×
This file seems to be a .NET executable .
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Architecture
IMAGE_FILE_MACHINE_I386
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date
2057-Aug-18 10:59:29
Debug artifacts
C:\ES4tools\NegativeParts\1.4.4.0\NegativeParts\obj\Debug\NegativeParts.pdb
Comments
CompanyName
FileDescription
NegativeParts
FileVersion
1.4.4
InternalName
NegativeParts.exe
LegalCopyright
Copyright © 2022
LegalTrademarks
OriginalFilename
NegativeParts.exe
ProductName
NegativeParts
ProductVersion
1.4.4
Assembly Version
1.4.4.0
MD5
a891f363a729481528168291b99b8f54
SHA1
74e0121cecd62a0498956f776961f2aa94cf5178
SHA256
68a10268e2104be2c835d5f4accc83f92ba91cf82ae67672ace74e7cd2df1157
SHA3
ab4e681506a41d2af8eb841e5f2167785cd6e7cba070988ed5c3b71b36148cf5
SSDeep
49152:HtxKEwkrPv1QdTp3Nw0um+t5kpFQ/Tn7gPnGBRgeDztoXgyltfjl4IP41DWVH9g:Htx1d0w0F+epy/T1WwhxNOn
Imports Hash
f34d5f2d4577ed6d9ceec516c1f5a744
e_magic
MZ
e_cblp
0x90
e_cp
0x3
e_crlc
0
e_cparhdr
0x4
e_minalloc
0
e_maxalloc
0xffff
e_ss
0
e_sp
0xb8
e_csum
0
e_ip
0
e_cs
0
e_ovno
0
e_oemid
0
e_oeminfo
0
e_lfanew
0x80
Signature
PE
Machine
IMAGE_FILE_MACHINE_I386
NumberofSections
3
TimeDateStamp
2057-Aug-18 10:59:29
PointerToSymbolTable
0
NumberOfSymbols
0
SizeOfOptionalHeader
0xe0
Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Magic
PE32
LinkerVersion
48.0
SizeOfCode
0xa27000
SizeOfInitializedData
0x43400
SizeOfUninitializedData
0
AddressOfEntryPoint
0x00A28F22 (Section: .text)
BaseOfCode
0x2000
BaseOfData
0xa2a000
ImageBase
0x400000
SectionAlignment
0x2000
FileAlignment
0x200
OperatingSystemVersion
4.0
ImageVersion
0.0
SubsystemVersion
6.0
Win32VersionValue
0
SizeOfImage
0xa70000
SizeOfHeaders
0x200
Checksum
0
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve
0x100000
SizeofStackCommit
0x1000
SizeofHeapReserve
0x100000
SizeofHeapCommit
0x1000
LoaderFlags
0
NumberOfRvaAndSizes
16
MD5
49be5f640f58921ee040d7a1cecebfcd
SHA1
1da81db89ec50e595a8ec397a19fa1a41e9d93ed
SHA256
11daeb11015e5e5065a688b55b71f761561853f5efeccb18966a4993a546dc5d
SHA3
5a25cca04ebc331754e4dc982a5f0823f1db3bc5c87369ca36d836c822187b37
VirtualSize
0xa26f28
VirtualAddress
0x2000
SizeOfRawData
0xa27000
PointerToRawData
0x200
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy
5.8317
MD5
c9c0bf36349fc6ae9a96645f5a282ca6
SHA1
440e0b89d34b1dd7d2900a00f9c4278bc503919f
SHA256
9e4b2e5d9a8872d59fa7683e6e8fe45dd40080e80ebbe22d551fd55db48b73d3
SHA3
cc7280c36081e1bc24cb191425a76cf909f466e42982f39bcc9ffc9c255972a6
VirtualSize
0x430a0
VirtualAddress
0xa2a000
SizeOfRawData
0x43200
PointerToRawData
0xa27200
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy
2.8769
MD5
c528d89b92102665cfc70b389fc732f4
SHA1
da48b8adb9eafac2e8263ba4d3be8fb656dbf0ca
SHA256
7be955343119027df3536fa803c202e8a9168906aa60646368bb1441eb77468b
SHA3
74a1ab7c5b3f7f8b742503813351a2441b87be58ebaabdca6df0dc26f20c942b
VirtualSize
0xc
VirtualAddress
0xa6e000
SizeOfRawData
0x200
PointerToRawData
0xa6a400
PointerToRelocations
0
PointerToLineNumbers
0
NumberOfLineNumbers
0
NumberOfRelocations
0
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy
0.10191
Type
RT_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x42028
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
2.77956
MD5
16c07ba5e5d25910be1a928791149a88
SHA1
c7420d9e8c52eeb635762dc75a7c185846ef810b
SHA256
8cf062858bcd88dda865b50b94f885bcb5786b1ad0db495eb7180ace76403279
SHA3
912f399ed07841cdc5559d19b8f841d9dcee2b3ab9f69d855ad042a5af42d517
Type
RT_GROUP_ICON
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x14
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
1.67095
Detected Filetype
Icon file
MD5
464cb94db3a2622922a9562865009ae8
SHA1
dbe17c767d942f219df59f9eae77b213c15eab70
SHA256
8affd1fa69a6c5a5b54e504d72d4e9a0eba9b7d702a445ea1399a5978794719a
SHA3
3e0e32110c6c0f3323eeeb5e4a6cbb7a8db52ab14e0f065384fb4eedac4fbcda
Type
RT_VERSION
Language
UNKNOWN
Codepage
UNKNOWN
Size
0x334
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
3.30071
MD5
35a3cb68df04e2809379601b4d5a18af
SHA1
82a59c83a5c93a449a491e5d8029c0c3c962ff6a
SHA256
b2ebd749400a856956b8cb3e85df5079501694896442b0837bd727eae9993011
SHA3
79b2c2bb92eadaf47ce2a4f2a19632d1266d37be0440debc8939d578f27a83d1
Type
RT_MANIFEST
Language
UNKNOWN
Codepage
UNKNOWN
Size
0xbfb
TimeDateStamp
1980-Jan-01 00:00:00
Entropy
4.96159
MD5
beda8c0a74772607d5e720a784c48d37
SHA1
8f6c2d82062dd8356c4e1c4003432a510873da79
SHA256
923648a35590e074fcd5a3c63f6f14f220e87d37e0f66ee7a2471086fa8cbc8e
SHA3
52e4b7b870a109a4ea0c3fa76796295609b7cd4463d7bba9041acdcf58f95101
Signature
0xfeef04bd
StructVersion
0x10000
FileVersion
1.4.4.0
ProductVersion
1.4.4.0
FileFlags
(EMPTY)
FileOs
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType
VFT_APP
Language
UNKNOWN
Comments
CompanyName
FileDescription
NegativeParts
FileVersion (#2)
1.4.4
InternalName
NegativeParts.exe
LegalCopyright
Copyright © 2022
LegalTrademarks
OriginalFilename
NegativeParts.exe
ProductName
NegativeParts
ProductVersion (#2)
1.4.4
Assembly Version
1.4.4.0
Characteristics
0
TimeDateStamp
2049-Dec-29 22:38:37
Version
0.0
SizeofData
100
AddressOfRawData
0xa28e6c
PointerToRawData
0xa2706c
Referenced File
C:\ES4tools\NegativeParts\1.4.4.0\NegativeParts\obj\Debug\NegativeParts.pdb
Characteristics
0
TimeDateStamp
1970-Jan-01 00:00:00
Version
0.0
SizeofData
0
AddressOfRawData
0
PointerToRawData
0