Static | ZeroBOX

PE Compile Time

2086-09-13 02:41:14

PDB Path

Task32Watch.pdb

PE Imphash

f34d5f2d4577ed6d9ceec516c1f5a744

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00002000 0x0000eaa4 0x0000ec00 5.94986062525
.rsrc 0x00012000 0x000006ca 0x00000800 3.76153751356
.reloc 0x00014000 0x0000000c 0x00000200 0.0815394123432

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x000120a0 0x0000043e LANG_NEUTRAL SUBLANG_NEUTRAL data
RT_MANIFEST 0x000124e0 0x000001ea LANG_NEUTRAL SUBLANG_NEUTRAL XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

Library mscoree.dll:
0x402000 _CorExeMain

!This program cannot be run in DOS mode.
`.rsrc
@.reloc
x'aEyv
p\'-:!@
?Kq>Za8g
uo8jZ
Z?_b`
>9]NZ
Z R$Gja8s
Z %rJsa8
roZ zi
Z h@(2a8O
)#2bZ
_bj/
FI Lp6
_bY*
r@H8Z
KZ =$7
QZ zON
pCGZa8
8{Za8)
_J%&8
Z_bX
c5Z k~%;a+
;VZ %|
Y_cX*
n$'TZ G
T Uv]ca%
EtZ L3<
'ni>Za+
i_j%&8L
/O`i%+
(*=/Z
6{.eZ )M
q'%Z y
,9 %HWk
%$ -]a
%( V,
%/ x|
%: 0Z
%> %%
%E *M^
%M Bc
%N eu
%U i$
%X Zy
%[ E.
%i QH
%s Dn
%{ z\
Z f:=9a8
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
v4.0.30319
#Strings
#Strings
#Schema
string_10
string_20
string_11
string_21
string_1
string_12
string_22
UInt32
string_2
string_13
string_23
string_3
string_14
string_4
string_15
string_5
string_16
string_6
string_7
get_UTF8
string_8
string_19
string_9
<Module>
_ZD4kGsHHrOs6CIEqyisOIBsl8ZB
_j5gFaTKindyjnJPONVg1EYXTpEO
System.IO
_aoHJ7fsDiadGEMm6CWEQwoRaWZP
_f7hYyD287kFdWvLxLiKetoOQS7S
_WQuSiiYEDX0jPjFjF4bXhP6e6rT
_GcSC1eBFvpnM9jfxppMHbktcVOY
cfname_
_umpLwYfP7CD6l5jBII45m3f3aRb
mscorlib
_epUchL8P0bn4mzgVl9bp6z07UPd
get_CurrentThread
get_IsAttached
Synchronized
set_IsBackground
GetMethod
CreateInstance
set_AutoScaleMode
FileMode
Invoke
IDisposable
RuntimeFieldHandle
RuntimeTypeHandle
GetTypeFromHandle
set_FormBorderStyle
set_WindowStyle
ProcessWindowStyle
get_ExStyle
set_ExStyle
set_Name
get_ProcessName
GetProcessesByName
xfname
WriteLine
ValueType
GetElementType
MethodBase
ApplicationSettingsBase
Dispose
EditorBrowsableState
Delete
STAThreadAttribute
CompilerGeneratedAttribute
GuidAttribute
GeneratedCodeAttribute
DebuggerNonUserCodeAttribute
DebuggableAttribute
EditorBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
SuppressIldasmAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
ConfusedByAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
set_UseShellExecute
ReadByte
get_IsAlive
Task32Watch.exe
set_ClientSize
_tRicHc8VJSo7vKTqLYD5hbe99Yf
System.Threading
Encoding
IsLogging
System.Runtime.Versioning
GetString
disposing
System.Drawing
_reFPD022UO8fjM58tfFm4lSqd7h
Task32Watch
GetTempPath
GetFolderPath
get_Length
_EAWtJD70PZ64fbbXOuT2imjeQyh
_lASEZBQ0DG5L0F7fH82IiXWL8Yj
_pBIwiaqo0AhjytLqbqgbRI8512k
_4Y2TRoWCfE5NOtvI0NhRZ6AGUrk
System.ComponentModel
ContainerControl
FileStream
MemoryStream
System
StopOn
set_ShowIcon
Application
System.Configuration
System.Globalization
System.Reflection
Intern
DisableRun
CheckRun
_Bf0zgr6EVj8vTdpP8wupK8vn4o
_LyeDtyJMjhKOQsTutnabwvgRLXo
MethodInfo
FileInfo
CultureInfo
FileSystemInfo
set_StartInfo
ProcessStartInfo
RequestInfo
set_ShowInTaskbar
SpecialFolder
Buffer
ResourceManager
Debugger
System.CodeDom.Compiler
IContainer
StreamWriter
TextWriter
.cctor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
System.Resources
_pBIwiaqo0AhjytLqbqgbRI8512k.resources
Task32Watch.Fregat.resources
DebuggingModes
InheritPrevileges
Task32Watch.Properties
EnableVisualStyles
ReadAllLines
GetProcesses
set_Attributes
FileAttributes
Settings
Equals
get_CreateParams
System.Windows.Forms
Contains
set_AutoScaleDimensions
RuntimeHelpers
FileAccess
GetCurrentProcess
set_Arguments
Exists
Concat
Fregat
Object
SetCompatibleTextRenderingDefault
Environment
ParameterizedThreadStart
FailFast
MakeInst
SuspendLayout
ResumeLayout
System.Text
set_Text
set_CreateNoWindow
InitializeArray
get_Assembly
GetCallingAssembly
GetExecutingAssembly
BlockCopy
set_WorkingDirectory
set_Opacity
op_Equality
op_Inequality
Confuser.Core 1.2.0+4110faee9d
WrapNonExceptionThrows
DLL Host Service
Shell Infrastructure Host
&Microsoft
Windows
Operating System
dllhost
Microsoft Corporation. All Rights Reserved.
Microsoft Corporation.
$7b7344d7-8ee4-4af1-b4d1-ee28bf905570
10.0.19041.746
.NETFramework,Version=v4.6.1
FrameworkDisplayName
.NET Framework 4.6.1
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
11.0.0.0
Task32Watch.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Shell Infrastructure Host
CompanyName
Microsoft
Windows
Operating System
FileDescription
DLL Host Service
FileVersion
10.0.19041.746
InternalName
Task32Watch.exe
LegalCopyright
Microsoft Corporation. All Rights Reserved.
LegalTrademarks
Microsoft Corporation.
OriginalFilename
Task32Watch.exe
ProductName
dllhost
ProductVersion
10.0.19041.746
Assembly Version
10.0.19041.746
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Tedy.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.MSILHeracles.40131
ClamAV Clean
FireEye Gen:Variant.MSILHeracles.40131
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
McAfee RDN/Generic.dx
Cylance unsafe
VIPRE Gen:Variant.MSILHeracles.40131
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0059cf7a1 )
BitDefender Gen:Variant.MSILHeracles.40131
K7GW Trojan ( 0059cf7a1 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZemsilCO.36250.dm0@aigZqsn
VirIT Clean
Cyren W32/ABRisk.ZXPQ-4777
Symantec ML.Attribute.HighConfidence
tehtris Clean
ESET-NOD32 a variant of MSIL/Spy.Agent.DZE
APEX Malicious
Paloalto Clean
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.MSIL.Agent.gen
Alibaba Trojan:Win32/Generic.0d5c232d
NANO-Antivirus Clean
ViRobot Clean
Rising Malware.Obfus/MSIL@AI.88 (RDM.MSIL2:5sDdg/jBidzZCJSOmMubwQ)
Sophos Mal/Generic-S
Baidu Clean
F-Secure Trojan.TR/Dropper.MSIL.Gen
DrWeb Clean
Zillya Clean
TrendMicro TROJ_GEN.R06CC0DF723
McAfee-GW-Edition RDN/Generic.dx
Trapmine Clean
CMC Clean
Emsisoft Gen:Variant.MSILHeracles.40131 (B)
Ikarus Clean
GData Gen:Variant.MSILHeracles.40131
Jiangmin Clean
Webroot W32.Trojan.Gen
Avira TR/Dropper.MSIL.Gen
MAX malware (ai score=88)
Antiy-AVL Trojan/Win32.Tiggre
Gridinsoft Clean
Xcitium Clean
Arcabit Trojan.MSILHeracles.D9CC3
SUPERAntiSpyware Clean
ZoneAlarm HEUR:Trojan.MSIL.Agent.gen
Microsoft Trojan:MSIL/Anagra.R!MTB
Google Detected
AhnLab-V3 Dropper/Win.Generic.C5184084
Acronis Clean
VBA32 CIL.HeapOverride.Heur
ALYac Gen:Variant.MSILHeracles.40131
TACHYON Clean
DeepInstinct MALICIOUS
Malwarebytes Trojan.FakeMS
Panda Clean
Zoner Clean
TrendMicro-HouseCall TROJ_GEN.R06CC0DF723
Tencent Clean
Yandex Clean
SentinelOne Clean
MaxSecure Trojan.Malware.184485797.susgen
Fortinet PossibleThreat
AVG Win32:DropperX-gen [Drp]
Avast Win32:DropperX-gen [Drp]
No IRMA results available.