6b0479eb5ec7bd1f6a146602bc4795f152c79c9de0add90c9dea3267be0df21d

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-25 05:35:06
Detected languages English - United States
Debug artifacts E:\Projects\neverwin-v2\bin\x64\Release\neverwin.pdb

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Tries to detect virtualized environments:
  • HARDWARE\DESCRIPTION\System
 Miscellaneous malware strings:
  • Exploit
  • exploit
 Contains domain names:
  • autopeek.nl
  • github.com
  • http://www.processtypefoundry.comLicensed
  • http://www.processtypefoundry.comhttps
  • http://www.styleseven.comFreeware
  • http://www.styleseven.comSmallest
  • http://www.w3.org
  • http://www.w3.org/1999/xlink
  • http://www.w3.org/2000/svg
  • https://github.com
  • https://lua.neverlose.cc
  • https://neverlose.cc
  • https://processtypefoundry.com
  • https://spurdoverse.app
  • https://yougame.biz
  • processtypefoundry.com
  • www.w3.org
Info Cryptographic algorithms detected in the binary: Uses constants related to RC5 or RC6
Suspicious The PE is possibly packed. Unusual section name found: .nlart
Unusual section name found: .uifix
Unusual section name found: .fixdata
Unusual section name found: .nlprof
Unusual section name found: .luaTxt
Unusual section name found: .luaRod
Unusual section name found: .luaDbg
Unusual section name found: .luaDat
Unusual section name found: .luaPdt
Unusual section name found: .nlrt
Unusual section name found: .spuTxt
Unusual section name found: .spuRod
Unusual section name found: .spuDbg
Unusual section name found: .spuPdt
Unusual section name found: .rt5Txt
Unusual section name found: .rt5Rod
Unusual section name found: .rt5Dbg
Unusual section name found: .rt5Dat
Unusual section name found: .rt5Pdt
Unusual section name found: .kb50
Unusual section name found: .kb51
Unusual section name found: .kb52
Unusual section name found: .kb53
Unusual section name found: .kb54
Unusual section name found: .helpTxt
Unusual section name found: .helpDat
Unusual section name found: .relTxt
Unusual section name found: .relDat
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryA
  • LoadLibraryExA
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Can access the registry:
  • RegOpenKeyExW
  • RegCloseKey
  • RegGetValueW
  • RegQueryValueExW
 Possibly launches other programs:
  • ShellExecuteA
  • ShellExecuteW
 Uses functions commonly found in keyloggers:
  • MapVirtualKeyA
  • GetAsyncKeyState
  • GetForegroundWindow
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Has Internet access capabilities:
  • WinHttpQueryDataAvailable
  • WinHttpCrackUrl
  • WinHttpConnect
  • WinHttpSetTimeouts
  • WinHttpSendRequest
  • WinHttpCloseHandle
  • WinHttpOpenRequest
  • WinHttpReadData
  • WinHttpQueryHeaders
  • WinHttpOpen
  • WinHttpReceiveResponse
 Enumerates local disk drives:
  • GetDriveTypeW
 Reads the contents of the clipboard:
  • GetClipboardData
Suspicious VirusTotal score: 1/71 (Scanned on 2026-11-06 21:18:03) Skyhigh: BehavesLike.Win64.Dropper.vm

Hashes

MD5 7e6092312cb57e77bcd596e276a508da 🔍
SHA1 5f4272a08721922eabeae574d82cee3415072407 🔍
SHA256 6b0479eb5ec7bd1f6a146602bc4795f152c79c9de0add90c9dea3267be0df21d 🔍
SHA3 a81c6839d617576d27f3e9997c65f86c16cc6504cb73351d9f034c78e165177f 🔍
SSDeep 98304:Pov7LlRdVVloLpT/aPrDY7sTTijNcpd6tzy0KOv2cfo7Laha:PS7RR38Lp/aPrDc2cNcpdyvx2aha 🔍
Imports Hash 940c023191d22497aa25e621d9ad8b24 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x120

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 35
TimeDateStamp 2026-Oct-25 05:35:06
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x598800
SizeOfInitializedData 0xd37a30
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000004ED880 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x13a2000
SizeOfHeaders 0x800
Checksum 0xe62738
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 dae2a3f9d61c6a70fe4070fcaed31b6d 🔍
SHA1 983dd36c086642c49f107e6a4051c00f0883b66d 🔍
SHA256 09049a2a8c8232355f69d22e03e81cc561df6a7676012e8f6f5c07ecbb75eb5c 🔍
SHA3 d0ed43e878a9beb10b4a9c563b6a9920eca62b440afb2213c5ba5393093ba4d9 🔍
VirtualSize 0x569585
VirtualAddress 0x1000
SizeOfRawData 0x569600
PointerToRawData 0x800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.57108

.rdata

MD5 0357b551efd25036924680f13f416d2d 🔍
SHA1 029a16609860b81ae06f448ee369b0134eee01eb 🔍
SHA256 a51174f74e87e785c33dd81b41c80c6470b681daae0fcf4f01e055b974fd7733 🔍
SHA3 f31ffa35194fd3956c7063d09363a0b4d55afa97b4cea413666d3c5586e8ca0f 🔍
VirtualSize 0x3adcee
VirtualAddress 0x56b000
SizeOfRawData 0x3ade00
PointerToRawData 0x569e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.39085

.data

MD5 c45ac61c674968791034c5361f3a6f67 🔍
SHA1 c5ec005d37685191b82043328d73c69bf947a399 🔍
SHA256 9edeb56026055dcb9d224db13d295077f7c99c9d7a03ba36f29a72be14c73f9b 🔍
SHA3 afce9770966852d99d3a2148e6970a1cb425cbd8ae7e336ca8b4285dfdd09487 🔍
VirtualSize 0x7fd510
VirtualAddress 0x919000
SizeOfRawData 0x385c00
PointerToRawData 0x917c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.580079

.pdata

MD5 57bf932ccce7f493fc2fb8e23386e55b 🔍
SHA1 3cd3d1fa92751cb52a80b5adc57953404fb23581 🔍
SHA256 1da9fab63c47cb8c2c4a64ebe99f6cc150fd852ca842dfec7ed1185fa78c840b 🔍
SHA3 2ef5293bff720f613790494a62f10c59cd332a41cad181732846f4a889cdb3f4 🔍
VirtualSize 0x31bfc
VirtualAddress 0x1117000
SizeOfRawData 0x31c00
PointerToRawData 0xc9d800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.46763

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x1149000
SizeOfRawData 0x200
PointerToRawData 0xccf400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 f4705239432acef1b0c1459faf84be6e 🔍
SHA1 62811f3b331ec7998021879b5e3b02921a7228cd 🔍
SHA256 6f2e12b9b01527eedc154688820b9dbc78491f02c33d31f4a4e5d6e202e2b779 🔍
SHA3 22db3d2e775e7de9a8903559d908c7b3f8f6c51ca55e8d26a0625290e3cfbee2 🔍
VirtualSize 0xb420
VirtualAddress 0x114a000
SizeOfRawData 0xb600
PointerToRawData 0xccf600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.38003

.reloc

MD5 b9f02d3ad6fa616db9d8dfd3ed1ae89e 🔍
SHA1 7b4a8dede1aacd1f690fb8b64ece5690df25d5b5 🔍
SHA256 23d93bc60a382be5f6711a2bef34d4c364def0925e535be5b19ef5b6a6dcdf39 🔍
SHA3 e5e10cab7eae5411345d48fc5057da8890413efa30f857a082d100a3bafdecfc 🔍
VirtualSize 0x887c
VirtualAddress 0x1156000
SizeOfRawData 0x8a00
PointerToRawData 0xcdac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.4493

.nlart

MD5 37bea11975b4950085040a37fd88deb4 🔍
SHA1 9fcba8ae367221cec68975f915a66ebfb6821ef7 🔍
SHA256 4c03a61dbad5ca7ce02bc49ce5170c5df65f87a66b93b5bc69bbc799a847de7c 🔍
SHA3 dc5c95a0a88149c59351e81e470c7b83dbd06f104c74805fedbcaeb8ca8edc7e 🔍
VirtualSize 0x5d970
VirtualAddress 0x115f000
SizeOfRawData 0x5da00
PointerToRawData 0xce3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.64596

.uifix

MD5 516e8a35b5ef8789a3ad3682b3993c39 🔍
SHA1 04141eee9d263569992bd90fd5b331c0f9224616 🔍
SHA256 44f9a89200e50480c088c6b3b9068e45199faffa685b69fe666e419e1b1ff0b6 🔍
SHA3 143c27e7071042cea4ec523469de0378858c864dcb6080f16cb4b7d4e57d50c1 🔍
VirtualSize 0x20000
VirtualAddress 0x11bd000
SizeOfRawData 0x20000
PointerToRawData 0xd41000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.70064

.fixdata

MD5 620f0b67a91f7f74151bc5be745b7110 🔍
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d 🔍
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7 🔍
SHA3 a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563 🔍
VirtualSize 0x10000
VirtualAddress 0x11dd000
SizeOfRawData 0x1000
PointerToRawData 0xd61000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.nlprof

MD5 27e5930a49c9953f4beccc9a252fb217 🔍
SHA1 945443110ee3ba60ae1492195e6a176318621147 🔍
SHA256 60abe57743bd6cddcaaf6aa1aa13c0bc5f5ba19dd4aa60e7742d3a72ac4bccac 🔍
SHA3 97c355aae9ad91eac69bf93f8e0ac6801c01e1540b4eb80fbcd0218774a21cd2 🔍
VirtualSize 0x12000
VirtualAddress 0x11ed000
SizeOfRawData 0x12000
PointerToRawData 0xd62000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.43392

.luaTxt

MD5 71d106517d6f8cbaf4b03a21ac1ca8ee 🔍
SHA1 96fcc90d630561bb061687bb8f0a1f23d4bcc5e7 🔍
SHA256 2866b8fe4e4b2355e933456f85d498f2c68538fa74e8166eef2c622d5bf90ddd 🔍
SHA3 f15d5f9edb9ae93c93baa7e8dc394dd8a8caebd2dd6d951ba64ca28fd31cda49 🔍
VirtualSize 0x33a6
VirtualAddress 0x11ff000
SizeOfRawData 0x3400
PointerToRawData 0xd74000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.44443

.luaRod

MD5 b57b81e5ccfac74a786df1722eea3a69 🔍
SHA1 f9b99f628d1209fe4c3a6a1e9203a3f1fd0aa6b3 🔍
SHA256 6da42db9e60728cee6b60c919253eb3673e2665485aec0ae17dfe1cdd374f923 🔍
SHA3 c395d480b27d0f30e6855ed804950ba757a0b9ff091ed817f5ce5c4c6980dbfb 🔍
VirtualSize 0xdfc
VirtualAddress 0x1203000
SizeOfRawData 0xe00
PointerToRawData 0xd77400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.60116

.luaDbg

MD5 eec00e5cf8a585e53ac86dbbff4a8f96 🔍
SHA1 b973a05455410dfdc2f5f8451840dafe61006f52 🔍
SHA256 c28fb08540f28ee977c3cd5968f46f75c5110da1baab34f4ec8c69c8d1d2a6e8 🔍
SHA3 8c9a811f1e5a4a0b0c16b20f658de583d4e4dc1727927bd3cc9d995324dea6ed 🔍
VirtualSize 0x35
VirtualAddress 0x1204000
SizeOfRawData 0x200
PointerToRawData 0xd78200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.527641

.luaDat

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0x90438
VirtualAddress 0x1205000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.luaPdt

MD5 66728b762f00b155e87f1d29d7ee9df5 🔍
SHA1 7d21bc224e232a1107403bc85e9cfb0770f2b915 🔍
SHA256 399f83badc759952857dee1b6703cf0295f887ba3be2bddfd79f7c3055b29aad 🔍
SHA3 ddeb19113ee8fca16a997ec2d1ffb98a216fb025ddefc7e43cf1339f7cd49b33 🔍
VirtualSize 0x108
VirtualAddress 0x1296000
SizeOfRawData 0x200
PointerToRawData 0xd78400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.27363

.nlrt

MD5 e83a05364f4fa7dd9eb7f6887e25edb2 🔍
SHA1 57277b1954d7283579a2abec41c2ef64b8eeff43 🔍
SHA256 9772e9cc2cb9e298e9938bbbff575decdcd955dd821ee5d4782a4f1ff91f8232 🔍
SHA3 0e3b22bc8147c4c52c36d8f8803299c3b598fe763c588c5a30149bac016b7056 🔍
VirtualSize 0x31dd0
VirtualAddress 0x1297000
SizeOfRawData 0x31e00
PointerToRawData 0xd78600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.46986

.spuTxt

MD5 69a2d87a8901de61f47e2e7bf37b1128 🔍
SHA1 5df9b420f66bc5e9435dd8f433ab09cfa854a04d 🔍
SHA256 06089782e3414bf69b457e9994b057c91025e2609bf924d801ac00e3264ab1b1 🔍
SHA3 2f0ed9b265cecc9ced0222019fb9104861ec97cf84f77df88855827b465f5105 🔍
VirtualSize 0x441
VirtualAddress 0x12c9000
SizeOfRawData 0x600
PointerToRawData 0xdaa400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.97803

.spuRod

MD5 733bc882ff65a7b21944f78f328bb8b5 🔍
SHA1 51ea560830281d40992b3573d48a7b6f26b62a00 🔍
SHA256 457e71fc3668982c7dde79f54c7a131d4b7311fb17e6953079c6fbe362801098 🔍
SHA3 4a50ee25192793bd751a199ec5d505bd3077876575b656f129badd9215a7165c 🔍
VirtualSize 0x23678
VirtualAddress 0x12ca000
SizeOfRawData 0x23800
PointerToRawData 0xdaaa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.995

.spuDbg

MD5 4f5b3fef6446d9a3c2a5f7857620c2e3 🔍
SHA1 e4a3603711006ff9ba83acdda4f2a2eb4ac41cf2 🔍
SHA256 da613e473892d7e198203a436ea7499175676a0f68851441935ebbcaaad8b5e7 🔍
SHA3 8a5007e20033fc15c69e126173a8e76311f89ac3840ee90b8251e2dc6862cab4 🔍
VirtualSize 0x35
VirtualAddress 0x12ee000
SizeOfRawData 0x200
PointerToRawData 0xdce200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.554923

.spuPdt

MD5 7b83ab3914b311707f27e884019d5f7e 🔍
SHA1 aea46e9adc6457031890b75ac9a1f38ade405d31 🔍
SHA256 0660959561446e9734c25c37d0b4c193406048cad022a98778563b3074066a16 🔍
SHA3 c132f8d8244b746391a47f49e16b99ec785aff5b1b22bb0e3f7433cc79ced615 🔍
VirtualSize 0x18
VirtualAddress 0x12ef000
SizeOfRawData 0x200
PointerToRawData 0xdce400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.249053

.rt5Txt

MD5 e4375fbd7111b25fa326ef686916b1dc 🔍
SHA1 7bc831e5eb81bcef844dd92a288238e2137279c4 🔍
SHA256 0e2fa83fb1c19264fae84489f20cfe463928de6057899fa1d4660bf0c8854a0e 🔍
SHA3 73c6b35b94fb3c79ff879bd4a455a1307ca8f7b066ffea194f83d18d1e5b38cc 🔍
VirtualSize 0x129a
VirtualAddress 0x12f0000
SizeOfRawData 0x1400
PointerToRawData 0xdce600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.30299

.rt5Rod

MD5 77103e693582b17224b043908c2bc108 🔍
SHA1 a8f21400f53dc8b2ef32f35fd7b9e78f05e85181 🔍
SHA256 6cc4d8923f3f92ccdfe80b3d73ca11eefed5a21d56f6e17ab51eb6ed49e82fa3 🔍
SHA3 0413a8581ec959464a721f0ce2157da988eb8c0157c706b3ac05c969fe249afd 🔍
VirtualSize 0x23b3c
VirtualAddress 0x12f2000
SizeOfRawData 0x23c00
PointerToRawData 0xdcfa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.99509

.rt5Dbg

MD5 6195cb84295765bdbcfb42c71c73522e 🔍
SHA1 d42e98026f3ab4ed55adfe86bb1a73513e55ff6b 🔍
SHA256 bdc7a9be5e81265bffdbd5426417c008fb19923a39e3ff4a178573ed426c8597 🔍
SHA3 5b70b05115d0058e9d56d62ecfe7ae3c4677efda647f5d35d32c1e072a6a487a 🔍
VirtualSize 0x35
VirtualAddress 0x1316000
SizeOfRawData 0x200
PointerToRawData 0xdf3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.551017

.rt5Dat

MD5 9475a59226943a3ad422e18169989f66 🔍
SHA1 4174927c59854c80d33c69e7a43856b2b6c6af84 🔍
SHA256 d839a3521723b8a55d09d8eed9848940b284828e4d09218202c3ee11046bc16d 🔍
SHA3 6a93cc87909571d767d237e39dc48f437ee4242cf646fe335698b2b191003d4e 🔍
VirtualSize 0x20150
VirtualAddress 0x1317000
SizeOfRawData 0x200
PointerToRawData 0xdf3800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0203931

.rt5Pdt

MD5 12c35814cd8eeb157a466a1d1d945c59 🔍
SHA1 71ad92172b5df8742be29a3b0abb32358b17cef2 🔍
SHA256 54e86d59cacfd6cbd6afa9e6c5c7b8656fc3f4b59c1615c8021ac9fdecd6453a 🔍
SHA3 a474c935829054637219a8f85f94234c7bd1516e82a503c2bb8fe8892b5dd6d6 🔍
VirtualSize 0x78
VirtualAddress 0x1338000
SizeOfRawData 0x200
PointerToRawData 0xdf3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.18903

.kb50

MD5 1aadfaed9e5f95273dde111249e9967f 🔍
SHA1 039c36df0dbad8e2da5d0f4be23f323d29e62342 🔍
SHA256 dee07da19e5d692be004dfb3e9e14b274029486d12326164a9078929d9e9693b 🔍
SHA3 0f306135797847b5699df71765a13edf6700e7c1d172b4376d5b8344745b4061 🔍
VirtualSize 0x262
VirtualAddress 0x1339000
SizeOfRawData 0x400
PointerToRawData 0xdf3c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.51599

.kb51

MD5 126310222fdfc34ae69ea28ba1ca233c 🔍
SHA1 b49222660aa95ead3706bbaf082a3eef59f60ca2 🔍
SHA256 ad173c690de8484dc38d510acdad67d97993bfc696c84515c68c4ffff31158cb 🔍
SHA3 3ef46b2bd004a694ca24d57bb98b82e1f5778fd2411ee462ca5e097d43e4a679 🔍
VirtualSize 0xa4
VirtualAddress 0x133a000
SizeOfRawData 0x200
PointerToRawData 0xdf4000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.69122

.kb52

MD5 87c4bd5fe2e5478686d62f0a642f0062 🔍
SHA1 ba8a0bedfe4441ef522f3853ccade7edec7ef25e 🔍
SHA256 04b101cc129888ef0f5bb360e3f3c409d327d4763b48cdd9d5360f6c233f355e 🔍
SHA3 da26b0e565364494353d7a6a3c6baaa5045ac412fd372ecb0fc6cd2898bb42cb 🔍
VirtualSize 0x35
VirtualAddress 0x133b000
SizeOfRawData 0x200
PointerToRawData 0xdf4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.523735

.kb53

MD5 d41d8cd98f00b204e9800998ecf8427e 🔍
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 🔍
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 🔍
SHA3 a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a 🔍
VirtualSize 0xa30
VirtualAddress 0x133c000
SizeOfRawData 0
PointerToRawData 0
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kb54

MD5 629614fa06b1508ab68f4a42e09cc68c 🔍
SHA1 90bc4dcb7b5ed1eeabcc021d23945ac37475d9b1 🔍
SHA256 823c456460834f831707b31576212cd83797d81c30972e42d496870f1f13dcd0 🔍
SHA3 a37bc2ec18843893d8828577bea98095fafb39296919d0a747cdb16bbf59dc52 🔍
VirtualSize 0xc
VirtualAddress 0x133d000
SizeOfRawData 0x200
PointerToRawData 0xdf4400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0.10191

.helpTxt

MD5 5cfb52ef4b070aa32fd7e46547213afb 🔍
SHA1 648e8ec386789088777b253fd8c1093dde377e8d 🔍
SHA256 9ff4b904ffe46183ed62379cdb70b345a89b531cc79f0b69abf49f57e89a9d4f 🔍
SHA3 218f43c8a1d23e73330487a69e855c6899b69f7bdafb7b790dff218847728ee1 🔍
VirtualSize 0x9000
VirtualAddress 0x133e000
SizeOfRawData 0x9000
PointerToRawData 0xdf4600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.06979

.helpDat

MD5 f23aff0fef17498a2b73b6e7e892d7f5 🔍
SHA1 5e0b7758bb83aae81dea469bd08052444cab6261 🔍
SHA256 41aad0602d8ac53294702e18518d9d5c4479197453df4b9a297fdbe2af1e7e1b 🔍
SHA3 e1c69e925341c83718836a722a6ff9819e5ac07fd0bea79f8bceacfbdce122af 🔍
VirtualSize 0x59000
VirtualAddress 0x1347000
SizeOfRawData 0x59000
PointerToRawData 0xdfd600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.78556

.relTxt

MD5 4d2376059d301a188864886a3765b8bc 🔍
SHA1 b5b047597032d1425f8ea1f70a4119dc0b4af440 🔍
SHA256 753fec2c4282cc350ccb6dfcc1cc94d50e5600db43721d25a599fd11cafe6fc3 🔍
SHA3 8752993b8ecf804abe7cde5a3491ecb11f7bcb1a3b1d407479eb8b4f8eaa5581 🔍
VirtualSize 0x1000
VirtualAddress 0x13a0000
SizeOfRawData 0x1000
PointerToRawData 0xe56600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 0.415628

.relDat

MD5 cf2e840cf6313c0937aadecb2aecc246 🔍
SHA1 314fedecc0e25f89cbba38d84de417097b443a08 🔍
SHA256 0d88d2e72d996bbf911118e88b9689484f93bccc994400ea3295f8d4ddcf9b69 🔍
SHA3 4a71032f5ead5171a06b69169acd7c932581aa97cf861977de85d1972379c000 🔍
VirtualSize 0x1000
VirtualAddress 0x13a1000
SizeOfRawData 0x1000
PointerToRawData 0xe57600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.0290038

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
USER32.dll GetClipboardData
MapVirtualKeyA
EmptyClipboard
GetAsyncKeyState
RegisterClassExA
SetWindowLongPtrA
UnregisterClassA
ClipCursor
CreateWindowExA
PostMessageA
GetClipCursor
GetRawInputData
CallWindowProcA
GetCursorInfo
DestroyWindow
CloseClipboard
OpenClipboard
GetKeyNameTextA
FlashWindowEx
SetClipboardData
GetClassLongPtrW
GetForegroundWindow
DefWindowProcA
SetCapture
ReleaseDC
DefWindowProcW
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
LoadCursorW
SystemParametersInfoA
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
MessageBoxA
GetDC
MonitorFromWindow
LoadIconW
KERNEL32.dll ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetDateFormatW
LoadLibraryExW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetStdHandle
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
ExitProcess
ReadFile
SetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
CreateFileW
FlsFree
FlsSetValue
FlsGetValue
GetCurrentThreadId
Sleep
VirtualProtect
GetModuleHandleA
GetTickCount64
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceFrequency
ReleaseSRWLockShared
GetProcAddress
AcquireSRWLockShared
QueryPerformanceCounter
VirtualQuery
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLastError
CloseHandle
CreateThread
GetLocalTime
MoveFileExA
DeleteFileA
HeapFree
HeapAlloc
GetProcessHeap
GetLocaleInfoW
GetTimeFormatW
GetSystemInfo
LoadLibraryW
GlobalMemoryStatusEx
GetModuleHandleW
GetTickCount
VirtualFree
VirtualAlloc
GetCurrentProcess
K32GetModuleInformation
GetSystemTimeAsFileTime
GetWindowsDirectoryA
SetEnvironmentVariableW
FlushInstructionCache
GetTimeZoneInformation
SetEvent
TerminateThread
LoadLibraryA
GetUserDefaultLocaleName
GetFileAttributesA
SizeofResource
FindResourceA
GetModuleHandleExA
LockResource
LoadResource
GetModuleFileNameW
RtlAddFunctionTable
RtlLookupFunctionEntry
FreeLibraryAndExitThread
ExitThread
DisableThreadLibraryCalls
Beep
FreeLibrary
RtlDeleteFunctionTable
OutputDebugStringA
GetLocaleInfoA
IsDBCSLeadByte
HeapCreate
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
SetThreadContext
OpenThread
RtlCaptureContext
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
RaiseException
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LoadLibraryExA
FormatMessageA
FlsAlloc
IsValidCodePage
GetACP
GetOEMCP
RtlUnwind
HeapSize
HeapQueryInformation
WriteConsoleW
InterlockedFlushSList
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
WaitForThreadpoolWorkCallbacks
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
WaitForSingleObject
FreeEnvironmentStringsW
SetEndOfFile
GetLocaleInfoEx
RtlPcToFileHeader
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
GetLogicalProcessorInformationEx
GetExitCodeThread
TryAcquireSRWLockExclusive
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
SetFileTime
CreateFile2
AreFileApisANSI
CopyFile2
MoveFileExW
GetFileInformationByHandleEx
LocalFree
GetSystemTimePreciseAsFileTime
WaitForSingleObjectEx
GDI32.dll GetDeviceCaps
ADVAPI32.dll RegOpenKeyExW
RegCloseKey
RegGetValueW
RegQueryValueExW
SHELL32.dll ShellExecuteA
Shell_NotifyIconW
ShellExecuteW
ole32.dll CoUninitialize
CoInitializeEx
CoCreateInstance
WINHTTP.dll WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
IMM32.dll ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
D3DCOMPILER_47.dll D3DCompile

Delayed Imports

__swprintf_l

Ordinal 1
Address 0x47fe80

__vswprintf_l

Ordinal 2
Address 0x47fee0

_fprintf_l

Ordinal 3
Address 0x47ff30

_fprintf_p

Ordinal 4
Address 0x47ff80

_fprintf_p_l

Ordinal 5
Address 0x47ffd0

_fprintf_s_l

Ordinal 6
Address 0x480020

_fscanf_l

Ordinal 7
Address 0x480070

_fscanf_s_l

Ordinal 8
Address 0x4800c0

_fwprintf_l

Ordinal 9
Address 0x480110

_fwprintf_p

Ordinal 10
Address 0x480160

_fwprintf_p_l

Ordinal 11
Address 0x4801b0

_fwprintf_s_l

Ordinal 12
Address 0x480200

_fwscanf_l

Ordinal 13
Address 0x480250

_fwscanf_s_l

Ordinal 14
Address 0x4802a0

_printf_l

Ordinal 15
Address 0x4802f0

_printf_p

Ordinal 16
Address 0x480350

_printf_p_l

Ordinal 17
Address 0x4803b0

_printf_s_l

Ordinal 18
Address 0x480410

_scanf_l

Ordinal 19
Address 0x480470

_scanf_s_l

Ordinal 20
Address 0x4804c0

_scprintf

Ordinal 21
Address 0xb7cc0

_scprintf_l

Ordinal 22
Address 0x480520

_scprintf_p

Ordinal 23
Address 0x480580

_scprintf_p_l

Ordinal 24
Address 0x4805e0

_scwprintf

Ordinal 25
Address 0x480640

_scwprintf_l

Ordinal 26
Address 0x4806a0

_scwprintf_p

Ordinal 27
Address 0x480700

_scwprintf_p_l

Ordinal 28
Address 0x480760

_snprintf

Ordinal 29
Address 0x4807c0

_snprintf_c

Ordinal 30
Address 0x480820

_snprintf_c_l

Ordinal 31
Address 0x480880

_snprintf_l

Ordinal 32
Address 0x4808e0

_snprintf_s

Ordinal 33
Address 0x480940

_snprintf_s_l

Ordinal 34
Address 0x4809b0

_snscanf

Ordinal 35
Address 0x480a10

_snscanf_l

Ordinal 36
Address 0x480a60

_snscanf_s

Ordinal 37
Address 0x480ab0

_snscanf_s_l

Ordinal 38
Address 0x480b10

_snwprintf

Ordinal 39
Address 0x480b70

_snwprintf_l

Ordinal 40
Address 0x480bd0

_snwprintf_s

Ordinal 41
Address 0x480c30

_snwprintf_s_l

Ordinal 42
Address 0x480ca0

_snwscanf

Ordinal 43
Address 0x480d00

_snwscanf_l

Ordinal 44
Address 0x480d50

_snwscanf_s

Ordinal 45
Address 0x480da0

_snwscanf_s_l

Ordinal 46
Address 0x480e00

_sprintf_l

Ordinal 47
Address 0x480e60

_sprintf_p

Ordinal 48
Address 0x480ec0

_sprintf_p_l

Ordinal 49
Address 0x480f20

_sprintf_s_l

Ordinal 50
Address 0x480f80

_sscanf_l

Ordinal 51
Address 0x480fe0

_sscanf_s_l

Ordinal 52
Address 0x481030

_swprintf

Ordinal 53
Address 0x481090

_swprintf_c

Ordinal 54
Address 0x4810f0

_swprintf_c_l

Ordinal 55
Address 0x481150

_swprintf_l

Ordinal 56
Address 0x481150

_swprintf_p

Ordinal 57
Address 0x4811b0

_swprintf_p_l

Ordinal 58
Address 0x481210

_swprintf_s_l

Ordinal 59
Address 0x481270

_swscanf_l

Ordinal 60
Address 0x4812d0

_swscanf_s_l

Ordinal 61
Address 0x481320

_vfprintf_l

Ordinal 62
Address 0x2b2120

_vfprintf_p

Ordinal 63
Address 0x481380

_vfprintf_p_l

Ordinal 64
Address 0x4813d0

_vfprintf_s_l

Ordinal 65
Address 0x481410

_vfscanf_l

Ordinal 66
Address 0x481450

_vfscanf_s_l

Ordinal 67
Address 0x481490

_vfwprintf_l

Ordinal 68
Address 0x4814d0

_vfwprintf_p

Ordinal 69
Address 0x481510

_vfwprintf_p_l

Ordinal 70
Address 0x481560

_vfwprintf_s_l

Ordinal 71
Address 0x4815a0

_vfwscanf_l

Ordinal 72
Address 0x4815e0

_vfwscanf_s_l

Ordinal 73
Address 0x481620

_vprintf_l

Ordinal 74
Address 0x481660

_vprintf_p

Ordinal 75
Address 0x4816b0

_vprintf_p_l

Ordinal 76
Address 0x481700

_vprintf_s_l

Ordinal 77
Address 0x481750

_vscanf_l

Ordinal 78
Address 0x4817a0

_vscanf_s_l

Ordinal 79
Address 0x4817e0

_vscprintf

Ordinal 80
Address 0x481830

_vscprintf_l

Ordinal 81
Address 0xb7c60

_vscprintf_p

Ordinal 82
Address 0x481880

_vscprintf_p_l

Ordinal 83
Address 0x4818d0

_vscwprintf

Ordinal 84
Address 0x481930

_vscwprintf_l

Ordinal 85
Address 0x481980

_vscwprintf_p

Ordinal 86
Address 0x4819e0

_vscwprintf_p_l

Ordinal 87
Address 0x481a30

_vsnprintf

Ordinal 88
Address 0x3d62d0

_vsnprintf_c

Ordinal 89
Address 0x481a90

_vsnprintf_c_l

Ordinal 90
Address 0x481ae0

_vsnprintf_l

Ordinal 91
Address 0x3d6270

_vsnprintf_s

Ordinal 92
Address 0x481b30

_vsnprintf_s_l

Ordinal 93
Address 0x481b90

_vsnwprintf

Ordinal 94
Address 0x481bf0

_vsnwprintf_l

Ordinal 95
Address 0x481c40

_vsnwprintf_s

Ordinal 96
Address 0x481ca0

_vsnwprintf_s_l

Ordinal 97
Address 0x481d00

_vsnwscanf_l

Ordinal 98
Address 0x481d60

_vsnwscanf_s_l

Ordinal 99
Address 0x481db0

_vsprintf_l

Ordinal 100
Address 0x481e00

_vsprintf_p

Ordinal 101
Address 0x481e50

_vsprintf_p_l

Ordinal 102
Address 0x481ea0

_vsprintf_s_l

Ordinal 103
Address 0x9c9a0

_vsscanf_l

Ordinal 104
Address 0x13710

_vsscanf_s_l

Ordinal 105
Address 0x96f90

_vswprintf

Ordinal 106
Address 0x481ef0

_vswprintf_c

Ordinal 107
Address 0x481f50

_vswprintf_c_l

Ordinal 108
Address 0x481fa0

_vswprintf_l

Ordinal 109
Address 0x481fa0

_vswprintf_p

Ordinal 110
Address 0x481ff0

_vswprintf_p_l

Ordinal 111
Address 0x482040

_vswprintf_s_l

Ordinal 112
Address 0x482090

_vswscanf_l

Ordinal 113
Address 0x4820e0

_vswscanf_s_l

Ordinal 114
Address 0x482130

_vwprintf_l

Ordinal 115
Address 0x482180

_vwprintf_p

Ordinal 116
Address 0x4821d0

_vwprintf_p_l

Ordinal 117
Address 0x482220

_vwprintf_s_l

Ordinal 118
Address 0x482270

_vwscanf_l

Ordinal 119
Address 0x4822c0

_vwscanf_s_l

Ordinal 120
Address 0x482300

_wprintf_l

Ordinal 121
Address 0x482350

_wprintf_p

Ordinal 122
Address 0x4823b0

_wprintf_p_l

Ordinal 123
Address 0x482410

_wprintf_s_l

Ordinal 124
Address 0x482470

_wscanf_l

Ordinal 125
Address 0x4824d0

_wscanf_s_l

Ordinal 126
Address 0x482520

fprintf

Ordinal 127
Address 0x2b2160

fprintf_s

Ordinal 128
Address 0x4826d0

fscanf

Ordinal 129
Address 0x482720

fscanf_s

Ordinal 130
Address 0x482770

fwprintf

Ordinal 131
Address 0x4827c0

fwprintf_s

Ordinal 132
Address 0x482810

fwscanf

Ordinal 133
Address 0x482860

fwscanf_s

Ordinal 134
Address 0x4828b0

printf

Ordinal 135
Address 0x3d6220

printf_s

Ordinal 136
Address 0x483030

scanf

Ordinal 137
Address 0x483120

scanf_s

Ordinal 138
Address 0x483170

snprintf

Ordinal 139
Address 0x136b0

sprintf

Ordinal 140
Address 0x4831d0

sprintf_s

Ordinal 141
Address 0x9c9f0

sscanf

Ordinal 142
Address 0x13760

sscanf_s

Ordinal 143
Address 0x97040

swprintf

Ordinal 144
Address 0x4810f0

swprintf_s

Ordinal 145
Address 0x483230

swscanf

Ordinal 146
Address 0x483290

swscanf_s

Ordinal 147
Address 0x4832f0

vfprintf

Ordinal 148
Address 0x483350

vfprintf_s

Ordinal 149
Address 0x4833a0

vfscanf

Ordinal 150
Address 0x4833f0

vfscanf_s

Ordinal 151
Address 0x483440

vfwprintf

Ordinal 152
Address 0x483490

vfwprintf_s

Ordinal 153
Address 0x4834e0

vfwscanf

Ordinal 154
Address 0x483530

vfwscanf_s

Ordinal 155
Address 0x483580

vprintf

Ordinal 156
Address 0x4835d0

vprintf_s

Ordinal 157
Address 0x483620

vscanf

Ordinal 158
Address 0x483670

vscanf_s

Ordinal 159
Address 0x4836c0

vsnprintf

Ordinal 160
Address 0x13660

vsnprintf_s

Ordinal 161
Address 0x481b30

vsprintf

Ordinal 162
Address 0x483710

vsprintf_s

Ordinal 163
Address 0x483770

vsscanf

Ordinal 164
Address 0x4837c0

vsscanf_s

Ordinal 165
Address 0x96fe0

vswprintf

Ordinal 166
Address 0x481f50

vswprintf_s

Ordinal 167
Address 0x483810

vswscanf

Ordinal 168
Address 0x483860

vswscanf_s

Ordinal 169
Address 0x4838b0

vwprintf

Ordinal 170
Address 0x483910

vwprintf_s

Ordinal 171
Address 0x483960

vwscanf

Ordinal 172
Address 0x4839b0

vwscanf_s

Ordinal 173
Address 0x483a00

wprintf

Ordinal 174
Address 0x483a50

wprintf_s

Ordinal 175
Address 0x483ab0

wscanf

Ordinal 176
Address 0x483b10

wscanf_s

Ordinal 177
Address 0x483b60

NLUpdateProfile

Ordinal 178
Address 0x11c2000

201

Type RT_RCDATA
Language English - United States
Codepage UNKNOWN
Size 0xb1fc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.33418
MD5 f3efd61e5afc3f8869bdd50866d54438 🔍
SHA1 d32b9a70a275e192b45a0326e6e51532ce24ab9e 🔍
SHA256 ad12c6164215405befe1f8fa7f4f0d741e313f91d93caf567d9cc9755b078ba9 🔍
SHA3 50ae3ee60e641b5112512180642f8793979bbd067f293e7d176399b1ffd8378d 🔍

2

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Oct-25 05:35:06
Version 0.0
SizeofData 77
AddressOfRawData 0x8b1ef0
PointerToRawData 0x8b0cf0
Referenced File E:\Projects\neverwin-v2\bin\x64\Release\neverwin.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Oct-25 05:35:06
Version 0.0
SizeofData 20
AddressOfRawData 0x8b1f40
PointerToRawData 0x8b0d40

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Oct-25 05:35:06
Version 0.0
SizeofData 1044
AddressOfRawData 0x8b1f54
PointerToRawData 0x8b0d54

IMAGE_DEBUG_TYPE_ILTCG

Characteristics 0
TimeDateStamp 2026-Oct-25 05:35:06
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

StartAddressOfRawData 0x1808b23c0
EndAddressOfRawData 0x1808b23e8
AddressOfIndex 0x180c9f468
AddressOfCallbacks 0x18056c5e8
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180919500

RICH Header

XOR Key 0xa6323cd7
Unmarked objects 0
C++ objects (33145) 194
ASM objects (33145) 35
Imports (VS2008 SP1 build 30729) 2
C objects (35721) 16
ASM objects (35721) 12
C++ objects (35721) 99
C objects (33145) 85
Unmarked objects (#2) 1
C objects (36260) 61
Imports (33145) 23
Total imports 285
C++ objects (LTCG) (36256) 215
Exports (36256) 1
Resource objects (36256) 1
151 1
Linker (36256) 1

Errors

[*] Warning: Section .luaDat has a size of 0! [*] Warning: Section .kb53 has a size of 0! [*] Warning: Yara callback received an unhandled message (6).
Leave a comment

No comments yet.