| 文件名 | ActivatorEUIV.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.217.174 |
| 数据库版本 | 2025-06-06 06:00:30 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
d485f64db9ee71a14456704e09643222
|
|
| SHA1 |
85088110fa7349dcb276ff74a554b66e8eb41821
|
|
| SHA256 |
ea092f27d09769df7206f3298e13e8c9fc43f70c9cb9bb9a4a1316a865009c54
|
|
| SHA512 |
ca8a707c18b472e129289e905adb84bac898920ad5a7d19138003f347175bc3251ff845fd81f822af019ab448a35d11b642681bd45ea194ff7bccebf129e75c3
|
|
| ImpHash |
3c8fc4a59bb39166dc9b590e44556e6e
|
| 图标 |
哈希: ac15b28520431e777443d372e18d0497
模糊: 304bb5a4f7cac0df835e554e3e05ddc2 dHash: 1f3b79fc7c692b0f |
| 映像基址 | 0x140000000 |
| 入口点 | 0x141822c88 |
| 编译时间 | 2022-09-07 11:09:36 |
| 校验和 | 0x0256f69b (实际: 0x0256ee9b) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| PDB 路径 | D:\jenkins\workspace\eu4\outputdir\release\eu4.pdb |
| 数字签名 | The expected hash does not match the digest in SpcInfo |
| 导入 | 22 库 |
| 导出 | 662 函数 |
| 资源 | 9 资源 |
| 节 | 10 节 |
| CompanyName | Paradox Interactive |
| FileDescription | Europa Universalis IV |
| FileVersion | 1.0 |
| InternalName | Europa Universalis IV |
| LegalCopyright | Copyright © 2012 |
| OriginalFilename | eu4.exe |
| ProductName | Europa Universalis IV |
| ProductVersion | 1.0 |
| Translation | 0x041d 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
27,136,642 bytes | 27,137,024 bytes | 6.46 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
7EB46F297320A2288AA328C9CF6E5CD8 |
.rdata |
0x019e3000 |
6,985,586 bytes | 6,985,728 bytes | 5.60 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E9D140216F32913EEA9ACB6D34514A2F |
.data |
0x0208d000 |
4,625,404 bytes | 3,383,808 bytes | 0.28 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
3918FE81744C77AAC3D4FC8606BDEE59 |
.pdata |
0x024f7000 |
1,078,116 bytes | 1,078,272 bytes | 6.80 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
114B60B3F5DFA57A34DFAD2C319B1A1C |
.gfids |
0x025ff000 |
4,832 bytes | 5,120 bytes | 3.80 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
0F82B17B21CA669B3A22DCB6036DCCD0 |
.tls |
0x02601000 |
29 bytes | 512 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BA27CBC596DCED9110BDFF8963A62F7E |
_RDATA |
0x02602000 |
5,968 bytes | 6,144 bytes | 5.67 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
EB82996E507514B0C42C2439CD055FD4 |
.gehcont |
0x02604000 |
36 bytes | 512 bytes | 0.18 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
19A37CB6B6C0F33CB3061F3ED1E52AD3 |
.rsrc |
0x02605000 |
371,960 bytes | 372,224 bytes | 5.70 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
26EE59BDACF4984DE4E1E8B05BEF0BCF |
.reloc |
0x02660000 |
209,036 bytes | 209,408 bytes | 5.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
9469E3E10EA22C13DD85D80E0AC81512 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 6 | 369,968 字节 | |
| RT_GROUP_ICON | 1 | 90 字节 | |
| RT_VERSION | 1 | 740 字节 | |
| RT_MANIFEST | 1 | 607 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The expected hash does not match the digest in SpcInfo
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
