| 文件名 | ea2310a0916222097eef511a9c220696545ded9a |
| 文件类型 |
Win32 EXE
|
| 魔术字节 | PE32+ executable (GUI) x86-64, for MS Windows |
| SSDEEP 哈希 |
24576:NfaicdIfRzYculNC8wnCxNxCNS4sPiuINC8wnCxNxCNS4sPiu:Nyic4IlVnxN0o5RIVnxN0o5R
|
| 扫描器版本 | 1.0.213.174 |
| 数据库版本 | 2025-04-11 11:00:24 UTC |
被 19 个安全引擎检测到 - 需要谨慎
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
51deb881a4b0e162e1fa708a94aa95e8
|
|
| SHA1 |
ea2310a0916222097eef511a9c220696545ded9a
|
|
| SHA256 |
da2ac071b7655c95ae6e1ac00751d75a83f9bd59e24e88f15e3298b3b00a7da4
|
|
| SHA512 |
a80564a490175f7bcb827287d0f983858db4f48a1dac2eda25bcbeaa2866a0371c4449b5c145b56c7e577074ecaca385bbf7444285b052bdb749cdc840c524a8
|
|
| ImpHash |
8d36bf26f0c905ea57ae9a0cd9daeb1f
|
| 映像基址 | 0x140000000 |
| 入口点 | 0x140056fd0 |
| 编译时间 | 2025-04-10 13:45:36 |
| 校验和 | 0x0013c8fa (实际: 0x0013c8fa) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 |
1 库
KERNEL32 |
| 导出 | 0 函数 |
| 资源 | 2 资源 |
| 节 | 13 节 |
| CompanyName | Microsoft Corporation |
| FileDescription | Microsoft® HTML Help Executable |
| FileVersion | 10.0.19041.1 (WinBuild.160101.0800) |
| InternalName | HH 1.41 |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | HH.exe |
| ProductName | HTML Help |
| ProductVersion | 10.0.19041.1 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
439,264 bytes | 439,296 bytes | 7.04 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
856674C7362BAF4BF41F229CFE987B8B |
.rdata |
0x0006d000 |
54,332 bytes | 54,784 bytes | 4.90 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BA6795AA1279CCEFFD0E8F047EA9AE20 |
.data |
0x0007b000 |
19,648 bytes | 7,680 bytes | 3.99 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
7C85A17FB784FE6F397150069871FB2F |
.pdata |
0x00080000 |
9,108 bytes | 9,216 bytes | 5.63 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
EF082F027341B094064BF10EC39D745F |
.B1 |
0x00083000 |
12,681 bytes | 12,800 bytes | 6.93 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
421999C7ABC1F89751ADE89DC80117D7 |
.gxfg |
0x00087000 |
5,072 bytes | 5,120 bytes | 5.09 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
0F50877259F3E1D724E40A01840F78C1 |
.retplne |
0x00089000 |
140 bytes | 512 bytes | 1.05 (正常) |
0x00000000
|
8C950F651287CBC1296BCB4E8CD7E990 |
.tls |
0x0008a000 |
9 bytes | 512 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1F354D76203061BFDD5A53DAE48D5435 |
_RDATA |
0x0008b000 |
500 bytes | 512 bytes | 4.19 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
10ED36D4878EC48A9A922C9EFEDA769E |
.reloc |
0x0008c000 |
2,240 bytes | 2,560 bytes | 5.17 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
FA9187FE079A8E2D1112C0D63AE13C0D |
.jss |
0x0008d000 |
368,640 bytes | 368,640 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
62E27A042A1B4795713063759C3DBC47 |
.jss |
0x000e7000 |
368,640 bytes | 368,640 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
62E27A042A1B4795713063759C3DBC47 |
.rsrc |
0x00141000 |
1,995 bytes | 2,048 bytes | 4.56 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D4010E7F0191BDC8AB3A562A43C88EE1 |
2 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 868 字节 | |
| RT_MANIFEST | 1 | 967 字节 |
| 产品 | HTML Help |
| 描述 | Microsoft® HTML Help Executable |
| 文件版本 | 10.0.19041.1 (WinBuild.160101.0800) |
| 原始名称 | HH.exe |
| 内部名称 | HH 1.41 |
| 版权 | © Microsoft Corporation. All rights reserved. |
✓ 此文件已进行数字签名，证书链已验证。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
