83773389608d6e1f29e85c6f6ec8c3ac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
83773389608d6e1f29e85c6f6ec8c3ac_JaffaCakes118
Size 2.3MB
Sample240809-zdnphssamf
SHA256 cc9ecb59ee1459f6375929b6e8b3f5ebf2008edc43dcd4abf1e1b6eb327933ed
MD5 83773389608d6e1f29e85c6f6ec8c3ac
SHA1 dda610e05a5233a1b0ec19510e418923c0611f4d
SHA512 6b10769fa70e3537c93d2930622ea1812c1aed2c30bb16c35cfc2b00c60711eb3cbcc3048dc8d2f2d62b67a4a36e37c925f5b934534e6bf56fec73b394d87d28
SSDEEP 49152:DRE0rehRftBbCLOZbK2W6C2SYF+lnwH5kzAgKCG30FaeHm:DREdftBbCLYC2S6+uH5T90FaT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/虚拟磁盘精灵/disk.dll	upx
static1/unpack001/虚拟磁盘精灵/虚拟磁盘精灵.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/虚拟磁盘精灵/disk.dll
unpack001/虚拟磁盘精灵/msvbvm60.dll
unpack001/虚拟磁盘精灵/虚拟磁盘精灵.exe

File Explorer

83773389608d6e1f29e85c6f6ec8c3ac_JaffaCakes118

.rar 2.3MB
虚拟磁盘精灵/disk.dll

.dll 1.6MB
虚拟磁盘精灵/msvbvm60.dll

.dll 1.3MB
虚拟磁盘精灵/新云软件.url

.url 133B
虚拟磁盘精灵/虚拟磁盘精灵.exe

.exe 228KB

83773389608d6e1f29e85c6f6ec8c3ac_JaffaCakes118

SHA256 cc9ecb59ee1459f6375929b6e8b3f5ebf2008edc43dcd4abf1e1b6eb327933ed
MD5 83773389608d6e1f29e85c6f6ec8c3ac
SHA1 dda610e05a5233a1b0ec19510e418923c0611f4d
SHA512 6b10769fa70e3537c93d2930622ea1812c1aed2c30bb16c35cfc2b00c60711eb3cbcc3048dc8d2f2d62b67a4a36e37c925f5b934534e6bf56fec73b394d87d28
SSDEEP 49152:DRE0rehRftBbCLOZbK2W6C2SYF+lnwH5kzAgKCG30FaeHm:DREdftBbCLYC2S6+uH5T90FaT
MD5 SHA1 SHA512 SSDEEP

虚拟磁盘精灵/disk.dll

IMPHASH 4cc4720c0f9a52886c719b9c1d497cad
SHA256 8feb175fe2d73bf13aadd6ce890f7465bf55b6109fdaddcf6bed316eabca73fd
MD5 b37b2c49d236b0d55de65c8c8857dd02
SHA1 5b1f0c600ee7067b9af54cc94f95012c185212f1
SHA512 f7970393f6ce97d54ab1708e80c58aba3e1bbac76b4cc5cc01f55a161d9ca1818ade85007e50b3f85883f8153498b46a080880971a5317c8435f1d90a55dafd6
SSDEEP 49152:NYMVbWQxpcTFXeZ6UvAZFYSbVcrZFNg3:eqbrxg68bb0g
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2192591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

2Y???��??B��??�䨺2?��o��y BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB u0~�U�[�W��@]E��^��[��6Nz�G/��d�#%��f��|�9w��Y��~#_��t}��r��0��x��ľv*�u~L�]~�w��+Ć7P�~(�=�R�)��Y��$�8�z'��Kd��U9V��aZ݃4�[c�AAOT��~]t�Gܮ��r�.Ro��CKnf�*��-{ X$ܙ�{�<��p�N��M�E��Ţ6�Y��#��N��7�0��;��}w(��`=��l��7.�C`�3��d{$�]:�.��߼ "g4��i��HQ!�s��a��{t�ܽb��X��9+A��^�(�Mc0U9a�1@q��:�"a�H�{o��I�c�.��d�� *��^�G_t��y�i�5�˩�Y�u��mCP�8YV �@"[��g0��{b��69��Q]�'Ξۺ�k�++��+��܂ON� (�☋9��m��SI��=߼_߮E"0I{A�X�q�2�љ�{ ��zY��R݊�cs��m]|��`��y@��R�ke��x4�rBGČ]_O��@��lT��,��xhJ]J;��m/�v�+-��[�Rq�H:V��t�S O>�u�i��y��8P��"��P��[��P�&}�`//��Ӆ"-�y��XB�Ux�C`��+�8Y8��)?p�E��}�Ͷ�!��L�w�B�~�n�$e_PгB)�U��J�?�}�=��u��0=��r�@�YωPGV�H�0��|�HSR�%�SA��݁a��Aϱ��QA&��ֱb�HA��F$Bx��:!5�@��R�lUښ��"��͚��:��'ҫ�v�2S�3O?��.�d�}0{\?�W��r��z� O�� ׬ξ�l��;X��`p��*<��ֱ�t�!}g;��v9�:M�JV5��T��-��ds�4�J��8��3rP�pܨ��$��v6�� 0'��pŴt�v��C��!i��ݿD�f�(Q��.��[u�MZglT��<�:k6*��}?�Wc��q,�$��WD��Y�3��z�y��_��hɾ��%��JL�$&4��'��܁3toxُHt��IY9 j?,��'��!ޮ��O�C�̲��R�Χ��j��"zB�٥8a7�� /�L�A��W8��A�5�,�pD�!dQ�H҇%0/^�w�*�ݵ��'�6�ܤ�D�{ߵJLu��$�]C�MX��襆�''��5P:�_��q�c��[��x��h5��Ih!�Dc� %�;Xuˣ=w�Ԃ�o7M)��QF4bE$!B��jH+��֊jy��cuu��?�ғQ�&�%��F��.�.(�H<+a�y�/3s��z!\6�a��Z��I��S��V�8,�fl�ƕ�X,ަ뀱Y��(Jf��p��5�Wԁ\�Y�o�r~ \��G�v��|��^��<��a�.��n�O��y©�F@x�� \��k��\1�y�߽I@ E�� u��7�q{g�Ɲ�:�� m�'�؞��x��֥9��6�-�V��ܛ�uB�"�+�k��|��%y`�/��ƫȪ��މm&��IZ��2ޖw:W!Oe�/��O,쩽��(jE�/�&��zϦ�I��D��S�t�2we��%{d*nݥ3h�N�n3{��n�}��HXq��hVU*{�w7g��RTzMmnr-��E<B0�TG�U:Н�x9��r��=��mcek�D�o�k�NP��󕨆�hː�56kS�Q��<��So�k��?"�z_ �1��B�6u�J$��4��7aMH��[�M�sζJA��3�n7��v<U� s��/�l�X�H9�L��ұ��$�9ڸbmZ��a�g��\�|ɺx"��3��?��Q�t��+5�j1��z{3mz�&��Q8��!5��Q��PJ��p�L#G��ڲ��΢��?^��r��τC�Q��բ!��A��t��r� �ZK38d��7т{|��ŋ��^�-��ش80��j5�/��}c50��8;Uc.��YȀ�3 #��Њ��l��h�Nk�i�6��`�H�4�9��r:'�_�t}��j��,q^$Sl@��s�u�?��0U3��ʭf�H��)��H1��<$�p�!�s��vFB%��٩�O��_��de~4>&�#��>��w ��]*��v ��%�ϥ5�H��ա��b�3��`n�R�k�'B��W��h2+.cJ�� 0 �O��L��q�{V�� :��#��C�,�M��3�"��&�$�8��_4V��z>�'Vh ��n͘RF��s��*;A�=� ̪��u|lNK0� ��ѭ7n�K�h��;�8�[��ɩ�CR|V�Q�3S(N��U?ZD�8E_COB��~�ઞq_�\�(��I�C�:��K�x��K�2'|�e��+�|�~��\z)L&w��uc��^��bs��Խ2J�a]��?�SL�L��=��R��"��eе��vM4I��鷽�� G�ĩ�x��"pQLd��L��x��5� 66��1�m��ѭC�Ae�jǝ@Y��Yy��=3q�K �Ȭ��:\��Q��o�LE|�6>��>�RSW��M��g�kY��Tq��#�+4��tӥ�|b��;�6]<,��9��I��^�B1`��h��/�%L��o�u~L�\�S��V:��m�X�Lh�*��YR�坯 "(.\��I.��I��$:�/r�O�[�c�0�SX�/�BW#ڽo�t�j��U��$Y;��?��h�[��[Ǫ[�{�͵=)��F�u �Ö�j[x, ��^ا%��3��jc�ȟ��-*$�v��\�us�|!,n~R��P��t�$�;9�Fg��PVh�l��

Name

Size

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

779KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX0

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

UPX1

Size

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE

Name

.tls

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX2

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

虚拟磁盘精灵/msvbvm60.dll

IMPHASH ce5958d8adf86078d58c0c6f95621ee9
SHA256 bec16f80e024ac2b182b46415872dbde1a1da553e850a2228a72dec4e05ed64b
MD5 efcf843edd837c5ab013e53fe6d03993
SHA1 29b9d05786b2e27d7c7b08a5a7c6291da53bd4a7
SHA512 21fdad4e1a2663b376abccf30f7277d9df3f6cafc02eafc5f841fa3d8f66e943a218ade67a11a1631cd466639c391174d3359d59fa314e74ee9155e01229859b
SSDEEP 24576:1TGs6JlHZLKCd6oQwznJyXpWIqaqufQrRhLsbRmUSi8zlmZYnDg+:1TrojznJyXpWISufQrRhLBUSiWlFM+
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTimeZoneInformation CreateThread ExitThread FlushFileBuffers CreateDirectoryA RemoveDirectoryA MoveFileA LockFile UnlockFile TerminateProcess SetEnvironmentVariableA GetCPInfo GetACP GetOEMCP SetHandleCount GetStdHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetStdHandle GetStringTypeW RaiseException LCMapStringW GetStringTypeA GetModuleFileNameW GetUserDefaultLangID GetComputerNameA SetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime SetFileTime GetLocalTime SetLocalTime RtlUnwind OpenFile CreateProcessW IsValidCodePage FormatMessageW GetStartupInfoA UnhandledExceptionFilter ExitProcess SetCurrentDirectoryA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindNextFileA FindClose VirtualFree GetSystemInfo VirtualAlloc VirtualProtect FlushInstructionCache FindResourceExA GetShortPathNameA WinExec lstrlenW lstrcpyW WriteFile SetEndOfFile SetFilePointer GetSystemTime SystemTimeToFileTime WaitForMultipleObjects ReleaseMutex CreateMutexA GetCurrentProcess DuplicateHandle ResumeThread GetCommandLineA TlsSetValue TlsFree TlsAlloc GetVersion CompareStringW lstrcmpiW MulDiv CreateProcessA GetExitCodeProcess LoadLibraryExA WaitForSingleObject ResetEvent SetEvent CreateEventA GetTickCount GetEnvironmentVariableA FreeResource GetSystemDefaultLCID GetPrivateProfileIntA IsBadCodePtr GetUserDefaultLCID GetSystemDirectoryA LoadLibraryA GetProcAddress Sleep GlobalDeleteAtom HeapDestroy SetErrorMode GlobalAddAtomA ReleaseSemaphore LCMapStringA CreateSemaphoreA VirtualQuery GetCurrentProcessId MultiByteToWideChar GetProfileStringA WideCharToMultiByte HeapReAlloc GetDriveTypeA CompareStringA GetFileAttributesA GetCurrentDirectoryA GetModuleFileNameA SetLastError GetFullPathNameA SearchPathA GetFileType GlobalUnlock GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc GlobalLock _lwrite _lread LockResource GetTempPathA GetTempFileNameA lstrcpynA _lclose _llseek FreeLibrary GetLocaleInfoA lstrcmpiA GetLastError GetModuleHandleA GetSystemDefaultLangID FormatMessageA HeapCreate GetWindowsDirectoryA GetPrivateProfileStringA lstrcatA CreateFileA ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement IsDBCSLeadByte IsBadReadPtr TlsGetValue lstrcpyA DeleteFileA lstrcmpA GetCurrentThreadId GetVersionExA HeapAlloc HeapFree HeapSize lstrlenA

user32

DdeClientTransaction DdeAbandonTransaction DdeGetData DdeGetLastError DdeCreateDataHandle DdeCmpStringHandles SetCursorPos EnumClipboardFormats DestroyCursor GetAsyncKeyState WaitForInputIdle GetForegroundWindow VkKeyScanW SetWindowsHookExW keybd_event CharUpperBuffW CharUpperBuffA CharLowerBuffW FindWindowW FindWindowA SetActiveWindow GetClassInfoExA LoadIconA LoadImageA RegisterClassExA FrameRect CreateDialogParamA IsDialogMessageA EnableMenuItem ShowCursor OemToCharA CharToOemBuffA GetWindowTextA EndDialog DrawTextA SendDlgItemMessageA SetDlgItemTextA GetWindowPlacement GetSystemMetrics LoadBitmapA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects WaitMessage PostQuitMessage UnhookWindowsHookEx RegisterClipboardFormatA CreateCursor CreateIcon PostMessageW PeekMessageW EnumWindows EnumChildWindows GetPropA RemovePropA SetPropA SetForegroundWindow ClipCursor CallWindowProcA DefFrameProcA GetKeyState GetDlgItem IsWindow UnregisterClassA RegisterClassA AdjustWindowRect GetTabbedTextExtentA TabbedTextOutA FillRect CharToOemA MessageBoxA wsprintfA WinHelpA GetDesktopWindow SetRect GetWindowDC DestroyIcon GetClassInfoA AdjustWindowRectEx GetMenuItemCount RemoveMenu GetMenuStringA GetMenuState DdePostAdvise GetCaretPos CharPrevA CharNextA GetUpdateRgn GetUpdateRect PtInRect ChildWindowFromPointEx ReleaseCapture SetCapture InflateRect GetWindowRect ClientToScreen MoveWindow IsWindowEnabled IsChild SetParent IsIconic IsZoomed DefMDIChildProcA MessageBeep PeekMessageA PostMessageA LoadStringA AppendMenuA DestroyMenu CreatePopupMenu GetMessageTime GetMessagePos DrawFocusRect CopyAcceleratorTableA GetWindowRgn CharUpperA TranslateMDISysAccel SubtractRect IsRectEmpty InvalidateRgn InvalidateRect CopyRect GetDCEx IntersectRect LoadAcceleratorsA BringWindowToTop GetWindowThreadProcessId AttachThreadInput EqualRect EnableWindow SetFocus SendMessageA SetWindowsHookExA GetClassNameA LoadCursorA SetCursor SetWindowLongA GetWindow GetFocus GetKeyboardLayout GetSystemMenu CallNextHookEx GetParent DestroyWindow SetWindowTextA SetWindowPos UpdateWindow CreateWindowExA SystemParametersInfoA GetCapture WindowFromPoint ScreenToClient SetTimer IsWindowVisible ShowWindow KillTimer GetDC ReleaseDC MapWindowPoints GetCursorPos GetCursor OffsetRect GetIconInfo DefWindowProcA BeginPaint GetClientRect EndPaint GetSysColor GetActiveWindow GetWindowLongA DdeDisconnect DdeConnect DdeSetUserHandle DdeNameService DdeCreateStringHandleA DdeUninitialize DdeInitializeA DdeFreeStringHandle DdeQueryConvInfo DdeQueryStringA DdeFreeDataHandle SetScrollRange SetScrollPos DrawFrameControl LockWindowUpdate CharLowerBuffA IsClipboardFormatAvailable SetClipboardData GetClipboardData OpenClipboard EmptyClipboard CloseClipboard GetCaretBlinkTime SetCaretPos GetWindowTextLengthA CreateCaret ShowCaret HideCaret DestroyCaret GetScrollPos GetClipboardFormatNameA DrawTextExA SetWindowRgn ToAscii CreateAcceleratorTableA DestroyAcceleratorTable ShowScrollBar GetScrollInfo GetLastActivePopup GetMenuItemInfoA SetMenuItemInfoA SetKeyboardState GetKeyboardState GetQueueStatus GetDoubleClickTime SetWindowContextHelpId TrackPopupMenu SetMenuDefaultItem DrawMenuBar DeleteMenu InsertMenuA GetSubMenu GetMenuItemID GetMenu SetMenu CreateMenu ModifyMenuA CheckMenuItem BeginDeferWindowPos EndDeferWindowPos DeferWindowPos PostThreadMessageA VkKeyScanA CharLowerA DrawIcon MessageBoxIndirectA DialogBoxParamA IsCharAlphaA EnumThreadWindows SetScrollInfo

gdi32

RestoreDC RealizePalette SetROP2 SaveDC GetClipBox SetWindowOrgEx ExcludeClipRect CreateHalftonePalette GetTextMetricsA PatBlt EnumFontsA TranslateCharsetInfo GetROP2 SetBrushOrgEx GetDeviceCaps GetObjectType CreatePenIndirect CreateBrushIndirect Rectangle GetStockObject Arc LineTo MoveToEx Pie Ellipse SetStretchBltMode GetPixel GetTextExtentPoint32A SetPixelV StretchDIBits GetCurrentObject TextOutA GetBkColor StretchBlt CreateDIBitmap CloseMetaFile SetWindowExtEx CreateMetaFileA EndDoc AbortDoc StartPage CreateCompatibleBitmap StartDocA CreateDCA ResetDCA Escape ScaleViewportExtEx SetViewportExtEx SetMapMode DeleteMetaFile PlayMetaFile SetAbortProc DeleteEnhMetaFile PlayEnhMetaFile CreateICA GetEnhMetaFileHeader ScaleWindowExtEx GetWindowOrgEx GetPaletteEntries CreateDIBSection CloseEnhMetaFile CreateEnhMetaFileA LPtoDP EqualRgn ExtCreateRegion GetDIBits SetTextAlign GetWindowExtEx GetViewportExtEx CopyMetaFileA CopyEnhMetaFileA PathToRegion EndPath BeginPath WidenPath GetTextColor GetMapMode SetDIBColorTable RoundRect CreateEllipticRgnIndirect CreateRoundRectRgn GetSystemPaletteEntries GetNearestColor CreateCompatibleDC SetViewportOrgEx BitBlt DeleteDC IntersectClipRect OffsetWindowOrgEx SelectClipRgn SelectPalette CreatePalette PtInRegion OffsetRgn ExtSelectClipRgn CreateRectRgnIndirect CreateRectRgn SetRectRgn CombineRgn CreateFontIndirectA GetTextExtentPointA GetObjectA GetBitmapBits SetBkMode SelectObject ExtTextOutA CreateBitmap CreatePatternBrush SetTextColor SetBkColor CreatePen CreateHatchBrush UnrealizeObject CreateSolidBrush EndPage DeleteObject

advapi32

RegQueryInfoKeyA RegCreateKeyW RegQueryValueExW RegEnumValueA RegEnumValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegOpenKeyW RegSetValueExW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA ReportEventA DeregisterEventSource RegisterEventSourceA RegDeleteValueA RegSetValueA RegCreateKeyA RegSetValueExA RegEnumKeyA RegDeleteKeyA RegQueryValueA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA

ole32

CoTaskMemAlloc CoTaskMemFree BindMoniker RegisterDragDrop RevokeDragDrop DoDragDrop CreateILockBytesOnHGlobal OleFlushClipboard OleIsCurrentClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator CreateDataAdviseHolder CreateOleAdviseHolder CoRegisterClassObject CoRevokeClassObject CLSIDFromString OleDoAutoConvert OleRegGetUserType OleSaveToStream ReadClassStg ReadClassStm OleConvertIStorageToOLESTREAM OleConvertOLESTREAMToIStorage StgIsStorageILockBytes StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleCreateFromData OleCreateLinkFromData OleGetIconOfClass OleGetClipboard OleSetClipboard OleCreateLink OleCreateLinkToFile OleGetAutoConvert OleCreateFromFile CoMarshalInterface CoUnmarshalInterface CreateStreamOnHGlobal StringFromCLSID StringFromGUID2 CLSIDFromProgID ProgIDFromCLSID CoGetClassObject CoCreateInstance MkParseDisplayName CoIsOle1Class OleQueryLinkFromData OleQueryCreateFromData GetClassFile CreateBindCtx OleDuplicateData ReleaseStgMedium OleSetMenuDescriptor CoRegisterMessageFilter OleUninitialize OleInitialize CoGetMalloc OleRegGetMiscStatus CoCreateGuid IIDFromString CoFreeUnusedLibraries CoDisconnectObject IsAccelerator OleIsRunning OleRun OleLockRunning StgCreateDocfile WriteClassStg OleSave StgOpenStorage OleLoad CoLockObjectExternal

oleaut32

OleTranslateColor OleCreatePropertyFrame VariantInit VariantClear SysAllocString SysFreeString OleCreateFontIndirect OleCreatePictureIndirect SysAllocStringByteLen OaBuildVersion SysAllocStringLen VariantChangeType SetErrorInfo CreateErrorInfo GetErrorInfo DispGetParam LoadTypeLi SysStringByteLen LoadRegTypeLi RegisterTypeLi LoadTypeLibEx UnRegisterTypeLi LHashValOfNameSys SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate OleLoadPicture SafeArrayDestroy VariantCopy VariantCopyInd SafeArrayDestroyData VariantChangeTypeEx CreateDispTypeInfo DispGetIDsOfNames DispInvoke SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement SafeArrayPutElement SafeArrayRedim SafeArrayCopy OleIconToCursor RevokeActiveObject SafeArrayAllocDescriptor SafeArrayDestroyDescriptor SafeArrayAllocData SafeArrayLock SafeArrayUnlock VarDateFromStr SysReAllocStringLen GetActiveObject VarR8FromStr VarCyFromI4 VarBstrFromI2 VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarBstrFromDate VarBstrFromCy VarI2FromStr VarI4FromStr VarI4FromR8 VarR4FromStr VarCyFromStr SysReAllocString LHashValOfNameSysA SysStringLen

BASIC_CLASS_AddRef BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke BASIC_CLASS_QueryInterface BASIC_CLASS_Release BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo CopyRecord CreateIExprSrvObj DLLGetDocumentation DllCanUnloadNow DllFunctionCall DllGetClassObject DllRegisterServer DllUnregisterServer EVENT_SINK2_AddRef EVENT_SINK2_Release EVENT_SINK_AddRef EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke EVENT_SINK_QueryInterface EVENT_SINK_Release EbCreateContext EbDestroyContext EbGetErrorInfo EbGetHandleOfExecutingProject EbGetObjConnectionCounts EbGetVBAObject EbIsProjectOnStack EbLibraryLoad EbLibraryUnload EbLoadRunTime EbResetProject EbResetProjectNormal EbSetContextWorkerThread GetMem1 GetMem2 GetMem4 GetMem8 GetMemEvent GetMemNewObj GetMemObj GetMemStr GetMemVar IID_IVbaHost MethCallEngine ProcCallEngine PutMem1 PutMem2 PutMem4 PutMem8 PutMemEvent PutMemNewObj PutMemObj PutMemStr PutMemVar SetMemEvent SetMemNewObj SetMemObj SetMemVar ThunRTMain TipCreateInstanceEx TipCreateInstanceProject2 TipGetAddressOfPredeclaredInstance TipInvokeMethod TipInvokeMethod2 TipSetOption TipUnloadInstance TipUnloadProject UserDllMain VBDllCanUnloadNow VBDllGetClassObject VBDllRegisterServer VBDllUnRegisterServer VarPtr Zombie_AddRef Zombie_GetIDsOfNames Zombie_GetTypeInfo Zombie_GetTypeInfoCount Zombie_Invoke Zombie_QueryInterface Zombie_Release _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct __vbaAryConstruct2 __vbaAryCopy __vbaAryDestruct __vbaAryLock __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaAryVarVarg __vbaBoolErrVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs __vbaCyAdd __vbaCyErrVar __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 __vbaCyI4 __vbaCyInt __vbaCyMul __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt __vbaFailedFriend __vbaFileClose __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeObjList __vbaFreeStr __vbaFreeStrList __vbaFreeVar __vbaFreeVarList __vbaFreeVarg __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Abs __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2I4 __vbaI2Sgn __vbaI2Str __vbaI2Var __vbaI4Abs __vbaI4Cy __vbaI4ErrVar __vbaI4ForNextCheck __vbaI4Sgn __vbaI4Str __vbaI4Var __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew __vbaNew2 __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRedimVar2 __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCopy __vbaStrCy __vbaStrDate __vbaStrErrVarCopy __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike __vbaStrMove __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy __vbaUI1ErrVar __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarCopy __vbaVarDateVar __vbaVarDiv __vbaVarDup __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMove __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarVargNofree __vbaVarXor __vbaVarZero __vbaVargObj __vbaVargObjAddref __vbaVargParmRef __vbaVargUnk __vbaVargUnkAddref __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef __vbaVerifyVarObj __vbaWriteFile _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul rtBoolFromErrVar rtBstrFromErrVar rtCyFromErrVar rtDecFromVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtUI1FromErrVar rtcAbsVar rtcAnsiValueBstr rtcAppActivate rtcAppleScript rtcArray rtcAtn rtcBeep rtcBstrFromAnsi rtcBstrFromByte rtcBstrFromChar rtcBstrFromError rtcBstrFromFormatVar rtcByteValueBstr rtcCVErrFromVar rtcCallByName rtcChangeDir rtcChangeDrive rtcCharValueBstr rtcChoose rtcCommandBstr rtcCommandVar rtcCompareBstr rtcCos rtcCreateObject rtcCreateObject2 rtcCurrentDir rtcCurrentDirBstr rtcDDB rtcDateAdd rtcDateDiff rtcDateFromVar rtcDatePart rtcDeleteSetting rtcDir rtcDoEvents rtcEndOfFile rtcEnvironBstr rtcEnvironVar rtcErrObj rtcExp rtcFV rtcFileAttributes rtcFileCopy rtcFileDateTime rtcFileLen rtcFileLength rtcFileLocation rtcFileReset rtcFileSeek rtcFileWidth rtcFilter rtcFixVar rtcFormatCurrency rtcFormatDateTime rtcFormatNumber rtcFormatPercent rtcFreeFile rtcGetAllSettings rtcGetCurrentCalendar rtcGetDateBstr rtcGetDateValue rtcGetDateVar rtcGetDayOfMonth rtcGetDayOfWeek rtcGetErl rtcGetFileAttr rtcGetHostLCID rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetObject rtcGetPresentDate rtcGetSecondOfMinute rtcGetSetting rtcGetTimeBstr rtcGetTimeValue rtcGetTimeVar rtcGetTimer rtcGetYear rtcHexBstrFromVar rtcHexVarFromVar rtcIMEStatus rtcIPMT rtcIRR rtcImmediateIf rtcInStr rtcInStrChar rtcInStrRev rtcInputBox rtcInputCharCount rtcInputCharCountVar rtcInputCount rtcInputCountVar rtcIntVar rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsMissing rtcIsNull rtcIsNumeric rtcIsObject rtcJoin rtcKillFiles rtcLeftBstr rtcLeftCharBstr rtcLeftCharVar rtcLeftTrimBstr rtcLeftTrimVar rtcLeftVar rtcLenCharVar rtcLenVar rtcLog rtcLowerCaseBstr rtcLowerCaseVar rtcMIRR rtcMacId rtcMakeDir rtcMidBstr rtcMidCharBstr rtcMidCharVar rtcMidVar rtcMonthName rtcMsgBox rtcNPV rtcNPer rtcOctBstrFromVar rtcOctVarFromVar rtcPMT rtcPPMT rtcPV rtcPackDate rtcPackTime rtcPartition rtcQBColor rtcR8ValFromBstr rtcRandomNext rtcRandomize rtcRate rtcRemoveDir rtcReplace rtcRgb rtcRightBstr rtcRightCharBstr rtcRightCharVar rtcRightTrimBstr rtcRightTrimVar rtcRightVar rtcRound rtcSLN rtcSYD rtcSaveSetting rtcSendKeys rtcSetCurrentCalendar rtcSetDateBstr rtcSetDateVar rtcSetFileAttr rtcSetTimeBstr rtcSetTimeVar rtcSgnVar rtcShell rtcSin rtcSpaceBstr rtcSpaceVar rtcSplit rtcSqr rtcStrConvVar rtcStrConvVar2 rtcStrFromVar rtcStrReverse rtcStringBstr rtcStringVar rtcSwitch rtcTan rtcTrimBstr rtcTrimVar rtcTypeName rtcUpperCaseBstr rtcUpperCaseVar rtcVarBstrFromAnsi rtcVarBstrFromByte rtcVarBstrFromChar rtcVarDateFromVar rtcVarFromError rtcVarFromFormatVar rtcVarFromVar rtcVarStrFromVar rtcVarType rtcWeekdayName

虚拟磁盘精灵/虚拟磁盘精灵.exe

IMPHASH 9153110e31d1c37896e82f2b636e3f18
SHA256 0dd740baa539da5ef30092aae99fa17cd470d73a7d5544cff68243628638e39b
MD5 b2333d260c3c29c04acf787dc904a085
SHA1 cf14412096de305761af6ccf43808d719addd643
SHA512 a156038a9df092161c090870861c793b27f3d33526cffed55b7fae409a366cc70ce1944ce9331ccc9acfa38a3d63ceca8b035285b38cd23f54046bd24787b381
SSDEEP 6144:GEFB0jx1vJ5JF6gJ82KeBB8ipF1b7klv44:GEfwJl7nBB8+alT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

227234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

?��ێ�s��bi�� }lW�˹�@�&��'��Ҿ��'�>�F�H3��2�^��D��0��r��9ࡵ��C͗D��A��q�F�5z�"#2 X��>�y�i�;[mP彣{j�Y�y�SRPW1�U=}��<��v[O%b��Z>�P��PWIQY�|F��7R�,I��(U��(��ג�u#��>��9�Oq�Xp��V�a>��k��`��j>�6��3��ޥ�@ȱݕ�Ӣ1��KzX� �-��h�:��/�9�I��:0�u3�WU.�7$�j�O��p\�\=D�5ة7�pݻ{znsƣ_FX �P��R�U��ZhRq�pLT��c��u6��L0�0Z��΃�j|7_��#�澈�K!P��<b��1�I�� ; Z��:ЭGY�A0��@��⎐}5�'�I�7G��$�'h��GYHn.ݧI!_y~C��j�� 5hD�G�s5�A`�tު��#�gV��F�cN��X��u�$�i��X�p b]PDh�~*5 }F!�?D�8Y#�$�_ `�HT�˃f�L��?��e��u�$4�C�V,�Di��|) �@��7Fb��-fV�޴jDB`Q�A��l�_��J� 3�3_G�<��C�*��(��7F�&Z�I�ςt�:J��kt��I!b�9ԈI�x�h�5�'wá�&Gp��@wh2��aS�8gUob5��}��U��z3��j&_�!˿"A�Ұ7z�Z��f��Q�Ԍ��H֑�z��b�KQ¶��(��&Î��[o�BC��I�wK�F�vMM`a�۶qNM]f^�Z5pdWN �� q?as-��СPs�FDZ�5��xSh�te*��y*@��>��E ��D��`8��Q��ۖ$Ѹ��T7�\�(��z�(.kw\��K�nM�D~��cj:�\~�RE�j7�_�^�I��z愩+@�C�m8�*DN�F��L%��t��t^��"�&�r^�f�l��y��d��Oi�(��o� ��+Q�ў|��2��A�v��%��K��º�?:��)G��Y9[�r5��eY��V8�/�Lm!#�u�o0��9I~��*Cj�-�f�[tBXv� �Vu�sy�[� ��z��E�#!��ޙ��d>[^��!I�Jzy3s�\8� �F��4��>;3T�<��{�U��[�yp�d�~�'��S��\�;�wc��؞� ��;��C��8gg\��`��o_'=�.^e�B��!�_5��F��o�T@V$3��B��N{�3��,�ٚ�\2�Q168��H�g��LNS;X�[ګ��=�Y*!n��I"�]�\p��w�[i��l��:D��H� hA_��)�T��_��A��vY�SO^��DVUv��A�G��˦mP9Y��z��/_k�q?/�;T6�"�G>�a~�/��V_�j��g��k��t�g�� m��y�X�{Os@��Jf��"f� ��f�� Z0-9~w=�A�y��)^��e�J��S6vu�l0�D#�kK��׋��^�z�g�6�iT�:@��r��j�ɣF�=Ӕ�#Nԭp@��<<O��rqp��t��oD!G� �M�p�`u0�P��P��\ �+L�� 9>��t^ o��)�U�=�ɥ��/k�wi�1Z��I� ՟�FR��ʬ]ת�!�9MT��>�{�)��!�Ӆ�l�q��^��P4�@�X��3�6��(Vn�,��Ԃ��]z�S_�FrT��{l'�F��390�TNԸ{wb�V��<U�a<��.��c�^f��kWٲ�X^a��X��X{�� 7�7#��L�"�/=��e%\�~��()E�Z+��8�6�q�b�梬�f5��G�g+Z�_�e�p␦�eő��?�ә��x�pЖ�?�M��*�.��M��"��ȵ�3�ɡ��Ѓ�r�7�@�Q�*��ԢBn�� r�J$fvL`��)W�l�r'��e�]�k[��,��S�4ƹ��A��s�e=D#鶕I+L�ƻ4e��D�M��i��U�ja�:j-_7�v��ϖ¥$�Gg��.�d��hOHXv|�浇��pp�qe��S*��S��2�>"/�%�I/�hAJ�G;H@�C�9 �h�?P�� &ǅ�ٮ��P�̙��$��\'��,�(Rh��v�ɴx��/KO�H��wǈ��n?��$��D��T@*��J ��?vQ�0!G��dY��"�켢��s��Ꮬ3��4��Z�,װ�Tg��uԸ��h稼1�K`^��G��֐�Y9�K��g�2��4y��1��P��$�9r"�M��!�>��v��E[�6��m��4g��b@��a?˾��L�W�`��iU��+GZѳ��hQ�m8��P�@j�ȡ�=��¸:,�+�VS��[�3�3�| �X�&.{�LI5�!lf��n��E�ЇM�%˶縄�eX���w��u�4t�`y~��$}��68�DZ�҂��^�K_�g#y-�Q�??hɿ�)��n��I��iA��b��}�J�Cl��U�]��7��s�R��f��V�RglO'Pl��"�Zg�i�2��[�"�M�y�Z��sn��S8�wCo`͡bMKd�#�!Ua��T�L`�Q'�6��zl�;>8prK�9>G��9M1EvY��RQ�Jώ��?�ر˽��n��iٕܹ��c�{x�K٩��)B��kJ��bm��X�c�$y��YN�iB�n�'ʹo��b�q#�/5!/�.�N�`&�)�\~�#U�AGm�1nP�qV��)��(QxZ� �SB��w�� :��

Name

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX0

Size

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE

Name

.tls

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX1

Size

152KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

83773389608d6e1f29e85c6f6ec8c3ac_JaffaCakes118

虚拟磁盘精灵/disk.dll

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

generic

虚拟磁盘精灵/msvbvm60.dll

kernel32

user32

gdi32

advapi32

ole32

oleaut32

generic

虚拟磁盘精灵/新云软件.url

虚拟磁盘精灵/虚拟磁盘精灵.exe

msvbvm60

user32

kernel32

generic