Click to jump to signature section
Source: cbH3TvDB3v.doc | Virustotal: Detection: 12% | Perma Link |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0 |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0= |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://ocsp.digicert.com0 |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://ocsp.digicert.com0A |
Source: cbH3TvDB3v.doc, ~WRD0000.doc.0.dr, ~DFCFAC4359F737332B.TMP.0.dr | String found in binary or memory: http://www.digicert.com/CPS0 |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{86E0087D-F291-472A-A1A1-6F1E38491318}.tmp | Jump to behavior |
Source: cbH3TvDB3v.doc | Stream path '\x18496\x16191\x17783\x17516\x15210\x17892\x18468' : NameTableTypeColumnIdentifier_ValidationValueNPropertyId_SummaryInformationDescriptionSetCategoryKeyTableMaxValueNullableKeyColumnMinValueName of tableName of columnY;NWhether the column is nullableYMinimum value allowedMaximum value allowedFor foreign key, Name of table to which data must linkColumn to which foreign key connectsText;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;CustomSource;Property;Cabinet;Shortcut;FormattedSDDLText;Integer;DoubleInteger;TimeDate;DefaultDirString categoryTextSet of values that are permittedDescription of columnAdminExecuteSequenceActionName of action to invoke, either in the engine or the handler DLL.ConditionOptional expression which skips the action if evaluates to expFalse.If the expression syntax is invalid, the engine will terminate, returning iesBadActionData.SequenceNumber that determines the sort order in which the actions are to be executed. Leave blank to suppress action.AdminUISequenceAdvtExecuteSequenceComponentPrimary key used to identify a particular component record.ComponentIdGuidA string GUID unique to this component, version, and language.Directory_DirectoryRequired key of a Directory table record. This is actually a property name whose value contains the actual path, set either by the AppSearch action or with the default setting obtained from the Directory table.AttributesRemote execution option, one of irsEnumA conditional statement that will disable this component if the specified condition evaluates to the 'True' state. If a component is disabled, it will not be installed, regardless of the 'Action' state associated with the component.KeyPathFile;Registry;ODBCDataSourceEither the primary key into the File table, Registry table, or ODBCDataSource table. This extract path is stored when the component is installed, and is used to detect the presence of the component and to return the path to it.CustomActionPrimary key, name of action, normally appears in sequence table unless private use.The numeric custom action type, consisting of source location, code type, entry, option flags.SourceCustomSourceThe table reference of the source of the code.TargetFormattedExcecution parameter, depends on the type of custom actionExtendedTypeA numeric custom action type that extends code type or option flags of the Type column.Unique identifier for directory entry, primary key. If a property b |