| 文件名 | KMSpico_setup.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.211.174 |
| 数据库版本 | 2025-03-26 19:01:11 UTC |
恶意软件家族: AutoKMS
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
a02164371a50c5ff9fa2870ef6e8cfa3
|
|
| SHA1 |
060614723f8375ecaad8b249ff07e3be082d7f25
|
|
| SHA256 |
64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
|
|
| SHA512 |
6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326
|
|
| ImpHash |
884310b1928934402ea6fec1dbd3cf5e
|
| 图标 |
哈希: 8bbb0a9939e7f4c93cd1e12408db5986
模糊: bf664f70c0e768f7575f91389633fed5 dHash: 0c9f1f0f4f7f1706 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x0040a5f8 |
| 编译时间 | 1992-06-19 22:22:17 |
| 校验和 | 0x0031d950 (实际: 0x0031d950) |
| 操作系统版本 | 1.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | Chain verification from CN=@ByELDI (serial:-69403741341198612868765313511281709924, sha1:eaaf9045685acd5ad5846a5e9ee125d7aeac21c2) failed: Unable to build a validation path for the certificate "Common Name: @ByELDI" - no issuer matching "Common Name: @ByELDI Certificate Authority" was found |
| 导入 |
5 库
kernel32, user32, oleaut32, advapi32, comctl32 |
| 导出 | 0 函数 |
| 资源 | 11 资源 |
| 节 | 8 节 |
| Comments | This installation was built with Inno Setup. |
| CompanyName | |
| FileDescription | KMSpico Setup |
| FileVersion | 10.2.0 |
| LegalCopyright | ByELDI |
| ProductName | KMSpico |
| ProductVersion | 10.2.0 |
| Translation | 0x0000 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
CODE |
0x00001000 |
40,240 bytes | 40,448 bytes | 6.63 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
C3BD95C4B1A8E5199981E0D9B45FD18C |
DATA |
0x0000b000 |
592 bytes | 1,024 bytes | 2.75 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1EE71D84F1C77AF85F1F5C278F880572 |
BSS |
0x0000c000 |
3,724 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x0000d000 |
2,384 bytes | 2,560 bytes | 4.43 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BB5485BF968B970E5EA81292AF2ACDBA |
.tls |
0x0000e000 |
8 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x0000f000 |
24 bytes | 512 bytes | 0.20 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
9BA824905BF9C7922B6FC87A38B74366 |
.reloc |
0x00010000 |
2,244 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rsrc |
0x00011000 |
23,204 bytes | 23,552 bytes | 5.05 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
125E5C915DE1B5C449C617B9B5C2DF35 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 1 | 16,936 字节 | |
| RT_STRING | 6 | 2,710 字节 | |
| RT_RCDATA | 1 | 44 字节 | |
| RT_GROUP_ICON | 1 | 20 字节 | |
| RT_VERSION | 1 | 1,268 字节 | |
| RT_MANIFEST | 1 | 1,512 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=@ByELDI (serial:-69403741341198612868765313511281709924, sha1:eaaf9045685acd5ad5846a5e9ee125d7aeac21c2) failed: Unable to build a validation path for the certificate "Common Name: @ByELDI" - no issuer matching "Common Name: @ByELDI Certificate Authority" was found
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
