| 在线病毒检测器 | v.1.0.169.174 |
| 数据库版本: | 2024-03-17 12:00:22 |
CoinMiner是一种利用受害者的计算机资源（主要是CPU和RAM）进行加密货币挖掘（例如Monero或Zcash）的恶意软件。此恶意软件通过将开源挖掘工具集成到系统的启动例程中来建立持久性，而不需要用户的同意。高级的加密货币挖掘程序通常采用定时器配置或CPU使用限制等技术，以悄悄运行并避免检测。
| File | xmrig.exe |
| 已检查 | 2024-03-17 10:45:22 |
| MD5 | 1bef8e8b12a404ab83d07fbce2d1dc7d |
| SHA1 | 44804f411b350d651878ab3d9bb576ae38e6db3f |
| SHA256 | 4fdfcfd9a7aa5e9a9be2c2d3b621655030bbb0afa0d5feba1213aac73ff4fd32 |
| SHA512 | 84796861590e05508042131ea0cc51e46b5e980550550e87dc7578e569d585b2b439708e2546a29fd8e5b79b1a254fd380edfddaddc09e4ed31b169278772bab |
| Imphash | b0ae45c93fc1e0883b4a246b7b4b4400 |
| File Size | 8337920 bytes |
Gridinsoft能够识别并消除Risk.Win64.CoinMiner.sd!i，无需进一步的用户干预。
| CompanyName | www.xmrig.com |
| FileDescription | XMRig miner |
| FileVersion | 6.21.1 |
| LegalCopyright | Copyright (C) 2016-2024 xmrig.com |
| OriginalFilename | xmrig.exe |
| ProductName | XMRig |
| ProductVersion | 6.21.1 |
| Translation | 0x0000 0x04b0 |
 |
e35ef5b40987be4a81b37bdb1b3a8730 67b5702929aead99d08ec74265d272c5 e8f4b4d959d6a6f8 |
| Image Base: | 0x140000000 |
| Entry Point: | 0x1400013f0 |
| Compilation: | 2024-03-17 10:21:41 |
| Checksum: | 0x007ff371 (Actual: 0x007ff371) |
| OS Version: | 4.0 |
| PEiD: | PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows |
| Sign: | The PE file does not contain a certificate table. |
| Sections: | 11 |
| Imports: | ADVAPI32, CRYPT32, IPHLPAPI, KERNEL32, msvcrt, ole32, SHELL32, USER32, USERENV, WS2_32, |
| Exports: | 0 |
| Resources: | 7 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | MD5 | 熵 |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x00604ab0 | 0x00604c00 | 0fa0492bfc4b9e71c113fdf69217df02 | 6.50 |
| .data | 0x00606000 | 0x000105a0 | 0x00010600 | cbdc7a6623c297cc7da9225f39b2ccc2 | 3.30 |
| .rdata | 0x00617000 | 0x0015f3b0 | 0x0015f400 | de273c3a72d3894c3c60cba247f74078 | 6.47 |
| .pdata | 0x00777000 | 0x0002f49c | 0x0002f600 | 70327b5907774ec3314966f46c45c2b9 | 6.37 |
| .xdata | 0x007a7000 | 0x0003bf80 | 0x0003c000 | cf8280d58228da35dc79c62988a4c876 | 5.01 |
| .bss | 0x007e3000 | 0x003209a0 | 0x00000000 | d41d8cd98f00b204e9800998ecf8427e | 0.00 |
| .idata | 0x00b04000 | 0x00004660 | 0x00004800 | 42004e7ef9e0b840d80e269108252e1f | 4.61 |
| .CRT | 0x00b09000 | 0x00000068 | 0x00000200 | 220326d919c491ba90d60ba888555e91 | 0.39 |
| .tls | 0x00b0a000 | 0x00000010 | 0x00000200 | bf619eac0cdf3f68d496ea9344137e8b | 0.00 |
| .rsrc | 0x00b0b000 | 0x00005ce8 | 0x00005ce8 | 5478bb4240ce4721a2dfdf99cd576ca3 | 5.54 |
| .reloc | 0x00b11000 | 0x00008ea0 | 0x00009000 | 7f256305d5ee12077779f879f3d7622e | 5.45 |
