| 文件名 | SearchProtocolHost.exe |
| 文件类型 |
PE32+ executable (console) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.210.174 |
| 数据库版本 | 2025-03-11 04:00:40 UTC |
我们的扫描器未检测到威胁
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
40718d05814c83eafd4cc2d8a89662b5
|
|
| SHA1 |
b4b37ba76914ca9b951e4a6366d5e52430459005
|
|
| SHA256 |
73cc70e86106fb3c862830105877af18015d39f4e719e44260d2682b212f8ce4
|
|
| SHA512 |
853b0e3fed071b870a444ffbd40a98beadaebe2ee8d31c8e0be5189f0789529753aa2d05dae0325a797c47569648fc9c285b43b4fca8f25544474d472baa6550
|
|
| ImpHash |
8c356ea975557806a061fcb7cbf224b7
|
| 图标 |
哈希: a60d07d70f34be772ec641eee732db82
模糊: badcff590785d887d9bf23d8a9b5d9cd dHash: 10f071f092e87890 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x1400032f0 |
| 编译时间 | 2064-11-28 21:25:57 |
| 校验和 | 0x00077352 (实际: 0x00077352) |
| 操作系统版本 | 10.0 |
| PEiD 签名 |
PE32+ executable (console) x86-64, for MS Windows
|
| PDB 路径 | SearchProtocolHost.pdb |
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 43 库 |
| 导出 | 0 函数 |
| 资源 | 16 资源 |
| 节 | 8 节 |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft Windows Search Protocol Host |
| FileVersion | 7.0.26100.3323 (WinBuild.160101.0800) |
| InternalName | SearchProtocolHost.exe |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | SearchProtocolHost.exe |
| ProductName | Windows® Search |
| ProductVersion | 7.0.26100.3323 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
255,221 bytes | 258,048 bytes | 6.18 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
17F02A452A2ACB04390815A194DA5571 |
fothk |
0x00040000 |
4,096 bytes | 4,096 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
E94C21DB11C2E2E13244F45C971E8CD6 |
.rdata |
0x00041000 |
87,046 bytes | 90,112 bytes | 4.62 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E4450AFE53C200B48F2717F506DB973A |
.data |
0x00057000 |
9,984 bytes | 8,192 bytes | 1.87 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
47F342542F31C2DDA3112B25354E1805 |
.pdata |
0x0005a000 |
15,372 bytes | 16,384 bytes | 5.33 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
8A2EA7457CD741A4640BB29BD08AF4A3 |
.didat |
0x0005e000 |
440 bytes | 4,096 bytes | 0.40 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
C13F578778286595655AB2E61DD358AD |
.rsrc |
0x0005f000 |
86,704 bytes | 90,112 bytes | 6.89 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
41C1501B196B213E2771F1E823A842DC |
.reloc |
0x00075000 |
1,444 bytes | 4,096 bytes | 2.67 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
54315B1877FE43079782304405F2E8F8 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 13 | 83,701 字节 | |
| RT_GROUP_ICON | 1 | 188 字节 | |
| RT_VERSION | 1 | 952 字节 | |
| RT_MANIFEST | 1 | 973 字节 |
| 产品 | Windows® Search |
| 描述 | Microsoft Windows Search Protocol Host |
| 文件版本 | 7.0.26100.3323 (WinBuild.160101.0800) |
| 原始名称 | SearchProtocolHost.exe |
| 内部名称 | SearchProtocolHost.exe |
| 版权 | © Microsoft Corporation. All rights reserved. |
✓ 此文件已进行数字签名，证书链已验证。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
