| 文件名 | Volume Tools Assistant 6.5.exe |
| 文件类型 |
Win32 EXE
|
| 魔术字节 | PE32+ executable (GUI) x86-64, for MS Windows |
| SSDEEP 哈希 |
393216:yK3XnR9tCc9m4wNHY3gInV2GWtscH3vqS:yKHR9tCc09Y3gIn9WtDH3vV
|
| 扫描器版本 | 1.0.211.174 |
| 数据库版本 | 2025-03-22 20:00:45 UTC |
被 17 个安全引擎检测到 - 需要谨慎
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
f052bd178cbf824c6de19b559b4c3a99
|
|
| SHA1 |
0e647d75808f59d2d87d9293976f3633451200ff
|
|
| SHA256 |
bf1ff82c1e5d624b41763af0ea04e30bcd1445a1753f71a81e7b6584ad351849
|
|
| SHA512 |
ed9be3852a51664d83f68cfb80e8ffa04abbc3eee5cc286abc4d8f4d0f8185a6c4e90639eabb781548fd108fa720e3f41f0e5132f3e73f1aee062394d26a0126
|
|
| ImpHash |
76beffdbe1a94b91bd3c2cec3ca2abeb
|
| 图标 |
哈希: baa39fc7135ce78e26d53a7d428159f7
模糊: 1739da63ee8875554603b1316d74f290 dHash: aa3596968ac666ba |
| 映像基址 | 0x140000000 |
| 入口点 | 0x14304de90 |
| 编译时间 | 2024-10-17 12:16:00 |
| 校验和 | 0x00000000 (实际: 0x00db246a) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 16 库 |
| 导出 | 0 函数 |
| 资源 | 4 资源 |
| 节 | 9 节 |
| Translation | 0x0000 0x04b0 |
| CompanyName | VolumeToolsAssist |
| FileDescription | VolumeToolsAssist |
| FileVersion | 1.0.0.0 |
| InternalName | VolumeToolsAssist.dll |
| LegalCopyright | |
| OriginalFilename | VolumeToolsAssist.dll |
| ProductName | VolumeToolsAssist |
| ProductVersion | 1.0.0 |
| Assembly Version | 1.0.0.0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
|
0x00001000 |
90,112 bytes | 40,960 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
3485FC33EEE112329F3B612298B6D439 |
|
0x00017000 |
40,960 bytes | 12,288 bytes | 7.97 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F96D0F70570BD3F4B0458420ACC3AA8B |
|
0x00021000 |
8,192 bytes | 512 bytes | 7.24 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
ECAC98B369328E4BA718983F21ABAF19 |
|
0x00023000 |
8,192 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
|
0x00025000 |
4,096 bytes | 1,024 bytes | 6.53 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1A9B4D74259985BCBEE091559537AE84 |
|
0x00026000 |
77,824 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rsrc |
0x00039000 |
77,824 bytes | 74,240 bytes | 7.95 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
24F00FAB5106966733D747D50A2CDF76 |
|
0x0004c000 |
41,394,176 bytes | 5,211,136 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
C02621B7330A403CF49141214EF600AF |
|
0x027c6000 |
8,966,144 bytes | 8,962,560 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
0C12D10F72600D3DCA6251FE41945B62 |
5 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 1 | 69,496 字节 | |
| RT_GROUP_ICON | 1 | 20 字节 | |
| RT_VERSION | 1 | 784 字节 | |
| RT_MANIFEST | 1 | 3,419 字节 |
| 产品 | VolumeToolsAssist |
| 描述 | VolumeToolsAssist |
| 文件版本 | 1.0.0.0 |
| 原始名称 | VolumeToolsAssist.dll |
| 内部名称 | VolumeToolsAssist.dll |
1A 6B EE 72 49 2D D0 9D 99 D6 35 92 C2 29 9F 83 E9 D0 32 F62C ED 5C 2C 5D B4 B7 06 CF DF 0F 49 77 45 62 80 4F DC 00 C7✓ 此文件已进行数字签名，证书链已验证。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
