| 文件名 | winlogson.exe |
| 文件类型 |
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
|
| 扫描器版本 | 1.0.186.174 |
| 数据库版本 | 2024-09-04 04:00:15 UTC |
恶意软件家族: CoinMiner
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
5385a40c6af4c73f43cfa5de46b9f05a
|
|
| SHA1 |
aec914b73e3c7b4efe0971d1a87e62de2b0776a4
|
|
| SHA256 |
21bc43587dc1f19ec6271e69fe709b18fdefdfbfc5971a3edf00e92cb1b77995
|
|
| SHA512 |
2273c25dcd4eb20c5cdf2d941a523362a680bbb341f2b64dcd17bbc40e66e60b2319fa0804cfa6303299b17ed6cd8d57b7e8efb465417b680370d922d8c89dd7
|
|
| ImpHash |
0b9709c1ad172fbf7dc8ea7943281cb3
|
| 图标 |
哈希: e8722c548890318e4b9e2a5ec1dc3aa5
模糊: 6779bf959ed497a7f621ba3ddbad0454 dHash: 00b28e8e86868600 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x004014f0 |
| 编译时间 | 2021-12-02 14:10:39 |
| 校验和 | 0x007da669 (实际: 0x007da669) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 |
10 库
ADVAPI32, CRYPT32, IPHLPAPI, KERNEL32, msvcrt, ole32, SHELL32, USER32, USERENV, WS2_32 |
| 导出 | 0 函数 |
| 资源 | 11 资源 |
| 节 | 10 节 |
| CompanyName | www.xmrig.com |
| FileDescription | System Authentication Policy |
| FileVersion | 6.16.2 |
| LegalCopyright | Copyright (C) 2016-2021 xmrig.com |
| OriginalFilename | xmrig.exe |
| ProductName | XMRig |
| ProductVersion | 6.16.2 |
| Translation | 0x0000 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
6,191,128 bytes | 6,193,152 bytes | 6.48 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4096BYTES
|
5D50078F9FF9439159DE834E1147BC32 |
.data |
0x005e9000 |
66,592 bytes | 67,072 bytes | 3.11 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_64BYTES
|
4873ACF8CD5C156D93D63DD53642EE66 |
.rdata |
0x005fa000 |
1,449,264 bytes | 1,449,472 bytes | 6.38 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES
|
98C02A974EFE047761D8C1ECB13C8A5A |
.pdata |
0x0075c000 |
192,672 bytes | 193,024 bytes | 6.38 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
A3F26E961EE644BD351E86EE32871F43 |
.xdata |
0x0078c000 |
241,760 bytes | 242,176 bytes | 5.08 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES
|
DA9B9AA5714949988E8D37507D903DB7 |
.bss |
0x007c8000 |
3,279,168 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_64BYTES
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x00ae9000 |
18,020 bytes | 18,432 bytes | 4.72 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
9110EFBD511F2CFCC620A2DA2655E8F4 |
.CRT |
0x00aee000 |
112 bytes | 512 bytes | 0.33 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES
|
EEBDEBAAE95B68C91B8D8369B7B236D8 |
.tls |
0x00aef000 |
16 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x00af0000 |
47,771 bytes | 48,128 bytes | 3.86 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
0F5321516B99973021AC9D02CAF5EFEB |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 8 | 45,155 字节 | |
| RT_GROUP_ICON | 1 | 118 字节 | |
| RT_VERSION | 1 | 688 字节 | |
| RT_MANIFEST | 1 | 1,167 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
