filenameRobocopy.exe
size128000 (0x1f400)
md50a551ccdef9d6f99a008b5b075354650
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307292
132307295
1473072919
10224
1313072919
1383072913
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4ce794c7
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x1cc00
SizeOfInitializedData0x64800
SizeOfUninitializedData0
AddressOfEntryPoint0x1844c
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x85000
SizeOfHeaders0x400
CheckSum0x2297c
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1ca040x1cc00R-X CODE
.data0x1e0000x626f80x400RW- IDATA
.pdata0x810000x11a00x1200R-- IDATA
.rsrc0x830000x6a00x800R-- IDATA
.reloc0x840000x54c0x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1c6480xa0
RESOURCE0x830000x6a0
EXCEPTION0x810000x11a0
SECURITY00
BASERELOC0x840000xf8
DEBUG0x17700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2b80xa0
IAT0x10000x688
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#17160
MANIFEST#15310
module_namehintordfunction_name
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll557ReadEncryptedFileRaw
ADVAPI32.dll216DecryptFileW
ADVAPI32.dll327GetSecurityDescriptorControl
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll322GetNamedSecurityInfoW
ADVAPI32.dll249EncryptFileW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll85CloseEncryptedFileRaw
ADVAPI32.dll804WriteEncryptedFileRaw
ADVAPI32.dll500OpenEncryptedFileRawW
KERNEL32.dll512GetFullPathNameW
KERNEL32.dll1228SystemTimeToFileTime
KERNEL32.dll299FileTimeToSystemTime
KERNEL32.dll100CompareStringW
KERNEL32.dll1378lstrlenW
KERNEL32.dll518GetLastError
KERNEL32.dll682GetVersion
KERNEL32.dll637GetSystemTime
KERNEL32.dll291ExpandEnvironmentStringsW
KERNEL32.dll841LocalFileTimeToFileTime
KERNEL32.dll91CloseThreadpoolWork
KERNEL32.dll311FindFirstChangeNotificationW
KERNEL32.dll1238TlsGetValue
KERNEL32.dll1126SetErrorMode
KERNEL32.dll186CreateThreadpoolWork
KERNEL32.dll1210SetWaitableTimer
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll309FindCloseChangeNotification
KERNEL32.dll1127SetEvent
KERNEL32.dll1023ReleaseSRWLockExclusive
KERNEL32.dll1220SleepEx
KERNEL32.dll1290WaitForSingleObjectEx
KERNEL32.dll540GetModuleHandleW
KERNEL32.dll1194SetThreadUILanguage
KERNEL32.dll1143SetFileTime
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll1239TlsSetValue
KERNEL32.dll898OpenProcess
KERNEL32.dll181CreateThreadpool
KERNEL32.dll1217Sleep
KERNEL32.dll1196SetThreadpoolThreadMaximum
KERNEL32.dll495GetFileAttributesW
KERNEL32.dll438GetConsoleOutputCP
KERNEL32.dll1151SetLastError
KERNEL32.dll182CreateThreadpoolCleanupGroup
KERNEL32.dll87CloseThreadpoolCleanupGroupMembers
KERNEL32.dll753InitializeSRWLock
KERNEL32.dll519GetLocalTime
KERNEL32.dll903OpenThread
KERNEL32.dll133CreateEventW
KERNEL32.dll328FindNextChangeNotification
KERNEL32.dll1287WaitForMultipleObjects
KERNEL32.dll1224SubmitThreadpoolWork
KERNEL32.dll195CreateWaitableTimerW
KERNEL32.dll732HeapSetInformation
KERNEL32.dll938QueryPerformanceFrequency
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll1236TlsAlloc
KERNEL32.dll82CloseHandle
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll1313WideCharToMultiByte
KERNEL32.dll356FormatMessageW
KERNEL32.dll319FindFirstFileW
KERNEL32.dll96CompareFileTime
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll314FindFirstFileExW
KERNEL32.dll143CreateFileW
KERNEL32.dll1366lstrcmpW
KERNEL32.dll707GlobalFree
KERNEL32.dll308FindClose
KERNEL32.dll1030RemoveDirectoryW
KERNEL32.dll225DeviceIoControl
KERNEL32.dll331FindNextFileW
KERNEL32.dll497GetFileInformationByHandle
KERNEL32.dll1134SetFileAttributesW
KERNEL32.dll687GetVolumeInformationW
KERNEL32.dll114CopyFileExW
KERNEL32.dll1289WaitForSingleObject
KERNEL32.dll24BackupRead
KERNEL32.dll26BackupWrite
KERNEL32.dll1369lstrcmpiW
KERNEL32.dll503GetFileTime
KERNEL32.dll215DeleteFileW
KERNEL32.dll843LocalFree
KERNEL32.dll288ExitThread
KERNEL32.dll1190SetThreadPriority
KERNEL32.dll487GetExitCodeThread
KERNEL32.dll1046ResumeThread
KERNEL32.dll180CreateThread
KERNEL32.dll1199SetUnhandledExceptionFilter
KERNEL32.dll664GetTickCount
KERNEL32.dll638GetSystemTimeAsFileTime
KERNEL32.dll1227TerminateProcess
KERNEL32.dll453GetCurrentProcess
KERNEL32.dll1247UnhandledExceptionFilter
KERNEL32.dll1059RtlVirtualUnwind
KERNEL32.dll1052RtlLookupFunctionEntry
KERNEL32.dll1045RtlCaptureContext
KERNEL32.dll286ExitProcess
KERNEL32.dll723HeapAlloc
KERNEL32.dll727HeapFree
KERNEL32.dll590GetProcessHeap
KERNEL32.dll433GetConsoleMode
KERNEL32.dll735HeapValidate
KERNEL32.dll1328WriteConsoleW
KERNEL32.dll617GetStdHandle
KERNEL32.dll732HeapSize
KERNEL32.dll503GetFileType
KERNEL32.dll914PrivCopyFileExW
MFC42u.dll1264
MFC42u.dll1262
MFC42u.dll1259
MFC42u.dll1353
MFC42u.dll5933
MFC42u.dll4234
MFC42u.dll620
MFC42u.dll2629
MFC42u.dll2783
MFC42u.dll3830
MFC42u.dll1869
MFC42u.dll445
MFC42u.dll940
MFC42u.dll6886
MFC42u.dll6880
MFC42u.dll1483
MFC42u.dll6887
MFC42u.dll5949
MFC42u.dll1379
MFC42u.dll624
MFC42u.dll626
MFC42u.dll1126
MFC42u.dll1122
MFC42u.dll1287
MFC42u.dll4436
MFC42u.dll6050
MFC42u.dll4523
MFC42u.dll1040
msvcrt.dll364_initterm
msvcrt.dll1056exit
msvcrt.dll179_cexit
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll83__C_specific_handler
msvcrt.dll143__wgetmainargs
msvcrt.dll899_wcsnicmp
msvcrt.dll1140malloc
msvcrt.dll1082free
msvcrt.dll1048clock
msvcrt.dll1063fflush
msvcrt.dll1092fwprintf_s
msvcrt.dll984_wsetlocale
msvcrt.dll816_unlock
msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll1226swprintf_s
msvcrt.dll1060fclose
msvcrt.dll1234time
msvcrt.dll695_setmode
msvcrt.dll1080fputws
msvcrt.dll268_fileno
msvcrt.dll1053ctime
msvcrt.dll856_vsnwprintf
msvcrt.dll1075fprintf
msvcrt.dll1163printf
msvcrt.dll1068fgetws
msvcrt.dll1294wprintf
msvcrt.dll945_wfopen
msvcrt.dll115__iob_func
msvcrt.dll1091fwprintf
msvcrt.dll639_onexit
msvcrt.dll469_lock
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll128__set_app_type
msvcrt.dll34void * __ptr64 __cdecl operator new[](unsigned __int64)

??_U@YAPEAX_K@Z

msvcrt.dll109__dllonexit
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll36void __cdecl operator delete[](void * __ptr64)

??_V@YAXPEAX@Z

msvcrt.dll160_amsg_exit
msvcrt.dll87__CxxFrameHandler3
msvcrt.dll1156memset
msvcrt.dll324_get_osfhandle
msvcrt.dll246_errno
msvcrt.dll1152memcpy
USER32.dll510LoadStringW
WS2_32.dll116
ntdll.dll498NtSetInformationProcess
ntdll.dll512NtSetSecurityObject
ntdll.dll864RtlGetDaclSecurityDescriptor
ntdll.dll1045RtlNtStatusToDosError
ntdll.dll856RtlGetControlSecurityDescriptor
ntdll.dll895RtlGetSaclSecurityDescriptor
ntdll.dll421NtQuerySecurityObject
ntdll.dll1147RtlSetControlSecurityDescriptor

StringTable 040904b0

CompanyNameMicrosoft
FileDescriptionrobocopy
FileVersion5, 1, 10, 1027
InternalNamerobocopy
LegalCopyrightCopyright ⌐ 1995-2004
OriginalFilenamerobocopy.exe
ProductNameMicrosoft Robocopy
ProductVersionXP027

VS_FIXEDFILEINFO

FileVersion5.1.10.1027
ProductVersion5.1.0.0
StrucVersion0x10000
FileFlagsMask0x1f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0122416BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2b8