filenametaskmgr.exe
size227328 (0x37800)
md5545bf7eaa24a9e062857d0742ec0b28a
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307297
1473072933
10399
1323072917
1313072924
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce78d21
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1d000
SizeOfInitializedData0x1b000
SizeOfUninitializedData0
AddressOfEntryPoint0x8387
BaseOfCode0x1000
BaseOfData0x22000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x3a000
SizeOfHeaders0x600
CheckSum0x44dcd
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1ce640x1d000R-X CODE
.data0x1e0000x2b580x1e00RW- IDATA
.rsrc0x210000x165c80x16600R-- IDATA
.reloc0x380000x1cb80x1e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1bdb40x154
RESOURCE0x210000x165c8
EXCEPTION00
SECURITY00
BASERELOC0x380000x1cb8
DEBUG0x1de040x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xd9080x40
Bound_IAT0x2780x194
IAT0x10000x5e0
Delay_IAT0x1b9fc0xe0
CLR_Header00
typenamesizecp
MUI#12640
WEVT_TEMPLATE#111620
BITMAP#10316040
BITMAP#10416040
BITMAP#12516040
ICON#116400
ICON#27440
ICON#34880
ICON#42960
ICON#537520
ICON#622160
ICON#717360
ICON#813840
ICON#996400
ICON#1042640
ICON#1124400
ICON#1211280
ICON#137440
ICON#142960
ICON#152960
ICON#162960
ICON#172960
ICON#182960
ICON#192960
ICON#202960
ICON#212960
ICON#222960
ICON#232960
ICON#242960
ICON#252960
ICON#262960
ICON#277440
ICON#284880
ICON#292960
ICON#3022160
ICON#3117360
ICON#3213840
ICON#3342640
ICON#3424400
ICON#3511280
ICON#367440
ICON#374880
ICON#382960
ICON#3922160
ICON#4017360
ICON#4113840
ICON#4242640
ICON#4324400
ICON#4411280
ICON#457440
ICON#464880
ICON#472960
ICON#4822160
ICON#4917360
ICON#5013840
ICON#5142640
ICON#5224400
ICON#5311280
GROUP_ICON#1071740
GROUP_ICON#118340
GROUP_ICON#127200
GROUP_ICON#128200
GROUP_ICON#129200
GROUP_ICON#130200
GROUP_ICON#131200
GROUP_ICON#132200
GROUP_ICON#133200
GROUP_ICON#134200
GROUP_ICON#135200
GROUP_ICON#136200
GROUP_ICON#137200
GROUP_ICON#138200
GROUP_ICON#30031320
GROUP_ICON#30041320
GROUP_ICON#30241320
VERSION#19120
MANIFEST#111840
module_namehintordfunction_name
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll223DuplicateTokenEx
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll371ImpersonateLoggedOnUser
ADVAPI32.dll270EventRegister
ADVAPI32.dll271EventUnregister
ADVAPI32.dll272EventWrite
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll131CreateWellKnownSid
ADVAPI32.dll390IsValidSid
ADVAPI32.dll706SetTokenInformation
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll257EnumServicesStatusExW
ADVAPI32.dll87CloseServiceHandle
ADVAPI32.dll548QueryServiceConfigW
ADVAPI32.dll507OpenServiceW
ADVAPI32.dll713StartServiceW
ADVAPI32.dll505OpenSCManagerW
ADVAPI32.dll92ControlService
ADVAPI32.dll88CloseThreadWaitChainSession
ADVAPI32.dll345GetThreadWaitChain
ADVAPI32.dll509OpenThreadWaitChainSession
KERNEL32.dll480GetExitCodeThread
KERNEL32.dll551GetNumaHighestNodeNumber
KERNEL32.dll895OpenProcess
KERNEL32.dll929QueryFullProcessImageNameW
KERNEL32.dll840LocalFree
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll662GetTimeFormatW
KERNEL32.dll568GetPriorityClass
KERNEL32.dll232DuplicateHandle
KERNEL32.dll143CreateFileW
KERNEL32.dll644GetTempPathW
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll1357lstrlenA
KERNEL32.dll656GetThreadTimes
KERNEL32.dll64CallbackMayRunLong
KERNEL32.dll1231TrySubmitThreadpoolCallback
KERNEL32.dll1112SetEvent
KERNEL32.dll1346lstrcmpW
KERNEL32.dll1220Thread32Next
KERNEL32.dll900OpenThread
KERNEL32.dll1219Thread32First
KERNEL32.dll190CreateToolhelp32Snapshot
KERNEL32.dll1202Sleep
KERNEL32.dll399GetComputerNameW
KERNEL32.dll391GetCommandLineW
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll962ReadProcessMemory
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll658GetTickCount
KERNEL32.dll1358lstrlenW
KERNEL32.dll100CompareStringW
KERNEL32.dll561GetNumberFormatW
KERNEL32.dll516GetLocaleInfoW
KERNEL32.dll724HeapSize
KERNEL32.dll869MulDiv
KERNEL32.dll722HeapReAlloc
KERNEL32.dll350FormatMessageW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll1147SetPriorityClass
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll920ProcessIdToSessionId
KERNEL32.dll86CloseThreadpoolCleanupGroup
KERNEL32.dll478GetErrorMode
KERNEL32.dll1111SetErrorMode
KERNEL32.dll183CreateThreadpoolCleanupGroup
KERNEL32.dll133CreateEventW
KERNEL32.dll1153SetProcessShutdownParameters
KERNEL32.dll220DeviceIoControl
KERNEL32.dll1134SetLastError
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll168CreateProcessW
KERNEL32.dll447GetCurrentDirectoryW
KERNEL32.dll782IsWow64Process
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1216TerminateProcess
KERNEL32.dll158CreateMutexW
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll831LoadLibraryW
KERNEL32.dll579GetProcAddress
KERNEL32.dll354FreeLibrary
KERNEL32.dll512GetLastError
KERNEL32.dll584GetProcessHeap
KERNEL32.dll715HeapAlloc
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll719HeapFree
KERNEL32.dll675GetVersionExW
KERNEL32.dll1017ReleaseMutex
KERNEL32.dll82CloseHandle
KERNEL32.dll181CreateThread
KERNEL32.dll87CloseThreadpoolCleanupGroupMembers
KERNEL32.dll521GetLogicalProcessorInformationEx
KERNEL32.dll332FindResourceExW
KERNEL32.dll832LoadResource
KERNEL32.dll850LockResource
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll631GetSystemTimeAsFileTime
KERNEL32.dll931QueryPerformanceCounter
KERNEL32.dll530GetModuleHandleA
KERNEL32.dll1184SetUnhandledExceptionFilter
KERNEL32.dll609GetStartupInfoW
KERNEL32.dll747InterlockedExchange
GDI32.dll48CreateCompatibleDC
GDI32.dll509GetObjectW
GDI32.dll452GetCurrentObject
GDI32.dll64CreateFontIndirectW
GDI32.dll439GetCharWidth32W
GDI32.dll638SetBkColor
GDI32.dll47CreateCompatibleBitmap
GDI32.dll607Rectangle
GDI32.dll639SetBkMode
GDI32.dll678SetTextColor
GDI32.dll459GetDeviceCaps
GDI32.dll227DeleteDC
GDI32.dll19BitBlt
GDI32.dll631SelectObject
GDI32.dll570MoveToEx
GDI32.dll566LineTo
GDI32.dll230DeleteObject
GDI32.dll75CreatePen
GDI32.dll525GetStockObject
USER32.dll465IsIconic
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll461IsDialogMessageW
USER32.dll762TranslateAcceleratorW
USER32.dll349GetMessageW
USER32.dll42ChangeWindowMessageFilterEx
USER32.dll99CreateDialogParamW
USER32.dll533MessageBoxW
USER32.dll611RegisterWindowMessageW
USER32.dll680SetProcessDPIAware
USER32.dll208DrawTextW
USER32.dll110CreateWindowExW
USER32.dll785UpdateWindow
USER32.dll446InvalidateRect
USER32.dll379GetSysColor
USER32.dll294GetDlgCtrlID
USER32.dll10AppendMenuW
USER32.dll214EnableMenuItem
USER32.dll158DeleteMenu
USER32.dll382GetSystemMetrics
USER32.dll218EndDialog
USER32.dll172DialogBoxParamW
USER32.dll688SetScrollInfo
USER32.dll689SetScrollPos
USER32.dll373GetScrollInfo
USER32.dll656SetDlgItemTextW
USER32.dll759TrackPopupMenuEx
USER32.dll216EnableWindow
USER32.dll419GetWindowTextW
USER32.dll45CharLowerBuffW
USER32.dll306GetGuiResources
USER32.dll736ShowWindowAsync
USER32.dll221EndTask
USER32.dll480IsWindowVisible
USER32.dll698SetThreadDesktop
USER32.dll464IsHungAppWindow
USER32.dll272GetClassLongW
USER32.dll482IsZoomed
USER32.dll398GetWindow
USER32.dll670SetMenuDefaultItem
USER32.dll74CloseDesktop
USER32.dll225EnumDesktopWindows
USER32.dll552OpenDesktopW
USER32.dll746SwitchToThisWindow
USER32.dll475IsWindow
USER32.dll324GetLastActivePopup
USER32.dll33CascadeWindows
USER32.dll752TileWindows
USER32.dll291GetDesktopWindow
USER32.dll227EnumDesktopsW
USER32.dll360GetProcessWindowStation
USER32.dll288GetCursorPos
USER32.dll563PeekMessageW
USER32.dll62CheckDlgButton
USER32.dll462IsDlgButtonChecked
USER32.dll418GetWindowTextLengthW
USER32.dll686SetRect
USER32.dll648SetCursor
USER32.dll491LoadCursorW
USER32.dll540MsgWaitForMultipleObjects
USER32.dll156DefWindowProcW
USER32.dll539MoveWindow
USER32.dll586RedrawWindow
USER32.dll338GetMenuItemID
USER32.dll525MessageBeep
USER32.dll483KillTimer
USER32.dll163DestroyIcon
USER32.dll340GetMenuItemInfoW
USER32.dll292GetDialogBaseUnits
USER32.dll386GetThreadDesktop
USER32.dll493LoadIconW
USER32.dll699SetTimer
USER32.dll301GetForegroundWindow
USER32.dll569PostThreadMessageW
USER32.dll444InternalGetWindowText
USER32.dll567PostQuitMessage
USER32.dll250FindWindowW
USER32.dll420GetWindowThreadProcessId
USER32.dll6AllowSetForegroundWindow
USER32.dll635SendMessageTimeoutW
USER32.dll748SystemParametersInfoW
USER32.dll503LoadMenuW
USER32.dll378GetSubMenu
USER32.dll615RemoveMenu
USER32.dll164DestroyMenu
USER32.dll317GetKeyState
USER32.dll300GetFocus
USER32.dll274GetClassNameW
USER32.dll658SetFocus
USER32.dll356GetParent
USER32.dll536MonitorFromPoint
USER32.dll351GetMonitorInfoW
USER32.dll485LoadAcceleratorsW
USER32.dll495LoadImageW
USER32.dll553OpenIcon
USER32.dll659SetForegroundWindow
USER32.dll166DestroyWindow
USER32.dll566PostMessageW
USER32.dll377GetShellWindow
USER32.dll735ShowWindow
USER32.dll13BeginDeferWindowPos
USER32.dll412GetWindowRect
USER32.dll157DeferWindowPos
USER32.dll217EndDeferWindowPos
USER32.dll710SetWindowPos
USER32.dll668SetMenu
USER32.dll295GetDlgItem
USER32.dll521MapWindowPoints
USER32.dll636SendMessageW
USER32.dll331GetMenu
USER32.dll64CheckMenuRadioItem
USER32.dll63CheckMenuItem
USER32.dll506LoadStringW
USER32.dll715SetWindowTextW
USER32.dll270GetClassInfoW
USER32.dll590RegisterClassW
USER32.dll289GetDC
USER32.dll613ReleaseDC
USER32.dll380GetSysColorBrush
USER32.dll276GetClientRect
USER32.dll246FillRect
USER32.dll406GetWindowLongW
USER32.dll708SetWindowLongW
USER32.dll30CallWindowProcW
USER32.dll354GetNextDlgTabItem
USER32.dll422GhostWindowFromHungWindow
USER32.dll427HungWindowFromGhostWindow
msvcrt.dll295_controlfp
msvcrt.dll345_except_handler4_common
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll999_wcmdln
msvcrt.dll1167exit
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll1339towlower
msvcrt.dll1133_wtol
msvcrt.dll1190free
msvcrt.dll405_ftol2_sse
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1260memmove
msvcrt.dll1328swscanf_s
msvcrt.dll1380wcsstr
msvcrt.dll923_ui64tow_s
msvcrt.dll468_i64tow_s
msvcrt.dll1316strrchr
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll1007_wcsicmp
msvcrt.dll276_cexit
msvcrt.dll404_ftol2
msvcrt.dll1258memcpy
msvcrt.dll974_vsnwprintf
msvcrt.dll1376wcsrchr
msvcrt.dll1002_wcsdup
msvcrt.dll225__wgetmainargs
msvcrt.dll1262memset
IPHLPAPI.DLL62GetAdaptersAddresses
IPHLPAPI.DLL77GetIfEntry2
IPHLPAPI.DLL206NhGetInterfaceNameFromDeviceGuid
COMCTL32.dll12CreateStatusWindowW
COMCTL32.dll17
COMCTL32.dll345
COMCTL32.dll328
COMCTL32.dll329
COMCTL32.dll334
COMCTL32.dll336
COMCTL32.dll338
COMCTL32.dll111ImageList_ReplaceIcon
COMCTL32.dll337
COMCTL32.dll331
COMCTL32.dll117ImageList_SetIconSize
COMCTL32.dll109ImageList_Remove
COMCTL32.dll83ImageList_Create
pcwum.dll5PcwCreateQuery
pcwum.dllPcwAddQueryItem
pcwum.dll2PcwCollectData
SHLWAPI.dll437
SHLWAPI.dll16
SHLWAPI.dll348
SHLWAPI.dll52PathAppendW
SHLWAPI.dll137PathRemoveExtensionW
SHLWAPI.dll50PathAddExtensionW
SHLWAPI.dll328StrStrW
SHLWAPI.dll618
SHLWAPI.dll299StrFormatByteSizeW
SHLWAPI.dll158
SHELL32.dll61
SHELL32.dll282ShellAboutW
SHELL32.dll289ShellExecuteExW
SHELL32.dll245
SHELL32.dll243SHOpenFolderAndSelectItems
SHELL32.dll246SHParseDisplayName
SHELL32.dll75
SHELL32.dll6CommandLineToArgvW
SHELL32.dll100
SHELL32.dll34DuplicateIcon
SHELL32.dll302Shell_NotifyIconW
ntdll.dll343NtOpenFile
ntdll.dll1211RtlTryEnterCriticalSection
ntdll.dll362NtOpenThread
ntdll.dll212NtClose
ntdll.dll363NtOpenThreadToken
ntdll.dll1196RtlTimeToElapsedTimeFields
ntdll.dll493NtSetInformationFile
ntdll.dll779RtlEnterCriticalSection
ntdll.dll398NtQueryInformationProcess
ntdll.dll924RtlInitUnicodeString
ntdll.dll429NtQueryTimerResolution
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll730RtlDeleteCriticalSection
ntdll.dll931RtlInitializeCriticalSection
ntdll.dll1372WinSqmAddToStream
ntdll.dll425NtQuerySystemInformation
ntdll.dll401NtQueryInformationToken
ntdll.dll355NtOpenProcessToken
ntdll.dll1004RtlLeaveCriticalSection
ntdll.dll497NtSetInformationProcess
Secur32.dll30GetUserNameExW
UxTheme.dll70SetWindowTheme
UxTheme.dll63IsThemeActive
wevtapi.dll3EvtClose
wevtapi.dll44EvtSubscribe
credui.dll10CredUIPromptForCredentialsW
VDMDBG.dll27VDMTerminateTaskWOW
VDMDBG.dll4VDMEnumTaskWOWEx

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Task Manager
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNametaskmgr
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenametaskmgr.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0227328EXE11/20/2010 08:56:01#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278