d817d6435240a899de83b2d837ae99bb387c4774fc6df43ceb4b0a201691fd7c

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Feb-26 07:04:04
Debug artifacts C:\Orikan_Projects\PayStay.NET\Utility\PayStayLogAnalysis\PayStayLogAnalysis\obj\Debug\PayStayLogAnalysis.pdb
Comments
CompanyName
FileDescription PayStayLogAnalysis
FileVersion 1.0.0.0
InternalName PayStayLogAnalysis.exe
LegalCopyright Copyright © 2015
LegalTrademarks
OriginalFilename PayStayLogAnalysis.exe
ProductName PayStayLogAnalysis
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): .NET executable -> Microsoft
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 721e1a3ea557f1c0ed28d379f74f5925 🔍
SHA1 cea409b2803c09c5394f1c99a5a42a929c9cd30f 🔍
SHA256 d817d6435240a899de83b2d837ae99bb387c4774fc6df43ceb4b0a201691fd7c 🔍
SHA3 db5f2a4d9d122bd43241a4ed52cd4f6b8e430cbe827619e99c90026bd37b7a75 🔍
SSDeep 1536:u64mhmWwypBK6lalVS+pL/lorENcRlcGH:u6VmWwypBValzpL/lorENsP 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-Feb-26 07:04:04
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0xda00
SizeOfInitializedData 0x800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000F9EE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x10000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x14000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 487991132de56ee616fdb7587f494d61 🔍
SHA1 160725ba08629433bf8a7576b5637f0d82239d72 🔍
SHA256 305c7bc45737f5273d66e905df0cba334f3c33f494dc816f499d76016048b802 🔍
SHA3 8145708496a04551b817afd5bc598082cf16ae4ff2bac059bbcc0a3f9a140c80 🔍
VirtualSize 0xd9f4
VirtualAddress 0x2000
SizeOfRawData 0xda00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.20888

.rsrc

MD5 909544b1dbd2297d2d60f2eb6cb52a1c 🔍
SHA1 abaa22334657d85e3d87f55dedc01e274a20c643 🔍
SHA256 755dd48124fed7dfb2ec3d555f98afbc02ac15be7c0cf35876e17ecdb99818f1 🔍
SHA3 eae1a1710b8ac1b8346de37e34c1577a4c3f4b6f21475f531155a252c0f954a7 🔍
VirtualSize 0x5fc
VirtualAddress 0x10000
SizeOfRawData 0x600
PointerToRawData 0xdc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.18422

.reloc

MD5 fbac3dad953066e50b5f81dcfa378058 🔍
SHA1 491871e3df7d9f7e619f82127bab0c291eeed501 🔍
SHA256 995556d489f97840dc817aa2a83c1019c4f9ea924d1b7969acbf4338734988b7 🔍
SHA3 a39f925055cb22a439b25770667329c99b400f1f39aab0f497e4f3795d18c2ea 🔍
VirtualSize 0xc
VirtualAddress 0x12000
SizeOfRawData 0x200
PointerToRawData 0xe200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0776332

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x36c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.25731
MD5 17a3f7ce391b5d5a959ef7d1ecb5517a 🔍
SHA1 2a54d059a0a01f4baf8571ef1fa2678128f7f127 🔍
SHA256 07bed2c2f0470c35454d36aa2764941a93603a55782c4998da0bc5fc9a488efc 🔍
SHA3 5b354b19c22721437d17aefd5d01b8f7188b9d631163c6fc70f49c15e115072a 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription PayStayLogAnalysis
FileVersion (#2) 1.0.0.0
InternalName PayStayLogAnalysis.exe
LegalCopyright Copyright © 2015
LegalTrademarks
OriginalFilename PayStayLogAnalysis.exe
ProductName PayStayLogAnalysis
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Feb-26 07:04:04
Version 0.0
SizeofData 284
AddressOfRawData 0xf880
PointerToRawData 0xda80
Referenced File C:\Orikan_Projects\PayStay.NET\Utility\PayStayLogAnalysis\PayStayLogAnalysis\obj\Debug\PayStayLogAnalysis.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.