6df8049e09e985f799b2216e77f1e2e96e2f2e80bb93a2f929b406c8d21068fd

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
Size

763KB
MD5

e7adb670e2c0b0ce83e465811664f5fe
SHA1

51cd23804193da3f2c705bddacea1941443c9c5b
SHA256

6df8049e09e985f799b2216e77f1e2e96e2f2e80bb93a2f929b406c8d21068fd
SHA512

51cf7c682520e2ca34a68337d9d5bc6b453b358ad1319374caf9ae02a7ec09fd026744c35e836e311cedb7308b5d59ce5ac069c2e73b5d44ec7f78696c32cd56
SSDEEP

12288:8wxcFXH/BJrLBO9UsEace+42RFz+WJ5vmmr31br5t7vv7LgRWDrm86sjDojjV8:pcFv9PP75vmWFbr/r7LVrr3jkjx8

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	2496	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ctdownloader_2944 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe\" /afterreboot=\"C:\\Users\\Admin\\AppData\\Local\\ci-excel-add-in-v1.3.9_2023931344\""	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Loads dropped DLL 8 IoCs

pid	Process
636	MsiExec.exe
1436	rundll32.exe
1436	rundll32.exe
1436	rundll32.exe
1436	rundll32.exe
1436	rundll32.exe
636	MsiExec.exe
636	MsiExec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2496	msiexec.exe
Token: SeRestorePrivilege	600	msiexec.exe
Token: SeTakeOwnershipPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	600	msiexec.exe
Token: SeCreateTokenPrivilege	2496	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2496	msiexec.exe
Token: SeLockMemoryPrivilege	2496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2496	msiexec.exe
Token: SeMachineAccountPrivilege	2496	msiexec.exe
Token: SeTcbPrivilege	2496	msiexec.exe
Token: SeSecurityPrivilege	2496	msiexec.exe
Token: SeTakeOwnershipPrivilege	2496	msiexec.exe
Token: SeLoadDriverPrivilege	2496	msiexec.exe
Token: SeSystemProfilePrivilege	2496	msiexec.exe
Token: SeSystemtimePrivilege	2496	msiexec.exe
Token: SeProfSingleProcessPrivilege	2496	msiexec.exe
Token: SeIncBasePriorityPrivilege	2496	msiexec.exe
Token: SeCreatePagefilePrivilege	2496	msiexec.exe
Token: SeCreatePermanentPrivilege	2496	msiexec.exe
Token: SeBackupPrivilege	2496	msiexec.exe
Token: SeRestorePrivilege	2496	msiexec.exe
Token: SeShutdownPrivilege	2496	msiexec.exe
Token: SeDebugPrivilege	2496	msiexec.exe
Token: SeAuditPrivilege	2496	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2496	msiexec.exe
Token: SeChangeNotifyPrivilege	2496	msiexec.exe
Token: SeRemoteShutdownPrivilege	2496	msiexec.exe
Token: SeUndockPrivilege	2496	msiexec.exe
Token: SeSyncAgentPrivilege	2496	msiexec.exe
Token: SeEnableDelegationPrivilege	2496	msiexec.exe
Token: SeManageVolumePrivilege	2496	msiexec.exe
Token: SeImpersonatePrivilege	2496	msiexec.exe
Token: SeCreateGlobalPrivilege	2496	msiexec.exe
Token: SeCreateTokenPrivilege	2496	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2496	msiexec.exe
Token: SeLockMemoryPrivilege	2496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2496	msiexec.exe
Token: SeMachineAccountPrivilege	2496	msiexec.exe
Token: SeTcbPrivilege	2496	msiexec.exe
Token: SeSecurityPrivilege	2496	msiexec.exe
Token: SeTakeOwnershipPrivilege	2496	msiexec.exe
Token: SeLoadDriverPrivilege	2496	msiexec.exe
Token: SeSystemProfilePrivilege	2496	msiexec.exe
Token: SeSystemtimePrivilege	2496	msiexec.exe
Token: SeProfSingleProcessPrivilege	2496	msiexec.exe
Token: SeIncBasePriorityPrivilege	2496	msiexec.exe
Token: SeCreatePagefilePrivilege	2496	msiexec.exe
Token: SeCreatePermanentPrivilege	2496	msiexec.exe
Token: SeBackupPrivilege	2496	msiexec.exe
Token: SeRestorePrivilege	2496	msiexec.exe
Token: SeShutdownPrivilege	2496	msiexec.exe
Token: SeDebugPrivilege	2496	msiexec.exe
Token: SeAuditPrivilege	2496	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2496	msiexec.exe
Token: SeChangeNotifyPrivilege	2496	msiexec.exe
Token: SeRemoteShutdownPrivilege	2496	msiexec.exe
Token: SeUndockPrivilege	2496	msiexec.exe
Token: SeSyncAgentPrivilege	2496	msiexec.exe
Token: SeEnableDelegationPrivilege	2496	msiexec.exe
Token: SeManageVolumePrivilege	2496	msiexec.exe
Token: SeImpersonatePrivilege	2496	msiexec.exe
Token: SeCreateGlobalPrivilege	2496	msiexec.exe
Token: SeCreateTokenPrivilege	2496	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
2496	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 2944 wrote to memory of 2496	2944	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	29
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 600 wrote to memory of 636	600	msiexec.exe	31
PID 636 wrote to memory of 1436	636	MsiExec.exe	32
PID 636 wrote to memory of 1436	636	MsiExec.exe	32
PID 636 wrote to memory of 1436	636	MsiExec.exe	32
PID 636 wrote to memory of 1436	636	MsiExec.exe	32
PID 636 wrote to memory of 1436	636	MsiExec.exe	32
PID 636 wrote to memory of 1436	636	MsiExec.exe	32
PID 636 wrote to memory of 1436	636	MsiExec.exe	32

C:\Users\Admin\AppData\Local\Temp\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe"
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931344\SPGlobal.Platts.Excel.AddIn.Setup.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2496

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B19FC1294617C03412CE477491E9313A C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI56A4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259413937 1 SPGlobal.Platts.Excel.AddIn.PlattsCustomAction!SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.CustomActions.PluginInfo
    3⤵
    - Loads dropped DLL
    PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
344669ca8c2c7f5ceee076e54dbd2fba

SHA1
a562d09f29e8a09ca5656ece4a89b09ea4b2978b

SHA256
2661376c0c0af5e37ff4e6ed2e6d47f44f52306b638bfc750258d0c374b4cc6a

SHA512
fbd0986a02aee1ddce45fbdfc4b0d7dbbf038c28aa2247161dfe56060a1f086f42531e6b93bf5f96539b763177c228bbef6eb966b0185f9baac377e92d8ab8b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4146.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI56A4.tmp

Filesize
252KB

MD5
6c9009ef395c3b0029f592dc246947ec

SHA1
85e7625b35f8ea8b1de1da1924b2771257b9bc5b

SHA256
938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d

SHA512
7dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5D4A.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5DD7.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41F5.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931344\SPGlobal.Platts.Excel.AddIn.Setup.msi

Filesize
15.0MB

MD5
4874aa3db69a8a94cfd957c6e761db92

SHA1
c9f0e102a4b86d8a5d7d111bc6321ebb6648b21b

SHA256
1950172edcaaf0eefa20b20d81911d9907ff7e19a97f009bcb3b828f20246e9d

SHA512
de1303d98fbb50cc8e153ccf0614ed8581c634fa304f5c6e0ebd2a7883312cce674b1091b25005c332751c001a43ea4b08ff4c31832b4d53821100529a955866

Download Submit
C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931344\version_info.xml

Filesize
15KB

MD5
ad9ae654bbb119c13648c515883fd077

SHA1
ae7f8f2e8ea874d82dbebbab8f544dcdecf8d5c6

SHA256
2e5b14fe0ada3b8372020239b19739d47e885b633693365bb251ce7e290271c2

SHA512
14a670d8957afbf089c239818710ddd83186343a7459804df166c24f69ce1538a5638a7671ca1678aad2be970427d6d05268709831f784ee3c788fcb2a9a2f48

Download Submit
\Users\Admin\AppData\Local\Temp\MSI56A4.tmp

Filesize
252KB

MD5
6c9009ef395c3b0029f592dc246947ec

SHA1
85e7625b35f8ea8b1de1da1924b2771257b9bc5b

SHA256
938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d

SHA512
7dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184

Download Submit
\Users\Admin\AppData\Local\Temp\MSI56A4.tmp

Filesize
252KB

MD5
6c9009ef395c3b0029f592dc246947ec

SHA1
85e7625b35f8ea8b1de1da1924b2771257b9bc5b

SHA256
938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d

SHA512
7dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184

Download Submit
\Users\Admin\AppData\Local\Temp\MSI56A4.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
7f75f7a71b290d7976a33093b75377b9

SHA1
06412ecd7e0709871bb8836357a0a46fc44744ee

SHA256
85abc7a38eef2bdadb9e06de6406146decdb7c9a459a4a145629c6504deac542

SHA512
e9c62f89b6044450e9033218f48f1f69979060092f6e0572fdcb66334ea5a3cfb03ecfaeafda9e57f534ac03f0e37f11fa38755cd85f7fc42a23f229d3e6b6a0

Download Submit
\Users\Admin\AppData\Local\Temp\MSI56A4.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
7f75f7a71b290d7976a33093b75377b9

SHA1
06412ecd7e0709871bb8836357a0a46fc44744ee

SHA256
85abc7a38eef2bdadb9e06de6406146decdb7c9a459a4a145629c6504deac542

SHA512
e9c62f89b6044450e9033218f48f1f69979060092f6e0572fdcb66334ea5a3cfb03ecfaeafda9e57f534ac03f0e37f11fa38755cd85f7fc42a23f229d3e6b6a0

Download Submit
\Users\Admin\AppData\Local\Temp\MSI56A4.tmp-\SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll

Filesize
20KB

MD5
96159ed9e09c51c8c1ea3c5014d5c767

SHA1
983c4b119d39fbff68909d6875d34776578859a0

SHA256
b97729bb7be3ab903c046604052a40e6194a6a0b1eec1763e67428f0a2daf8ce

SHA512
46480545be6818628ad1729ee0927dfd90e1059028360dcded5b4264813aa092c0eeac9d71b36fad45e2d56c07693b461aca3ac0aaa514af30bda31dcbccd226

Download Submit
\Users\Admin\AppData\Local\Temp\MSI56A4.tmp-\SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll

Filesize
20KB

MD5
96159ed9e09c51c8c1ea3c5014d5c767

SHA1
983c4b119d39fbff68909d6875d34776578859a0

SHA256
b97729bb7be3ab903c046604052a40e6194a6a0b1eec1763e67428f0a2daf8ce

SHA512
46480545be6818628ad1729ee0927dfd90e1059028360dcded5b4264813aa092c0eeac9d71b36fad45e2d56c07693b461aca3ac0aaa514af30bda31dcbccd226

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5D4A.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5DD7.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
memory/1436-157-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/1436-161-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/1436-169-0x0000000072C50000-0x000000007333E000-memory.dmp

Filesize
6.9MB

Download
memory/1436-156-0x0000000000340000-0x000000000036E000-memory.dmp

Filesize
184KB

Download
memory/1436-151-0x0000000072C50000-0x000000007333E000-memory.dmp

Filesize
6.9MB

Download