Type DPAPI Blob

From truxwiki.com

Revision as of 13:17, 1 September 2021 by Sam (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to navigation Jump to search

Details
Defined Constant	`Type_DPAPI_Blob`
File Type Value	597
Parent Type	None
Carve	Yes
Format Details	Yes
MIME Type	`application/octet-stream`
Filename Extension	`bin`

Microsoft's Data Protection Application Programming Interface (DPAPI) Blob

Description

DPAPI Encrypted Data

Details

This is data encrypted via Microsoft's DPAPI functions. The CryptProtectData function produces this blob.

Truxton Exploiters

This file type is handled by the following ETLs:

Expand

Retrieved from "https://truxwiki.com/index.php?title=Type_DPAPI_Blob&oldid=5217"