| 在线病毒检测器 | v.1.0.184.174 |
| 数据库版本: | 2024-08-15 12:00:27 |
CoinMiner是一种利用受害者的计算机资源（主要是CPU和RAM）进行加密货币挖掘（例如Monero或Zcash）的恶意软件。此恶意软件通过将开源挖掘工具集成到系统的启动例程中来建立持久性，而不需要用户的同意。高级的加密货币挖掘程序通常采用定时器配置或CPU使用限制等技术，以悄悄运行并避免检测。
| File | WinLogin.exe |
| 已检查 | 2024-08-15 09:58:32 |
| MD5 | f218a1bbd12d9247c4e49c47b27ec0ef |
| SHA1 | 1ac11a3fdbdb7504cf0ed6551ed6cc44aea7a0aa |
| SHA256 | 0c758eaa5f4133ac24aad67d68bd4db01a401ee3465f499a2464778971d56026 |
| SHA512 | bf17265ca9b4573ed9f7c6461744639bb13c5ffcf3f13d148e60e04da33eaa838cac588cca422ea5ed3263cd7c913569d98443edf0ee9c19f33e9bd13ac0b5fd |
| Imphash | a4746e3291b3b8dd9a0af714ef1d6e21 |
| File Size | 4883968 bytes |
Gridinsoft能够识别并消除Trojan.Win64.CoinMiner.mz!s6，无需进一步的用户干预。
| CompanyName | jhoo1ho**d1d1d1dsa987juihdasdds1d1klJ)hno1bdi1udsad-1duj9SHJOIDH801oi2d1-d9u9-21ddsadasdas |
| FileDescription | WinLogin |
| FileVersion | 0.0.1 |
| LegalCopyright | Copyright (C) 2024 jhoo1ho**d1d1d1dsa987juihdasdds1d1klJ)hno1bdi1udsad-1duj9SHJOIDH801oi2d1-d9u9-21ddsadasdas |
| OriginalFilename | jhoo1ho**d1d1d1dsa987juihdasdds1d1klJ)hno1bdi1udsad-1duj9SHJOIDH801oi2d1-d9u9-21ddsadasdas.exe |
| ProductName | WinLogin |
| ProductVersion | 0.0.1 |
| Translation | 0x0000 0x04b0 |
 |
5e8019feb3e3cf253165a157f49dcf78 49ef6904231244ed8ffe1b4ca13ec6ad 90685832b2ece4c9 |
| Image Base: | 0x139900000 |
| Entry Point: | 0x139ce6720 |
| Compilation: | 2024-08-11 03:39:10 |
| Checksum: | 0x00000000 (Actual: 0x004b5aad) |
| OS Version: | 6.0 |
| PEiD: | PE32+ executable (console) x86-64, for MS Windows |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 9 |
| Imports: | WS2_32, IPHLPAPI, USERENV, CRYPT32, KERNEL32, USER32, ole32, ADVAPI32, ntdll, bcrypt, |
| Exports: | 0 |
| Resources: | 12 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | MD5 | 熵 |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00444d84 | 0x00444e00 | 382a5803eeae2ed792a2a06b6b518c6e | 6.48 |
| .data | 0x00446000 | 0x002a9134 | 0x0000aa00 | 08cd2be2dd494eadc086e427d644765b | 3.84 |
| .pdata | 0x006f0000 | 0x00026dfc | 0x00026e00 | a841fc984fce31edfa4a6b2a0f8db0d1 | 6.33 |
| .idata | 0x00717000 | 0x000028ca | 0x00002a00 | 2e46cc3888abd2ef7945fe316deb1e3b | 4.69 |
| _RANDOMX | 0x0071a000 | 0x00000c56 | 0x00000e00 | 9ee63642b94966ecb630ee0843e46b26 | 5.68 |
| _TEXT_CN | 0x0071b000 | 0x000026d1 | 0x00002800 | afea7882aa31e5987db2f12b8933de56 | 6.08 |
| _TEXT_CN | 0x0071e000 | 0x00001184 | 0x00001200 | 409bf3f918f2402291cb56c2e9354b47 | 6.05 |
| .rsrc | 0x00720000 | 0x0001f9b8 | 0x0001fa00 | 1930eaf29a61885f6c35c73a5df7d01f | 4.84 |
| .reloc | 0x00740000 | 0x0000afa8 | 0x0000b000 | 79b274e615a191de220a9386d8926c91 | 5.45 |
