6df8049e09e985f799b2216e77f1e2e96e2f2e80bb93a2f929b406c8d21068fd

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2023, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
Size

763KB
MD5

e7adb670e2c0b0ce83e465811664f5fe
SHA1

51cd23804193da3f2c705bddacea1941443c9c5b
SHA256

6df8049e09e985f799b2216e77f1e2e96e2f2e80bb93a2f929b406c8d21068fd
SHA512

51cf7c682520e2ca34a68337d9d5bc6b453b358ad1319374caf9ae02a7ec09fd026744c35e836e311cedb7308b5d59ce5ac069c2e73b5d44ec7f78696c32cd56
SSDEEP

12288:8wxcFXH/BJrLBO9UsEace+42RFz+WJ5vmmr31br5t7vv7LgRWDrm86sjDojjV8:pcFv9PP75vmWFbr/r7LVrr3jkjx8

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	600	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ctdownloader_4048 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe\" /afterreboot=\"C:\\Users\\Admin\\AppData\\Local\\ci-excel-add-in-v1.3.9_2023931346\""	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Loads dropped DLL 8 IoCs

pid	Process
4388	MsiExec.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
4388	MsiExec.exe
4388	MsiExec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c1400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e42040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64190000000100000010000000a344f71a7a52a76ee49b74b1d8816b155c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4048	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
4048	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	980	msiexec.exe
Token: SeCreateTokenPrivilege	600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	600	msiexec.exe
Token: SeLockMemoryPrivilege	600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	600	msiexec.exe
Token: SeMachineAccountPrivilege	600	msiexec.exe
Token: SeTcbPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	600	msiexec.exe
Token: SeTakeOwnershipPrivilege	600	msiexec.exe
Token: SeLoadDriverPrivilege	600	msiexec.exe
Token: SeSystemProfilePrivilege	600	msiexec.exe
Token: SeSystemtimePrivilege	600	msiexec.exe
Token: SeProfSingleProcessPrivilege	600	msiexec.exe
Token: SeIncBasePriorityPrivilege	600	msiexec.exe
Token: SeCreatePagefilePrivilege	600	msiexec.exe
Token: SeCreatePermanentPrivilege	600	msiexec.exe
Token: SeBackupPrivilege	600	msiexec.exe
Token: SeRestorePrivilege	600	msiexec.exe
Token: SeShutdownPrivilege	600	msiexec.exe
Token: SeDebugPrivilege	600	msiexec.exe
Token: SeAuditPrivilege	600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	600	msiexec.exe
Token: SeChangeNotifyPrivilege	600	msiexec.exe
Token: SeRemoteShutdownPrivilege	600	msiexec.exe
Token: SeUndockPrivilege	600	msiexec.exe
Token: SeSyncAgentPrivilege	600	msiexec.exe
Token: SeEnableDelegationPrivilege	600	msiexec.exe
Token: SeManageVolumePrivilege	600	msiexec.exe
Token: SeImpersonatePrivilege	600	msiexec.exe
Token: SeCreateGlobalPrivilege	600	msiexec.exe
Token: SeCreateTokenPrivilege	600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	600	msiexec.exe
Token: SeLockMemoryPrivilege	600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	600	msiexec.exe
Token: SeMachineAccountPrivilege	600	msiexec.exe
Token: SeTcbPrivilege	600	msiexec.exe
Token: SeSecurityPrivilege	600	msiexec.exe
Token: SeTakeOwnershipPrivilege	600	msiexec.exe
Token: SeLoadDriverPrivilege	600	msiexec.exe
Token: SeSystemProfilePrivilege	600	msiexec.exe
Token: SeSystemtimePrivilege	600	msiexec.exe
Token: SeProfSingleProcessPrivilege	600	msiexec.exe
Token: SeIncBasePriorityPrivilege	600	msiexec.exe
Token: SeCreatePagefilePrivilege	600	msiexec.exe
Token: SeCreatePermanentPrivilege	600	msiexec.exe
Token: SeBackupPrivilege	600	msiexec.exe
Token: SeRestorePrivilege	600	msiexec.exe
Token: SeShutdownPrivilege	600	msiexec.exe
Token: SeDebugPrivilege	600	msiexec.exe
Token: SeAuditPrivilege	600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	600	msiexec.exe
Token: SeChangeNotifyPrivilege	600	msiexec.exe
Token: SeRemoteShutdownPrivilege	600	msiexec.exe
Token: SeUndockPrivilege	600	msiexec.exe
Token: SeSyncAgentPrivilege	600	msiexec.exe
Token: SeEnableDelegationPrivilege	600	msiexec.exe
Token: SeManageVolumePrivilege	600	msiexec.exe
Token: SeImpersonatePrivilege	600	msiexec.exe
Token: SeCreateGlobalPrivilege	600	msiexec.exe
Token: SeCreateTokenPrivilege	600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	600	msiexec.exe
Token: SeLockMemoryPrivilege	600	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4048	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
600	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 600	4048	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	85
PID 4048 wrote to memory of 600	4048	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	85
PID 4048 wrote to memory of 600	4048	2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe	85
PID 980 wrote to memory of 4388	980	msiexec.exe	88
PID 980 wrote to memory of 4388	980	msiexec.exe	88
PID 980 wrote to memory of 4388	980	msiexec.exe	88
PID 4388 wrote to memory of 2988	4388	MsiExec.exe	89
PID 4388 wrote to memory of 2988	4388	MsiExec.exe	89
PID 4388 wrote to memory of 2988	4388	MsiExec.exe	89

C:\Users\Admin\AppData\Local\Temp\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe"
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931346\SPGlobal.Platts.Excel.AddIn.Setup.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:600

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C6D41CB5B9329590BF21D86EB8E762DE C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628046 1 SPGlobal.Platts.Excel.AddIn.PlattsCustomAction!SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.CustomActions.PluginInfo
    3⤵
    - Loads dropped DLL
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp

Filesize
252KB

MD5
6c9009ef395c3b0029f592dc246947ec

SHA1
85e7625b35f8ea8b1de1da1924b2771257b9bc5b

SHA256
938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d

SHA512
7dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp

Filesize
252KB

MD5
6c9009ef395c3b0029f592dc246947ec

SHA1
85e7625b35f8ea8b1de1da1924b2771257b9bc5b

SHA256
938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d

SHA512
7dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp

Filesize
252KB

MD5
6c9009ef395c3b0029f592dc246947ec

SHA1
85e7625b35f8ea8b1de1da1924b2771257b9bc5b

SHA256
938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d

SHA512
7dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
7f75f7a71b290d7976a33093b75377b9

SHA1
06412ecd7e0709871bb8836357a0a46fc44744ee

SHA256
85abc7a38eef2bdadb9e06de6406146decdb7c9a459a4a145629c6504deac542

SHA512
e9c62f89b6044450e9033218f48f1f69979060092f6e0572fdcb66334ea5a3cfb03ecfaeafda9e57f534ac03f0e37f11fa38755cd85f7fc42a23f229d3e6b6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
7f75f7a71b290d7976a33093b75377b9

SHA1
06412ecd7e0709871bb8836357a0a46fc44744ee

SHA256
85abc7a38eef2bdadb9e06de6406146decdb7c9a459a4a145629c6504deac542

SHA512
e9c62f89b6044450e9033218f48f1f69979060092f6e0572fdcb66334ea5a3cfb03ecfaeafda9e57f534ac03f0e37f11fa38755cd85f7fc42a23f229d3e6b6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp-\SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll

Filesize
20KB

MD5
96159ed9e09c51c8c1ea3c5014d5c767

SHA1
983c4b119d39fbff68909d6875d34776578859a0

SHA256
b97729bb7be3ab903c046604052a40e6194a6a0b1eec1763e67428f0a2daf8ce

SHA512
46480545be6818628ad1729ee0927dfd90e1059028360dcded5b4264813aa092c0eeac9d71b36fad45e2d56c07693b461aca3ac0aaa514af30bda31dcbccd226

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp-\SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.dll

Filesize
20KB

MD5
96159ed9e09c51c8c1ea3c5014d5c767

SHA1
983c4b119d39fbff68909d6875d34776578859a0

SHA256
b97729bb7be3ab903c046604052a40e6194a6a0b1eec1763e67428f0a2daf8ce

SHA512
46480545be6818628ad1729ee0927dfd90e1059028360dcded5b4264813aa092c0eeac9d71b36fad45e2d56c07693b461aca3ac0aaa514af30bda31dcbccd226

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB622.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB622.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB632.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB632.tmp

Filesize
164KB

MD5
2002556e19b51e171ee7a29407c531c5

SHA1
4e5438b8defa9a9960705c1f25b989665dd9af53

SHA256
03924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03

SHA512
423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84

Download Submit
C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931346\SPGlobal.Platts.Excel.AddIn.Setup.msi

Filesize
15.0MB

MD5
4874aa3db69a8a94cfd957c6e761db92

SHA1
c9f0e102a4b86d8a5d7d111bc6321ebb6648b21b

SHA256
1950172edcaaf0eefa20b20d81911d9907ff7e19a97f009bcb3b828f20246e9d

SHA512
de1303d98fbb50cc8e153ccf0614ed8581c634fa304f5c6e0ebd2a7883312cce674b1091b25005c332751c001a43ea4b08ff4c31832b4d53821100529a955866

Download Submit
C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931346\version_info.xml

Filesize
15KB

MD5
ad9ae654bbb119c13648c515883fd077

SHA1
ae7f8f2e8ea874d82dbebbab8f544dcdecf8d5c6

SHA256
2e5b14fe0ada3b8372020239b19739d47e885b633693365bb251ce7e290271c2

SHA512
14a670d8957afbf089c239818710ddd83186343a7459804df166c24f69ce1538a5638a7671ca1678aad2be970427d6d05268709831f784ee3c788fcb2a9a2f48

Download Submit
memory/2988-37-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/2988-42-0x0000000004D10000-0x0000000004D1C000-memory.dmp

Filesize
48KB

Download
memory/2988-51-0x00000000729E0000-0x0000000073190000-memory.dmp

Filesize
7.7MB

Download
memory/2988-38-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/2988-36-0x0000000004CD0000-0x0000000004CFE000-memory.dmp

Filesize
184KB

Download
memory/2988-31-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/2988-30-0x00000000729E0000-0x0000000073190000-memory.dmp

Filesize
7.7MB

Download