Manalyze report for ce5b885bf9e115e9345fa1970fd6798a

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2021-Dec-03 10:14:42
Comments
CompanyName	Microsoft
FileDescription	Rpg App
FileVersion	`10.0.0.19`
InternalName	ApplicationStateDispositi.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
LegalTrademarks
OriginalFilename	ApplicationStateDispositi.exe
ProductName	Rpg App
ProductVersion	`10.0.0.19`
Assembly Version	10.0.0.19

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Info	Interesting strings found in the binary:	`Contains domain names: http://tempuri.org http://www.w3.org http://www.w3.org/2001/XMLSchema tempuri.org www.w3.org`
Info	No VirusTotal score.	`A scan of the file is currently queued.`

Hashes

MD5	`ce5b885bf9e115e9345fa1970fd6798a`
SHA1	`64873f68ed9c364302cfcc6654ef37d2523ab96b`
SHA256	`3c2a4bc4dd6ebfc40c23c755d5bafd48c41a74400c3811a02c3b5ece7962b4d8`
SHA3	`c13cf63995e288e691d9d21c2bfec47c58dbb63642d8562c0b1be59e3da36d21`
SSDeep	`6144:JglU3DCTxHrpx6dckb9lSr0KRba+HDAZHoN+DMMgzmWEY1Hi7YKpWLJjF:JgzxLX6dckb9alwC4s+daxT`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2021-Dec-03 10:14:42
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x6e000`
SizeOfInitializedData	`0xa00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0006FFCE (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x70000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x74000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`97509ad0c46b0eebed814faf2063d78d`
SHA1	`6feac62e4250b26a111e6c27b4670ad24f2d6ed1`
SHA256	`1f13e970b171aa9d367a6e2c97d832af06a3f7d9f75f167e27bf57335b634b7a`
SHA3	`5bad320f3f5cfcfbb9901f71914c3b3d22363ecf54e0942473cd0626f5a34f8f`
VirtualSize	`0x6dfd4`
VirtualAddress	`0x2000`
SizeOfRawData	`0x6e000`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`7.76166`

.rsrc

MD5	`308a8b29ff2c5f81fcf83b9cbe61f8ce`
SHA1	`2d8d00d88d86e6471c2fcc57e34c5598900f9dff`
SHA256	`23924c0e8b4fb3d6740d58319aa07665810a6b8975f56db47adac81f40a5bccd`
SHA3	`9db8e6c0f38635bec9f9b2efe5e197f63eb4bcfb7ab76eaf3597bbbfe9868ff3`
VirtualSize	`0x638`
VirtualAddress	`0x70000`
SizeOfRawData	`0x800`
PointerToRawData	`0x6e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.49227`

.reloc

MD5	`5c3b254946b4a3e67b73ed14cf7b78c5`
SHA1	`30b44b700b8c336d8a676b0e69374457664ada23`
SHA256	`28628115e8ac6a7cd73f151c8d0923cc1558c708504a3586b08cab6dd31e3980`
SHA3	`ead62b2a6e4442f50add1003f254ddb2a05f2b1b824eb74d4805276ea37d3609`
VirtualSize	`0xc`
VirtualAddress	`0x72000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6ea00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.10191`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x3a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.34209`
MD5	`759b8d74b975e2f7623281d644a9600f`
SHA1	`a652a01f422ef5b5ee66e7274d764dc7739b4e4b`
SHA256	`20b44ed4af9d59a85593fe6048f5838f82b3485d3c5994cbbd6ff512d00caac9`
SHA3	`7ae0dc29a1da8ba7b570b8b90954bfb11404bd9902bb7fc9ff9d97f76a0a9f57`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	10.0.0.19
ProductVersion	10.0.0.19
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName	Microsoft
FileDescription	Rpg App
FileVersion (#2)	10.0.0.19
InternalName	ApplicationStateDispositi.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
LegalTrademarks
OriginalFilename	ApplicationStateDispositi.exe
ProductName	Rpg App
ProductVersion (#2)	10.0.0.19
Assembly Version	10.0.0.19

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

ce5b885bf9e115e9345fa1970fd6798a

Summary

Plugin Output

Hashes

DOS Header

PE Header

Image Optional Header

.text

.rsrc

.reloc

Imports

Delayed Imports

1

1 (#2)

Version Info

TLS Callbacks

Load Configuration

RICH Header

Errors