[SOLVED] PE Internal Name

[Starf0x]

Hello,

Let me get straight to the point, we've (against my better judgement) decomissioned an excellent Desktop Management tool, one of the options build is was a Application Monitor and it could block applications from running.

Now I won't pretent I am as good as the vendor and am able to reproduce this, but at least I'm trying.

I'm currently working on a simple tiny program that looks on a time interval what processes there are running and checks this with a 'Denied' list.

But of course I expect the end users to be smart and simply rename the executable and are still able to play 'Bomber' during office hours.

Of course there are even many other ways to mask an executable, but I don't want this to be a super extensive application, just the basic detection.

Is it possible (with the least impact) to see what the internal name is of an executable?

I've looked at Process.GetProcesses.MainModule.ModuleName, but that gives also the executable name, and not the internal name.

I have an way to get this information via WMI, but that is very resource intensive, is there another way?

Kind Regards, Starf0x

[Starf0x]

Is this a difficult question or am I missing something obvious?

Kind Regards, Starf0x

[Starf0x]

nevermind, it is obvious, stupid naming convention:

MainModule.FileVersionInfo.InternalName

I never expected this to b within the File Version Information, I was thinking digits.

Starf0x