664	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x8ED94111]
CEDE8	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xB4559432]
D15B1	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xFC4CD403]
D2D7A	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x2AD3F5BE]
D4924	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x72B57736]
DF1A2	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x7985665D]
E1179	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x5DDA6787]
E87F8	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xA0AB8C3E]
FA6DC	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x905A48DB]
106DC2	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x97697E22]
10C2D2	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x35FE890F]
11080D	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xC19D83]
111701	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xB5107A53]
11590D	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xE4CA60D7]
11AF47	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xFD544F26]
11C619	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x590AEDD6]
11F8B5	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x87777475]
124298	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x9040760F]
12520E	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x83C393E3]
131911	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xB15C627]
143047	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xD53A5A12]
14E94C	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xBB7F6552]
150330	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x263BC6AE]
15C786	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xCE787E04]
15E4D1	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x6FDB61C0]
170C9E	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x5172885]
1727D3	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x78D4BFED]
17BFF0	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x37129E1B]
17FC34	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x5F2D26F6]
1A4D3D	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x13D4E8EE]
1A5744	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x51AE1802]
1B6502	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xAFAA6F7C]
1B9E06	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xCE492509]
1BBF98	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x2FFC251]
1DD0CB	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x1AFD0509]
1DD9CE	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xDE5DB017]
1E2D55	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x62421015]
1E3FA2	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xE8943D6F]
1E5643	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x60A38959]
1F9FF1	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x3D9B1F1E]
1FB9F1	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xC24029F0]
202A61	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x2C30A095]
21CAF7	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xF97713F3]
21DBD4	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x2D593A23]
23313E	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x65A32A83]
235023	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x5EE343D]
235155	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x7ACA74A6]
23840B	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xA1C4D926]
23A4BD	N/A	.MPRESS1	JMP QWORD PTR [RIP+0xE3EF15A6]
23CC2D	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xFA908FB8]
23E1B3	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x7F41304F]
24224C	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x83F02F1E]
242E35	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x6C54F237]
245F12	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x3C9D8C5A]
24D3A7	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x5D273F01]
256040	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x4BB1821E]
27323B	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xC208086C]
27940F	N/A	.MPRESS1	JMP QWORD PTR [RIP+0x838C7D99]
27FC8C	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x22AA622E]
284942	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xAD2D5FBF]
291928	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xF015D027]
296BB1	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xAE0966AE]
2A1E06	N/A	.MPRESS1	CALL QWORD PTR [RIP+0xBB372799]
2A9DAE	N/A	.MPRESS1	CALL QWORD PTR [RIP+0x9AE19B6B]
2B1BD2	N/A	.rsrc	CALL QWORD PTR [RIP+0x11B78A6B]
2B5C5F	N/A	.rsrc	JMP QWORD PTR [RIP+0x2D83CDED]
2C42E2	N/A	.rsrc	JMP QWORD PTR [RIP+0x1FC7781E]
2C966D	N/A	.rsrc	CALL QWORD PTR [RIP+0xBCDFA4EB]
2D1D59	N/A	.rsrc	CALL QWORD PTR [RIP+0x30380033]
2E0DFF	N/A	.rsrc	JMP QWORD PTR [RIP+0x26FFD850]
2E1003	N/A	.rsrc	JMP QWORD PTR [RIP+0x2CFFFF5C]
2E173B	N/A	.rsrc	CALL QWORD PTR [RIP+0x4FFAE3A]
2E17E7	N/A	.rsrc	CALL QWORD PTR [RIP+0x15FF9423]
200-2AB9FF	1000	.MPRESS1	Executable section anomaly, first bytes: BE08A7B62A001100
2ABA00-2ACBFF	8BF000	.MPRESS2	Executable section anomaly, first bytes: 0000000000000000

Extra Analysis

Metric	Value	Percentage
Ascii Code	2137126	67,9595%
Null Byte Code	48447	1,5406%

PESCAN.IO - Analysis Report Basic