Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 10:36

General

  • Target

    TabularEditor.3.Installer.x64.exe

  • Size

    43.7MB

  • MD5

    92449094c9135b8abec40da0e9780ea7

  • SHA1

    c18cd12a3dca592296e818ddbf265bfb5549be82

  • SHA256

    e648b9f735d50b1f253fe6a5ea2fc036810f2c66525609c92d1463219a2ef9c1

  • SHA512

    e4e8107aa827eeb8db4ec2232c26ec2a98a4d1fcfad9c67050bb8460a716a7b3796c1a9d164f9b9792bdde238b17b7bc5a3f1db59b3c47a412c4154f7494c393

  • SSDEEP

    786432:rsTuRN2znDcYiMBssnpbqrvk56bFQzhy2bv/MGV+50KHWiNXhOdKdM5h+kep9qvT:rsTuRN2zDcbMBssndiv6QFQzzMGYuHi+

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 31 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 1 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Modifies Control Panel
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.exe" /i "C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\TabularEditor.3.Installer.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Tabular Editor 3" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tabular Editor 3" SECONDSEQUENCE="1" CLIENTPROCESSID="952" CHAINERUIPROCESSID="952Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" AGREE_CHECKBOX="Yes" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1710604144 " TARGETDIR="F:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.exe" AI_INSTALL="1"
      2⤵
      • Enumerates connected drives
      • Modifies system certificate store
      PID:1080
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A49133C79C7BA0ED15E3EE28C8BBDFE9 C
      2⤵
      • Loads dropped DLL
      PID:4084
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E7206AC1D51C834EB7C01B8E9FAF5AFC
      2⤵
      • Loads dropped DLL
      PID:1068
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4AE75290CACFD75968B617BC73EB10D8 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI99B3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687609 306 TabularEditor3.Installer.CA!TabularEditor.Installer.CustomActions.RegisterWithPowerBI
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e588394.rbs

    Filesize

    41KB

    MD5

    f19396d05d6a299e8e8107ae6abfafb6

    SHA1

    02298b4284cd99381b39e856081d46a78da9da80

    SHA256

    68848ec22df8091c8fd5e8c464f828cf6bdc6ebd4f42b73df646ee610da27c7e

    SHA512

    59a621ab59bd84ecfa523ba85f63676b72643fee5ae9a592d90203e54d1b777ce0b811f8dc15a923b7f3c1f4931f54a12c99f60cf90fed1b0ab67ba8a6a3edaf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_77CE493961898248548404A9747CAE7A

    Filesize

    1KB

    MD5

    87dcddee327f9a3694672aa3d4ea312d

    SHA1

    2e3bb0de63c7d63de0fe612e4b8b5a8c764d4241

    SHA256

    e757b5cb8ffeae4b5c6d86b09ca94e450cab1233f3b9c7ea5d95acaa5e736aa7

    SHA512

    df92040a60783a2809a1100d9f8cff4822ea783447040cd3447389cca6a8555ab6736f491d495fc700ccbc06065323e5f1a43734352a8a32550a9a9a72539080

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

    Filesize

    1KB

    MD5

    544ae7bb3d13a8a424d53b802af32a01

    SHA1

    52d011854e43388f5110bfc6969b1f8b65ab823f

    SHA256

    f51b9065fbe6f4812a02e5375d1ee7b0fcae4df0e8f1c86e16c5c5d95fffa30d

    SHA512

    085c9543b5231d868bebfe8ceb0fa75defde3299210a45062cdb7fa54186651a45c892a7bc171fc7d8ab5282db7d239018f386f30b8b76f85b5352931125ac5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_77CE493961898248548404A9747CAE7A

    Filesize

    536B

    MD5

    e0ddd270b781837a135eb23c3d3d449f

    SHA1

    bd92e185eaf6f4ea1c1379e31d614d3a4110f26a

    SHA256

    757c3f127db06b838403d8b36722f33832c811294b3f71c91478b26ca3f6fbd2

    SHA512

    3dcce8e984534b0012985dbe8e6fc04b155c6a603f14c8222e1e588a52334cbdf03e9fda2471b58c7128338089d63e9a347620f7f29e9aa51328e3ae1756bf52

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

    Filesize

    536B

    MD5

    40503c4df9d11caa99bba4617427b02e

    SHA1

    63a7625806b3b70ec0f9395f59504c58734a4ad7

    SHA256

    38c60db5b96ee606d3ebe6b5c875585749015550243dc4d9901ecf8248ad8ba0

    SHA512

    59505b3434ef2bbc519f7f865d7a5060f5faaa16353c274c3c2a30c05d25549e5f2e234d966f91216fa27c3e4607d5c85741c3f51ce7e213f590779386054f3b

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\backgroundprepare

    Filesize

    134B

    MD5

    a0efb0e7b9cee25b09e09a1a64e96ba6

    SHA1

    0c1e18f6f5e6e5e6953e9fb99ca60fdec35d6e39

    SHA256

    f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787

    SHA512

    7e53f9f564aaa529b3b15035671957c2923ec98ddee93758ea7a4c8645ee9058962078771b853e3490290fde1f57030dff5092d40d69418776ffee89f79c8a7c

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\checkbox

    Filesize

    1KB

    MD5

    0b044ccde7aa9d86e02a94030d744ac2

    SHA1

    0594ebb3737536703907ba5672ccd351c6afb98a

    SHA256

    bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3

    SHA512

    dbfba793722589f1a76dbc75c9a2f3646733e4a079a6b70003716a7f7b8fa1a6a2b234ec9132f5737e91d20d460db1e29826b2d7ac740f73136975f19e336cd8

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_bottom_left.bmp

    Filesize

    66B

    MD5

    1fb3755fe9676fca35b8d3c6a8e80b45

    SHA1

    7c60375472c2757650afbe045c1c97059ca66884

    SHA256

    384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21

    SHA512

    dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_bottom_mid.bmp

    Filesize

    66B

    MD5

    71fa2730c42ae45c8b373053cc504731

    SHA1

    ef523fc56f6566fbc41c7d51d29943e6be976d5e

    SHA256

    205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd

    SHA512

    ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_caption.bmp

    Filesize

    206B

    MD5

    8641f45594b8d413bf1da25ce59f1207

    SHA1

    afebb23f5a55d304d028ca9942526b3649cddb52

    SHA256

    0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707

    SHA512

    86a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_left.bmp

    Filesize

    66B

    MD5

    30384472ae83ff8a7336b987292d8349

    SHA1

    85d3e6cffe47f5a0a4e1a87ac9da729537783cd0

    SHA256

    f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a

    SHA512

    7611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_left_inactive.bmp

    Filesize

    66B

    MD5

    4b84f29fbce81aab5af97a311d0e51e2

    SHA1

    60723cf4b91c139661db5ecb0964deca1fc196ea

    SHA256

    c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55

    SHA512

    775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_top_left.bmp

    Filesize

    154B

    MD5

    1966f4308086a013b8837dddf88f67ad

    SHA1

    1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190

    SHA256

    17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741

    SHA512

    ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\frame_top_mid.bmp

    Filesize

    66B

    MD5

    4e0ac65606b6aacd85e11c470ceb4e54

    SHA1

    3f321e3bbde641b7733b806b9ef262243fb8af3b

    SHA256

    1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee

    SHA512

    7b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\logotransp.png

    Filesize

    2KB

    MD5

    591181aa7b9e1df21a5b5e1ea49092bc

    SHA1

    0b62267faa9b131d82ef355724e5579cb3e1bb4c

    SHA256

    26b881052c0b2287b4e5de4fb23d4e7bf99a5104eb8d6080445ffc5877e922e3

    SHA512

    3d3a7dc5b877fb20cec9810731be412c187a43710e29eb9775ae97ad7afd066f33fa84dab73854fdb4103dd4f81af96831c736105e7b8e437d5ee959da81811e

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\nextcancelbuttons.xaml

    Filesize

    1KB

    MD5

    3dec9f3886a7d180b1da7a72541dbf81

    SHA1

    07f3ba034be78970a86d055daed59bf7d87f8d21

    SHA256

    fb1c5df8785650b20612b61a66ecbda5e1ed323d6c8ac45b2ebccbe9193779f8

    SHA512

    0250b81a2795fcac69e3f2c95bdff406f01ff207e81bead96b2739f28e26dd2d97d82cccbfbd92b7141b1eabd2310db048618fef1cc5261fdff212d19bb910bf

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\sys_close_hot.png

    Filesize

    276B

    MD5

    17242d201d004bb34449aab0428d2df1

    SHA1

    77a332c6a6c4bfc47a2120203cfeabb8a2268a6b

    SHA256

    15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033

    SHA512

    605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\sys_close_normal.png

    Filesize

    225B

    MD5

    8ba33e929eb0c016036968b6f137c5fa

    SHA1

    b563d786bddd6f1c30924da25b71891696346e15

    SHA256

    bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5

    SHA512

    ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e

  • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_952\sys_min_hot.png

    Filesize

    180B

    MD5

    1a883668b735248518bfc4eefd248113

    SHA1

    1112803a0558a1ad049d1cac6b8a9d626b582606

    SHA256

    bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e

    SHA512

    d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04

  • C:\Users\Admin\AppData\Local\Temp\MSI45A5.tmp

    Filesize

    738KB

    MD5

    36cd2870d577ff917ba93c9f50f86374

    SHA1

    e51baf257f5a3c3cd7b68690e36945fa3284e710

    SHA256

    8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8

    SHA512

    426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda

  • C:\Users\Admin\AppData\Local\Temp\MSI480A.tmp

    Filesize

    870KB

    MD5

    65b853552e16654c53ab4d16920a9182

    SHA1

    9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5

    SHA256

    80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f

    SHA512

    b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a

  • C:\Users\Admin\AppData\Local\Temp\MSI480A.tmp

    Filesize

    857KB

    MD5

    7640ccc9fc74039031cd166ad017a693

    SHA1

    60dd7054e3623fa2c110af6a06acdf9f2ead7581

    SHA256

    b9ef3913cba5d99e85859ef6a58c92ae4ea4d63de9388844f4051898c03de636

    SHA512

    7df71f3e078e18af13dcc47d86917d05dd46278eecea4bf70ef5e570a1ba1a1350c70ff5cf9f71fc1d7cf235be39464dfc7cb1d623e900ddcb8b251cf5841459

  • C:\Users\Admin\AppData\Local\Temp\MSI4898.tmp

    Filesize

    704KB

    MD5

    6820f0c6e8c5f583e27dd3949162e28e

    SHA1

    0df92a41fdeabdf852b2d44791f3fb3a8b6861e5

    SHA256

    10395f8db878c438e6cdbf2b9ceea96b591f707c14bcb317668266a35dde4e39

    SHA512

    e7de4d86652a61628a4291c3c8b723b6586a560a3b6acbba95df70df2b05f175fc523f3d96388d4e46f1b058c6469b7a0b8b442a264975a5d701f8fb35be207f

  • C:\Users\Admin\AppData\Local\Temp\MSI48B8.tmp

    Filesize

    575KB

    MD5

    130fceb436a50494f250ab51d52e8127

    SHA1

    4f6b454d8a80b50cca638455c30556a8939ecccb

    SHA256

    b7fc4698ad82f682a41f96a7ebb5b9340977796b5d11cdd603b84a4e6bf55060

    SHA512

    3a17792e58a6de13129ce99824d8dbf9c30854c60df4a64114e28154f4b192ecb02e126d4569450a63d6dffd77e61b9c23cb3bc7f529d2fc75a5a011bf9fdf24

  • C:\Users\Admin\AppData\Local\Temp\MSI48B8.tmp

    Filesize

    274KB

    MD5

    f97b694439439dee79749589b3d03db9

    SHA1

    505d5b374ab7705a46a3b5abe500ae45f0a339c4

    SHA256

    1a9b255c311d6588478ea0a15295c31909559e4e6affea06ff4268f456fbfda5

    SHA512

    d06c4f1e5c38e633648a6094f2bfb40ef84d735b05cda75a116b271c4d6aef9b7feedfc9b6e941ec93fd2bd251cf9cb1e8ff195e0790bfbc11c300021f4ead66

  • C:\Users\Admin\AppData\Local\Temp\MSI48C9.tmp

    Filesize

    292KB

    MD5

    aeafe5358616f28a3840e9cde5b3db43

    SHA1

    105359641094b4a0c47c39b9ccedbe468bc787c1

    SHA256

    e21e8cb96949c5bdd61ca68be091428c3d903c56f3e14833b77971d66dec5d7b

    SHA512

    41a6b783ce6ca13a0029fad7474e9f23d090202f7306d9c7380524f423aba574360291c35c1e61067ea58661c9d3d8d571496bc438ba8af6e0a22fca864297cc

  • C:\Users\Admin\AppData\Local\Temp\MSI48C9.tmp

    Filesize

    396KB

    MD5

    c3f90aa25de6ad101929571b3b21696e

    SHA1

    75445fbb0f5289a4424344354a696e8dcc6f21ef

    SHA256

    23780cd0e51170ebd6a2f985d0e0ba0d74abf9f3ee3320f8974231d01a722c46

    SHA512

    a3420387ee47b583a47e37b8ffc81b194c41a70e2c3f6f1919c69f8f48a352192c29ad8b9fddb348e318cb9e7925d06b5c32fa72dcc2184aa9d18deb5bb0ff90

  • C:\Users\Admin\AppData\Local\Temp\MSI48D9.tmp

    Filesize

    227KB

    MD5

    874005cdd6a2c5edccab1c8e4fb2420b

    SHA1

    d32f52fdd422dac099917dd79ca1b2e6985bbcdd

    SHA256

    d2d639154c1996acce403d99f4180086d6f38b69029fd97cf8d357108334cec4

    SHA512

    e0ff014c2512b92228c7e2d9dec9195b947f54bc46ff480f6a04a9d9686282108580926e758624fb5e466f0298ed3db17ba2100f63c12f965dd16fb7779ae94b

  • C:\Users\Admin\AppData\Local\Temp\MSI48D9.tmp

    Filesize

    293KB

    MD5

    074d37b966bc60d2eeb60170c92f225c

    SHA1

    1255c89819c8ba5b8b935d5438b8ee30547b099f

    SHA256

    78ca50cc97b44e60ae54ddd31778be4afd1668aec4f2f5ff00ff2c004e06a82f

    SHA512

    bfc306be74d39ea6565165d4210de44b6a28519884e621125a46c3c3494e01151a44ae0ba60ba8058aac2e96129012a3f1c473da23d7f99ce52ddca424ba0382

  • C:\Users\Admin\AppData\Local\Temp\MSI48DA.tmp

    Filesize

    322KB

    MD5

    d05efc4f7bc547a075f4bb4b5156c12a

    SHA1

    c4ce43e601c728137221632e196548f4dd8a59cd

    SHA256

    3353e4cd2bcbd268d9431eec9f82ed549c3d314020f72d58a90fd8ee20938977

    SHA512

    4f039ce50e954497dec8bf8a7586b84ce7f968bd4d29f23704197a3d87e7c887866e9651ef67ba6323a4d6212dba3e7bc5930c539c258864fc1f77425004eef6

  • C:\Users\Admin\AppData\Local\Temp\shi82D7.tmp

    Filesize

    4.8MB

    MD5

    77d6c08c6448071b47f02b41fa18ed37

    SHA1

    e7fdb62abdb6d4131c00398f92bc72a3b9b34668

    SHA256

    047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b

    SHA512

    e1aeb8e8b441d755a119f45a465ca5660678f4131984322252bfb6d2cec52e7ee54d65a64b98429b23915eb5707b04b5cd62a85446c60de8842314130a926dbd

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\ActiveDirectoryObjectPicker.dll

    Filesize

    45KB

    MD5

    39fa5cd144737aee098f48258de8dad8

    SHA1

    7ea40f9b33031d2aff0c2b58e69adbe8e6e8aca1

    SHA256

    c1e545f25e48e5f5ea3e61d55cbb7d062f8ab423ac479a9248b5b7de20c6e89f

    SHA512

    8ff55d9ab6f49ae1443fe733a31d86f5bfc4fcd87bf9e88adc9db0d910576b03d5700a03fb122f715b6d0a6d1a959b2d00cfa813fa9c3a67878e74cffd9f7f86

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Antlr4.Runtime.Standard.dll

    Filesize

    187KB

    MD5

    49d915161226b746c6d87dd2972fec5c

    SHA1

    81e790793e4a766357b8a70065e2cc004bbe6b97

    SHA256

    0440e3d2c5906326e04df87d6a5272192b7d29099901ba4215ca9e0f5dca7591

    SHA512

    b7c7b29fa8919208896ea53940b56588a8f9e22c8e480571fd6d33e376c56bbbd5f0b605a8927361f4f8934bc83bfb41828a90f23740d721b82d86656b3967ef

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Azure.Core.dll

    Filesize

    368KB

    MD5

    65af139bcad87a3463fb776f51f60530

    SHA1

    01fc61e3f0d31fdc4d444efaed23a22451890c24

    SHA256

    9fdf65a3649bd909a2ec6182ed57a871ff8cef4e17469f1ff8f057969b7d5bcc

    SHA512

    612ed8454cf897a55b2d1ab4a8a6f3bbe586d7f96136910c41aa62d773e926f4f2188773ca7770753b61eef9cd59c27f5ec407596aaebee7898b53c1ebc01668

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Azure.Identity.dll

    Filesize

    327KB

    MD5

    462482b966b07f3b3917f6fe6bc22f2e

    SHA1

    7dbbe0840e8e6d7ebd541c167b2967770773245f

    SHA256

    fc2a610675b1803176706e7efff8c6242da082e4df4efe3b3bf37d65e476535d

    SHA512

    c6fbefef1a349b4dfdb7c02eb45decf59f89aef50149bc2ee92e8dc3790e8e8b3b98e0a8c73f7b62eb715181d8946aa18b86dd79210d046f0b4278f120c9e018

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\CliWrap.dll

    Filesize

    190KB

    MD5

    3fbb8c6b84d76feb14686644806c3553

    SHA1

    b925496a37ab83818b365f4b8c711748ad99106e

    SHA256

    de800fd420c11e35b2b9abadbd643eb8ce8c0ba3c6949f50d49dc364c590f211

    SHA512

    abed4e8da222a962b60a564bfdfc853139f34fb21743dcece10f0eff987e52d4a7a89097c0d08df1f685549e8bc0eb5470bc19fe40fd89ea11be7810d37eba99

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\CommonFilesFolder\Microsoft Shared\Power BI Desktop\External Tools\tabulareditor3.pbitool.json

    Filesize

    1KB

    MD5

    1364cf6a363b4eda89aa34d96cea9613

    SHA1

    53ab33a7c0fadc9843752da5b85befb2f463e257

    SHA256

    7aa74334f6518f38760d30512877989f8f0b9992c194f20380a69fef012018f3

    SHA512

    c3d657ab00226c3a34f3c9cdb837dc20390fe16a6b0d6aba62b3a4b261e35193cc984c697058d52f4d23144bcc9bcc65a1ee9e622de79c503e473827c03816c7

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.Analyzer.dll

    Filesize

    767KB

    MD5

    bea73ff5cd7f07e572429c6f34b6cefc

    SHA1

    0ad4704d26271929a5bd12223fdaf23bd46eee60

    SHA256

    34625653a3e9b0f06f35400b0fd8dd9a3f4cabe8b2bf3bdb4547fff1f0ac79af

    SHA512

    279f2d8c52065d08d428e705fea2bac21379f5fda7d3be5f09f1444313f4e44bb66364ab13c9389acbe6782acccf234468578e64623f016f985f02ab97393050

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.Debugger.dll

    Filesize

    154KB

    MD5

    a4fad9e875353dbb5a14e238f6140071

    SHA1

    ee446fb4f764409a272976b0c7306057d5966a27

    SHA256

    12a11e2afc7bf393291e36fddfe236790133b66c27bb1173d4be00e03cfd9af2

    SHA512

    e2dcc7e48d52d6f60033fe9743f2dfde9ca986b71c7beab5746ebf3e2418bfc729df890f498235a484b86a786fc3d3ac86c5989d64bb86942b768fbebee7870d

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.Formatter.dll

    Filesize

    43KB

    MD5

    604b66ca5a16d21aff367c4d66b6698f

    SHA1

    977ea0e78dcf8a16fd288511bba05fa7e8b0c816

    SHA256

    c38817182547ec34a6d3ad943254c269f0b2a1674ae0e94776296fed552602b3

    SHA512

    397f25dfaeda059208474d1a507c281c269ee1c63076b372e3559d340670490e7e5827be3d459520581504bda5bd9fc9db4c1526cacc793784ac6944e9ccad55

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.Metadata.dll

    Filesize

    40KB

    MD5

    f443e639f18a1f2aa8729f9dfe1e48aa

    SHA1

    c82f91f8c04a8fcbc6074f6f9eb9cc4cdf78e9b6

    SHA256

    0b62d717e5267d23185fe9f0926e8ed053fb7d98f32ffe5dbd94cf1c0a68341a

    SHA512

    4176438c3c8fd54683bfb1625b4a8012d76eec0aa60c4b046672fd17c964ab39537820e7cbbd0ddca832f4e64d50096d3d1e8f88a2655311a960322c2a03a8f5

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.Model.Extractor.dll

    Filesize

    62KB

    MD5

    2a0cf556cecf1d4d2367f3f2c5e0c401

    SHA1

    63466905f01fb913b1bdc244ab23409bebb3f3ae

    SHA256

    9d7226ffd30349502ca70c0a31f9c3db620656532f9cb4bd6172e052fad81049

    SHA512

    355a90db3eb0c5ddc36d008cdf745aad5c78bcd88d06d173c98481ee77725d66cc082d52f2ca1c4c6632a49fdb2e34d7bc07f827fedc9279a1b3d40cad26dedd

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.ViewVpaExport.dll

    Filesize

    22KB

    MD5

    1c4f95fee7930c0916c53db8bf41d843

    SHA1

    768f14a40185c745e45df20867c21fdb10eee9d1

    SHA256

    960613bbed6bcada35b68183350f041e2743fc82854cd6a44f884c5a0c157137

    SHA512

    16b9cbc54208fdf988ca5ad1afcb852c922ae60081ea27c4e21d00f4802c7616747b2cb70695af8bff809496d4dd015fdcb1605dd991600f3480e93d0bd3621b

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Dax.Vpax.dll

    Filesize

    11KB

    MD5

    fa53a0f93fabf75d4e375331c279f375

    SHA1

    10f00db5171db94ec9707838f81062f2ac32cfc2

    SHA256

    81669b1d9d949f8c30367f5b7e99052f9f0869987ead0b3afb314407982ff892

    SHA512

    7e8d574b92b43d0e61a8bf42f15a21421010cb29403a185fa75a3d251e3533a2aa9b6e849e19cf8c061c01a771578b2cff3fffa7bf7647a5a8d5bec5db705f6e

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\Daxscilla.dll

    Filesize

    157KB

    MD5

    a9fbd6d69b925016b649ef9289718dd8

    SHA1

    598b38919ab2f8c07adcc325b33c7665af1213d1

    SHA256

    d0052ce1312dbccdef512ea2d49ddb0b148d3d115e5b86f5cf831e011b76d0b5

    SHA512

    b6b8c6a9f2f96fec629bccc0e946cf86943f6c13b5b0c65268dff9aae476426b64a09e4bb944719ce48110e179305a6965f406e951d4bb09d7e1708f1a97eb57

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\TabularEditor.3.Installer.x64.msi

    Filesize

    2.9MB

    MD5

    e01ce5b01a88973f8a75439f0bfb100b

    SHA1

    ee2d005de59f2ecfafd3c7b90d88c9d2af9eb2f6

    SHA256

    4cddf97da4c1df1963a93c8261e6756a9151668ce4508d5eb54df6bcd085449c

    SHA512

    86f24fcd95d5433df4d26b84f398981abf97e0ad765db843ce2c5c957701cad5c9a7377460530f1721f5a311fbc74e3b90b4b4ee76e83effcdc00773b5ed16cc

  • C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.14.0\install\E83AFAE\TabularEditor3.exe

    Filesize

    173KB

    MD5

    5cf05606ad7f1f7796c7dfb2e96ddde3

    SHA1

    1a7b24f82f03630ff8b9fd8588f31915bcb1c542

    SHA256

    a8a5d18404ed54f03bc6ccacabedf2408a4887c27277d5a2ab8f8ef9d7a61414

    SHA512

    b4beb0c778c88247cf4048bfa532da9e88da569f57288a64dd690adb2a8cf9db95de4697be74f2bd1e1940a5173c0fdb9b188611e87b12751a2aea650bd73e3a

  • C:\Windows\Installer\MSI99B3.tmp-\Newtonsoft.Json.dll

    Filesize

    685KB

    MD5

    081d9558bbb7adce142da153b2d5577a

    SHA1

    7d0ad03fbda1c24f883116b940717e596073ae96

    SHA256

    b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

    SHA512

    2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

  • memory/820-700-0x0000000002D10000-0x0000000002D3E000-memory.dmp

    Filesize

    184KB

  • memory/820-702-0x00000000052F0000-0x0000000005300000-memory.dmp

    Filesize

    64KB

  • memory/820-703-0x00000000052F0000-0x0000000005300000-memory.dmp

    Filesize

    64KB

  • memory/820-705-0x00000000052F0000-0x0000000005300000-memory.dmp

    Filesize

    64KB

  • memory/820-704-0x00000000052F0000-0x0000000005300000-memory.dmp

    Filesize

    64KB

  • memory/820-707-0x0000000002D50000-0x0000000002D58000-memory.dmp

    Filesize

    32KB

  • memory/820-709-0x00000000051F0000-0x00000000052A0000-memory.dmp

    Filesize

    704KB

  • memory/820-713-0x0000000005170000-0x0000000005192000-memory.dmp

    Filesize

    136KB

  • memory/820-724-0x000000006E870000-0x000000006F020000-memory.dmp

    Filesize

    7.7MB

  • memory/820-701-0x000000006E870000-0x000000006F020000-memory.dmp

    Filesize

    7.7MB