filenamemstask.dll
size209920 (0x33400)
md5c5a99a4c0dc9f0f5a95ba0c83d30a549
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307294
10270
1473072915
146307291
1323072944
1313072920
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7b8d1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x16a00
SizeOfInitializedData0x1c600
SizeOfUninitializedData0
AddressOfEntryPoint0x2156
BaseOfCode0x1000
BaseOfData0x18000
ImageBase0x6c8c0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x35000
SizeOfHeaders0x400
CheckSum0x3b1c2
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x1686f0x16a00R-X CODE
.data0x180000xbf00xc00RW- IDATA
.rsrc0x190000x1a9d00x1aa00R-- IDATA
.reloc0x340000xe640x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x141c0x385
IMPORT0x167dc0xa0
RESOURCE0x190000x1a9d0
EXCEPTION00
SECURITY00
BASERELOC0x340000xe64
DEBUG0x178100x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x3f600x40
Bound_IAT0x2800x98
IAT0x10000x2e0
Delay_IAT0x161280x1c0
CLR_Header00
typenamesizecp
MUI#12400
BITMAP#2713600
BITMAP#27211280
BITMAP#27524080
BITMAP#334281860
ICON#17440
ICON#22960
ICON#337520
ICON#422160
ICON#513840
ICON#696400
ICON#742640
ICON#811280
ICON#97440
ICON#102960
ICON#1137520
ICON#1222160
ICON#1313840
ICON#1496400
ICON#1542640
ICON#1611280
ICON#1716400
ICON#187440
ICON#192960
ICON#2037520
ICON#2122160
ICON#2213840
ICON#2396400
ICON#2442640
ICON#2511280
ICON#267440
GROUP_ICON#1001320
GROUP_ICON#101200
GROUP_ICON#2731180
GROUP_ICON#2741180
VERSION#19400
MANIFEST#27220
module_namehintordfunction_name
msvcrt.dll1254mbstowcs_s
msvcrt.dll1190free
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll764_purecall
msvcrt.dll1380wcsstr
msvcrt.dll563_itow
msvcrt.dll1017_wcsnicmp
msvcrt.dll1387wcstoul
msvcrt.dll1375wcspbrk
msvcrt.dll1379wcsspn
msvcrt.dll1361wcschr
msvcrt.dll1277rand
msvcrt.dll974_vsnwprintf
msvcrt.dll1262memset
msvcrt.dll1007_wcsicmp
msvcrt.dll1258memcpy
msvcrt.dll1260memmove
msvcrt.dll345_except_handler4_common
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll106_XcptFilter
msvcrt.dll1376wcsrchr
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1246malloc
msvcrt.dll1385wcstombs
ADVAPI32.dll334GetSecurityInfo
ADVAPI32.dll678SetEntriesInAclW
ADVAPI32.dll699SetSecurityInfo
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll373ImpersonateSelf
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll304GetFileSecurityW
ADVAPI32.dll5AccessCheck
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll288FreeSid
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll575RegDeleteKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll357GetUserNameW
ADVAPI32.dll564RegConnectRegistryW
USER32.dll533MessageBoxW
USER32.dll658SetFocus
USER32.dll296GetDlgItemInt
USER32.dll521MapWindowPoints
USER32.dll483KillTimer
USER32.dll699SetTimer
USER32.dll65CheckRadioButton
USER32.dll62CheckDlgButton
USER32.dll218EndDialog
USER32.dll462IsDlgButtonChecked
USER32.dll627SendDlgItemMessageW
USER32.dll356GetParent
USER32.dll418GetWindowTextLengthW
USER32.dll412GetWindowRect
USER32.dll710SetWindowPos
USER32.dll809WinHelpW
USER32.dll715SetWindowTextW
USER32.dll216EnableWindow
USER32.dll735ShowWindow
USER32.dll163DestroyIcon
USER32.dll382GetSystemMetrics
USER32.dll708SetWindowLongW
USER32.dll406GetWindowLongW
USER32.dll172DialogBoxParamW
USER32.dll156DefWindowProcW
USER32.dll506LoadStringW
USER32.dll495LoadImageW
USER32.dll648SetCursor
USER32.dll110CreateWindowExW
USER32.dll590RegisterClassW
USER32.dll491LoadCursorW
USER32.dll298GetDlgItemTextW
USER32.dll656SetDlgItemTextW
USER32.dll295GetDlgItem
USER32.dll166DestroyWindow
USER32.dll636SendMessageW
USER32.dll270GetClassInfoW
GDI32.dll230DeleteObject
GDI32.dll525GetStockObject
RPCRT4.dll507UuidCreate
RPCRT4.dll366RpcBindingSetAuthInfoExW
RPCRT4.dll383RpcEpResolveBinding
RPCRT4.dll494RpcStringBindingComposeW
RPCRT4.dll351RpcBindingFromStringBindingW
RPCRT4.dll498RpcStringFreeW
RPCRT4.dll349RpcBindingFree
RPCRT4.dll45I_RpcExceptionFilter
RPCRT4.dll149NdrClientCall2
KERNEL32.dll451GetCurrentThread
KERNEL32.dll71CancelWaitableTimer
KERNEL32.dll1191SetWaitableTimer
KERNEL32.dll193CreateWaitableTimerW
KERNEL32.dll734InitOnceExecuteOnce
KERNEL32.dll926QueryFullProcessImageNameW
KERNEL32.dll333FindResourceW
KERNEL32.dll832LoadResource
KERNEL32.dll850LockResource
KERNEL32.dll1342lstrcmpW
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll237EnterCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll324FindNextFileW
KERNEL32.dll208DeleteCriticalSection
KERNEL32.dll842LocalReAlloc
KERNEL32.dll292FileTimeToSystemTime
KERNEL32.dll486GetFileAttributesTransactedW
KERNEL32.dll484GetFileAttributesExW
KERNEL32.dll1115SetFileAttributesTransactedW
KERNEL32.dll142CreateFileTransactedW
KERNEL32.dll446GetCurrentDirectoryW
KERNEL32.dll1121SetFilePointer
KERNEL32.dll1103SetEndOfFile
KERNEL32.dll496GetFileType
KERNEL32.dll493GetFileSize
KERNEL32.dll956ReadFile
KERNEL32.dll629GetSystemTime
KERNEL32.dll512GetLocalTime
KERNEL32.dll1209SystemTimeToFileTime
KERNEL32.dll96CompareFileTime
KERNEL32.dll1013ReleaseActCtx
KERNEL32.dll221DisableThreadLibraryCalls
KERNEL32.dll442GetCurrentActCtx
KERNEL32.dll511GetLastError
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll578GetProcAddress
KERNEL32.dll353FreeLibrary
KERNEL32.dll744InterlockedCompareExchange
KERNEL32.dll828LoadLibraryExA
KERNEL32.dll747InterlockedExchange
KERNEL32.dll1198Sleep
KERNEL32.dll931QueryPerformanceCounter
KERNEL32.dll657GetTickCount
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll631GetSystemTimeAsFileTime
KERNEL32.dll1212TerminateProcess
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll1184SetUnhandledExceptionFilter
KERNEL32.dll1000RegSetValueExW
KERNEL32.dll677GetVolumeInformationW
KERNEL32.dll284ExpandEnvironmentStringsW
KERNEL32.dll1354lstrlenW
KERNEL32.dll82CloseHandle
KERNEL32.dll1313WriteFile
KERNEL32.dll143CreateFileW
KERNEL32.dll839LocalFree
KERNEL32.dll1116SetFileAttributesW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll674GetVersionExW
KERNEL32.dll487GetFileAttributesW
KERNEL32.dll349FormatMessageW
KERNEL32.dll213DeleteFileW
KERNEL32.dll515GetLocaleInfoW
KERNEL32.dll475GetEnvironmentVariableW
KERNEL32.dll100CompareStringW
KERNEL32.dll455GetDateFormatW
KERNEL32.dll661GetTimeFormatW
KERNEL32.dll830LoadLibraryW
KERNEL32.dll835LocalAlloc
KERNEL32.dll466GetDriveTypeW
KERNEL32.dll1345lstrcmpiW
KERNEL32.dll397GetComputerNameExW
KERNEL32.dll398GetComputerNameW
KERNEL32.dll301FindClose
KERNEL32.dll312FindFirstFileW
KERNEL32.dll504GetFullPathNameW
KERNEL32.dll1049SearchPathW
KERNEL32.dll750InterlockedIncrement
KERNEL32.dll746InterlockedDecrement
ntdll.dll1389WinSqmIsOptedIn
ntdll.dll1372WinSqmAddToStream
ordentry_vafunction_name
10x4d2dConvertAtJobsToTasks
20x413fDllCanUnloadNow
30x17a6DllGetClassObject
40x5079GetNetScheduleAccountInformation
50x3fb1NetrJobAdd
60x3fdcNetrJobDel
70x4007NetrJobEnum
80x4032NetrJobGetInfo
90x40deSAGetAccountInformation
100x40b3SAGetNSAccountInformation
110x405dSASetAccountInformation
120x4088SASetNSAccountInformation
130x4ff9SetNetScheduleAccountInformation
140x4d2d_ConvertAtJobsToTasks@0
150x413f_DllCanUnloadNow@0
160x17a6_DllGetClassObject@12
170x5079_GetNetScheduleAccountInformation@12
180x3fb1_NetrJobAdd@12
190x3fdc_NetrJobDel@12
200x4007_NetrJobEnum@20
210x4032_NetrJobGetInfo@12
220x40de_SAGetAccountInformation@16
230x40b3_SAGetNSAccountInformation@12
240x405d_SASetAccountInformation@20
250x4088_SASetNSAccountInformation@12
260x4ff9_SetNetScheduleAccountInformation@12
module_namemstask.dll
flags0
timestamp2010-11-20 09:16:35
version0.0
ordinal_base1
nFunctions26
nNames26
Names(26)0x14ac
Functions(26)0x1444
NameOrdinals(26)0x1514

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTask Scheduler interface DLL
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameTaskScheduler
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamemstask.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0209920DLL11/20/2010 12:02:25#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280