Should I block it?

No, this file is 100% safe to run.

Additional versions

1,0,0,473	15.15%
1,0,0,473	9.09%
1,0,0,473	3.03%
1,0,0,471	3.03%
1,0,0,465	3.03%
1,0,0,460	3.03%
1,0,0,434	3.03%
1,0,0,433	15.15%
1,0,0,433	3.03%
1,0,0,433	3.03%
1,0,0,433	3.03%
1,0,0,403	3.03%
1,0,0,341	3.03%
1,0,0,341	3.03%
1,0,0,271	3.03%
1,0,0,259	3.03%
1,0,0,259	3.03%
1,0,0,247	3.03%
1,0,0,247	3.03%
1,0,0,247	3.03%
1,0,0,240	3.03%
1,0,0,240	3.03%
1,0,0,237	3.03%

Relationships

schedhlp.exe (Acronis Scheduler Helper by Acronis International GmbH)

PE file structure

Show functions

Import table

advapi32.dll

GetSidSubAuthorityCount, RegEnumKeyExW, RegDeleteKeyW, RegDeleteKeyA, OpenServiceW, QueryServiceStatus, SetThreadToken, GetSecurityDescriptorOwner, SetFileSecurityW, GetUserNameW, SetSecurityDescriptorOwner, StartServiceA, RegSetValueExA, RegDeleteValueA, RegQueryValueExA, RegQueryValueExW, RegSetValueExW, AllocateAndInitializeSid, RegCloseKey, FreeSid, EqualSid, RegOpenKeyExA, RegEnumValueW, LookupAccountSidW, RegSetKeySecurity, RegCreateKeyExA, RegEnumKeyExA, RegEnumValueA, IsValidSid, GetTokenInformation, AllocateLocallyUniqueId, RevertToSelf, ImpersonateLoggedOnUser, LogonUserW, RegOpenKeyExW, CreateProcessAsUserW, SetTokenInformation, GetSidSubAuthority, SetSecurityInfo, GetSidIdentifierAuthority, OpenThreadToken, GetUserNameA, RegCreateKeyExW, CloseEventLog, OpenEventLogW, GetNumberOfEventLogRecords, GetOldestEventLogRecord, ReadEventLogA, NotifyChangeEventLog, OpenProcessToken, RegDeleteValueW, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, CloseServiceHandle, OpenServiceA, OpenSCManagerA, AdjustTokenPrivileges, LookupPrivilegeValueA, SetKernelObjectSecurity, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, CopySid, GetLengthSid, LookupPrivilegeNameW, GetFileSecurityW, QueryServiceConfigW, OpenSCManagerW, StartServiceW, RegFlushKey

comdlg32.dll

GetOpenFileNameA, GetSaveFileNameW, GetOpenFileNameW, GetSaveFileNameA

gdi32.dll

EnumFontFamiliesExA, CreateFontIndirectA, GetTextMetricsA, EnumFontFamiliesExW, CreateFontIndirectW, GetTextMetricsW

kernel32.dll

DllMain

mpr.dll

WNetCloseEnum, WNetCancelConnection2W, WNetEnumResourceW, WNetOpenEnumW, WNetGetUniversalNameW, WNetAddConnection3W, WNetGetUniversalNameA, WNetAddConnection3A

ole32.dll

CoInitialize, CoInitializeEx, CoCreateInstance, CoUninitialize, OleInitialize, OleUninitialize

rpcrt4.dll

RpcStringBindingComposeA, RpcBindingFromStringBindingA, RpcStringFreeA, RpcBindingFree, NdrClientCall2, NdrServerInitializeNew, NdrConvert, NdrConformantArrayUnmarshall, NdrConformantArrayBufferSize, RpcServerUnregisterIf, I_RpcGetBuffer, NdrConformantArrayMarshall, RpcRaiseException, RpcServerUseProtseqEpA, RpcServerRegisterIf, RpcServerListen, RpcImpersonateClient, RpcRevertToSelf

shell32.dll

SHGetFileInfoA, SHGetMalloc, SHGetDesktopFolder, ShellExecuteExA, ShellExecuteA, SHGetPathFromIDListA, ShellExecuteW, ShellExecuteExW, Shell_NotifyIconA

user32.dll

UnregisterClassA, SetTimer, SendMessageA, GetWindowLongA, WinHelpW, DispatchMessageA, SendNotifyMessageA, CreateDialogIndirectParamA, PeekMessageA, RegisterClassExA, RegisterClipboardFormatA, TranslateMessage, GetMessageA, SetWindowLongA, CreateWindowExA, RegisterClassA, PostQuitMessage, KillTimer, wsprintfW, GetWindowThreadProcessId, AppendMenuA, ModifyMenuA, SetWindowTextA, SystemParametersInfoA, GetClipboardFormatNameA, EnumWindows, PostMessageA, RegisterClassExW, DefWindowProcW, GetClipboardFormatNameW, AppendMenuW, ModifyMenuW, SetWindowTextW, SystemParametersInfoW, DefWindowProcA, GetWindowLongW, SetWindowLongW, SendMessageW, WinHelpA, VkKeyScanA, VkKeyScanExA, CharUpperBuffW, CharUpperBuffA, SendNotifyMessageW, VkKeyScanExW, CharLowerW, VkKeyScanW, PostMessageW, CreateDialogIndirectParamW, RegisterClipboardFormatW, DispatchMessageW, PeekMessageW, CharUpperA

version.dll

GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

ws2_32.dll

WSARecv, WSASend

schedul2.exe

Acronis Scheduler 2 by Acronis (Signed)

Remove schedul2.exe

Version:	1,0,0,341
MD5:	2c41ae09bb51ea074069135f183daa9c
SHA1:	e7b1107a8f1f9fa5fd7125ce89f4a4fc454667f8
SHA256:	3c6bb986c36d715ebf401ed480a620025d87b657cdf3cf16bcf1cbdcf327a074

What is schedul2.exe?

Acronis Scheduler for Acronis True Image is a backup and disk imaging program for Windows. As a disk imaging software, True Image can restore the previously captured image to another disk, replicating the structure and contents to the new disk, also allowing disk cloning and partition resizing.

About schedul2.exe (from Acronis)

“True Image by Acronis protects your photos, documents, music, mail, programs, contacts, calendars, and more. It stores your content in a secure online location and syncs it with your devices.”

Overview

schedul2.exe runs as a service under the name Service Scheduler2 Acronis (AcrSch2Svc) with extensive SYSTEM privileges (full administrator access). It is installed with a couple of know programs including Acronis True Image Home published by Acronis and Acronis True Image Home published by Acronis. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). The file is digitally signed by Acronis which was issued by the VeriSign certificate authority (CA).

Details

File name:	schedul2.exe
Publisher:	Acronis
Product name:	Acronis Scheduler 2
Typical file path:	C:\Program Files\common files\acronis\schedule2\schedul2.exe
File version:	1,0,0,341
Size:	645.09 KB (660,576 bytes)
Certificate
Issued to:	Acronis
Authority (CA):	VeriSign
Effective date:	Wednesday, September 5, 2007
Expiration date:	Friday, September 26, 2008
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Programs

The following programs will install this file

Acronis True Image Home

Acronis

10% remove

Acronis True Image (or simply True Image) is a brand name for a line of backup and disk imaging software for Microsoft operating systems, produced by Acronis. As a disk imaging software, True Image can restore the previously captured image to another disk, replicating the structure and contents to the new disk, also allowing disk cloning and partition resizing, even if the new disk is of different capacity. The backups are in a propriet...

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'AcrSch2Svc' (Service Scheduler2 Acronis)
AcrSch2Svc

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00035164%	0.028634%
Kernel CPU:	0.00022602%	0.013761%
User CPU:	0.00012562%	0.014873%
Kernel CPU time:	45,422 ms/min	100,923,805ms/min
Context switches:	2/sec	284/sec
Memory
Private memory:	1.31 MB	21.59 MB
Private (maximum):	3.73 MB
Private (minimum):	724 KB
Non-paged memory:	1.31 MB	21.59 MB
Virtual memory:	34.41 MB	140.96 MB
Virtual memory (peak):	35.56 MB	169.69 MB
Working set:	1.42 MB	18.61 MB
Working set (peak):	3.75 MB	37.95 MB
Page faults:	27,447/min	2,039/min
I/O
I/O read transfer:	81 Bytes/sec	1.02 MB/min
I/O read operations:	3/sec	343/min
I/O write transfer:	74 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	2.7 KB/sec	448.09 KB/min
I/O other operations:	147/sec	1,671/min
Resource allocations
Threads:	7	12
Handles:	104	600
GUI GDI count:	5	103
GUI USER count:	1	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	"C:\Program Files\common files\acronis\schedule2\schedul2.exe"
Owner:	SYSTEM
Windows Service
Service name:	AcrSch2Svc
Display name:	Service Scheduler2 Acronis
Description:	“Planification de tâches pour les applications Acronis.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads