应该是管理磁盘备份的一个驱动，具体原因没时间分析，卸载了吧，等BUG修复了再装回来。

VMware Workstation 14.0.0 Build 6661328 KEY
GA18K-DRXE3-488TZ-J4ZNX-PZAXA

—– BEGIN LICENSE —–
TwitterInc
200 User License
EA7E-890007
1D77F72E 390CDD93 4DCBA022 FAF60790
61AA12C0 A37081C5 D0316412 4584D136
94D7F7D4 95BC8C1C 527DA828 560BB037
D1EDDD8C AE7B379F 50C9D69D B35179EF
2FE898C4 8E4277A8 555CE714 E1FB0E43
D5D52613 C3D12E98 BC49967F 7652EED2
9D2D2E61 67610860 6D338B72 5CF95C69
E36B85CC 84991F19 7575D828 470A92AB
—— END LICENSE ——

• • 添加注册码，注册PGP

pgp --license-authorize --license-number "DAAY2-UUE69-LE950-RAZ0L-2AW5N-ANA"

• • 列出本机key

pgp --list-keys

• • 启用某个KEY

pgp --enable 0x11223344

• • 用公钥加密

pgp -e d:\file1.rtf -r 0x11223344

• • 加密目录

pgp -e -i t:\ -r 0x11223344 --archive -o d:\1.pgp

• • 解密

pgp --decrypt --input "test.pgp" -r 0x11223344 --passphrase "the_password"

• • 将KEY设置为可信

pgp --set-trust 0x11223344 --trust implicit

在AppData目录下有这些文件，每次启动YY的时候都会尝试通过卸载接口以管理员权限运行某程序，具体是什么程序就不跟了。

int CalcSha512(PBYTE Data, DWORD DataLength, BYTE Sha512[64])
{
	HCRYPTHASH	hCryptHash = 0;
	HCRYPTPROV	hCryptProv = 0;
	DWORD		HashLen = 64;
	int			ret = 1;

	do
	{
		if (!CryptAcquireContextW(&hCryptProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT))
			break;

		if (!CryptCreateHash(hCryptProv, CALG_SHA_512, 0, 0, &hCryptHash))
			break;

		if (!CryptHashData(hCryptHash, Data, DataLength, 0))
			break;

		if (!CryptGetHashParam(hCryptHash, HP_HASHVAL, Sha512, &HashLen, 0))
			break;
		ret = 0;
	} while (0);
	if (hCryptProv)
		CryptReleaseContext(hCryptProv, 0);
	if (hCryptHash)
		CryptDestroyHash(hCryptHash);
	return ret;
}

typedef struct {
  ULONG i[2]; /* number of _bits_ handled mod 2^64 */
  ULONG buf[4]; /* scratch buffer */
  unsigned char in[64]; /* input buffer */
  unsigned char digest[16]; /* actual digest after MD5Final call */
} MD5_CTX;

#define MD5DIGESTLEN 16
typedef void(WINAPI* PMD5Init)(MD5_CTX *);
typedef void(WINAPI* PMD5Update)(MD5_CTX *, const unsigned char *,
  unsigned int);
typedef void(WINAPI* PMD5Final)(MD5_CTX *);

BOOL CalcMd5(unsigned char * data, unsigned int len, char *digest)
{
  MD5_CTX  ctx;
  HMODULE  hDLL;
  BOOL    ret = FALSE;

  SecureZeroMemory(digest, MD5DIGESTLEN);
  hDLL = LoadLibraryA("advapi32.dll");
  if (hDLL) {
    PMD5Init MD5Init = (PMD5Init)GetProcAddress(hDLL, "MD5Init");
    PMD5Update MD5Update = (PMD5Update)GetProcAddress(hDLL, "MD5Update");
    PMD5Final MD5Final = (PMD5Final)GetProcAddress(hDLL, "MD5Final");
    if (MD5Init && MD5Update && MD5Final) {
      MD5Init(&ctx);
      MD5Update(&ctx, data, len);
      MD5Final(&ctx);
      memcpy(digest, ctx.digest, MD5DIGESTLEN);
      ret = TRUE;
    }
    FreeLibrary(hDLL);
  }
  return ret;
}

Command Line
DAAY2-UUE69-LE950-RAZ0L-2AW5N-ANA
Desktop
D4R6W-PQBCD-FFF6L-K950U-Q5XRV-DYC