filenameat.exe
size24064 (0x5e00)
md57bd932ffa2e9b359cb0544615973d149
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
132307293
149307291
1473072915
1095
1313072927
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc544
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x4000
SizeOfInitializedData0x2e00
SizeOfUninitializedData0
AddressOfEntryPoint0x3a7f
BaseOfCode0x1000
BaseOfData0x5000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x9000
SizeOfHeaders0x400
CheckSum0xd61c
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x3f220x4000R-X CODE
.data0x50000x1c3c0xa00RW- IDATA
.rsrc0x70000x8180xa00R-- IDATA
.reloc0x80000x5480x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x47340xa0
RESOURCE0x70000x818
EXCEPTION00
SECURITY00
BASERELOC0x80000x444
DEBUG0x11900x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x14880x40
Bound_IAT0x2780x98
IAT0x10000x174
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19320
MANIFEST#16940
module_namehintordfunction_name
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll560RegCloseKey
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll350FormatMessageW
KERNEL32.dll428GetConsoleMode
KERNEL32.dll499GetFileType
KERNEL32.dll612GetStdHandle
KERNEL32.dll1317WriteFile
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll840LocalFree
KERNEL32.dll432GetConsoleOutputCP
KERNEL32.dll663GetTimeFormatW
KERNEL32.dll652GetThreadLocale
KERNEL32.dll631GetSystemTime
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll958ReadConsoleW
KERNEL32.dll391GetCommandLineW
KERNEL32.dll831LoadLibraryW
KERNEL32.dll514GetLastError
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll1181SetThreadUILanguage
KERNEL32.dll370GetCPInfo
KERNEL32.dll723HeapSetInformation
KERNEL32.dll604GetProfileStringA
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll1212TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll658GetTickCount
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll1185SetUnhandledExceptionFilter
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll1198Sleep
KERNEL32.dll747InterlockedExchange
KERNEL32.dll835LocalAlloc
KERNEL32.dll829LoadLibraryExW
KERNEL32.dll353FreeLibrary
KERNEL32.dll599GetProfileIntA
msvcrt.dll145__getmainargs
msvcrt.dll276_cexit
msvcrt.dll354_exit
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll212__setusermatherr
msvcrt.dll185__p__commode
msvcrt.dll190__p__fmode
msvcrt.dll210__set_app_type
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll345_except_handler4_common
msvcrt.dll1365wcscpy_s
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll562_itoa_s
msvcrt.dll1303strcpy_s
msvcrt.dll1262memset
msvcrt.dll1315strpbrk
msvcrt.dll1317strspn
msvcrt.dll1295sscanf
msvcrt.dll295_controlfp
msvcrt.dll862_stricmp
msvcrt.dll475_iob
msvcrt.dll1176fgets
msvcrt.dll1299strchr
msvcrt.dll1376wcsrchr
msvcrt.dll1382wcstok
msvcrt.dll1361wcschr
msvcrt.dll1034_wcsupr
msvcrt.dll1167exit
msvcrt.dll1007_wcsicmp
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll1387wcstoul
msvcrt.dll974_vsnwprintf
msvcrt.dll1298strcat_s
netutils.dll1NetApiBufferFree
schedcli.dll2NetScheduleJobEnum
schedcli.dll3NetScheduleJobGetInfo
schedcli.dll1NetScheduleJobDel
schedcli.dllNetScheduleJobAdd
SHELL32.dll6CommandLineToArgvW
ntdll.dll1371WinSqmAddToStream
ntdll.dll1388WinSqmIsOptedIn

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSchedule service command line interface
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameAT.EXE
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameAT.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
024064EXE07/13/2009 23:37:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278