home

AWAYSCH.EXE

Maintenance Manager

Lenovo (Japan) Ltd

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘AwaySch’.
Publisher:
Lenovo Group Limited  (signed by Lenovo (Japan) Ltd)

Product:
Maintenance Manager

Description:
Maintenance Manager Scheduler

Version:
3, 0, 0, 0

MD5:
beef4eef24a61e351c9c3f46c7e758f5

SHA-1:
ff702b1b815f69fddd4a3436d4a2eb6071424f3f

SHA-256:
c9acd60262b932a63bd623da5268481bf46b6cf5f4e99c002faff5c0c5629406

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 8:12:32 AM UTC  (today)

File size:
107 KB (109,608 bytes)

Copyright:
Copyright (C) Lenovo 2005, 2006

Original file name:
AWAYSCH.EXE

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\Program Files\lenovo\awaytask\awaysch.exe

Digital Signature
Signed by:
Lenovo (Japan) Ltd

Authority:
VeriSign, Inc.

Valid from:
4/19/2006 8:00:00 PM

Valid to:
4/20/2007 7:59:59 PM

Subject:
CN=Lenovo (Japan) Ltd, OU="TVT Development 3, R&D", OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Lenovo (Japan) Ltd, L=Yamato-shi, S=Kanagawa, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
714F93E21C50CDB2616394BCF33153A5

File PE Metadata
Compilation timestamp:
11/7/2006 6:58:55 PM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
3072:c4Xrth3Knr7GIk64ers86TKW+2ZDlwELoj5suG:lUOpsrsrx5

Entry address:
0x3DF0

Entry point:
48, 83, EC, 28, E8, D7, 5E, 00, 00, 48, 83, C4, 28, E9, FE, FC, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 89, 4C, 24, 08, 48, 83, EC, 38, 48, 89, 5C, 24, 50, 48, 8B, CA, 48, 89, 7C, 24, 28, 48, 8B, DA, E8, E3, 6D, 00, 00, 8B, 4B, 18, F6, C1, 82, 48, 63, F8, 75, 23, E8, 93, 13, 00, 00, C7, 00, 09, 00, 00, 00, 83, 4B, 18, 20, B8, FF, FF, FF, FF, 48, 8B, 7C, 24, 28, 48, 8B, 5C, 24, 50, 48, 83, C4, 38, C3, F6, C1, 40, 74, 23, E8, 6B, 13, 00, 00, C7, 00, 22, 00, 00, 00, 83, 4B, 18, 20, B8...
 
[+]

Entropy:
6.1788

Code size:
67.5 KB (69,120 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
AwaySch

Command:
C:\Program Files\lenovo\awaytask\awaysch.exe


Scan AWAYSCH.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.