| 在线病毒检测器 | v.1.0.186.174 |
| 数据库版本: | 2024-09-04 04:00:15 |
CoinMiner是一种利用受害者的计算机资源（主要是CPU和RAM）进行加密货币挖掘（例如Monero或Zcash）的恶意软件。此恶意软件通过将开源挖掘工具集成到系统的启动例程中来建立持久性，而不需要用户的同意。高级的加密货币挖掘程序通常采用定时器配置或CPU使用限制等技术，以悄悄运行并避免检测。
| File | winlogson.exe |
| 已检查 | 2024-09-04 01:20:31 |
| MD5 | 5385a40c6af4c73f43cfa5de46b9f05a |
| SHA1 | aec914b73e3c7b4efe0971d1a87e62de2b0776a4 |
| SHA256 | 21bc43587dc1f19ec6271e69fe709b18fdefdfbfc5971a3edf00e92cb1b77995 |
| SHA512 | 2273c25dcd4eb20c5cdf2d941a523362a680bbb341f2b64dcd17bbc40e66e60b2319fa0804cfa6303299b17ed6cd8d57b7e8efb465417b680370d922d8c89dd7 |
| Imphash | 0b9709c1ad172fbf7dc8ea7943281cb3 |
| File Size | 8216576 bytes |
Gridinsoft能够识别并消除Trojan.Win64.CoinMiner.vb，无需进一步的用户干预。
| CompanyName | www.xmrig.com |
| FileDescription | System Authentication Policy |
| FileVersion | 6.16.2 |
| LegalCopyright | Copyright (C) 2016-2021 xmrig.com |
| OriginalFilename | xmrig.exe |
| ProductName | XMRig |
| ProductVersion | 6.16.2 |
| Translation | 0x0000 0x04b0 |
 |
e8722c548890318e4b9e2a5ec1dc3aa5 6779bf959ed497a7f621ba3ddbad0454 00b28e8e86868600 |
| Image Base: | 0x00400000 |
| Entry Point: | 0x004014f0 |
| Compilation: | 2021-12-02 14:10:39 |
| Checksum: | 0x007da669 (Actual: 0x007da669) |
| OS Version: | 4.0 |
| PEiD: | PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 10 |
| Imports: | ADVAPI32, CRYPT32, IPHLPAPI, KERNEL32, msvcrt, ole32, SHELL32, USER32, USERENV, WS2_32, |
| Exports: | 0 |
| Resources: | 11 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | MD5 | 熵 |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x005e7818 | 0x005e8000 | 5d50078f9ff9439159de834e1147bc32 | 6.48 |
| .data | 0x005e9000 | 0x00010420 | 0x00010600 | 4873acf8cd5c156d93d63dd53642ee66 | 3.11 |
| .rdata | 0x005fa000 | 0x00161d30 | 0x00161e00 | 98c02a974efe047761d8c1ecb13c8a5a | 6.38 |
| .pdata | 0x0075c000 | 0x0002f0a0 | 0x0002f200 | a3f26e961ee644bd351e86ee32871f43 | 6.38 |
| .xdata | 0x0078c000 | 0x0003b060 | 0x0003b200 | da9b9aa5714949988e8d37507d903db7 | 5.08 |
| .bss | 0x007c8000 | 0x00320940 | 0x00000000 | d41d8cd98f00b204e9800998ecf8427e | 0.00 |
| .idata | 0x00ae9000 | 0x00004664 | 0x00004800 | 9110efbd511f2cfcc620a2da2655e8f4 | 4.72 |
| .CRT | 0x00aee000 | 0x00000070 | 0x00000200 | eebdebaae95b68c91b8d8369b7b236d8 | 0.33 |
| .tls | 0x00aef000 | 0x00000010 | 0x00000200 | bf619eac0cdf3f68d496ea9344137e8b | 0.00 |
| .rsrc | 0x00af0000 | 0x0000ba9b | 0x0000bc00 | 0f5321516b99973021ac9d02caf5efeb | 3.86 |
