filenamemstask.dll
size238080 (0x3a200)
md5862596399aafd2a21db2af9270cd4f70
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307292
10270
1473072915
1313072915
146307291
1383072948
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4ce7c827
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x17e00
SizeOfInitializedData0x22000
SizeOfUninitializedData0
AddressOfEntryPoint0x1b7c
BaseOfCode0x1000
ImageBase0x7ff72240000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x3d000
SizeOfHeaders0x400
CheckSum0x44478
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x17c870x17e00R-X CODE
.rdata0x190000x4fe80x5000R-- IDATA
.data0x1e0000x11b00x1200RW- IDATA
.pdata0x200000xeac0x1000R-- IDATA
.rsrc0x210000x1a9d00x1aa00R-- IDATA
.reloc0x3c0000x2c40x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x197e00x1c3
IMPORT0x1bce80xa0
RESOURCE0x210000x1a9d0
EXCEPTION0x200000xeac
SECURITY00
BASERELOC0x3c0000x2c4
DEBUG0x18c280x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2e80xa8
IAT0x190000x5a8
Delay_IAT0x1b5bc0x1c0
CLR_Header00
typenamesizecp
MUI#12400
BITMAP#2713600
BITMAP#27211280
BITMAP#27524080
BITMAP#334281860
ICON#17440
ICON#22960
ICON#337520
ICON#422160
ICON#513840
ICON#696400
ICON#742640
ICON#811280
ICON#97440
ICON#102960
ICON#1137520
ICON#1222160
ICON#1313840
ICON#1496400
ICON#1542640
ICON#1611280
ICON#1716400
ICON#187440
ICON#192960
ICON#2037520
ICON#2122160
ICON#2213840
ICON#2396400
ICON#2442640
ICON#2511280
ICON#267440
GROUP_ICON#1001320
GROUP_ICON#101200
GROUP_ICON#2731180
GROUP_ICON#2741180
VERSION#19400
MANIFEST#27260
module_namehintordfunction_name
msvcrt.dll653_purecall
msvcrt.dll1282wcsstr
msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll899_wcsnicmp
msvcrt.dll456_itow
msvcrt.dll1289wcstoul
msvcrt.dll1277wcspbrk
msvcrt.dll1154memmove
msvcrt.dll856_vsnwprintf
msvcrt.dll1173rand
msvcrt.dll1263wcschr
msvcrt.dll1281wcsspn
msvcrt.dll889_wcsicmp
msvcrt.dll83__C_specific_handler
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll82_XcptFilter
msvcrt.dll19void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

msvcrt.dll1287wcstombs
msvcrt.dll1148mbstowcs_s
msvcrt.dll21void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

msvcrt.dll1278wcsrchr
msvcrt.dll1140malloc
msvcrt.dll1082free
msvcrt.dll1151memcmp
ntdll.dll635RtlCaptureContext
ntdll.dll1026RtlLookupFunctionEntry
ntdll.dll1265RtlVirtualUnwind
ntdll.dll1404WinSqmIsOptedIn
ntdll.dll1387WinSqmAddToStream
ADVAPI32.dll373ImpersonateSelf
ADVAPI32.dll304GetFileSecurityW
ADVAPI32.dll5AccessCheck
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll334GetSecurityInfo
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll678SetEntriesInAclW
ADVAPI32.dll699SetSecurityInfo
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll288FreeSid
ADVAPI32.dll575RegDeleteKeyExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll564RegConnectRegistryW
ADVAPI32.dll357GetUserNameW
USER32.dll537MessageBoxW
USER32.dll298GetDlgItemInt
USER32.dll705SetTimer
USER32.dll487KillTimer
USER32.dll664SetFocus
USER32.dll525MapWindowPoints
USER32.dll422GetWindowTextLengthW
USER32.dll416GetWindowRect
USER32.dll172DialogBoxParamW
USER32.dll358GetParent
USER32.dll297GetDlgItem
USER32.dll218EndDialog
USER32.dll631SendDlgItemMessageW
USER32.dll718SetWindowPos
USER32.dll62CheckDlgButton
USER32.dll743ShowWindow
USER32.dll466IsDlgButtonChecked
USER32.dll384GetSystemMetrics
USER32.dll300GetDlgItemTextW
USER32.dll662SetDlgItemTextW
USER32.dll216EnableWindow
USER32.dll723SetWindowTextW
USER32.dll163DestroyIcon
USER32.dll817WinHelpW
USER32.dll166DestroyWindow
USER32.dll65CheckRadioButton
USER32.dll499LoadImageW
USER32.dll654SetCursor
USER32.dll510LoadStringW
USER32.dll495LoadCursorW
USER32.dll409GetWindowLongPtrW
USER32.dll270GetClassInfoW
USER32.dll110CreateWindowExW
USER32.dll594RegisterClassW
USER32.dll715SetWindowLongPtrW
USER32.dll640SendMessageW
USER32.dll156DefWindowProcW
GDI32.dll230DeleteObject
GDI32.dll525GetStockObject
RPCRT4.dll515UuidCreate
RPCRT4.dll506RpcStringFreeW
RPCRT4.dll357RpcBindingFree
RPCRT4.dll374RpcBindingSetAuthInfoExW
RPCRT4.dll391RpcEpResolveBinding
RPCRT4.dll502RpcStringBindingComposeW
RPCRT4.dll359RpcBindingFromStringBindingW
RPCRT4.dll43I_RpcExceptionFilter
RPCRT4.dll150NdrClientCall3
KERNEL32.dll457GetCurrentThread
KERNEL32.dll1206SetWaitableTimer
KERNEL32.dll71CancelWaitableTimer
KERNEL32.dll194CreateWaitableTimerW
KERNEL32.dll743InitOnceExecuteOnce
KERNEL32.dll929QueryFullProcessImageNameW
KERNEL32.dll853LockResource
KERNEL32.dll835LoadResource
KERNEL32.dll339FindResourceW
KERNEL32.dll452GetCurrentDirectoryW
KERNEL32.dll1362lstrcmpW
KERNEL32.dll241EnterCriticalSection
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll330FindNextFileW
KERNEL32.dll747InitializeCriticalSection
KERNEL32.dll845LocalReAlloc
KERNEL32.dll298FileTimeToSystemTime
KERNEL32.dll636GetSystemTime
KERNEL32.dll491GetFileAttributesExW
KERNEL32.dll503GetFileType
KERNEL32.dll960ReadFile
KERNEL32.dll1118SetEndOfFile
KERNEL32.dll1136SetFilePointer
KERNEL32.dll500GetFileSize
KERNEL32.dll518GetLocalTime
KERNEL32.dll96CompareFileTime
KERNEL32.dll1224SystemTimeToFileTime
KERNEL32.dll1365lstrcmpiW
KERNEL32.dll307FindClose
KERNEL32.dll403GetComputerNameExW
KERNEL32.dll404GetComputerNameW
KERNEL32.dll448GetCurrentActCtx
KERNEL32.dll1017ReleaseActCtx
KERNEL32.dll225DisableThreadLibraryCalls
KERNEL32.dll517GetLastError
KERNEL32.dll359FreeLibrary
KERNEL32.dll585GetProcAddress
KERNEL32.dll831LoadLibraryExA
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll1213Sleep
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll664GetTickCount
KERNEL32.dll458GetCurrentThreadId
KERNEL32.dll454GetCurrentProcessId
KERNEL32.dll638GetSystemTimeAsFileTime
KERNEL32.dll1227TerminateProcess
KERNEL32.dll453GetCurrentProcess
KERNEL32.dll1247UnhandledExceptionFilter
KERNEL32.dll1199SetUnhandledExceptionFilter
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1329WriteFile
KERNEL32.dll683GetVersionExW
KERNEL32.dll494GetFileAttributesW
KERNEL32.dll143CreateFileW
KERNEL32.dll1374lstrlenW
KERNEL32.dll82CloseHandle
KERNEL32.dll1004RegSetValueExW
KERNEL32.dll842LocalFree
KERNEL32.dll1131SetFileAttributesW
KERNEL32.dll686GetVolumeInformationW
KERNEL32.dll290ExpandEnvironmentStringsW
KERNEL32.dll833LoadLibraryW
KERNEL32.dll473GetDriveTypeW
KERNEL32.dll462GetDateFormatW
KERNEL32.dll521GetLocaleInfoW
KERNEL32.dll355FormatMessageW
KERNEL32.dll668GetTimeFormatW
KERNEL32.dll100CompareStringW
KERNEL32.dll214DeleteFileW
KERNEL32.dll838LocalAlloc
KERNEL32.dll511GetFullPathNameW
KERNEL32.dll1064SearchPathW
KERNEL32.dll318FindFirstFileW
KERNEL32.dll482GetEnvironmentVariableW
ordentry_vafunction_name
10x404cConvertAtJobsToTasks
20x32ccDllCanUnloadNow
30x104cDllGetClassObject
40x43d4GetNetScheduleAccountInformation
50x30f0NetrJobAdd
60x3120NetrJobDel
70x3150NetrJobEnum
80x3190NetrJobGetInfo
90x325cSAGetAccountInformation
100x322cSAGetNSAccountInformation
110x31c0SASetAccountInformation
120x31fcSASetNSAccountInformation
130x4384SetNetScheduleAccountInformation
module_namemstask.dll
flags0
timestamp2010-11-20 10:03:17
version0.0
ordinal_base1
nFunctions13
nNames13
Names(13)0x1983c
Functions(13)0x19808
NameOrdinals(13)0x19870

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTask Scheduler interface DLL
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameTaskScheduler
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemstask.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0232496BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2e8