| 文件名 | potplayer (1).exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.150.174 |
| 数据库版本 | 2023-12-07 10:01:37 UTC |
恶意软件家族: RussAd
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
5739b874866db4019c0d7bb2735c63a0
|
|
| SHA1 |
473b263c5b2ea6ae19c2a54a5189815f73d41fe2
|
|
| SHA256 |
2e2296eb23a3279754ad779ad931aa6b0c9b502f81f406a2383733488c22a8ad
|
|
| SHA512 |
236d7ade049b137bbdb696509a3434e433c2483f694b425c99a52dcc42ef4a4ef44a7af3ff21f488345c0d41d19e960be6a843483cc324ea409065144a1feca3
|
|
| ImpHash |
20dd26497880c05caed9305b3c8b9109
|
| 图标 |
哈希: acc7b0d2685eb6c9ad24ee788dc220c2
模糊: b108bd000ddab4b449fb1148b0c48bb3 dHash: 33cc9af2f29acc33 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x0041181c |
| 编译时间 | 2018-06-14 13:27:46 |
| 校验和 | 0x0268a8c5 (实际: 0x0268a8c5) |
| 操作系统版本 | 5.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | OK |
| 导入 |
5 库
oleaut32, advapi32, user32, kernel32, comctl32 |
| 导出 | 0 函数 |
| 资源 | 25 资源 |
| 节 | 8 节 |
| Sectigo RSA Time Stamping CA | Sectigo Limited (GB) |
| USERTrust RSA Certification Authority | Sectigo Limited (GB) |
| AAA Certificate Services | Comodo CA Limited (GB) |
| AAA Certificate Services | The USERTRUST Network (US) |
| USERTrust RSA Certification Authority | Sectigo Limited (GB) |
| Sectigo RSA Code Signing CA | LID LABS, OOO (RU) |
| Comments | This installation was built with Inno Setup. |
| CompanyName | |
| FileDescription | PotPlayer Setup (r2312070500) |
| FileVersion | |
| LegalCopyright | |
| ProductName | PotPlayer |
| ProductVersion | |
| Translation | 0x0000 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
62,044 bytes | 62,464 bytes | 6.38 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
0DA5D73FFBC41792FA65A09058A91476 |
.itext |
0x00011000 |
4,004 bytes | 4,096 bytes | 5.78 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
2EB275566563C3F1D0099A0DA7345B74 |
.data |
0x00012000 |
3,212 bytes | 3,584 bytes | 2.30 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
73B859E23F5FD17E00C08DB2E0E73DFE |
.bss |
0x00013000 |
22,204 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x00019000 |
3,588 bytes | 4,096 bytes | 4.60 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
E9B9C0328FD9628AD4D6AB8283DCB20E |
.tls |
0x0001a000 |
8 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x0001b000 |
24 bytes | 512 bytes | 0.20 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3DFFC444CCC131C9DCEE18DB49EE6403 |
.rsrc |
0x0001c000 |
200,704 bytes | 198,144 bytes | 4.52 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
CE40056222D0502DAFBC1DAF16949489 |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 12 | 157,233 字节 | |
| RT_STRING | 6 | 2,668 字节 | |
| RT_RCDATA | 4 | 33,908 字节 | |
| RT_GROUP_ICON | 1 | 118 字节 | |
| RT_VERSION | 1 | 1,268 字节 | |
| RT_MANIFEST | 1 | 1,580 字节 |
| 主题 |
Sectigo RSA Time Stamping Signer #4 Sectigo Limited GB |
| 颁发者 | Sectigo RSA Time Stamping CA |
| 序列号 | 76161378635050837295056099126206603988 |
| 主题 |
Sectigo RSA Time Stamping CA Sectigo Limited GB |
| 颁发者 | USERTrust RSA Certification Authority |
| 序列号 | 63883093293784159655322269805543173561 |
| 主题 |
AAA Certificate Services Comodo CA Limited GB |
| 颁发者 | AAA Certificate Services |
| 序列号 | 1 |
| 主题 |
USERTrust RSA Certification Authority The USERTRUST Network US |
| 颁发者 | AAA Certificate Services |
| 序列号 | 76359301477803385872276235234032301461 |
| 主题 |
Sectigo RSA Code Signing CA Sectigo Limited GB |
| 颁发者 | USERTrust RSA Certification Authority |
| 序列号 | 39390228139828865494873669055555031914 |
| 主题 |
LID LABS, OOO LID LABS, OOO RU |
| 颁发者 | Sectigo RSA Code Signing CA |
| 序列号 | 238784519719654851391842345780850118558 |
OK
按照以下步骤完全从系统中移除威胁
