filenamebfsvc.exe
size71168 (0x11600)
md5317cd1ce327b6520bf4ee007bcd39e61
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307291
1323072916
1473072919
10229
1313072964
1373072921
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4ce79449
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0xfa00
SizeOfInitializedData0x1e00
SizeOfUninitializedData0
AddressOfEntryPoint0xa2bc
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.2
Reserved10
SizeOfImage0x15000
SizeOfHeaders0x400
CheckSum0x1e055
Subsystem3
DllCharacteristics0x8040
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xf93e0xfa00R-X CODE
.data0x110000xa880x600RW- IDATA
.pdata0x120000x5040x600R-- IDATA
.rsrc0x130000x8180xa00R-- IDATA
.reloc0x140000x1020x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xfa380xb4
RESOURCE0x130000x818
EXCEPTION0x120000x504
SECURITY00
BASERELOC0x140000x2c
DEBUG0x14c00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2c00xb8
IAT0x10000x488
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19240
MANIFEST#16980
module_namehintordfunction_name
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll327GetSecurityDescriptorControl
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll114ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll333GetSecurityDescriptorSacl
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll108ConvertSidToStringSidW
ADVAPI32.dll329GetSecurityDescriptorGroup
ADVAPI32.dll328GetSecurityDescriptorDacl
ADVAPI32.dll503OpenProcessToken
KERNEL32.dll907OutputDebugStringA
KERNEL32.dll617GetStartupInfoW
KERNEL32.dll540GetModuleHandleW
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll665GetTickCount
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll639GetSystemTimeAsFileTime
KERNEL32.dll1231TerminateProcess
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1251UnhandledExceptionFilter
KERNEL32.dll319FindFirstFileW
KERNEL32.dll724HeapAlloc
KERNEL32.dll728HeapFree
KERNEL32.dll591GetProcessHeap
KERNEL32.dll1333WriteFile
KERNEL32.dll691GetVolumePathNameW
KERNEL32.dll495GetFileAttributesW
KERNEL32.dll143CreateFileW
KERNEL32.dll1151SetLastError
KERNEL32.dll308FindClose
KERNEL32.dll331FindNextFileW
KERNEL32.dll1134SetFileAttributesW
KERNEL32.dll687GetVolumeInformationW
KERNEL32.dll857MapViewOfFile
KERNEL32.dll1254UnmapViewOfFile
KERNEL32.dll1217Sleep
KERNEL32.dll843LocalFree
KERNEL32.dll518GetLastError
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll502GetFileSizeEx
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll82CloseHandle
KERNEL32.dll114CopyFileExW
KERNEL32.dll225DeviceIoControl
KERNEL32.dll512GetFullPathNameW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll458GetCurrentThread
msvcrt.dll899_wcsnicmp
msvcrt.dll1063fflush
msvcrt.dll1282wcsstr
msvcrt.dll370_isatty
msvcrt.dll978_write
msvcrt.dll478_lseeki64
msvcrt.dll268_fileno
msvcrt.dll661_read
msvcrt.dll125__pioinfo
msvcrt.dll101__badioinfo
msvcrt.dll1175realloc
msvcrt.dll1287wcstombs
msvcrt.dll1120iswctype
msvcrt.dll1062ferror
msvcrt.dll1140malloc
msvcrt.dll1091fwprintf
msvcrt.dll1278wcsrchr
msvcrt.dll1243ungetc
msvcrt.dll856_vsnwprintf
msvcrt.dll1292wctomb
msvcrt.dll454_itoa
msvcrt.dll698_snprintf
msvcrt.dll367_iob
msvcrt.dll1133localeconv
msvcrt.dll1129isxdigit
msvcrt.dll1110isleadbyte
msvcrt.dll123__mb_cur_max
msvcrt.dll1149mbtowc
msvcrt.dll1108isdigit
msvcrt.dll1043calloc
msvcrt.dll1082free
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll128__set_app_type
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll881_wcmdln
msvcrt.dll1056exit
msvcrt.dll179_cexit
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll83__C_specific_handler
msvcrt.dll143__wgetmainargs
msvcrt.dll893_wcslwr
msvcrt.dll246_errno
msvcrt.dll889_wcsicmp
msvcrt.dll1263wcschr
imagehlp.dll2CheckSumMappedFile
SHELL32.dll6CommandLineToArgvW
SHLWAPI.dll133PathRemoveBackslashW
ntdll.dll465NtResetEvent
ntdll.dll431NtQueryValueKey
ntdll.dll347NtOpenKey
ntdll.dll423NtQuerySymbolicLinkObject
ntdll.dll362NtOpenSymbolicLinkObject
ntdll.dll613RtlAllocateHeap
ntdll.dll843RtlFreeHeap
ntdll.dll494NtSetInformationFile
ntdll.dll107LdrFindResource_U
ntdll.dll98LdrAccessResource
ntdll.dll344NtOpenFile
ntdll.dll355NtOpenProcess
ntdll.dll228NtCreateEvent
ntdll.dll1045RtlNtStatusToDosError
ntdll.dll500NtSetInformationThread
ntdll.dll556NtWaitForSingleObject
ntdll.dll399NtQueryInformationProcess
ntdll.dll396NtQueryInformationFile
ntdll.dll931RtlInitUnicodeString
ntdll.dll401NtQueryInformationThread
ntdll.dll271NtDeviceIoControlFile
ntdll.dll214NtClose
ntdll.dll426NtQuerySystemInformation
ntdll.dll635RtlCaptureContext
ntdll.dll1026RtlLookupFunctionEntry
ntdll.dll1265RtlVirtualUnwind
VERSION.dll6GetFileVersionInfoW
VERSION.dll14VerQueryValueW
VERSION.dll5GetFileVersionInfoSizeW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionBoot File Servicing Utility
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamebfsvc.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamebfsvc.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d065584BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2c0