filename763942dc5bd1c5ae5d01761002406d7dc0cfb660519777944c9ba492e68fd2ee.bin
size212480 (0x33e00)
md517030c4d70dbee607f840a4efb64df49
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307297
1313072963
126507271
1473072925
1323072964
10632
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x56de9bfd
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x14200
SizeOfInitializedData0x1f800
SizeOfUninitializedData0x1000
AddressOfEntryPoint0x14004
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x39000
SizeOfHeaders0x400
CheckSum0x38051
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x11ee60x12000R-X CODE
.text0x130000xfa00x1000R-X CODE
.ydata0x140000x101d0x1200R-X CODE
.bss10x160000x10000RW- UDATA
.rdata0x170000x71840x7200R-- IDATA
.data0x1f0000x47680x4800RW- IDATA
.rsrc0x240000x119a80x11a00R-- IDATA
.reloc0x360000x22ee0x2400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1d3080xdc
RESOURCE0x240000x119a8
EXCEPTION00
SECURITY00
BASERELOC0x360000x1f48
DEBUG0x18f700
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x170000x2a8
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#137520
ICON#296400
ICON#337520
ICON#496400
ICON#542640
ICON#624400
ICON#711280
ICON#8169360
ICON#917200
ICON#10169360
GROUP_ICON#2331340
GROUP_ICON#2341900
GROUP_ICON#21221340
VERSION#19480
module_namehintordfunction_name
KERNEL32.dll610GetStartupInfoA
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll1351lstrcpyA
KERNEL32.dll1358lstrlenW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll21AreFileApisANSI
KERNEL32.dll1354lstrcpynA
KERNEL32.dll354FreeLibrary
KERNEL32.dll514GetLastError
KERNEL32.dll1357lstrlenA
KERNEL32.dll82CloseHandle
KERNEL32.dll155CreateMutexA
KERNEL32.dll1139SetLastError
KERNEL32.dll485GetFileAttributesA
KERNEL32.dll840LocalFree
KERNEL32.dll581GetProcAddress
KERNEL32.dll828LoadLibraryA
KERNEL32.dll71CancelWaitableTimer
KERNEL32.dll659GetTickCount
KERNEL32.dll586GetProcessHeap
KERNEL32.dll2ActivateActCtx
KERNEL32.dll360GetACP
KERNEL32.dll903OpenWaitableTimerA
KERNEL32.dll904OpenWaitableTimerW
KERNEL32.dll695GlobalFindAtomW
KERNEL32.dll567GetOEMCP
KERNEL32.dll66CancelIo
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll504GetFullPathNameA
KERNEL32.dll674GetVersion
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1263VirtualProtect
USER32.dll43CharLowerA
USER32.dll479IsWindowUnicode
USER32.dll291GetDesktopWindow
USER32.dll480IsWindowVisible
USER32.dll482IsZoomed
USER32.dll294GetDlgCtrlID
USER32.dll216EnableWindow
USER32.dll785UpdateWindow
USER32.dll686SetRect
USER32.dll612ReleaseCapture
USER32.dll640SetCapture
USER32.dll714SetWindowTextA
USER32.dll301GetForegroundWindow
USER32.dll412GetWindowRect
USER32.dll223EnumChildWindows
USER32.dll155DefWindowProcA
USER32.dll423GrayStringA
USER32.dll356GetParent
USER32.dll576PtInRect
USER32.dll475IsWindow
USER32.dll246FillRect
USER32.dll382GetSystemMetrics
USER32.dll416GetWindowTextA
USER32.dll381GetSystemMenu
USER32.dll659SetForegroundWindow
USER32.dll819wsprintfW
USER32.dll476IsWindowEnabled
USER32.dll389GetTopWindow
USER32.dll631SendMessageA
USER32.dll749TabbedTextOutA
USER32.dll205DrawTextA
USER32.dll549OffsetRect
GDI32.dll667SetPixel
GDI32.dll61CreateFontIndirectA
GDI32.dll564LPtoDP
GDI32.dll73CreatePalette
GDI32.dll599Polyline
GDI32.dll536GetTextColor
GDI32.dll19BitBlt
GDI32.dll602PtVisible
GDI32.dll601PtInRegion
GDI32.dll696TextOutA
GDI32.dll164DPtoLP
GDI32.dll78CreatePolygonRgn
GDI32.dll672SetRectRgn
GDI32.dll34CombineRgn
GDI32.dll606RectVisible
GDI32.dll79CreateRectRgn
GDI32.dll507GetObjectA
ADVAPI32.dll593RegEnumValueA
ADVAPI32.dll181CryptDeriveKey
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll180CryptDecrypt
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll288FreeSid
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll427LsaFreeMemory
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll606RegOpenCurrentUser
ADVAPI32.dll445LsaOpenPolicy
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll592RegEnumKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll413LsaClose
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll263EqualSid
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll200CryptHashData
ADVAPI32.dll183CryptDestroyKey
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll186CryptEncrypt
ADVAPI32.dll612RegOpenKeyW
SHELL32.dll286ShellExecuteA
SHELL32.dll207SHGetMalloc
SHELL32.dll182SHGetDesktopFolder
SHELL32.dll213SHGetPathFromIDListA
ole32.dll108CoUninitialize
ole32.dll16CoCreateInstance
ole32.dll376StringFromCLSID
ole32.dll62CoInitialize
ole32.dll104CoTaskMemFree
ole32.dll6CLSIDFromProgID
COMCTL32.dll146_TrackMouseEvent
COMCTL32.dll123InitCommonControlsEx
VERSION.dllGetFileVersionInfoA
VERSION.dll13VerQueryValueA
VERSION.dll3GetFileVersionInfoSizeA
oledlg.dll8
oledlg.dll3OleUIBusyW
msvcrt.dll182_adjust_fdiv
msvcrt.dll66_CIsin
msvcrt.dll214_controlfp
msvcrt.dll655exit
msvcrt.dll676free
msvcrt.dll542_vsnprintf
msvcrt.dll501_strdup
msvcrt.dll314_initterm
msvcrt.dll389_mbscmp
msvcrt.dll109__getmainargs
msvcrt.dll494_splitpath
msvcrt.dll168_acmdln
msvcrt.dll106__dllonexit
msvcrt.dll435_onexit
msvcrt.dll237_except_handler3
msvcrt.dll154__setusermatherr
msvcrt.dll82__CxxFrameHandler
msvcrt.dll246_exit
msvcrt.dll16public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll477_setmbcp
msvcrt.dll395_mbsicmp
msvcrt.dll71_CxxThrowException
msvcrt.dll78_XcptFilter
msvcrt.dll52void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type

StringTable 040904E2

CompanyNameSouthsoftware.com
FileDescriptionAdvanced Task Scheduler 32-bit Edition
FileVersion4.1.0.612
InternalNameAdvanced Task Scheduler 32-bit Edition
LegalCopyrightCopyright © Southsoftware.com, 2002-2015
OriginalFilenameadvscheduler_admin.exe
ProductNameAdvanced Task Scheduler 32-bit Edition
ProductVersion4.1.0.612

VS_FIXEDFILEINFO

FileVersion4.1.0.612
ProductVersion4.1.0.612
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0212480EXE03/08/2016 09:31:41#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK