| 文件名 | 4436990a94d4f59e6e95ddda2edf40cadee17937365eeb0b59c9141549adf90c.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.226.174 |
| 数据库版本 | 2025-10-08 18:00:32 UTC |
恶意软件家族: Packed
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
22a88a21370738b8d68dda97ea7e86a0
|
|
| SHA1 |
fe9af5153e57dc01672c2db1c4726f6f56d1989a
|
|
| SHA256 |
4436990a94d4f59e6e95ddda2edf40cadee17937365eeb0b59c9141549adf90c
|
|
| SHA512 |
cd480d046ccec95f95c9e38b46dd8c02ab291e669ce0daf60580143c543f8a294a8bc733f3ec70ccf26cc53b37b7637292a8359f7f5f7e9655486de7a5560b8b
|
|
| ImpHash |
d400a6a867a8623e410a8599e61fe849
|
| 图标 |
哈希: 81efaa3201546b9fd3931797164009f9
模糊: 3addf73e3fc2088b87d083046523edfb dHash: e0e1e4aebcaec820 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x140609d4c |
| 编译时间 | 2097-04-27 11:12:46 |
| 校验和 | 0x0079fdfd (实际: 0x0079fdfd) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 |
9 库
kernel32, USER32, ADVAPI32, SHELL32, ole32, OLEAUT32, SHLWAPI, WTSAPI32, WININET |
| 导出 | 0 函数 |
| 资源 | 15 资源 |
| 节 | 11 节 |
| CompanyName | Microsoft Corporation |
| FileDescription | WMI Provider Host |
| FileVersion | 10.0.26100.3323 (WinBuild.160101.0800) |
| InternalName | Wmiprvse.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | Wmiprvse.exe |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.26100.3323 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
|
0x00001000 |
263,860 bytes | 128,000 bytes | 7.96 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
EDCC7D42100F67734E34662F8B1D5549 |
|
0x00042000 |
99,072 bytes | 41,472 bytes | 7.95 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D70074C5E2E8AA736AB16278BB232777 |
|
0x0005b000 |
4,218,968 bytes | 4,212,736 bytes | 7.96 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
278DA520CEFFCB2F25FA46ED78B5CF4A |
|
0x00462000 |
15,792 bytes | 8,192 bytes | 7.65 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3BBF5509E1A273EF6F4FC70CD67F7A16 |
|
0x00466000 |
244 bytes | 512 bytes | 2.55 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
7F738BF07E05B7423860AF5131473876 |
|
0x00467000 |
2,364 bytes | 1,536 bytes | 7.57 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
B7FA6AD5A47DEB5E69247EB4FDDEE950 |
.rsrc |
0x00468000 |
63,320 bytes | 63,488 bytes | 6.84 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
1A050DAF6F77720B23CA731E704EAF7E |
.idata |
0x00478000 |
4,096 bytes | 1,024 bytes | 2.41 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
EC92772C54E3479F13244277231597FC |
.tls |
0x00479000 |
12,288 bytes | 10,240 bytes | 0.03 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
9B55D66DFE130A8448D76339CBB2480B |
.themida |
0x0047c000 |
3,481,600 bytes | 3,481,600 bytes | 6.80 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
0B873726E135CFCE9141EE643315AC35 |
.reloc |
0x007ce000 |
4,096 bytes | 16 bytes | 2.77 (正常) |
IMAGE_SCN_MEM_READ
|
701F91E31B6DE93473B006A6FA2B3B54 |
5 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 13 | 61,384 字节 | |
| RT_GROUP_ICON | 1 | 188 字节 | |
| RT_VERSION | 1 | 920 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
保持无恶意软件：使用 Gridinsoft 反恶意软件 保护您的 PC
Gridinsoft 反恶意软件正是如此——提供强大、用户友好的解决方案，让您安心，并不断更新以应对最新威胁。由网络安全专家设计，它提供实时保护和轻松删除恶意软件。这不仅仅是检测威胁；它是通过不间断的安全来增强您的数字生活。试一试，体验无忧浏览的感觉！
