| 文件名 | prismlauncher.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.216.174 |
| 数据库版本 | 2025-05-15 18:00:23 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
89166bd77f2db033283d12953db62bea
|
|
| SHA1 |
256103b6e1f3dfc022e04513d8ff2f8005c2d36c
|
|
| SHA256 |
abc38628321b8ffbc4f6b06b37d87a1a1ca470108f49274acd339de8cd8500b6
|
|
| SHA512 |
3f1c58debd78cce145fc46ab870934eb5e4c959f0e8abd0576811f6bafe5e379b984332f918fe5aa24c54f79de2153d9850f933cf4faba8140dad31458a82c63
|
|
| ImpHash |
85674746759a75f20f608cf415e81768
|
| 图标 |
哈希: 35d2c1a80133032cd42cce963b0770c8
模糊: b40dc48b4f5fb6bc5a605f1d4061fb99 dHash: 30f8b0b0e0b2e030 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x140001160 |
| 编译时间 | 2025-04-09 18:20:35 |
| 校验和 | 0x00000000 (实际: 0x00f56336) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 26 库 |
| 导出 | 0 函数 |
| 资源 | 10 资源 |
| 节 | 15 节 |
| CompanyName | MultiMC & Prism Launcher Contributors |
| FileDescription | Prism Launcher |
| FileVersion | 10.0.0.0 |
| ProductName | Prism Launcher |
| ProductVersion | 10.0.0.0 |
| Translation | 0x0000 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
7,316,998 bytes | 7,317,504 bytes | 5.94 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
5DA75DE1EB7FDABC53AF74406FD5085D |
.rdata |
0x006fc000 |
5,480,436 bytes | 5,480,448 bytes | 7.30 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
4AB0D24FF67963C280AE5599902A37A3 |
.buildid |
0x00c36000 |
53 bytes | 512 bytes | 0.64 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
DDCB3D99CC99C3C21B7E57281E61846E |
.data |
0x00c37000 |
52,952 bytes | 45,568 bytes | 1.89 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
082171B7F833E5222BD2A44108F39EA3 |
.pdata |
0x00c44000 |
102,516 bytes | 102,912 bytes | 6.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BA95651F2B78B505DBA1397779F6C746 |
.qtversi |
0x00c5e000 |
16 bytes | 512 bytes | 0.14 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
C13BD51EF3DA4631CA7C3C1785F1562B |
.tls |
0x00c5f000 |
16 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x00c60000 |
375,080 bytes | 375,296 bytes | 3.63 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
64C91746B12EBFA8AF06D89736806612 |
.reloc |
0x00cbc000 |
54,576 bytes | 54,784 bytes | 5.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
18CA5B8C367865B0118032BF0684ECC3 |
/4 |
0x00cca000 |
8,230 bytes | 8,704 bytes | 4.55 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
5CA213959E5C7A9C6B11589C8650D6D3 |
/18 |
0x00ccd000 |
132,322 bytes | 132,608 bytes | 5.05 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
27DF9065AEE49F0082790AC02E6091C2 |
/30 |
0x00cee000 |
10,903 bytes | 11,264 bytes | 5.58 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
DBD42577B98BEE2CB309F0CA93B7874B |
/42 |
0x00cf1000 |
9,683 bytes | 9,728 bytes | 1.96 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
A9C03E055BC377F35D4A2309DAAA971B |
/53 |
0x00cf4000 |
544 bytes | 1,024 bytes | 0.79 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
C11F48C38219FB75BF3740F236D4CA82 |
/67 |
0x00cf5000 |
143,798 bytes | 143,872 bytes | 5.24 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
8BFF2BF940F208A5098794E7C074C82D |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 7 | 372,408 字节 | |
| RT_GROUP_ICON | 1 | 104 字节 | |
| RT_VERSION | 1 | 572 字节 | |
| RT_MANIFEST | 1 | 1,367 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
