» svchost.exe
Overview
Analysis
File Details

svchost.exe

RFWatch

Lepide Software Pvt. Ltd.

File name:

svchost.exe

Publisher:

Lepide Software Pvt.Ltd (signed by Lepide Software Pvt. Ltd.)

Product:

RFWatch

Version:

11.03

MD5:

ecf1059a5657789cc4ddd70091f3f603

SHA-1:

98402ec0fc241b41f01eec0355944bbcbdacbf58

SHA-256:

229cc5058425f637607c02ea9deec85e1c0cb30e0358fe33d4098a9d5afd5f46

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

4/20/2024 2:08:01 PM UTC (today)

Scan engine

Detection

Engine version

McAfee

Keylog-RFEM

5600.7234

File size:

784.1 KB (802,952 bytes)

Product version:

11.03

Original file name:

RFWatch.EXE

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Windows\System32\zx_wh\svchost.exe

Digital Signature

Signed by:

Lepide Software Pvt. Ltd.

Authority:

GlobalSign nv-sa

Valid from:

3/29/2011 11:03:27 AM

Valid to:

3/22/2012 4:47:30 PM

Subject:

CN=Lepide Software Pvt. Ltd., O=Lepide Software Pvt. Ltd., C=IN

Issuer:

CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE

Serial number:

0100000000012F00D11CB1

File PE Metadata

Compilation timestamp:

3/3/2011 1:43:21 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

24576:QCTsyqzQ0M0IDFeRtMHJOL3PksMLAsF9T7yma:9OzQ0wTHJ1YeT0

Entry address:

0x26DBA

Entry point:

55, 8B, EC, 6A, FF, 68, 68, CE, 48, 00, 68, 90, 6F, 42, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 24, C3, 48, 00, 59, 83, 0D, C4, 3B, 4C, 00, FF, 83, 0D, C8, 3B, 4C, 00, FF, FF, 15, 28, C3, 48, 00, 8B, 0D, 24, D4, 4B, 00, 89, 08, FF, 15, 2C, C3, 48, 00, 8B, 0D, 20, D4, 4B, 00, 89, 08, A1, 30, C3, 48, 00, 8B, 00, A3, C0, 3B, 4C, 00, E8, 9A, 01, 00, 00, 39, 1D, 58, 30, 4B, 00, 75, 0C, 68, C0, 6F, 42, 00, FF, 15, 34, C3... 
[+]

Entropy:

6.3556

Developed / compiled with:

Microsoft Visual C++ v6.0

Code size:

556 KB (569,344 bytes)

Scan svchost.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.