filenameserver.exe
size102534 (0x19086)
md56a4a7fa07e6ad176f0f1ca3fb12d70ad
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
1197821
1272911
1180471
1472992
10804711
480472
10816812
93403511
10114
11816812
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x510e1a27
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x12000
SizeOfInitializedData0x6000
SizeOfUninitializedData0
AddressOfEntryPoint0x11f2a
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x19000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x115fa0x12000R-X CODE
.rdata0x130000x1c120x2000R-- IDATA
.data0x150000x2a7c0x3000RW- IDATA
.rsrc0x180000x10000x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x144780x8c
RESOURCE0x180000x65c
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x130000x180
Delay_IAT0x143800x40
CLR_Header00
typenamesizecp
VERSION#15960
MANIFEST#18720
module_namehintordfunction_name
KERNEL32.dll600LocalAlloc
KERNEL32.dll957lstrcatA
KERNEL32.dll653OutputDebugStringA
KERNEL32.dll489GetVersionExA
KERNEL32.dll604LocalFree
KERNEL32.dll789SetErrorMode
KERNEL32.dll369GetLastError
KERNEL32.dll679RaiseException
KERNEL32.dll932WriteFile
KERNEL32.dll419GetProcessHeap
KERNEL32.dll79CreateEventA
KERNEL32.dll854Sleep
KERNEL32.dll479GetTickCount
KERNEL32.dll102CreateProcessA
KERNEL32.dll795SetFilePointer
KERNEL32.dll693ReadFile
KERNEL32.dll52CloseHandle
KERNEL32.dll790SetEvent
KERNEL32.dll966lstrcpyA
KERNEL32.dll897VirtualAlloc
KERNEL32.dll899VirtualFree
KERNEL32.dll594LoadLibraryA
KERNEL32.dll706ReleaseMutex
KERNEL32.dll416GetProcAddress
KERNEL32.dll553InterlockedExchange
KERNEL32.dll248FreeLibrary
KERNEL32.dll439GetStartupInfoA
KERNEL32.dll383GetModuleHandleA
USER32.dll353GetThreadDesktop
ADVAPI32.dll491RegOpenKeyA
ADVAPI32.dll503RegQueryValueExA
ADVAPI32.dll478RegEnumKeyExA
ADVAPI32.dll29AllocateAndInitializeSid
ADVAPI32.dll247GetLengthSid
ADVAPI32.dll307InitializeAcl
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll308InitializeSecurityDescriptor
ADVAPI32.dll570SetSecurityDescriptorDacl
ADVAPI32.dll514RegSetKeySecurity
ADVAPI32.dll226FreeSid
ADVAPI32.dll465RegCreateKeyExA
ADVAPI32.dll516RegSetValueExA
ADVAPI32.dll459RegCloseKey
ADVAPI32.dll492RegOpenKeyExA
SHELL32.dll196SHGetSpecialFolderPathA
MSVCRT.dll663memcpy
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll65_CxxThrowException
MSVCRT.dll577ceil
MSVCRT.dll241_ftol
MSVCRT.dll702strlen
MSVCRT.dll709strstr
MSVCRT.dll665memset
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll662memcmp
MSVCRT.dll694strcat
MSVCRT.dll698strcpy
MSVCRT.dll707strrchr
MSVCRT.dll657malloc
MSVCRT.dll573atoi
MSVCRT.dll704strncmp
MSVCRT.dll705strncpy
MSVCRT.dll696strcmp
MSVCRT.dll606free
MSVCRT.dll695strchr
MSVCRT.dll200_errno
MSVCRT.dll739wcscpy
MSVCRT.dll202_except_handler3
MSVCRT.dll703strncat
MSVCRT.dll678rand
MSVCRT.dll166_beginthreadex
MSVCRT.dll576calloc
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll211_exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll585exit
MSVCRT.dll143_acmdln
MSVCRT.dll88__getmainargs
MSVCRT.dll271_initterm
MSVCRT.dll131__setusermatherr
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll183_controlfp
MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll664memmove
MSVCRT.dll453_strnicmp
NETAPI32.dll166NetLocalGroupAddMembers
NETAPI32.dll241NetUserAdd

StringTable 040904E4

CompanyNameYY Inc.
FileDescriptionYY
FileVersion5.4.0.2
LegalCopyrightCopyright © 2007-2012 YY Inc. All rights reserved.
ProductNameYY
ProductVersion5.4.0.2

VS_FIXEDFILEINFO

FileVersion5.4.0.2
ProductVersion5.4.0.2
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0102400EXE02/03/2013 08:04:55#
15c115HTM#
19000134BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 102534 bytes (101 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK