Manalyze report for 74170fb07ec08b1c54ff93e451e8e0d28f0ed2216728d7be9cbb3dfc6845e0da

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2026-Oct-25 05:35:06
Detected languages	English - United States
Debug artifacts	E:\Projects\neverlose-v2\bin\x64\Release\neverlose.pdb

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `Contains another PE executable: This program cannot be run in DOS mode.` `Miscellaneous malware strings: Exploit exploit` `Contains domain names: autopeek.nl github.com http://www.processtypefoundry.comLicensed http://www.processtypefoundry.comhttps http://www.styleseven.comFreeware http://www.styleseven.comSmallest http://www.w3.org http://www.w3.org/2000/svg https://github.com https://lua.neverlose.one https://neverlose.one https://processtypefoundry.com processtypefoundry.com www.w3.org`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to RC5 or RC6`
Suspicious	The PE is possibly packed.	`Unusual section name found: .nlart` `Unusual section name found: .pview` `Unusual section name found: .model` `Section .model is both writable and executable.`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryExW GetProcAddress LoadLibraryW LoadLibraryA LoadLibraryExA` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Can access the registry: RegOpenKeyExW RegCloseKey RegGetValueW RegQueryValueExW` `Possibly launches other programs: ShellExecuteA ShellExecuteW` `Uses functions commonly found in keyloggers: MapVirtualKeyA GetAsyncKeyState GetForegroundWindow` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Has Internet access capabilities: WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse` `Enumerates local disk drives: GetDriveTypeW` `Reads the contents of the clipboard: GetClipboardData`
Safe	VirusTotal score: 0/71 (Scanned on 2026-11-06 20:47:55)	`All the AVs think this file is safe.`

Hashes

MD5	`ae4725a424f000e2e3ca42b26f4c903a` 🔍
SHA1	`32ca54772c0c100431a0440bdf6e260a1ddad73a` 🔍
SHA256	`74170fb07ec08b1c54ff93e451e8e0d28f0ed2216728d7be9cbb3dfc6845e0da` 🔍
SHA3	`1be6f823affee20d045d99168ad54022184bb2c874369cafc9406bf2f8bcc626` 🔍
SSDeep	`98304:eFvdLAEdU3j3LPps187DYws/lPrJcpd2V5P0KOv2PZn:eFdEEqbLhs187DHETJcpdxvax` 🔍
Imports Hash	`940c023191d22497aa25e621d9ad8b24` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x120`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`10`
TimeDateStamp	2026-Oct-25 05:35:06
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x569600`
SizeOfInitializedData	`0xc4ea00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000004ED880 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x180000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x12a0000`
SizeOfHeaders	`0x400`
Checksum	`0xe25739`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`e7dcfee618062ce1061c62d46d2f2c11 🔍`
SHA1	`6ecb202e8e9b842752da32d75812965c04aa635b 🔍`
SHA256	`2a5b7e3bb716dd5fd11e97e3022380b0b6b29f5df65a5f28070e916540171a32 🔍`
SHA3	`169288291b06bafa0569baeff9e1752af3a5489fe41329ae3a6202d91bd45392 🔍`
VirtualSize	`0x5694fc`
VirtualAddress	`0x1000`
SizeOfRawData	`0x569600`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.57082`

.rdata

MD5	`50e7adf53f49b34a77fec11f1b80f150 🔍`
SHA1	`9da7919a595c81cd2f054de0f32cb081cd26694d 🔍`
SHA256	`dea47bb8dab0473db2706e174aef4adfcddbb59be38bce7587d101ea91705ae9 🔍`
SHA3	`779dd4bcee9e614c020581bd8da9d1efb0340cf2b262fa71c1391d9bb46a061d 🔍`
VirtualSize	`0x3adcee`
VirtualAddress	`0x56b000`
SizeOfRawData	`0x3ade00`
PointerToRawData	`0x569a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.41744`

.data

MD5	`1d9c654c6a41bcb39d27e4122f98da7a 🔍`
SHA1	`c2158f9f538c30499f6885e608dbec90f32415c4 🔍`
SHA256	`6838f629c204c56ac1a085e1d60a07a560e0f385cdd2602966229544398b9cb6 🔍`
SHA3	`347454ec1f6e3849c5d77d3eb9614bd34813d8e4552706f248917c92a1a14ea9 🔍`
VirtualSize	`0x7fd4cc`
VirtualAddress	`0x919000`
SizeOfRawData	`0x385c00`
PointerToRawData	`0x917800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.580081`

.pdata

MD5	`e33f5b1c022f6360061aa348029e4ac5 🔍`
SHA1	`2c6f73c234983c4a520bf95af4ed21eaeb9dd544 🔍`
SHA256	`0c98341b2f3ce19aea61b6ff1fb05e6190a432e69042151e0418ab11f128f571 🔍`
SHA3	`b6584239e5be2199e21da31e3d035a8622311c2d67aa3a310b4f55b0ea7bf233 🔍`
VirtualSize	`0x3189c`
VirtualAddress	`0x1117000`
SizeOfRawData	`0x31a00`
PointerToRawData	`0xc9d400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.45378`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x100`
VirtualAddress	`0x1149000`
SizeOfRawData	`0x200`
PointerToRawData	`0xccee00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.rsrc

MD5	`f4705239432acef1b0c1459faf84be6e 🔍`
SHA1	`62811f3b331ec7998021879b5e3b02921a7228cd 🔍`
SHA256	`6f2e12b9b01527eedc154688820b9dbc78491f02c33d31f4a4e5d6e202e2b779 🔍`
SHA3	`22db3d2e775e7de9a8903559d908c7b3f8f6c51ca55e8d26a0625290e3cfbee2 🔍`
VirtualSize	`0xb420`
VirtualAddress	`0x114a000`
SizeOfRawData	`0xb600`
PointerToRawData	`0xccf000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.38003`

.reloc

MD5	`b9f02d3ad6fa616db9d8dfd3ed1ae89e 🔍`
SHA1	`7b4a8dede1aacd1f690fb8b64ece5690df25d5b5 🔍`
SHA256	`23d93bc60a382be5f6711a2bef34d4c364def0925e535be5b19ef5b6a6dcdf39 🔍`
SHA3	`e5e10cab7eae5411345d48fc5057da8890413efa30f857a082d100a3bafdecfc 🔍`
VirtualSize	`0x887c`
VirtualAddress	`0x1156000`
SizeOfRawData	`0x8a00`
PointerToRawData	`0xcda600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.4493`

.nlart

MD5	`1e4a3fd1aad7f7cbf16ac476f26b8a70 🔍`
SHA1	`75d3f2e6839637e19314481d2c4830aaddf1d0d1 🔍`
SHA256	`99a889b09fe8c0f796e3fe02879a9ce11bd945b94a3e5488b075a8955bbea666 🔍`
SHA3	`3db717a08dded12f0304c743d4d62bf2764f9bb431f5f3e49d19dc718c6d6b52 🔍`
VirtualSize	`0x5d970`
VirtualAddress	`0x115f000`
SizeOfRawData	`0x5da00`
PointerToRawData	`0xce3000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`1.03487`

.pview

MD5	`7c972746693f2e203174cea35781e62c 🔍`
SHA1	`5c3cfbfa5532b8298487f794089808beb29e7acf 🔍`
SHA256	`3309421e4d6393eeb08023286156aa41b4291e7316980efc3da7796cfe7ff0d6 🔍`
SHA3	`65ecff83d751a2b335a248a86731afd2fa57ebfcb225420ba3c330f94227ce75 🔍`
VirtualSize	`0x3f0`
VirtualAddress	`0x11bd000`
SizeOfRawData	`0x400`
PointerToRawData	`0xd40a00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.16625`

.model

MD5	`617369a493c967675e2f94bcd13a4de9 🔍`
SHA1	`72c156df0e9a54eeea64631c11f02296792e3064 🔍`
SHA256	`a62434d21ffeca1fe3263f516f301b6a7864300e101bf1cd4f3b224d6c2f1fe4 🔍`
SHA3	`b5528b436a25a5a9f65245b2aec328204f8e1640ccfc3924bb1b61df2db807f3 🔍`
VirtualSize	`0xe1644`
VirtualAddress	`0x11be000`
SizeOfRawData	`0xe1800`
PointerToRawData	`0xd40e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.4318`

Imports

d3d11.dll	`D3D11CreateDeviceAndSwapChain`
USER32.dll	`GetClipboardData` `MapVirtualKeyA` `EmptyClipboard` `GetAsyncKeyState` `RegisterClassExA` `SetWindowLongPtrA` `UnregisterClassA` `ClipCursor` `CreateWindowExA` `PostMessageA` `GetClipCursor` `GetRawInputData` `CallWindowProcA` `GetCursorInfo` `DestroyWindow` `CloseClipboard` `OpenClipboard` `GetKeyNameTextA` `FlashWindowEx` `SetClipboardData` `GetClassLongPtrW` `GetForegroundWindow` `DefWindowProcA` `SetCapture` `ReleaseDC` `DefWindowProcW` `GetKeyState` `GetMessageExtraInfo` `ScreenToClient` `GetCapture` `ClientToScreen` `TrackMouseEvent` `GetKeyboardLayout` `LoadCursorW` `SystemParametersInfoA` `SetCursor` `GetClientRect` `IsWindowUnicode` `ReleaseCapture` `SetCursorPos` `GetCursorPos` `MessageBoxA` `GetDC` `MonitorFromWindow` `LoadIconW`
KERNEL32.dll	`ReadConsoleW` `EnumSystemLocalesW` `GetUserDefaultLCID` `IsValidLocale` `LCMapStringW` `CompareStringW` `GetDateFormatW` `LoadLibraryExW` `GetConsoleMode` `GetConsoleOutputCP` `WriteFile` `FlushFileBuffers` `SetFilePointerEx` `GetFileSizeEx` `GetStdHandle` `UnhandledExceptionFilter` `IsDebuggerPresent` `IsProcessorFeaturePresent` `TerminateProcess` `ExitProcess` `ReadFile` `SetStdHandle` `FileTimeToSystemTime` `SystemTimeToTzSpecificLocalTime` `PeekNamedPipe` `GetFileType` `GetDriveTypeW` `CreateFileW` `FlsFree` `FlsSetValue` `FlsGetValue` `GetCurrentThreadId` `Sleep` `VirtualProtect` `GetModuleHandleA` `GetTickCount64` `ReleaseSRWLockExclusive` `AcquireSRWLockExclusive` `QueryPerformanceFrequency` `ReleaseSRWLockShared` `GetProcAddress` `AcquireSRWLockShared` `QueryPerformanceCounter` `VirtualQuery` `MultiByteToWideChar` `GlobalAlloc` `GlobalFree` `GlobalLock` `WideCharToMultiByte` `GlobalUnlock` `GetLastError` `CloseHandle` `CreateThread` `GetLocalTime` `MoveFileExA` `DeleteFileA` `HeapFree` `HeapAlloc` `GetProcessHeap` `GetLocaleInfoW` `GetTimeFormatW` `GetSystemInfo` `LoadLibraryW` `GlobalMemoryStatusEx` `GetModuleHandleW` `GetTickCount` `VirtualFree` `VirtualAlloc` `GetCurrentProcess` `K32GetModuleInformation` `GetSystemTimeAsFileTime` `GetWindowsDirectoryA` `SetEnvironmentVariableW` `FlushInstructionCache` `GetTimeZoneInformation` `SetEvent` `TerminateThread` `LoadLibraryA` `GetUserDefaultLocaleName` `GetFileAttributesA` `SizeofResource` `FindResourceA` `GetModuleHandleExA` `LockResource` `LoadResource` `GetModuleFileNameW` `RtlAddFunctionTable` `RtlLookupFunctionEntry` `FreeLibraryAndExitThread` `ExitThread` `DisableThreadLibraryCalls` `Beep` `FreeLibrary` `RtlDeleteFunctionTable` `OutputDebugStringA` `GetLocaleInfoA` `IsDBCSLeadByte` `HeapCreate` `Thread32Next` `Thread32First` `SuspendThread` `ResumeThread` `CreateToolhelp32Snapshot` `HeapReAlloc` `HeapDestroy` `GetThreadContext` `GetCurrentProcessId` `SetThreadContext` `OpenThread` `RtlCaptureContext` `RtlRestoreContext` `RtlUnwindEx` `RtlVirtualUnwind` `RaiseException` `SetLastError` `InitializeCriticalSection` `EnterCriticalSection` `LeaveCriticalSection` `DeleteCriticalSection` `LoadLibraryExA` `FormatMessageA` `FlsAlloc` `IsValidCodePage` `GetACP` `GetOEMCP` `RtlUnwind` `HeapSize` `HeapQueryInformation` `WriteConsoleW` `InterlockedFlushSList` `InitializeSListHead` `GetStartupInfoW` `SetUnhandledExceptionFilter` `GetCPInfo` `GetStringTypeW` `LCMapStringEx` `DecodePointer` `EncodePointer` `InitializeCriticalSectionEx` `WaitForThreadpoolWorkCallbacks` `GetModuleHandleExW` `CloseThreadpoolWork` `SubmitThreadpoolWork` `CreateThreadpoolWork` `FreeLibraryWhenCallbackReturns` `GetCommandLineA` `GetCommandLineW` `GetEnvironmentStringsW` `WaitForSingleObject` `FreeEnvironmentStringsW` `SetEndOfFile` `GetLocaleInfoEx` `RtlPcToFileHeader` `InitOnceBeginInitialize` `InitOnceComplete` `SleepConditionVariableSRW` `WakeAllConditionVariable` `WakeConditionVariable` `GetLogicalProcessorInformationEx` `GetExitCodeThread` `TryAcquireSRWLockExclusive` `GetCurrentDirectoryW` `CreateDirectoryW` `FindClose` `FindFirstFileW` `FindFirstFileExW` `FindNextFileW` `GetFileAttributesExW` `GetFileInformationByHandle` `GetFinalPathNameByHandleW` `GetFullPathNameW` `SetFileInformationByHandle` `SetFileTime` `CreateFile2` `AreFileApisANSI` `CopyFile2` `MoveFileExW` `GetFileInformationByHandleEx` `LocalFree` `GetSystemTimePreciseAsFileTime` `WaitForSingleObjectEx`
GDI32.dll	`GetDeviceCaps`
ADVAPI32.dll	`RegOpenKeyExW` `RegCloseKey` `RegGetValueW` `RegQueryValueExW`
SHELL32.dll	`ShellExecuteA` `Shell_NotifyIconW` `ShellExecuteW`
ole32.dll	`CoUninitialize` `CoInitializeEx` `CoCreateInstance`
WINHTTP.dll	`WinHttpQueryDataAvailable` `WinHttpCrackUrl` `WinHttpConnect` `WinHttpSetTimeouts` `WinHttpSendRequest` `WinHttpCloseHandle` `WinHttpOpenRequest` `WinHttpReadData` `WinHttpQueryHeaders` `WinHttpOpen` `WinHttpReceiveResponse`
IMM32.dll	`ImmSetCandidateWindow` `ImmSetCompositionWindow` `ImmReleaseContext` `ImmGetContext`
D3DCOMPILER_47.dll	`D3DCompile`

Delayed Imports

__swprintf_l

Ordinal	`1`
Address	`0x47fe80`

__vswprintf_l

Ordinal	`2`
Address	`0x47fee0`

_fprintf_l

Ordinal	`3`
Address	`0x47ff30`

_fprintf_p

Ordinal	`4`
Address	`0x47ff80`

_fprintf_p_l

Ordinal	`5`
Address	`0x47ffd0`

_fprintf_s_l

Ordinal	`6`
Address	`0x480020`

_fscanf_l

Ordinal	`7`
Address	`0x480070`

_fscanf_s_l

Ordinal	`8`
Address	`0x4800c0`

_fwprintf_l

Ordinal	`9`
Address	`0x480110`

_fwprintf_p

Ordinal	`10`
Address	`0x480160`

_fwprintf_p_l

Ordinal	`11`
Address	`0x4801b0`

_fwprintf_s_l

Ordinal	`12`
Address	`0x480200`

_fwscanf_l

Ordinal	`13`
Address	`0x480250`

_fwscanf_s_l

Ordinal	`14`
Address	`0x4802a0`

_printf_l

Ordinal	`15`
Address	`0x4802f0`

_printf_p

Ordinal	`16`
Address	`0x480350`

_printf_p_l

Ordinal	`17`
Address	`0x4803b0`

_printf_s_l

Ordinal	`18`
Address	`0x480410`

_scanf_l

Ordinal	`19`
Address	`0x480470`

_scanf_s_l

Ordinal	`20`
Address	`0x4804c0`

_scprintf

Ordinal	`21`
Address	`0xb7cc0`

_scprintf_l

Ordinal	`22`
Address	`0x480520`

_scprintf_p

Ordinal	`23`
Address	`0x480580`

_scprintf_p_l

Ordinal	`24`
Address	`0x4805e0`

_scwprintf

Ordinal	`25`
Address	`0x480640`

_scwprintf_l

Ordinal	`26`
Address	`0x4806a0`

_scwprintf_p

Ordinal	`27`
Address	`0x480700`

_scwprintf_p_l

Ordinal	`28`
Address	`0x480760`

_snprintf

Ordinal	`29`
Address	`0x4807c0`

_snprintf_c

Ordinal	`30`
Address	`0x480820`

_snprintf_c_l

Ordinal	`31`
Address	`0x480880`

_snprintf_l

Ordinal	`32`
Address	`0x4808e0`

_snprintf_s

Ordinal	`33`
Address	`0x480940`

_snprintf_s_l

Ordinal	`34`
Address	`0x4809b0`

_snscanf

Ordinal	`35`
Address	`0x480a10`

_snscanf_l

Ordinal	`36`
Address	`0x480a60`

_snscanf_s

Ordinal	`37`
Address	`0x480ab0`

_snscanf_s_l

Ordinal	`38`
Address	`0x480b10`

_snwprintf

Ordinal	`39`
Address	`0x480b70`

_snwprintf_l

Ordinal	`40`
Address	`0x480bd0`

_snwprintf_s

Ordinal	`41`
Address	`0x480c30`

_snwprintf_s_l

Ordinal	`42`
Address	`0x480ca0`

_snwscanf

Ordinal	`43`
Address	`0x480d00`

_snwscanf_l

Ordinal	`44`
Address	`0x480d50`

_snwscanf_s

Ordinal	`45`
Address	`0x480da0`

_snwscanf_s_l

Ordinal	`46`
Address	`0x480e00`

_sprintf_l

Ordinal	`47`
Address	`0x480e60`

_sprintf_p

Ordinal	`48`
Address	`0x480ec0`

_sprintf_p_l

Ordinal	`49`
Address	`0x480f20`

_sprintf_s_l

Ordinal	`50`
Address	`0x480f80`

_sscanf_l

Ordinal	`51`
Address	`0x480fe0`

_sscanf_s_l

Ordinal	`52`
Address	`0x481030`

_swprintf

Ordinal	`53`
Address	`0x481090`

_swprintf_c

Ordinal	`54`
Address	`0x4810f0`

_swprintf_c_l

Ordinal	`55`
Address	`0x481150`

_swprintf_l

Ordinal	`56`
Address	`0x481150`

_swprintf_p

Ordinal	`57`
Address	`0x4811b0`

_swprintf_p_l

Ordinal	`58`
Address	`0x481210`

_swprintf_s_l

Ordinal	`59`
Address	`0x481270`

_swscanf_l

Ordinal	`60`
Address	`0x4812d0`

_swscanf_s_l

Ordinal	`61`
Address	`0x481320`

_vfprintf_l

Ordinal	`62`
Address	`0x2b2120`

_vfprintf_p

Ordinal	`63`
Address	`0x481380`

_vfprintf_p_l

Ordinal	`64`
Address	`0x4813d0`

_vfprintf_s_l

Ordinal	`65`
Address	`0x481410`

_vfscanf_l

Ordinal	`66`
Address	`0x481450`

_vfscanf_s_l

Ordinal	`67`
Address	`0x481490`

_vfwprintf_l

Ordinal	`68`
Address	`0x4814d0`

_vfwprintf_p

Ordinal	`69`
Address	`0x481510`

_vfwprintf_p_l

Ordinal	`70`
Address	`0x481560`

_vfwprintf_s_l

Ordinal	`71`
Address	`0x4815a0`

_vfwscanf_l

Ordinal	`72`
Address	`0x4815e0`

_vfwscanf_s_l

Ordinal	`73`
Address	`0x481620`

_vprintf_l

Ordinal	`74`
Address	`0x481660`

_vprintf_p

Ordinal	`75`
Address	`0x4816b0`

_vprintf_p_l

Ordinal	`76`
Address	`0x481700`

_vprintf_s_l

Ordinal	`77`
Address	`0x481750`

_vscanf_l

Ordinal	`78`
Address	`0x4817a0`

_vscanf_s_l

Ordinal	`79`
Address	`0x4817e0`

_vscprintf

Ordinal	`80`
Address	`0x481830`

_vscprintf_l

Ordinal	`81`
Address	`0xb7c60`

_vscprintf_p

Ordinal	`82`
Address	`0x481880`

_vscprintf_p_l

Ordinal	`83`
Address	`0x4818d0`

_vscwprintf

Ordinal	`84`
Address	`0x481930`

_vscwprintf_l

Ordinal	`85`
Address	`0x481980`

_vscwprintf_p

Ordinal	`86`
Address	`0x4819e0`

_vscwprintf_p_l

Ordinal	`87`
Address	`0x481a30`

_vsnprintf

Ordinal	`88`
Address	`0x3d62d0`

_vsnprintf_c

Ordinal	`89`
Address	`0x481a90`

_vsnprintf_c_l

Ordinal	`90`
Address	`0x481ae0`

_vsnprintf_l

Ordinal	`91`
Address	`0x3d6270`

_vsnprintf_s

Ordinal	`92`
Address	`0x481b30`

_vsnprintf_s_l

Ordinal	`93`
Address	`0x481b90`

_vsnwprintf

Ordinal	`94`
Address	`0x481bf0`

_vsnwprintf_l

Ordinal	`95`
Address	`0x481c40`

_vsnwprintf_s

Ordinal	`96`
Address	`0x481ca0`

_vsnwprintf_s_l

Ordinal	`97`
Address	`0x481d00`

_vsnwscanf_l

Ordinal	`98`
Address	`0x481d60`

_vsnwscanf_s_l

Ordinal	`99`
Address	`0x481db0`

_vsprintf_l

Ordinal	`100`
Address	`0x481e00`

_vsprintf_p

Ordinal	`101`
Address	`0x481e50`

_vsprintf_p_l

Ordinal	`102`
Address	`0x481ea0`

_vsprintf_s_l

Ordinal	`103`
Address	`0x9c9a0`

_vsscanf_l

Ordinal	`104`
Address	`0x13710`

_vsscanf_s_l

Ordinal	`105`
Address	`0x96f90`

_vswprintf

Ordinal	`106`
Address	`0x481ef0`

_vswprintf_c

Ordinal	`107`
Address	`0x481f50`

_vswprintf_c_l

Ordinal	`108`
Address	`0x481fa0`

_vswprintf_l

Ordinal	`109`
Address	`0x481fa0`

_vswprintf_p

Ordinal	`110`
Address	`0x481ff0`

_vswprintf_p_l

Ordinal	`111`
Address	`0x482040`

_vswprintf_s_l

Ordinal	`112`
Address	`0x482090`

_vswscanf_l

Ordinal	`113`
Address	`0x4820e0`

_vswscanf_s_l

Ordinal	`114`
Address	`0x482130`

_vwprintf_l

Ordinal	`115`
Address	`0x482180`

_vwprintf_p

Ordinal	`116`
Address	`0x4821d0`

_vwprintf_p_l

Ordinal	`117`
Address	`0x482220`

_vwprintf_s_l

Ordinal	`118`
Address	`0x482270`

_vwscanf_l

Ordinal	`119`
Address	`0x4822c0`

_vwscanf_s_l

Ordinal	`120`
Address	`0x482300`

_wprintf_l

Ordinal	`121`
Address	`0x482350`

_wprintf_p

Ordinal	`122`
Address	`0x4823b0`

_wprintf_p_l

Ordinal	`123`
Address	`0x482410`

_wprintf_s_l

Ordinal	`124`
Address	`0x482470`

_wscanf_l

Ordinal	`125`
Address	`0x4824d0`

_wscanf_s_l

Ordinal	`126`
Address	`0x482520`

fprintf

Ordinal	`127`
Address	`0x2b2160`

fprintf_s

Ordinal	`128`
Address	`0x4826d0`

fscanf

Ordinal	`129`
Address	`0x482720`

fscanf_s

Ordinal	`130`
Address	`0x482770`

fwprintf

Ordinal	`131`
Address	`0x4827c0`

fwprintf_s

Ordinal	`132`
Address	`0x482810`

fwscanf

Ordinal	`133`
Address	`0x482860`

fwscanf_s

Ordinal	`134`
Address	`0x4828b0`

printf

Ordinal	`135`
Address	`0x3d6220`

printf_s

Ordinal	`136`
Address	`0x483030`

scanf

Ordinal	`137`
Address	`0x483120`

scanf_s

Ordinal	`138`
Address	`0x483170`

snprintf

Ordinal	`139`
Address	`0x136b0`

sprintf

Ordinal	`140`
Address	`0x4831d0`

sprintf_s

Ordinal	`141`
Address	`0x9c9f0`

sscanf

Ordinal	`142`
Address	`0x13760`

sscanf_s

Ordinal	`143`
Address	`0x97040`

swprintf

Ordinal	`144`
Address	`0x4810f0`

swprintf_s

Ordinal	`145`
Address	`0x483230`

swscanf

Ordinal	`146`
Address	`0x483290`

swscanf_s

Ordinal	`147`
Address	`0x4832f0`

vfprintf

Ordinal	`148`
Address	`0x483350`

vfprintf_s

Ordinal	`149`
Address	`0x4833a0`

vfscanf

Ordinal	`150`
Address	`0x4833f0`

vfscanf_s

Ordinal	`151`
Address	`0x483440`

vfwprintf

Ordinal	`152`
Address	`0x483490`

vfwprintf_s

Ordinal	`153`
Address	`0x4834e0`

vfwscanf

Ordinal	`154`
Address	`0x483530`

vfwscanf_s

Ordinal	`155`
Address	`0x483580`

vprintf

Ordinal	`156`
Address	`0x4835d0`

vprintf_s

Ordinal	`157`
Address	`0x483620`

vscanf

Ordinal	`158`
Address	`0x483670`

vscanf_s

Ordinal	`159`
Address	`0x4836c0`

vsnprintf

Ordinal	`160`
Address	`0x13660`

vsnprintf_s

Ordinal	`161`
Address	`0x481b30`

vsprintf

Ordinal	`162`
Address	`0x483710`

vsprintf_s

Ordinal	`163`
Address	`0x483770`

vsscanf

Ordinal	`164`
Address	`0x4837c0`

vsscanf_s

Ordinal	`165`
Address	`0x96fe0`

vswprintf

Ordinal	`166`
Address	`0x481f50`

vswprintf_s

Ordinal	`167`
Address	`0x483810`

vswscanf

Ordinal	`168`
Address	`0x483860`

vswscanf_s

Ordinal	`169`
Address	`0x4838b0`

vwprintf

Ordinal	`170`
Address	`0x483910`

vwprintf_s

Ordinal	`171`
Address	`0x483960`

vwscanf

Ordinal	`172`
Address	`0x4839b0`

vwscanf_s

Ordinal	`173`
Address	`0x483a00`

wprintf

Ordinal	`174`
Address	`0x483a50`

wprintf_s

Ordinal	`175`
Address	`0x483ab0`

wscanf

Ordinal	`176`
Address	`0x483b10`

wscanf_s

Ordinal	`177`
Address	`0x483b60`

201

Type	`RT_RCDATA`
Language	English - United States
Codepage	UNKNOWN
Size	`0xb1fc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.33418`
MD5	`f3efd61e5afc3f8869bdd50866d54438 🔍`
SHA1	`d32b9a70a275e192b45a0326e6e51532ce24ab9e 🔍`
SHA256	`ad12c6164215405befe1f8fa7f4f0d741e313f91d93caf567d9cc9755b078ba9 🔍`
SHA3	`50ae3ee60e641b5112512180642f8793979bbd067f293e7d176399b1ffd8378d 🔍`

2

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x17d`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.91161`
MD5	`1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍`
SHA1	`4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍`
SHA256	`4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍`
SHA3	`4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍`

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2026-Oct-25 05:35:06
Version	`0.0`
SizeofData	`77`
AddressOfRawData	`0x8b1ef0`
PointerToRawData	`0x8b08f0`
Referenced File	E:\Projects\neverlose-v2\bin\x64\Release\neverlose.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2026-Oct-25 05:35:06
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x8b1f40`
PointerToRawData	`0x8b0940`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2026-Oct-25 05:35:06
Version	`0.0`
SizeofData	`1044`
AddressOfRawData	`0x8b1f54`
PointerToRawData	`0x8b0954`

IMAGE_DEBUG_TYPE_ILTCG

Characteristics	`0`
TimeDateStamp	2026-Oct-25 05:35:06
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

StartAddressOfRawData	`0x1808b23c0`
EndAddressOfRawData	`0x1808b23e8`
AddressOfIndex	`0x180c9f468`
AddressOfCallbacks	`0x18056c5e8`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0x140`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x180919500`

RICH Header

XOR Key	`0xa6323cd7`
Unmarked objects	`0`
C++ objects (33145)	`194`
ASM objects (33145)	`35`
Imports (VS2008 SP1 build 30729)	`2`
C objects (35721)	`16`
ASM objects (35721)	`12`
C++ objects (35721)	`99`
C objects (33145)	`85`
Unmarked objects (#2)	`1`
C objects (36260)	`61`
Imports (33145)	`23`
Total imports	`285`
C++ objects (LTCG) (36256)	`215`
Exports (36256)	`1`
Resource objects (36256)	`1`
151	`1`
Linker (36256)	`1`

Errors

[*] Warning: Yara callback received an unhandled message (6).

Leave a comment

No comments yet.