| 文件名 | ChromeSetup.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
| 扫描器版本 | 1.0.150.174 |
| 数据库版本 | 2023-11-28 19:01:01 UTC |
恶意软件家族: InstallCore
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
415d5bea8367425eb1aa29d60b36ce47
|
|
| SHA1 |
47c1874774e40505b90114ced234b1cf744e2121
|
|
| SHA256 |
6a37812cce3675e78ac0a4cf038bf15fd83f61d3fa67cc04a84f08d6d06b9a41
|
|
| SHA512 |
42b1d386e5cc77460ee2f93bb0b468ee8d4c802fb7a60f2b43b6093af3792e627e6caafc3ee45702f417ff84b8389e39dcbf93774d86bd6b9cc055fa95bcd9ec
|
|
| ImpHash |
56a78d55f3f7af51443e58e0ce2fb5f6
|
| 图标 |
哈希: 5e172c0dc3b3b45ca039c9e793a07b29
模糊: a0944f9361276e2a5e874864a5c88639 dHash: f8e2eae6b696c6cc |
| 映像基址 | 0x00400000 |
| 入口点 | 0x0040352d |
| 编译时间 | 2021-09-25 21:57:46 |
| 校验和 | 0x00347904 (实际: 0x00347904) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
| 数字签名 | OK |
| 导入 |
7 库
ADVAPI32, SHELL32, ole32, COMCTL32, USER32, GDI32, KERNEL32 |
| 导出 | 0 函数 |
| 资源 | 12 资源 |
| 节 | 5 节 |
| SSL.com Code Signing Intermediate CA RSA R1 | Xetapp Limited (CY) |
| SSL.com Root Certification Authority RSA | SSL Corp (US) |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
26,775 bytes | 27,136 bytes | 6.46 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
CE9DF19DF15AA7BFBC0A8D0AF0B841D0 |
.rdata |
0x00008000 |
5,286 bytes | 5,632 bytes | 5.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
A118375C929D970903C1204233B7583D |
.data |
0x0000a000 |
176,152 bytes | 1,536 bytes | 4.15 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
82A10C59A8679BB952FC8316070B8A6C |
.ndata |
0x00036000 |
90,112 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rsrc |
0x0004c000 |
16,648 bytes | 16,896 bytes | 4.19 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
A6FF3EA18F4940F14839E3195F0262BE |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 7 | 13,784 字节 | |
| RT_DIALOG | 3 | 1,000 字节 | |
| RT_GROUP_ICON | 1 | 104 字节 | |
| RT_MANIFEST | 1 | 1,059 字节 |
| 主题 |
Xetapp Limited Xetapp Limited CY |
| 颁发者 | SSL.com Code Signing Intermediate CA RSA R1 |
| 序列号 | 115626748377711368629307014091170502297 |
| 主题 |
SSL.com Code Signing Intermediate CA RSA R1 SSL Corp US |
| 颁发者 | SSL.com Root Certification Authority RSA |
| 序列号 | 7220204597627363080 |
OK
Gridinsoft 能够识别并消除 Adware.Win32.InstallCore.sd!c，无需用户进一步干预。
下载反恶意软件按照以下步骤完全从系统中移除威胁
