home

PPSGame.exe

游戏大厅客户端

SHANGHAI ZHONGYUAN NETWORKS LIMITED

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PPSGame’.
Publisher:
上海众源网络有限公司  (signed by SHANGHAI ZHONGYUAN NETWORKS LIMITED)

Product:
游戏大厅客户端

Version:
1, 0, 1, 450

MD5:
a31229bf41a08e5a2aa4fce485bb23a2

SHA-1:
a0cf1f4fded709cf8cdeebf678ce4b2e7b1faafa

SHA-256:
37caa6e8d9532576e1eef68f403359ee148f0596932a8d57ae4352698a5f2b58

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/23/2024 8:47:54 AM UTC  (today)

File size:
4.8 MB (5,068,720 bytes)

Product version:
1, 0, 1, 450

Copyright:
上海众源网络有限公司保留所有权利。

Original file name:
PPSGame.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, PRC)

Digital Signature
Signed by:
SHANGHAI ZHONGYUAN NETWORKS LIMITED

Authority:
VeriSign, Inc.

Valid from:
7/12/2011 8:00:00 AM

Valid to:
8/11/2012 7:59:59 AM

Subject:
CN=SHANGHAI ZHONGYUAN NETWORKS LIMITED, OU=Development department, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SHANGHAI ZHONGYUAN NETWORKS LIMITED, L=Shanghai, S=Shanghai, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0F7FE25AE1191062E67174403487897F

File PE Metadata
Compilation timestamp:
1/6/2012 9:55:59 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
98304:NKW+vwuhc5ia9iIfBQjsh6tkFUgwB5a+E5Y/6nJnPEpxcFBBA:HuhcIax5usHnJ1FQ

Entry address:
0x2BA651

Entry point:
E8, 41, 0A, 01, 00, E9, 17, FE, FF, FF, 55, 8B, EC, 56, 8B, 75, 14, 57, 33, FF, 3B, F7, 75, 04, 33, C0, EB, 65, 39, 7D, 08, 75, 1B, E8, 7A, 76, 00, 00, 6A, 16, 5E, 89, 30, 57, 57, 57, 57, 57, E8, 6D, 14, 00, 00, 83, C4, 14, 8B, C6, EB, 45, 39, 7D, 10, 74, 16, 39, 75, 0C, 72, 11, 56, FF, 75, 10, FF, 75, 08, E8, FD, 66, 00, 00, 83, C4, 0C, EB, C1, FF, 75, 0C, 57, FF, 75, 08, E8, 6C, 15, 00, 00, 83, C4, 0C, 39, 7D, 10, 74, B6, 39, 75, 0C, 73, 0E, E8, 2B, 76, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, AD, 6A, 16...
 
[+]

Entropy:
6.5317

Code size:
3.6 MB (3,821,568 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PPSGame

Command:
"C:\pps.tv\ppsgame\ppsgame.exe" auto


Scan PPSGame.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.