Manalyze report for 2619cd68d18067336683bd42523783ebc04e5370f7782e9d2c25db5e1a53b3df

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2080-Jan-26 05:35:45
Debug artifacts	E:\VSProjects\NMS_PauseBeGone\obj\Release\net48\win7-x86\NMS_PauseBeGone.pdb
CompanyName	kBlankii
FileDescription	NMS_PauseBeGone
FileVersion	`1.0.1`
InternalName	NMS_PauseBeGone.exe
LegalCopyright
OriginalFilename	NMS_PauseBeGone.exe
ProductName	NMS_PauseBeGone
ProductVersion	`1.0.0`
Assembly Version	1.0.1.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Info	Interesting strings found in the binary:	`Contains domain names: http://schemas.microsoft.com http://schemas.microsoft.com/expression/blend/2008 http://schemas.microsoft.com/winfx/2006/xaml http://schemas.microsoft.com/winfx/2006/xaml/presentation http://schemas.openxmlformats.org http://schemas.openxmlformats.org/markup-compatibility/2006 microsoft.com openxmlformats.org schemas.microsoft.com schemas.openxmlformats.org`
Suspicious	The PE is possibly a dropper.	`Resources amount for 90.1228% of the executable.`
Safe	VirusTotal score: 0/69 (Scanned on 2026-08-15 04:57:24)	`All the AVs think this file is safe.`

Hashes

MD5	`a82aeaffbec5f02d9a0db83f4c07bbba` 🔍
SHA1	`f33d306b98dae868d10df3aec248da02f5d0aee0` 🔍
SHA256	`2619cd68d18067336683bd42523783ebc04e5370f7782e9d2c25db5e1a53b3df` 🔍
SHA3	`c4a3523d55dbd06dae4431f1bcb674967e308fad7e066c95d0c83de63617dbc8` 🔍
SSDeep	`768:zmkpIgPT2SnyJWhld1aw3jT3qZZhLjinArz1W:zt3KSnyU7d1aw/3qLhLjdW` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2080-Jan-26 05:35:45
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x2600`
SizeOfInitializedData	`0x19800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000044FE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x6000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x22000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`37aef2d52ff59733ecba3df8686343ec 🔍`
SHA1	`dec1923a1b0f4ad3ab3ffed13eb73d8fade893da 🔍`
SHA256	`dc6abf240bd98e79721c257a1c1f9629128529944b8fe4f5355d7d65504771c6 🔍`
SHA3	`c137db6b8cef162567f748a4193769dcc56f68b8cb67533f73f0a58700123a49 🔍`
VirtualSize	`0x2504`
VirtualAddress	`0x2000`
SizeOfRawData	`0x2600`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.70456`

.rsrc

MD5	`725acc28148d274dabde97df57494d83 🔍`
SHA1	`0eab80c0a4cee875f3469d36f901c0af009387ce 🔍`
SHA256	`e2367ffe8f8ff3b9e19fa1297b99b320b542f23f60c07341c4d3adb94a4bbffe 🔍`
SHA3	`e48233d13abb46150199bcb12e1144c0ace0ede6a4e3c77a88718a1e8e2d95ff 🔍`
VirtualSize	`0x195e8`
VirtualAddress	`0x6000`
SizeOfRawData	`0x19600`
PointerToRawData	`0x2800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.64817`

.reloc

MD5	`23fec5dc17c17e07711eb2b1ed47841b 🔍`
SHA1	`5dae906e098d591e214c8a1c24b95c67a67dd966 🔍`
SHA256	`054f425418db9c313ad9735149fbf9b25ef5de37aad422fd7b76e058e905ee84 🔍`
SHA3	`d6eb4bb6d119fa32dd0aed9da61a291ffc675a243a976947ed3188423a0d1d1d 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x20000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1be00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0611629`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x10828`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.02824`
MD5	`c6f882f8e00e3b4181446bcbf701101a 🔍`
SHA1	`5abb907dcfa9dd767fc4ddb3e091c45db1363ba7 🔍`
SHA256	`1c81ae84386b9099275f510cf2997e35e3a55f69b9abfa945c2d65d1787c5e05 🔍`
SHA3	`42bfed00b405040dc06eaa1856f496c721d140c1a1fb76b6401f350f93fddb28 🔍`

2

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x4228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.89537`
MD5	`376424ed0304857d7280da34b78cda00 🔍`
SHA1	`a68ef7a73be4eef8c15ab6005981139afcb48a6a 🔍`
SHA256	`9ea804c24a8b1fc52bd039788d69f1a70ee51c344008119cf98d55de29b01c5e 🔍`
SHA3	`62e977f28d76ed5ed4beed7cb5210bf812e28240eb459b3078f22442da0bc356 🔍`

3

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.20746`
MD5	`e0a244f93fb5839ca3eaabdf63f54235 🔍`
SHA1	`c1a6193d81fc0f8171bdedb2666f353dc60a48a8 🔍`
SHA256	`90dcd76d2438e8e01077c2338e951b77ad7d9933f1e9703b9342068057e2afe2 🔍`
SHA3	`4be0d02ca27e9679fba991c28bfac71b4d767f784d45234c89ed84b7bc4e71e9 🔍`

4

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.99352`
MD5	`087747f45a2c3552a1bd05dae53e1eb7 🔍`
SHA1	`dd9de44348cf1a4278b9d0a8ecebff68faac4577 🔍`
SHA256	`d1b24fe765629a6c4205a55830d2cc37274061f090168906fecf88be57a4090d 🔍`
SHA3	`26d1d0534d18109e95eb54eda25de8235f8d0a81f63e7918c1ae361740f3dfd4 🔍`

5

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x988`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.56763`
MD5	`345545434e3c697eec061a677864e5cd 🔍`
SHA1	`629f0c5d571489c032be49f00d3e8a11759b7a6f 🔍`
SHA256	`2d693295c66c63640eba05b0f67c6688d840f24e17d1a4ad678e3ce10b01e98f 🔍`
SHA3	`11984e595a16efb79774b4cc4629d674e05f9e043994fbf24e16d8a6cc5b54af 🔍`

6

Type	`RT_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.19589`
MD5	`f11c9f0d1ed7c563513d7efc86c46a31 🔍`
SHA1	`844a61e31afac87088932a8bfbe5cecb6391810e 🔍`
SHA256	`d88dd15bde2555663f7306541aae45b487e18af5f6fdd0fac4eea8210f236de3 🔍`
SHA3	`513f5c98442067c754bb83717435e98fb0546fc81567de9366a774ba504cd2a0 🔍`

32512

Type	`RT_GROUP_ICON`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x5a`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.93166`
Detected Filetype	Icon file
MD5	`dbd79b4a81056b7c1989bf72374f0df8 🔍`
SHA1	`abdf3214f13178a5cfce8fc3cc86be060da1241c 🔍`
SHA256	`773b28fc21f6ffd62253114684836150068215fbe37c4425a6e282e70a167e10 🔍`
SHA3	`62e4d9750dfb2a6c07470a6facaaedf83c8e9a465029793402373b047e424f45 🔍`

1 (#2)

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2ec`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.31408`
MD5	`92242e5afd69857a2924ed38fc6a285f 🔍`
SHA1	`0618a2f821c3f7b8ebbaab5fdb30a00d26c37a32 🔍`
SHA256	`c3a59aa045cc5691f1c35f734a0f195e2f180bb236b9707574a06aa5beaedeee 🔍`
SHA3	`e72b0ea12836d6d1fcfc75da774a1b27b49711df8fb83e6897cdd3a464a9f2e1 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9 🔍`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734 🔍`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.1.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
CompanyName	kBlankii
FileDescription	NMS_PauseBeGone
FileVersion (#2)	1.0.1
InternalName	NMS_PauseBeGone.exe
LegalCopyright
OriginalFilename	NMS_PauseBeGone.exe
ProductName	NMS_PauseBeGone
ProductVersion (#2)	1.0.0
Assembly Version	1.0.1.0

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2071-Aug-05 00:53:28
Version	`256.20557`
SizeofData	`101`
AddressOfRawData	`0x4420`
PointerToRawData	`0x2620`
Referenced File	E:\VSProjects\NMS_PauseBeGone\obj\Release\net48\win7-x86\NMS_PauseBeGone.pdb

UNKNOWN

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`1.0`
SizeofData	`39`
AddressOfRawData	`0x4485`
PointerToRawData	`0x2685`

UNKNOWN (#2)

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.