0d6bb687052b6816de9bdbcaae3d512d6cf2316d881cc27488886fd76e720ac6

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Aug-15 14:47:12
Detected languages English - United States
CompanyName yowls
FileDescription NL Loader (neverlose.cc UI recreation)
FileVersion 1.0.0.0
InternalName NL
LegalCopyright (c) 2026 yowls. MIT License.
OriginalFilename NL.exe
ProductName NL Loader
ProductVersion 1.0.0.0

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains another PE executable:
  • This program cannot be run in DOS mode.
 Miscellaneous malware strings:
  • virus
 Contains domain names:
  • acutedotcomb.cn
  • breveacutecomb.cn
  • brevegravecomb.cn
  • brevetildecomb.cn
  • circumflexacutecomb.cn
  • circumflexgravecomb.cn
  • circumflexhookcomb.cn
  • circumflextildecomb.cn
  • commaaccentright.cn
  • commaaccentrotate.cn
  • exljbris.com
  • fontawesome.com
  • github.com
  • google.com
  • http://scripts.sil.org
  • http://scripts.sil.org/OFLInterBlackInterBlackOpen
  • http://scripts.sil.org/OFLInterMediumInterMediumOpen
  • http://scripts.sil.org/OFLhttp
  • http://www.exljbris.com
  • http://www.google.com
  • http://www.google.com/get/noto/Monotype
  • http://www.monotype.com
  • http://www.monotype.com/studiohttp
  • http://www.styleseven.comFreeware
  • http://www.styleseven.comSmallest
  • http://www.w3.org
  • http://www.w3.org/2000/svg
  • https://discord.gg
  • https://docs-csgo.neverlose.cc
  • https://docs-csgo.neverlose.cc/
  • https://fontawesome.com
  • https://forum.neverlose.cc
  • https://forum.neverlose.cc/
  • https://github.com
  • https://openfontlicense.orgThis
  • https://openfontlicense.orghttp
  • https://openfontlicense.orghttps
  • https://rsms.me
  • https://t.me
  • koronisaccentleft.cn
  • macrondieresiscomb.cn
  • monotype.com
  • scripts.sil.org
  • tildecross.cn
  • tildemacroncomb.cn
  • tonos.top
  • uni02E5.cn
  • uni02E6.cn
  • uni02E7.cn
  • uni02E8.cn
  • uni02E9.cn
  • uni1DC4.cn
  • uni1DC6.cn
  • www.exljbris.com
  • www.google.com
  • www.monotype.com
  • www.w3.org
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses known Mersenne Twister constants
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • LoadLibraryExW
  • LoadLibraryW
  • GetProcAddress
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Code injection capabilities:
  • CreateRemoteThread
  • OpenProcess
  • VirtualAllocEx
  • WriteProcessMemory
 Can access the registry:
  • RegGetValueW
 Possibly launches other programs:
  • CreateProcessW
  • ShellExecuteW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Memory manipulation functions often used by packers:
  • VirtualAllocEx
  • VirtualProtect
 Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • Process32FirstW
  • Process32NextW
 Reads the contents of the clipboard:
  • GetClipboardData
Malicious VirusTotal score: 13/71 (Scanned on 2026-08-22 07:20:15) APEX: Malicious
Antiy-AVL: Trojan[PSW]/Win32.Convagent
Bkav: W32.Malware.FDDC67C6
Cylance: Unsafe
DeepInstinct: MALICIOUS
Elastic: malicious (high confidence)
Google: Detected
Microsoft: Trojan:Win32/Wacatac.B!ml
Rising: Trojan.Kryptik@AI.82 (RDML:5x2JYMD1Dn50VnU5TyfC3Q)
Sophos: Generic Reputation PUA (PUA)
Symantec: ML.Attribute.HighConfidence
Trapmine: suspicious.low.ml.score
Varist: W64/ABApplication.AXVR-6512

Hashes

MD5 bf6f297ac0c32065299c397cee6a834b 🔍
SHA1 3a8f42cf99a10420e924b0086252788d55613486 🔍
SHA256 0d6bb687052b6816de9bdbcaae3d512d6cf2316d881cc27488886fd76e720ac6 🔍
SHA3 97141a73399ddb16367181cecc5469fe5faade445777dd2632df5642e20b2b93 🔍
SSDeep 98304:44kJ5kAImHKAlB0bIxSuBXCITC7xg83j/gU:44GkAlHKpbIHCgoxLz/gU 🔍
Imports Hash be44f010ffc32bff6f4885e0f5304194 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x118

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Aug-15 14:47:12
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xca800
SizeOfInitializedData 0x722400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000009A4C4 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x7f1000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f6e95524a3201634a0e5a3b27e0c48b4 🔍
SHA1 09888f3c306ee756521b3ce42902813361019abc 🔍
SHA256 e2c6b91bade0aafcf53d023127b5b36813fb91acf57dae0347ab09ef32e88b65 🔍
SHA3 6e96ae8a67333e8f227c13a4cacf4ff19efd36416059966b2dce93eeef111502 🔍
VirtualSize 0xca6fc
VirtualAddress 0x1000
SizeOfRawData 0xca800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.53075

.rdata

MD5 e1c6156fa636f6dc3050913d3386541e 🔍
SHA1 2edb6ff059f3a2e8f8465ad97bfe27b97d34f264 🔍
SHA256 50938cc8d3520f9f871ace4ec49e4f791303f7a3f3c52d14aaeea22722d70a60 🔍
SHA3 b15d4a34bcba7915df5d35b47e80fc2b196f1b8a83c48690e121c4b5a9ebc390 🔍
VirtualSize 0x70f9d4
VirtualAddress 0xcc000
SizeOfRawData 0x70fa00
PointerToRawData 0xcac00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.72143

.data

MD5 026f5ced8887e2786aa66af4239d1892 🔍
SHA1 83f021faadd47cae64a8b6db42b4797038d82287 🔍
SHA256 b4dcd5e365875735c976b8d87840357b5acc3ebfecd485de4efcb55dbdc891ba 🔍
SHA3 91a9d694042a01495ab104c7cbbe4fe41f816800a689e1c5acbac085024539c9 🔍
VirtualSize 0x3654
VirtualAddress 0x7dc000
SizeOfRawData 0x1c00
PointerToRawData 0x7da600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.45753

.pdata

MD5 81648ff31db3fb601786988205b364f8 🔍
SHA1 625da8b80edcf708b99b6006df2a50fbee484e1a 🔍
SHA256 c6abfefc4fc72c3f14922e08fad527778fe7fab4a4b20eb7a17bd0f3f82ea24b 🔍
SHA3 5ca0f7d97e7fbd2733cab49f664f7f4ddfe8077b8f23c270de320b3b41ad3fe6 🔍
VirtualSize 0x90fc
VirtualAddress 0x7e0000
SizeOfRawData 0x9200
PointerToRawData 0x7dc200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.04346

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x7ea000
SizeOfRawData 0x200
PointerToRawData 0x7e5400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 fcd3dc1c904df62e3ee7650fd537e75e 🔍
SHA1 993137fba2147c20aa2eb9b72c7753af2cfb98c7 🔍
SHA256 43de578d3c410d0f53e84cbc364d6b1ffeee1b7f19645d45c7d20892815fb3dc 🔍
SHA3 885bbbe1c8d7a5fd74348fed0f10906da00e303701067547ec8a65dd68b05589 🔍
VirtualSize 0x4e30
VirtualAddress 0x7eb000
SizeOfRawData 0x5000
PointerToRawData 0x7e5600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.62605

.reloc

MD5 e19aabd94993c603e5c6ff0ca5c72c2e 🔍
SHA1 6792c9fa5948a74a1074a1e90797103ca758f732 🔍
SHA256 f90490e1c42cc5734e861d766ceba0532ca8152d11274908113c34c77d4b5834 🔍
SHA3 f030111d8ae194727c1d677feeaf5ffb575e03dbd1433cc112bcb7d14fe742a3 🔍
VirtualSize 0xcb0
VirtualAddress 0x7f0000
SizeOfRawData 0xe00
PointerToRawData 0x7ea600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.21136

Imports

d3d11.dll D3D11CreateDeviceAndSwapChain
KERNEL32.dll QueryPerformanceFrequency
GetTickCount64
DeleteFileW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcessId
GetExitCodeProcess
CreateRemoteThread
GetExitCodeThread
CreateProcessW
OpenProcess
GetTickCount
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
OutputDebugStringA
LocalFree
FormatMessageW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LoadLibraryA
GetLocaleInfoA
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
QueryPerformanceCounter
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
ReadFile
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
FreeLibrary
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
FindNextFileW
GetCurrentThreadId
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
RtlUnwind
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
FormatMessageA
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
USER32.dll LoadCursorA
SetProcessDPIAware
ScreenToClient
ClientToScreen
SetCursor
SetCursorPos
GetClientRect
GetForegroundWindow
IsWindowUnicode
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
IsIconic
ShowWindow
WaitMessage
GetMonitorInfoW
MonitorFromPoint
TranslateMessage
SetWindowLongPtrW
GetWindowLongPtrW
GetCursorPos
GetWindowRect
SetWindowRgn
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
SetWindowPos
SetLayeredWindowAttributes
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
PeekMessageW
DispatchMessageW
MessageBoxW
GDI32.dll DeleteObject
CreateRoundRectRgn
SHELL32.dll SHGetKnownFolderPath
ShellExecuteW
ole32.dll CoTaskMemFree
ADVAPI32.dll RegGetValueW
IMM32.dll ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x216
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.54404
Detected Filetype PNG graphic file
MD5 a934f48d6a3d4e13861e79cef9ca7706 🔍
SHA1 777d528a3d8f23ae74c81ba3fb25a558b9924df5 🔍
SHA256 4498fa16abff77a852592d1d0ba0b535d2c9efb3e3f2c54513b3797e1e277a57 🔍
SHA3 1cdac340c61acf2c7fa5f00b4c581418610c26329b8447449d4f7aeae7773c28 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x2eb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.6851
Detected Filetype PNG graphic file
MD5 348afa28fd87c390ab476e2301274687 🔍
SHA1 07ff9b2dce3c161ae4e48a0398ba0d5819f0168f 🔍
SHA256 15548546e52bd302536591fcb2b9a5b89494a59b308f68e279e26d56c28def84 🔍
SHA3 0e7c700445413c41658f1e11c8e8cd246a941bf1eda48b4682beae8cef9c0e63 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3d2
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.75045
Detected Filetype PNG graphic file
MD5 03d12d8f2d30f7bed714621443e8ae70 🔍
SHA1 d7adf0dc126409c7a4be699e9bfd7734223f6adc 🔍
SHA256 ba71038219ba0d2aaee82e29089a22a48313be203271db19ca95b26bc91cab89 🔍
SHA3 acee62910705cf226c143813ad186c829284b2ad4f2ba46f8afdc96640c8fbf9 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x5d8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86443
Detected Filetype PNG graphic file
MD5 6d3e9975af86f6143467b693799888b0 🔍
SHA1 130200769b9fb11ff5a495ac06a763c94f287d82 🔍
SHA256 60e0799a6dcc6b68f196bb4846eabebe0c1be490c4b6410db3aee1aaeb18cb84 🔍
SHA3 eb654f93eedf3c854f8bccb862eef106e478ceb32ec119e2d114933feb945c49 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x7cb
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.8783
Detected Filetype PNG graphic file
MD5 d935c41b2689a30e9cc96d9aae9349ca 🔍
SHA1 fede5a561ee020256e10966c9cbb2e048df2d1b1 🔍
SHA256 5a9dc4a616c10981994d313df1f0e66a1b8317d0cd8a398f8b677ecd6da97686 🔍
SHA3 985d508745a6324f882180223f41950fd1c566cad60767ed998ebe819069c114 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xfec
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.90763
Detected Filetype PNG graphic file
MD5 0638d50f4232cb3c6c62fc3267137a90 🔍
SHA1 b4f11f80f2ed08c1329439ab750ba88b2a4f166a 🔍
SHA256 3390b718ba68403564cc5e49a0ed0f322f069c2dbb7ebebf962804c0f34707e9 🔍
SHA3 c719fc3674051fd74081e7de2c47a4f9930160fddcf9aeb3227e3f3e33c09395 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1901
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86385
Detected Filetype PNG graphic file
MD5 39f9d8f82bc6fbc19ecc8f16bd80e9e6 🔍
SHA1 6e08332dbe6eeb2334a360ef4b07f2347c06b06a 🔍
SHA256 f3e5cc5a74fa35846a80a4cf844f45bd6bfad63022e796cae7318d0b88666beb 🔍
SHA3 02a813cc99fcab32a6a0c4123e1f8bb1020db1b12af42afe9c1ad56c15bc16f1 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.8232
Detected Filetype Icon file
MD5 0205fb0b054742e198befa6966853984 🔍
SHA1 cb7367521d1b93834a2c12cbec67a0795b26b593 🔍
SHA256 12b8cdbe8a940b9fccd81431d87f292e379b681917a0d65c521a24d81b9870fa 🔍
SHA3 c103713179a1c635cd049b476cef4faa0393015eedce1ac19eb039e6dc22a7d4 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x2d8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.34907
MD5 f745896a4e12ebbaea368ae15e8b196a 🔍
SHA1 6d5ea82e9b8ec589ee98ce313397fa051ffbe093 🔍
SHA256 e4bc01bdee19e3506b492cf0cc58bca6d502e518e7c876c6f573ab0e9e80d9c5 🔍
SHA3 235a9ef041a33bbe25b993f4fba544d9a072c8fb45b81a46fbb2ecd90c6e6417 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x91a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.1575
MD5 22daf0b634a5d4e4f3941dc2d803160f 🔍
SHA1 f50dba006edbc9afa418b0f34280ece431020c8b 🔍
SHA256 3a11313789480aeaeefe8fad17e26af59826cc6d0c637269d6867755522c874e 🔍
SHA3 30c35c7f0d3e1c826d8fb9460bfb1214a09dae3a4c97992808921d1f69c21ce6 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName yowls
FileDescription NL Loader (neverlose.cc UI recreation)
FileVersion (#2) 1.0.0.0
InternalName NL
LegalCopyright (c) 2026 yowls. MIT License.
OriginalFilename NL.exe
ProductName NL Loader
ProductVersion (#2) 1.0.0.0
Resource LangID English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Aug-15 14:47:12
Version 0.0
SizeofData 1032
AddressOfRawData 0x7cb39c
PointerToRawData 0x7c9f9c

TLS Callbacks

StartAddressOfRawData 0x1407cb7f0
EndAddressOfRawData 0x1407cb81c
AddressOfIndex 0x1407de390
AddressOfCallbacks 0x1400cc708
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_8BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1407dc200

RICH Header

XOR Key 0xf7dc38c9
Unmarked objects 0
C++ objects (33145) 184
C objects (33145) 36
ASM objects (33145) 24
ASM objects (35207) 10
C objects (35207) 17
C++ objects (35207) 96
C objects (CVTCIL) (33145) 1
Imports (33145) 19
Total imports 240
C++ objects (35228) 25
Resource objects (35228) 1
151 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.