Spyware
Trojan.GenericKDZ.76753 Gen:Variant.Mikey.113998
Created on 2021-09-28T10:19:00
d8bc15335ca8daa9a8a67fc2261636775be4dde332d8a0944017676926236da3.exe.dll
Remarks (2/3)
(0x02000046): The maximum binlog size was reached. The analysis was terminated prematurely.
(0x02000009): DLL files normally need to be submitted with an appropriate loader. Analysis result may be incomplete if an appropriate loader was not submitted.
(0x0200000E): The overall sleep time of all monitored processes was truncated from "2 hours, 52 minutes, 7 seconds" to "1 minute, 10 seconds" to reveal dormant functionality.
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\RDhJ0CNFevzX\Desktop\d8bc15335ca8daa9a8a67fc2261636775be4dde332d8a0944017676926236da3.exe.dll | Sample File | Binary |
malicious
|
...
|
Threat Name | Verdict |
---|---|
Trojan.GenericKDZ.76753 |
malicious
|
Image Base | 0x140000000 |
Entry Point | 0x140041070 |
Size Of Code | 0x41000 |
Size Of Initialized Data | 0x1bd000 |
File Type | FileType.dll |
Subsystem | Subsystem.windows_cui |
Machine Type | MachineType.amd64 |
Compile Timestamp | 2020-02-20 08:35:24+00:00 |
CompanyName | Microsoft Corporati |
FileDescription | Background Intellig |
FileVersion | 7.5.7600.16385 (win7_rtm.090713- |
InternalName | bitsp |
LegalCopyright | © Microsoft Corporation. All rights reserv |
OriginalFilename | kbdy |
ProductName | Microsoft® Windows® Operating S |
ProductVersion | 6.1.7600 |
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x140001000 | 0x40796 | 0x41000 | 0x1000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.73 |
.rdata | 0x140042000 | 0x64fd0 | 0x65000 | 0x42000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.87 |
.data | 0x1400a7000 | 0x178b8 | 0x18000 | 0xa7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.32 |
.pdata | 0x1400bf000 | 0x12c | 0x1000 | 0xbf000 | IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.58 |
.rsrc | 0x1400c0000 | 0x880 | 0x1000 | 0xc0000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.24 |
.reloc | 0x1400c1000 | 0x2324 | 0x3000 | 0xc1000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 4.65 |
.qkm | 0x1400c4000 | 0x74a | 0x1000 | 0xc4000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.cvjb | 0x1400c5000 | 0x1e66 | 0x2000 | 0xc5000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.tlmkv | 0x1400c7000 | 0xbde | 0x1000 | 0xc7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.wucsxe | 0x1400c8000 | 0x45174 | 0x46000 | 0xc8000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.fltwtj | 0x14010e000 | 0x1267 | 0x2000 | 0x10e000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.sfplio | 0x140110000 | 0x736 | 0x1000 | 0x110000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.rpg | 0x140111000 | 0x45174 | 0x46000 | 0x111000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.bewzc | 0x140157000 | 0x1124 | 0x2000 | 0x157000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.vksvaw | 0x140159000 | 0x736 | 0x1000 | 0x159000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.wmhg | 0x14015a000 | 0x1278 | 0x2000 | 0x15a000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.nfuu | 0x14015c000 | 0x451c2 | 0x46000 | 0x15c000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.cqcgue | 0x1401a2000 | 0x1f7 | 0x1000 | 0x1a2000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.edydzn | 0x1401a3000 | 0x21b | 0x1000 | 0x1a3000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.fgoks | 0x1401a4000 | 0x8fe | 0x1000 | 0x1a4000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.fdf | 0x1401a5000 | 0x1e66 | 0x2000 | 0x1a5000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.vlyui | 0x1401a7000 | 0x13e | 0x1000 | 0x1a7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.onihaq | 0x1401a8000 | 0x322 | 0x1000 | 0x1a8000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.dnoygv | 0x1401a9000 | 0x21b | 0x1000 | 0x1a9000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ejopd | 0x1401aa000 | 0xd33 | 0x1000 | 0x1aa000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ech | 0x1401ab000 | 0x13e | 0x1000 | 0x1ab000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.euhsb | 0x1401ac000 | 0xd57 | 0x1000 | 0x1ac000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.tym | 0x1401ad000 | 0x13e | 0x1000 | 0x1ad000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.nhtbzp | 0x1401ae000 | 0x1f87 | 0x2000 | 0x1ae000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ujern | 0x1401b0000 | 0x128f | 0x2000 | 0x1b0000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.cuhy | 0x1401b2000 | 0x1278 | 0x2000 | 0x1b2000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.qqrro | 0x1401b4000 | 0xbde | 0x1000 | 0x1b4000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.mcqw | 0x1401b5000 | 0x13e | 0x1000 | 0x1b5000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.xvhbg | 0x1401b6000 | 0x5a7 | 0x1000 | 0x1b6000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.pjphmh | 0x1401b7000 | 0x8fe | 0x1000 | 0x1b7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.lgwynn | 0x1401b8000 | 0x45174 | 0x46000 | 0x1b8000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.dyw | 0x1401fe000 | 0xbde | 0x1000 | 0x1fe000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.69 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
LookupIconIdFromDirectoryEx | - | 0x140042098 | 0xa64c8 | 0xa64c8 | 0x205 |
WaitForInputIdle | - | 0x1400420a0 | 0xa64d0 | 0xa64d0 | 0x32e |
GetParent | - | 0x1400420a8 | 0xa64d8 | 0xa64d8 | 0x166 |
GetFocus | - | 0x1400420b0 | 0xa64e0 | 0xa64e0 | 0x12e |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CM_Get_Resource_Conflict_DetailsW | - | 0x140042078 | 0xa64a8 | 0xa64a8 | 0x8a |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
DeleteCriticalSection | - | 0x140042038 | 0xa6468 | 0xa6468 | 0xd2 |
DeleteTimerQueue | - | 0x140042040 | 0xa6470 | 0xa6470 | 0xd9 |
TerminateJobObject | - | 0x140042048 | 0xa6478 | 0xa6478 | 0x4cd |
GetFileInformationByHandle | - | 0x140042050 | 0xa6480 | 0xa6480 | 0x1f3 |
GetThreadLocale | - | 0x140042058 | 0xa6488 | 0xa6488 | 0x293 |
GetNamedPipeServerProcessId | - | 0x140042060 | 0xa6490 | 0xa6490 | 0x229 |
GetConsoleFontSize | - | 0x140042068 | 0xa6498 | 0xa6498 | 0x1aa |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateBitmapIndirect | - | 0x140042020 | 0xa6450 | 0xa6450 | 0x2b |
GetPolyFillMode | - | 0x140042028 | 0xa6458 | 0xa6458 | 0x206 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CertGetCTLContextProperty | - | 0x140042010 | 0xa6440 | 0xa6440 | 0x44 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
AddAccessDeniedObjectAce | - | 0x140042000 | 0xa6430 | 0xa6430 | 0x15 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ChrCmpIW | - | 0x140042088 | 0xa64b8 | 0xa64b8 | 0xa |
Api name | EAT Address | Ordinal |
---|---|---|
BeginBufferedAnimation | 0x34b7c | 0x25 |
BeginBufferedPaint | 0xeef0 | 0x26 |
BeginPanningFeedback | 0x34ac8 | 0x5 |
BufferedPaintClear | 0xef64 | 0x27 |
BufferedPaintInit | 0x2b79c | 0x28 |
BufferedPaintRenderAnimation | 0xd2b8 | 0x29 |
BufferedPaintSetAlpha | 0x1a3ec | 0x2a |
BufferedPaintStopAllAnimations | 0x25dc0 | 0x33 |
BufferedPaintUnInit | 0x7758 | 0x34 |
CloseThemeData | 0xc7d8 | 0x35 |
DllCanUnloadNow | 0x3fae0 | 0x36 |
DllGetActivationFactory | 0x40178 | 0x37 |
DllGetClassObject | 0x1c954 | 0x38 |
DrawThemeBackground | 0x3bca0 | 0x39 |
DrawThemeBackgroundEx | 0x25d34 | 0x2f |
DrawThemeEdge | 0x210dc | 0x3a |
DrawThemeIcon | 0x3328c | 0x3b |
DrawThemeParentBackground | 0x1fcc | 0x46 |
DrawThemeParentBackgroundEx | 0x2b734 | 0x47 |
DrawThemeText | 0x3e0c | 0x59 |
DrawThemeTextEx | 0x101b0 | 0x72 |
EnableThemeDialogTexture | 0x2fe30 | 0x81 |
EnableTheming | 0x1ccc0 | 0x84 |
EndBufferedAnimation | 0x3ef74 | 0x85 |
EndBufferedPaint | 0x2520c | 0x86 |
EndPanningFeedback | 0x2c590 | 0x6 |
GetBufferedPaintBits | 0x109d0 | 0x87 |
GetBufferedPaintDC | 0x36c24 | 0x88 |
GetBufferedPaintTargetDC | 0x3578c | 0x89 |
GetBufferedPaintTargetRect | 0x19a20 | 0x8a |
GetColorFromPreference | 0x1c10 | 0x79 |
GetCurrentThemeName | 0xd9cc | 0x8b |
GetImmersiveColorFromColorSetEx | 0x408c8 | 0x5f |
GetImmersiveUserColorSetPreference | 0x50b0 | 0x62 |
GetThemeAnimationProperty | 0x3e0d8 | 0x8c |
GetThemeAnimationTransform | 0x8ee4 | 0x8d |
GetThemeAppProperties | 0x3eda4 | 0x8e |
GetThemeBackgroundContentRect | 0xe010 | 0x8f |
GetThemeBackgroundExtent | 0x22354 | 0x90 |
GetThemeBackgroundRegion | 0x31700 | 0x91 |
GetThemeBitmap | 0x31334 | 0x92 |
GetThemeBool | 0x269f8 | 0x93 |
GetThemeColor | 0x2568 | 0x94 |
GetThemeDocumentationProperty | 0x3234c | 0x95 |
GetThemeEnumValue | 0xff94 | 0x96 |
GetThemeFilename | 0x3a308 | 0x97 |
GetThemeFont | 0x287c8 | 0x98 |
GetThemeInt | 0x2a7bc | 0x99 |
GetThemeIntList | 0xac50 | 0x9a |
GetThemeMargins | 0x20278 | 0x9b |
GetThemeMetric | 0x12ab8 | 0x9c |
GetThemePartSize | 0x277d8 | 0x9d |
GetThemePosition | 0x20380 | 0x9e |
GetThemePropertyOrigin | 0x12f38 | 0x9f |
GetThemeRect | 0x1f884 | 0xa0 |
GetThemeStream | 0x2da18 | 0xa1 |
GetThemeString | 0x16a44 | 0xa2 |
GetThemeSysBool | 0x25e0c | 0xa3 |
GetThemeSysColor | 0x37d48 | 0xa4 |
GetThemeSysColorBrush | 0x3c958 | 0xa5 |
GetThemeSysFont | 0x197e0 | 0xa6 |
GetThemeSysInt | 0x32208 | 0xa7 |
GetThemeSysSize | 0x24fa0 | 0xa8 |
GetThemeSysString | 0x22c98 | 0xa9 |
GetThemeTextExtent | 0x2d01c | 0xaa |
GetThemeTextMetrics | 0x5cc4 | 0xab |
GetThemeTimingFunction | 0x36718 | 0xac |
GetThemeTransitionDuration | 0x9b04 | 0xad |
GetUserColorPreference | 0x3f16c | 0x78 |
GetWindowTheme | 0x18e54 | 0xae |
HitTestThemeBackground | 0x39330 | 0xaf |
IsAppThemed | 0x34b84 | 0xb0 |
IsCompositionActive | 0x5db8 | 0xb1 |
IsThemeActive | 0x136b8 | 0xb2 |
IsThemeBackgroundPartiallyTransparent | 0x2d9c8 | 0xb3 |
IsThemeDialogTextureEnabled | 0x33c18 | 0xb4 |
IsThemePartDefined | 0x10a0c | 0xb5 |
OpenThemeData | 0x383b0 | 0xb6 |
OpenThemeDataEx | 0x250a4 | 0x3d |
OpenThemeDataForDpi | 0x1a7a4 | 0xb7 |
SetThemeAppProperties | 0x33d0 | 0xb8 |
SetWindowTheme | 0x321c | 0xb9 |
SetWindowThemeAttribute | 0x3770 | 0xba |
ThemeInitApiHook | 0x24900 | 0xbb |
UpdatePanningFeedback | 0x399d4 | 0xc |
(by ordinal) | 0x2b090 | 0x1 |
(by ordinal) | 0x23df8 | 0x2 |
(by ordinal) | 0x12d14 | 0x3 |
(by ordinal) | 0x9150 | 0x4 |
(by ordinal) | 0x5e20 | 0x7 |
(by ordinal) | 0x38734 | 0x8 |
(by ordinal) | 0x35148 | 0x9 |
(by ordinal) | 0x2a41c | 0xa |
(by ordinal) | 0x1d0bc | 0xb |
(by ordinal) | 0xb00c | 0xd |
(by ordinal) | 0xb58c | 0xe |
(by ordinal) | 0xa33c | 0xf |
(by ordinal) | 0x3322c | 0x10 |
(by ordinal) | 0xc544 | 0x11 |
(by ordinal) | 0x3f450 | 0x12 |
(by ordinal) | 0x32b9c | 0x13 |
(by ordinal) | 0x163d4 | 0x14 |
(by ordinal) | 0x21d30 | 0x15 |
(by ordinal) | 0xd978 | 0x16 |
(by ordinal) | 0x40b80 | 0x17 |
(by ordinal) | 0x1b150 | 0x18 |
(by ordinal) | 0x31a58 | 0x19 |
(by ordinal) | 0x13678 | 0x1a |
(by ordinal) | 0x1ac98 | 0x1b |
(by ordinal) | 0x355d8 | 0x1c |
(by ordinal) | 0xe3c4 | 0x1d |
(by ordinal) | 0x18b0c | 0x1e |
(by ordinal) | 0x36454 | 0x1f |
(by ordinal) | 0x28be0 | 0x20 |
(by ordinal) | 0x34090 | 0x21 |
(by ordinal) | 0x2abe8 | 0x22 |
(by ordinal) | 0x392ac | 0x23 |
(by ordinal) | 0x2bf58 | 0x24 |
(by ordinal) | 0xcf04 | 0x2b |
(by ordinal) | 0x1e574 | 0x2c |
(by ordinal) | 0x2e750 | 0x2d |
(by ordinal) | 0x2eb28 | 0x2e |
(by ordinal) | 0x38158 | 0x30 |
(by ordinal) | 0x2fbec | 0x31 |
(by ordinal) | 0x3cc14 | 0x32 |
(by ordinal) | 0x105fc | 0x3c |
(by ordinal) | 0x89f4 | 0x3e |
(by ordinal) | 0x22e14 | 0x3f |
(by ordinal) | 0x2c8ac | 0x40 |
(by ordinal) | 0xdddc | 0x41 |
(by ordinal) | 0x4ddc | 0x42 |
(by ordinal) | 0x35538 | 0x43 |
(by ordinal) | 0x11dc | 0x44 |
(by ordinal) | 0x1450 | 0x45 |
(by ordinal) | 0x5aa4 | 0x48 |
(by ordinal) | 0x1b84c | 0x49 |
(by ordinal) | 0x3dd64 | 0x4a |
(by ordinal) | 0xe760 | 0x4b |
(by ordinal) | 0x26cf0 | 0x4c |
(by ordinal) | 0x40e0c | 0x4d |
(by ordinal) | 0x2389c | 0x4e |
(by ordinal) | 0x10b98 | 0x4f |
(by ordinal) | 0x39b28 | 0x50 |
(by ordinal) | 0xfdd4 | 0x51 |
(by ordinal) | 0x30244 | 0x52 |
(by ordinal) | 0x271e4 | 0x53 |
(by ordinal) | 0x6464 | 0x54 |
(by ordinal) | 0x8eec | 0x55 |
(by ordinal) | 0x17d68 | 0x56 |
(by ordinal) | 0x40c2c | 0x57 |
(by ordinal) | 0x21950 | 0x58 |
(by ordinal) | 0xf968 | 0x5a |
(by ordinal) | 0x2d204 | 0x5b |
(by ordinal) | 0x25d08 | 0x5c |
(by ordinal) | 0x7868 | 0x5d |
(by ordinal) | 0x22e88 | 0x5e |
(by ordinal) | 0x26bfc | 0x60 |
(by ordinal) | 0x34c14 | 0x61 |
(by ordinal) | 0x2c674 | 0x63 |
(by ordinal) | 0x24760 | 0x64 |
(by ordinal) | 0x1dc00 | 0x65 |
(by ordinal) | 0xb6dc | 0x66 |
(by ordinal) | 0xd6ec | 0x67 |
(by ordinal) | 0x27df4 | 0x68 |
(by ordinal) | 0x35074 | 0x69 |
(by ordinal) | 0x1f20 | 0x6a |
(by ordinal) | 0x10d44 | 0x6b |
(by ordinal) | 0x225e8 | 0x6c |
(by ordinal) | 0xd3ec | 0x6d |
(by ordinal) | 0x11bf4 | 0x6e |
(by ordinal) | 0x36898 | 0x6f |
(by ordinal) | 0x13fe4 | 0x70 |
(by ordinal) | 0x12d94 | 0x71 |
(by ordinal) | 0x15e1c | 0x73 |
(by ordinal) | 0x1b200 | 0x74 |
(by ordinal) | 0x6db8 | 0x75 |
(by ordinal) | 0x19ea0 | 0x76 |
(by ordinal) | 0x5970 | 0x77 |
(by ordinal) | 0x3987c | 0x7a |
(by ordinal) | 0x1ed80 | 0x7b |
(by ordinal) | 0x27080 | 0x7c |
(by ordinal) | 0x3c194 | 0x7d |
(by ordinal) | 0x32324 | 0x7e |
(by ordinal) | 0x3c934 | 0x7f |
(by ordinal) | 0x2b760 | 0x80 |
(by ordinal) | 0x31fd0 | 0x82 |
(by ordinal) | 0xed68 | 0x83 |
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|