Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-02-2025 09:00
Static task
static1
Behavioral task
behavioral1
Sample
TabularEditor.3.Installer.x64.Net8.exe
Resource
win11-20250217-en
windows11-21h2-x64
19 signatures
150 seconds
General
-
Target
TabularEditor.3.Installer.x64.Net8.exe
-
Size
41.8MB
-
MD5
0a88da9b22e7b130313c6c828890a047
-
SHA1
1ebafbb93872f0f2558162bcd2fbbb1703b666d2
-
SHA256
8f5b7c34e176ec2a62b2e5a9de661dfc8b10fc2590bbbfab14ec9d06b147a0ac
-
SHA512
2a0aa27a982edba4d1338e6e86fdcb6500ffdaafc541ab9717a82ccf015668f99f51ae9deb4d6d1c7a5295238ea1cd36d52f3b13aad97b48bb6c2db778dff0e6
-
SSDEEP
786432:OJ1HSHwSmCW54uN7+qhF/A5rXtSXv6RjjOSjX6EmFOTpezsiFroGm57IyBl:OJ1HSHwSmdp+cY5rXtSX6jjOSjXxmFfa
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2372 windowsdesktop-runtime-8.0.6-win-x64.exe 484 windowsdesktop-runtime-8.0.6-win-x64.exe 928 windowsdesktop-runtime-8.0.6-win-x64.exe -
Loads dropped DLL 62 IoCs
pid Process 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 484 windowsdesktop-runtime-8.0.6-win-x64.exe 4764 MsiExec.exe 4764 MsiExec.exe 1344 MsiExec.exe 1344 MsiExec.exe 4584 MsiExec.exe 4584 MsiExec.exe 4584 MsiExec.exe 4584 MsiExec.exe 4824 MsiExec.exe 4824 MsiExec.exe 4908 windowsdesktop-runtime-8.0.2-win-x64.exe 3932 MsiExec.exe 3932 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 4204 MsiExec.exe 4204 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1180 TabularEditor.3.Installer.x64.Net8.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 4940 MsiExec.exe 2228 MsiExec.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 2228 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{942f6911-1a02-4186-8c4c-b27eb2b9733d} = "\"C:\\ProgramData\\Package Cache\\{942f6911-1a02-4186-8c4c-b27eb2b9733d}\\windowsdesktop-runtime-8.0.6-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-8.0.6-win-x64.exe -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 1104 MsiExec.exe 5 1104 MsiExec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\U: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\B: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\K: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\U: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\X: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\I: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\O: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\W: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\Y: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\Q: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\V: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\T: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\J: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\S: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\W: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\L: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\R: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\S: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\R: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\P: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\H: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\I: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\M: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\E: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\L: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\Z: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: TabularEditor.3.Installer.x64.Net8.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\zh-Hant\System.Windows.Forms.Primitives.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\tr\PresentationCore.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\Dax.Formatter.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\TabularEditor3.Snowflake.Data.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Net.Ping.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\DevExpress.XtraEditors.v24.1.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\Microsoft.Web.WebView2.WinForms.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\zh-Hant\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\Microsoft.Bcl.AsyncInterfaces.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\runtimes\win\lib\net8.0\System.DirectoryServices.AccountManagement.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.IO.FileSystem.DriveInfo.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\es\System.Windows.Forms.Primitives.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Xml.XDocument.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\zh-Hans\ReachFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\UIAutomationClientSideProviders.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\ActiveDirectoryObjectPicker.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\Azure.Identity.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Security.AccessControl.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\it\PresentationCore.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\cs\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\Microsoft.AnalysisServices.Tabular.Json.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Windows.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Runtime.Intrinsics.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\PresentationFramework.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\zh-Hans\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Runtime.Serialization.Json.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\Microsoft.WindowsDesktop.App.deps.json msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\Tabular Editor 3\Dax.Metadata.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.6\System.Drawing.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\ja\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\ru\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\ko\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.6\zh-Hans\System.Windows.Input.Manipulations.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json msiexec.exe File created C:\Program Files\Tabular Editor 3\TabularEditor3.Licensing.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF2C6738BDD4204D20.TMP msiexec.exe File created C:\Windows\Installer\e57ff45.msi msiexec.exe File created C:\Windows\SystemTemp\~DF105AC60BCCE9A3CC.TMP msiexec.exe File created C:\Windows\Installer\e57ff49.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI11B4.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{EAEDD1FB-8876-4FD8-98A6-3AF439887414} msiexec.exe File created C:\Windows\Installer\e57ff59.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI25E1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF3A75F7B339C2E010.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE8DCD125C9A6EA4D.TMP msiexec.exe File opened for modification C:\Windows\Installer\{93869B32-17F1-44F1-BB97-D4F86E5D4ED0}\TabularEditor_192DPI.exe msiexec.exe File created C:\Windows\SystemTemp\~DF1B105D1F549E7D2C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB5A1.tmp-0\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIFFEB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6F1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF60C9BBC9BD2DB9F1.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA344E876100A0EB7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF93642DEDEC3DD977.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3D45.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFCF354FA224B48315.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB9B4BDFA9500E8A3.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI104C.tmp msiexec.exe File created C:\Windows\Installer\e57ff55.msi msiexec.exe File created C:\Windows\SystemTemp\~DFAA77E997BD259A00.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3C79.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3DC3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA282.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFC5E8ABF2C6AE049E.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57ff40.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ff45.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC81148E3195FBD0A.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\64.8.8795 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\64.8.8795\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\MSI49FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA242.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF21.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI12BF.tmp msiexec.exe File created C:\Windows\Installer\e57ff4f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB5A1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB5A1.tmp-0\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\~DF25F46BDFCB71E7E9.TMP msiexec.exe File created C:\Windows\Installer\e57ff44.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1524.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA272.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF6053B4321FF57D82.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1428.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7E1993371F2106E8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA1F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD42.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{59C4A6C5-E254-4819-B254-0B4FF17747EB} msiexec.exe File created C:\Windows\SystemTemp\~DF89856485CA94BD74.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF84F25BC32673DA21.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4102.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE45.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D45.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA202.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{93869B32-17F1-44F1-BB97-D4F86E5D4ED0} msiexec.exe File opened for modification C:\Windows\Installer\MSIAF76.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3E70.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{F69305BE-6EFA-45D0-9635-752373304A1A} msiexec.exe File created C:\Windows\Installer\e57ff4a.msi msiexec.exe File created C:\Windows\SystemTemp\~DF11F7B3DD64381015.TMP msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TabularEditor.3.Installer.x64.Net8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-8.0.6-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-8.0.2-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-8.0.2-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-8.0.6-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-8.0.2-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TabularEditor.3.Installer.x64.Net8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-8.0.6-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 484 windowsdesktop-runtime-8.0.6-win-x64.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Control Panel\Colors TabularEditor.3.Installer.x64.Net8.exe -
Modifies data under HKEY_USERS 19 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{942f6911-1a02-4186-8c4c-b27eb2b9733d}\Dependents windowsdesktop-runtime-8.0.6-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB50396FAFE60D54695357323703A4A1\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.24.15199_x64\Dependents\{942f6911-1a02-4186-8c4c-b27eb2b9733d} windowsdesktop-runtime-8.0.6-win-x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.8.8795_x64 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\Version = "51576832" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB50396FAFE60D54695357323703A4A1\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB50396FAFE60D54695357323703A4A1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F69305BE-6EFA-45D0-9635-752373304A1A}v64.24.15199\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.24.15199_x64 windowsdesktop-runtime-8.0.6-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BF1DDEAE67888DF4896AA34F93884741 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D4DD5FE094CE7EA4C8A96FF48F3BAE85\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4DD5FE094CE7EA4C8A96FF48F3BAE85\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{942f6911-1a02-4186-8c4c-b27eb2b9733d} windowsdesktop-runtime-8.0.6-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE\Version = "1075329887" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\23B968391F711F44BB794D8FE6D5E40D msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9DD61CBBEAD5AD449609DDF0061A46BC msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.24.15199_x64 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\DisplayName = "Microsoft .NET Host - 8.0.6 (x64)" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{63880B41-04FC-4F9B-92C4-4455C255EB8C}\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C} windowsdesktop-runtime-8.0.2-win-x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9DF1F64D8EF250D42BCA10C1326BB942 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.8.8795_x64\Dependents windowsdesktop-runtime-8.0.2-win-x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\ProductName = "Tabular Editor 3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B227657935758766D48D45E6F6BC0885\EB50396FAFE60D54695357323703A4A1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CDF4AE7DE1850E56388D296F9D16594A\5C6A4C95452E91842B45B0F41F7774BE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF1DDEAE67888DF4896AA34F93884741\AdvertiseFlags = "388" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63337BB296F4141479799EDBF63E89A0\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents\{942f6911-1a02-4186-8c4c-b27eb2b9733d} windowsdesktop-runtime-8.0.6-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.24.15241_x64\ = "{0EF5DD4D-EC49-4AE7-8C9A-F64FF8B3EA58}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4DD5FE094CE7EA4C8A96FF48F3BAE85\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB50396FAFE60D54695357323703A4A1\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.24.15199_x64\Dependents windowsdesktop-runtime-8.0.6-win-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4DD5FE094CE7EA4C8A96FF48F3BAE85\Assignment = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.8.8795_x64\Dependents windowsdesktop-runtime-8.0.2-win-x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB50396FAFE60D54695357323703A4A1\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF1DDEAE67888DF4896AA34F93884741 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF1DDEAE67888DF4896AA34F93884741\SourceList\PackageName = "dotnet-host-8.0.6-win-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF1DDEAE67888DF4896AA34F93884741\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4DD5FE094CE7EA4C8A96FF48F3BAE85\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\ProductIcon = "C:\\Windows\\Installer\\{93869B32-17F1-44F1-BB97-D4F86E5D4ED0}\\TabularEditor_192DPI.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE\ProductName = "Microsoft .NET Host FX Resolver - 8.0.6 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BF1DDEAE67888DF4896AA34F93884741\Provider msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF1DDEAE67888DF4896AA34F93884741\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4DD5FE094CE7EA4C8A96FF48F3BAE85\ProductName = "Microsoft Windows Desktop Runtime - 8.0.6 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4DD5FE094CE7EA4C8A96FF48F3BAE85\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0EF5DD4D-EC49-4AE7-8C9A-F64FF8B3EA58}v64.24.15241\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_RUNTIME_64.8.8795_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C} windowsdesktop-runtime-8.0.2-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.24.15199_x64\ = "{F69305BE-6EFA-45D0-9635-752373304A1A}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB50396FAFE60D54695357323703A4A1\PackageCode = "566DD64B76A859C43A6EA63F9661EE02" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D4DD5FE094CE7EA4C8A96FF48F3BAE85\Provider msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64\Dependents windowsdesktop-runtime-8.0.2-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B968391F711F44BB794D8FE6D5E40D\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EB50396FAFE60D54695357323703A4A1 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C6A4C95452E91842B45B0F41F7774BE\InstanceType = "0" msiexec.exe -
Modifies system certificate store 2 TTPs 11 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 TabularEditor.3.Installer.x64.Net8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 TabularEditor.3.Installer.x64.Net8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 TabularEditor.3.Installer.x64.Net8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 TabularEditor.3.Installer.x64.Net8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 TabularEditor.3.Installer.x64.Net8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 4728 msiexec.exe 4728 msiexec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe 1104 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4728 msiexec.exe Token: SeCreateTokenPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeAssignPrimaryTokenPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeLockMemoryPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeIncreaseQuotaPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeMachineAccountPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeTcbPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSecurityPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeTakeOwnershipPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeLoadDriverPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSystemProfilePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSystemtimePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeProfSingleProcessPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeIncBasePriorityPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreatePagefilePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreatePermanentPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeBackupPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeRestorePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeShutdownPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeDebugPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeAuditPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSystemEnvironmentPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeChangeNotifyPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeRemoteShutdownPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeUndockPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSyncAgentPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeEnableDelegationPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeManageVolumePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeImpersonatePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreateGlobalPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreateTokenPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeAssignPrimaryTokenPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeLockMemoryPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeIncreaseQuotaPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeMachineAccountPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeTcbPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSecurityPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeTakeOwnershipPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeLoadDriverPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSystemProfilePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSystemtimePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeProfSingleProcessPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeIncBasePriorityPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreatePagefilePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreatePermanentPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeBackupPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeRestorePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeShutdownPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeDebugPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeAuditPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSystemEnvironmentPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeChangeNotifyPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeRemoteShutdownPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeUndockPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeSyncAgentPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeEnableDelegationPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeManageVolumePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeImpersonatePrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreateGlobalPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeCreateTokenPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeAssignPrimaryTokenPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeLockMemoryPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeIncreaseQuotaPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe Token: SeMachineAccountPrivilege 1180 TabularEditor.3.Installer.x64.Net8.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1180 TabularEditor.3.Installer.x64.Net8.exe 1180 TabularEditor.3.Installer.x64.Net8.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 4728 wrote to memory of 1104 4728 msiexec.exe 80 PID 4728 wrote to memory of 1104 4728 msiexec.exe 80 PID 4728 wrote to memory of 1104 4728 msiexec.exe 80 PID 1104 wrote to memory of 2372 1104 MsiExec.exe 81 PID 1104 wrote to memory of 2372 1104 MsiExec.exe 81 PID 1104 wrote to memory of 2372 1104 MsiExec.exe 81 PID 2372 wrote to memory of 484 2372 windowsdesktop-runtime-8.0.6-win-x64.exe 82 PID 2372 wrote to memory of 484 2372 windowsdesktop-runtime-8.0.6-win-x64.exe 82 PID 2372 wrote to memory of 484 2372 windowsdesktop-runtime-8.0.6-win-x64.exe 82 PID 484 wrote to memory of 928 484 windowsdesktop-runtime-8.0.6-win-x64.exe 83 PID 484 wrote to memory of 928 484 windowsdesktop-runtime-8.0.6-win-x64.exe 83 PID 484 wrote to memory of 928 484 windowsdesktop-runtime-8.0.6-win-x64.exe 83 PID 4728 wrote to memory of 4764 4728 msiexec.exe 84 PID 4728 wrote to memory of 4764 4728 msiexec.exe 84 PID 4728 wrote to memory of 4764 4728 msiexec.exe 84 PID 4728 wrote to memory of 1344 4728 msiexec.exe 85 PID 4728 wrote to memory of 1344 4728 msiexec.exe 85 PID 4728 wrote to memory of 1344 4728 msiexec.exe 85 PID 4728 wrote to memory of 4584 4728 msiexec.exe 86 PID 4728 wrote to memory of 4584 4728 msiexec.exe 86 PID 4728 wrote to memory of 4584 4728 msiexec.exe 86 PID 4728 wrote to memory of 4824 4728 msiexec.exe 87 PID 4728 wrote to memory of 4824 4728 msiexec.exe 87 PID 4728 wrote to memory of 4824 4728 msiexec.exe 87 PID 928 wrote to memory of 1756 928 windowsdesktop-runtime-8.0.6-win-x64.exe 88 PID 928 wrote to memory of 1756 928 windowsdesktop-runtime-8.0.6-win-x64.exe 88 PID 928 wrote to memory of 1756 928 windowsdesktop-runtime-8.0.6-win-x64.exe 88 PID 1756 wrote to memory of 4908 1756 windowsdesktop-runtime-8.0.2-win-x64.exe 89 PID 1756 wrote to memory of 4908 1756 windowsdesktop-runtime-8.0.2-win-x64.exe 89 PID 1756 wrote to memory of 4908 1756 windowsdesktop-runtime-8.0.2-win-x64.exe 89 PID 4908 wrote to memory of 4624 4908 windowsdesktop-runtime-8.0.2-win-x64.exe 90 PID 4908 wrote to memory of 4624 4908 windowsdesktop-runtime-8.0.2-win-x64.exe 90 PID 4908 wrote to memory of 4624 4908 windowsdesktop-runtime-8.0.2-win-x64.exe 90 PID 4728 wrote to memory of 3932 4728 msiexec.exe 91 PID 4728 wrote to memory of 3932 4728 msiexec.exe 91 PID 4728 wrote to memory of 3932 4728 msiexec.exe 91 PID 4728 wrote to memory of 3336 4728 msiexec.exe 92 PID 4728 wrote to memory of 3336 4728 msiexec.exe 92 PID 4728 wrote to memory of 3336 4728 msiexec.exe 92 PID 4728 wrote to memory of 4204 4728 msiexec.exe 93 PID 4728 wrote to memory of 4204 4728 msiexec.exe 93 PID 4728 wrote to memory of 4204 4728 msiexec.exe 93 PID 1180 wrote to memory of 332 1180 TabularEditor.3.Installer.x64.Net8.exe 94 PID 1180 wrote to memory of 332 1180 TabularEditor.3.Installer.x64.Net8.exe 94 PID 1180 wrote to memory of 332 1180 TabularEditor.3.Installer.x64.Net8.exe 94 PID 4728 wrote to memory of 4940 4728 msiexec.exe 95 PID 4728 wrote to memory of 4940 4728 msiexec.exe 95 PID 4728 wrote to memory of 4940 4728 msiexec.exe 95 PID 4728 wrote to memory of 2228 4728 msiexec.exe 96 PID 4728 wrote to memory of 2228 4728 msiexec.exe 96 PID 4728 wrote to memory of 2228 4728 msiexec.exe 96 PID 2228 wrote to memory of 1820 2228 MsiExec.exe 97 PID 2228 wrote to memory of 1820 2228 MsiExec.exe 97 PID 2228 wrote to memory of 1820 2228 MsiExec.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.Net8.exe"C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.Net8.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.Net8.exe"C:\Users\Admin\AppData\Local\Temp\TabularEditor.3.Installer.x64.Net8.exe" /i "C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.19.0\install\E5D4ED0\TabularEditor.3.Installer.x64.Net8.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Tabular Editor 3" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tabular Editor 3" SECONDSEQUENCE="1" CLIENTPROCESSID="1180" AI_MORE_CMD_LINE=12⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:332
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AC459914DFF21B4D3A0C66246095E279 C2⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3\prerequisites\.NET 8.0\windowsdesktop-runtime-8.0.6-win-x64.exe"C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3\prerequisites\.NET 8.0\windowsdesktop-runtime-8.0.6-win-x64.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\Temp\{8A41891B-ECA3-4CA1-A894-9C09BA0DE620}\.cr\windowsdesktop-runtime-8.0.6-win-x64.exe"C:\Windows\Temp\{8A41891B-ECA3-4CA1-A894-9C09BA0DE620}\.cr\windowsdesktop-runtime-8.0.6-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3\prerequisites\.NET 8.0\windowsdesktop-runtime-8.0.6-win-x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=728 /q /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\Temp\{A54F10A4-D2A1-4346-A327-80FCC7C33B4F}\.be\windowsdesktop-runtime-8.0.6-win-x64.exe"C:\Windows\Temp\{A54F10A4-D2A1-4346-A327-80FCC7C33B4F}\.be\windowsdesktop-runtime-8.0.6-win-x64.exe" -q -burn.elevated BurnPipe.{7CC429DA-8176-4970-AD08-A1E23253343A} {E9D6C58E-C52D-4DB6-8D40-66865FBF41B4} 4845⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:928 -
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={942f6911-1a02-4186-8c4c-b27eb2b9733d} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{62F88E7C-BC59-4DD3-A2C6-CD4A8474E72F} {393DDB48-BC61-4DAE-B7E4-EDC5841C96FA} 9286⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={942f6911-1a02-4186-8c4c-b27eb2b9733d} -burn.filehandle.self=1072 -burn.embedded BurnPipe.{62F88E7C-BC59-4DD3-A2C6-CD4A8474E72F} {393DDB48-BC61-4DAE-B7E4-EDC5841C96FA} 9287⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -q -burn.elevated BurnPipe.{4D232D8F-F35E-497B-B1E8-DF657D38137C} {CCFBC88E-E58D-4C8F-B8F6-8914B51F70AA} 49088⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4624
-
-
-
-
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3E202D016EE038DE2196721E384B5D782⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4764
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5671A7EAA079CA22AF80DCBCF296804B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1344
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0BA6F1E3E185FA5E44B284B13AD3A5182⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4584
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 646B4FF2D5FCF2B14296731786DD752F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69202A4EB6ABF4DA55CBD59641B9AB412⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3932
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD05E796865BE40299718A2DF936BD2A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3336
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E5B81D00BE9732A491F9A0A4EA3CA1D82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 17249C9C66B2A3EC75B558ED5673979D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4940
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AFAEA7144D51D7CE0E4C0F0A43441BA9 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB5A1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240694734 379 TabularEditor3.Installer.CA!TabularEditor.Installer.CustomActions.RegisterWithPowerBI3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1820
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5a0703d686f74a2b519fa93ee9b219507
SHA1435978ee3de037e914234edbf08888f9dabf3b6b
SHA2564770246095cde8816faf1a2c53ec46e04c7449fe7a95af2b4eb58c0362cafe92
SHA51283b300e0931053ffea3713d0ab0481b6d6884a22271349ef796e40952dcc4d20594829d18a530fc9df4bad6e2e2a1d2fefb2ecb956371810a87f1fb6a7382062
-
Filesize
9KB
MD5dd388094499a14251f0a305b8b23dc82
SHA1a47648c9994937870d91bc99d5a3636e7bed1ba8
SHA25600ea7dce6ae0600443eb5337e042ac0fce6d5fdd7d3539219642a603dd21bc5b
SHA512d5888b770fd5e77299465ef5adccce460dcd3359c1242634a43332010e8fa5e556df94cf557674556f00b5577f5976a1f01d9d1003f5591b9a02391deff28d5c
-
Filesize
11KB
MD5f68a8fc5446f49631966a42f932b8acc
SHA10a2f9ff9fb11f4364cec64aea424868793585e57
SHA256cd392711d13917ab5ec388a250f03ed5560e89f1c334bed39a4642851ec989f7
SHA512e532e5cc177a57b688ed353c57e92b0a7aeaa3223df007cb33e8077f189d1d94fd19d809ff8642e76359a6444523c0e81b460b2beb7db96b2439cc965990d39f
-
Filesize
8KB
MD52c15afdc1eb1c625c4b92066002ab4ef
SHA180b84e0d53563b0a1694008902824bad042af699
SHA256ef0d4d734a58f13e72783b319763e3d0f5bf06c704fb476472189658d0c2c7ff
SHA5127190fc6bbe5439e8850b951d29ad61399857512070a380771017a4a0b296e2e507470620f667bd53ef8a3f3bc70c712c985268b9b74e21e625891406cc007a62
-
Filesize
143KB
MD533b4c87f18b4c49114d7a8980241657a
SHA1254c67b915e45ad8584434a4af5e06ca730baa3b
SHA256587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662
SHA51242b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
87KB
MD5ba28fd79b61a29d490ff55982f0bf6e1
SHA142fa325f95c661249d25b258dca3b6f91488e389
SHA2566dc72ceaede918c90b52ac9941af24d1b4855301a3170b2e590ed06066983893
SHA51251070fadf5f9370ecd9333ab8e52ec09d25b1b0247c4a17b9134c8f7879b8d6bbf2a1b7e9c40b38452f7bb55be01f9372c2db0aa7b691db526336a2bf3dccd54
-
Filesize
131KB
MD54affb5f917ecd66b3e9479acc0a42ff3
SHA160bcfbbf14deccc8a41af9eca1c848d60fdad987
SHA25693d7da2f8a8aa4c8041562dcbc309184dc8cd904ebfe43fb713b447b74085d80
SHA51209a580ba28181a5598389cf3c5e7b161e1537e0dba2d036c9c38713751c7fccf3160a4a43dd4e25f2d0ad7edd12bdb97cf92f872ca1f3bba31b1534b4c86e6e4
-
Filesize
8KB
MD52be89ff17dbb4e47d86d020b0b3ab92b
SHA1cfafff8cb41353418ebf0118003b4f37c1764e54
SHA25618ebf8f4dd3bac06a42524ab9a8cfd087c6a0a727496baaa6f47f5e4ef4c8e2c
SHA5128f177954068d50c0c7bfc25be0a4dae1222339cab12d0cbad43c5afae3393b4955d012069bf3c2a11a84878a69c314611df234a581c489029046377e8eca0a1d
-
Filesize
85KB
MD53a25f47d3dd9a028596d2548b5d43828
SHA1fbff4520da3660fbb1b1acba9d3d99aa513f1708
SHA256107a76189c558935bd54abdf56de4167938632470b29c51e5ee5a241a61c7d93
SHA512a9bab6b74ed18c152fa4790339617858a1721808e478048cb9fb0c1210b11a9082e328d1773d89b24d1e5d19ab7d6bd0859800abb754e4087fb147d22d64307b
-
Filesize
38KB
MD594900691aad34e186333fd08b934a41d
SHA15100f84d3a422e7cb46e24054c8ab473a3397546
SHA2560da4ea66c9c38cfab12716ed5465030d512acccb96ec85b04d5f5959e22683ad
SHA5126080ba44823d9b45272a3e28b1506df33532bfdc014ee57d536711c436c18511d404516b10591dc8502901ff77f3c409eb18e7d683906c814de28fd288c78876
-
Filesize
162KB
MD551df28006beec16f1b2bfe35c5b659d7
SHA18e1b22c789fdd1bdf6146164bcc54d0d83ae7102
SHA2565567609caf1577ef94d2dc0dffb82e8f173dda78073cbde581346fb643b5a10e
SHA512883506794aee8e59814fc23a8304471b6e1622a1dee5ed663a8b13cc345c63cdf77b9a79cdcb157b5c1875e48990f24d203e03324e0619f6d958a60fd211bc46
-
Filesize
134B
MD5a0efb0e7b9cee25b09e09a1a64e96ba6
SHA10c1e18f6f5e6e5e6953e9fb99ca60fdec35d6e39
SHA256f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787
SHA5127e53f9f564aaa529b3b15035671957c2923ec98ddee93758ea7a4c8645ee9058962078771b853e3490290fde1f57030dff5092d40d69418776ffee89f79c8a7c
-
Filesize
1KB
MD50b044ccde7aa9d86e02a94030d744ac2
SHA10594ebb3737536703907ba5672ccd351c6afb98a
SHA256bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3
SHA512dbfba793722589f1a76dbc75c9a2f3646733e4a079a6b70003716a7f7b8fa1a6a2b234ec9132f5737e91d20d460db1e29826b2d7ac740f73136975f19e336cd8
-
Filesize
66B
MD51fb3755fe9676fca35b8d3c6a8e80b45
SHA17c60375472c2757650afbe045c1c97059ca66884
SHA256384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21
SHA512dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3
-
Filesize
66B
MD571fa2730c42ae45c8b373053cc504731
SHA1ef523fc56f6566fbc41c7d51d29943e6be976d5e
SHA256205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd
SHA512ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f
-
Filesize
206B
MD58641f45594b8d413bf1da25ce59f1207
SHA1afebb23f5a55d304d028ca9942526b3649cddb52
SHA2560403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707
SHA51286a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a
-
Filesize
66B
MD530384472ae83ff8a7336b987292d8349
SHA185d3e6cffe47f5a0a4e1a87ac9da729537783cd0
SHA256f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a
SHA5127611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963
-
Filesize
66B
MD54b84f29fbce81aab5af97a311d0e51e2
SHA160723cf4b91c139661db5ecb0964deca1fc196ea
SHA256c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55
SHA512775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1
-
Filesize
154B
MD51966f4308086a013b8837dddf88f67ad
SHA11b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190
SHA25617b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741
SHA512ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17
-
Filesize
66B
MD54e0ac65606b6aacd85e11c470ceb4e54
SHA13f321e3bbde641b7733b806b9ef262243fb8af3b
SHA2561d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee
SHA5127b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64
-
Filesize
2KB
MD5591181aa7b9e1df21a5b5e1ea49092bc
SHA10b62267faa9b131d82ef355724e5579cb3e1bb4c
SHA25626b881052c0b2287b4e5de4fb23d4e7bf99a5104eb8d6080445ffc5877e922e3
SHA5123d3a7dc5b877fb20cec9810731be412c187a43710e29eb9775ae97ad7afd066f33fa84dab73854fdb4103dd4f81af96831c736105e7b8e437d5ee959da81811e
-
Filesize
1KB
MD53dec9f3886a7d180b1da7a72541dbf81
SHA107f3ba034be78970a86d055daed59bf7d87f8d21
SHA256fb1c5df8785650b20612b61a66ecbda5e1ed323d6c8ac45b2ebccbe9193779f8
SHA5120250b81a2795fcac69e3f2c95bdff406f01ff207e81bead96b2739f28e26dd2d97d82cccbfbd92b7141b1eabd2310db048618fef1cc5261fdff212d19bb910bf
-
Filesize
276B
MD517242d201d004bb34449aab0428d2df1
SHA177a332c6a6c4bfc47a2120203cfeabb8a2268a6b
SHA25615405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033
SHA512605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f
-
Filesize
225B
MD58ba33e929eb0c016036968b6f137c5fa
SHA1b563d786bddd6f1c30924da25b71891696346e15
SHA256bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5
SHA512ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e
-
Filesize
180B
MD51a883668b735248518bfc4eefd248113
SHA11112803a0558a1ad049d1cac6b8a9d626b582606
SHA256bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e
SHA512d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04
-
Filesize
1001KB
MD5de574f7f5256f98f356a2d620c4a2288
SHA11d57d182bb748170f5cefb7ecf594b4998e113b8
SHA256e831a5aebc7bd941fa815a9441e552a0ba699f9bd5454036a68ccbb42200353a
SHA512431f3ea61d23028e1c538af3c808e7213d629615e3cb22b41d44715ff805323da82880c35bc90fffe95621132dad96eab5bfcc395863f167664a5666369d0d5b
-
Filesize
1.1MB
MD5dd194cab81ba0394a9300fac3290fd22
SHA13ef676605e239b53bec63310e14b7df75e0d42f8
SHA2561b21039c84e860b0619a17d9f1508e5e622a1d4834b86e1b8eeffafe5d59f683
SHA51214bc3815b0367830759ca3e48edbe7061423ca72cea5ed0b2070674ee3acd7c17e8f3ce7dc6b9f83b9215507402daa0b162d68afd809b76612009fa73831f8dc
-
Filesize
893KB
MD51e105e916a38059af2253769bc9be624
SHA1521ec39ffafd44ddd5cd793ecc126481f1ee411a
SHA2563b4bac5bbb4bf191691a1b052926418d4bcab5e9aad9d535f4e1e87a19617308
SHA512eec650afe3ccb812241716530722129e35917043bca41cbba3b7e17b9f560f346908b9559d4c2f2313032348a5ba1cbf3f1d4dc66553b1da9d956c754322059a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250218090138_000_windowsdesktop_runtime_8.0.2_win_x64.msi.log
Filesize1KB
MD578c4a022b51222783e966c7de6aab1c2
SHA14506561ce4ba67576ede3868cc2c9b8ede9577c6
SHA2567571a9acd413691e505b96376cae9e7de0af4016a2e08f3a1bb28621b6778665
SHA512b0e391cd682dd30a0cf1825391d44189d87692bfb1edd5ec72b17f624c0ea39710af6564340d63fb5e1cc4daaeeebc22f20fced2f21ed88445a6fcf0badb73da
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250218090138_001_dotnet_hostfxr_8.0.2_win_x64.msi.log
Filesize1KB
MD5b8d01d7732d7ee016cd8d61c8e0b2ec7
SHA1c86f8e7f165cc0a8e4f75707dd524257596485a7
SHA256cc4ee76ab25b250559b7b86faf9e56b3527aa3d0470aa4266ec1eee0654dfd5e
SHA512e38800b58f62523460ffe1e7e5e52849a3a3c90affb986c0c96e840746cded8a763273f185394a1fefed50753d021a634d69b573fcba3f8e96bfdb8d7e586921
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.6_(x64)_20250218090127_000_dotnet_runtime_8.0.6_win_x64.msi.log
Filesize4KB
MD5ed58426c4f82880222c294093808dcee
SHA16b5f871bcb98cfaaa375d561b2a25dcbdbc60f9a
SHA25694a35187a88780c1f5f81c7cfb740dd0b20f8da660fe5348e85d2ae9beff72b9
SHA5121b7a44b947e7c0d9d24c60d7f0f02cb21024f574cf2379409f9e814b71ce0e3a85656e9f333e5943131a93ba92b11d1e379d0b390009ed5e9d805da910ce9d8c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.6_(x64)_20250218090127_001_dotnet_hostfxr_8.0.6_win_x64.msi.log
Filesize3KB
MD5d1d9fa5eb3032b4effa099e6c1aa401e
SHA1bc15eb0e426ed8d39d1f55616c14d7e060be126d
SHA256f2e86ae926f4f59fa5750c0134b4d84dafeb5d5015ab719de1b5d51a6d958f6a
SHA5128d9b517ef6726c7a876e6e78d8718307784cab1e26b69df44bc249a86e0456d40f5bc08ace3c2d38a4451378d98c740dcbd563eddba1db19349d1a7a168704ec
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.6_(x64)_20250218090127_002_dotnet_host_8.0.6_win_x64.msi.log
Filesize3KB
MD54c85a39d0f26d9aaacd91e0f97d787a8
SHA17a7f29102c53b0f920e8c3f726e55c77378391fc
SHA256bcf3bf4405705f99a47e8e66acb9e988b1c37e405c44097987e45d4ff282ecd5
SHA512c335d0c0ac4e6ed3ee2edd9b538c582b19275ef56efd598eff624d9dbb711a0c03534c743db6f95b9ccb2fe06c049db533669559810828eb78c75865a96b153b
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.6_(x64)_20250218090127_003_windowsdesktop_runtime_8.0.6_win_x64.msi.log
Filesize2KB
MD512aff8cf505265981fd1178529acd4dd
SHA1560d315eb3327ef4524dcc13c1b1613887fd44fa
SHA256415c3fe9a806c45875dcd793da191203c81a7aaf7757c294a88ab1e0babee6f7
SHA5121b485a62b1c019ac9ef7f4ccd0193f44ee93e64a2cbc5cb9499ef399ca137a860e4fbdef822725bdb518582609d0916877a8324ce6b41ffc0533077f31925c64
-
Filesize
5.0MB
MD5b40e4304f279119d9345be970babce41
SHA1f76f5b30e7c333efcba1d4e19215ef1fd21d6943
SHA25606285446d57089fe85b3b6127bbc92508773af458ad5cf20abf4570d41c0fee7
SHA512ad7e6b30b3ba32d641737f499874f23ccda7c4539def0465d1723d579c79c5e3e981df8526d31f2eb79dc0fe572eb4b71a780eb63df11170d4b6a0786f588299
-
C:\Users\Admin\AppData\Roaming\Tabular Editor ApS\Tabular Editor 3 3.19.0\install\E5D4ED0\TabularEditor.3.Installer.x64.Net8.msi
Filesize4.4MB
MD52e065c5da874710a5dfd76a9db7b3913
SHA1bd68000e9cb0caf70cec42d30b9c0e9616be2cc9
SHA25630dbdb77cc11ef3b6d4f855efedaa0b4ddea05ea9e5f9aa9e812c19e228b6725
SHA512cf9293e4ff530a7da46c2c8f787e91bbf496100cf8f45680a41e5df9209309fb6522711436c32cb1046cdc09a6bafd4948fe3e54f18f5f1e1299365215aa9418
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
685KB
MD5081d9558bbb7adce142da153b2d5577a
SHA17d0ad03fbda1c24f883116b940717e596073ae96
SHA256b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
SHA5122fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
-
Filesize
244KB
MD560e8c139e673b9eb49dc83718278bc88
SHA100a3a9cd6d3a9f52628ea09c2e645fe56ee7cd56
SHA256b181b6b4d69a53143a97a306919ba1adbc0b036a48b6d1d41ae7a01e8ef286cb
SHA512ac7cb86dbf3b86f00da7b8a246a6c7ef65a6f1c8705ea07f9b90e494b6239fb9626b55ee872a9b7f16575a60c82e767af228b8f018d4d7b9f783efaccca2b103
-
Filesize
5KB
MD5d5070cb3387a0a22b7046ae5ab53f371
SHA1bc9da146a42bbf9496de059ac576869004702a97
SHA25681a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
SHA5128fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
-
Filesize
636KB
MD506d322e819a7adb25748c3b389831908
SHA178db40c7525145938a108212f8532cd73c49546d
SHA256f3d4e358135c533ce225ba64370119d41f4c84e643d2670fc99c82807ee708d1
SHA512920dcc3c7db8f01f3888f46d815271e3273a09476b69e6e63979199cb4d093a7414475a52ffaff266afd1db0e91441c80d8cba8959cad971c1aa7e721bf07a0c
-
Filesize
4KB
MD59eb0320dfbf2bd541e6a55c01ddc9f20
SHA1eb282a66d29594346531b1ff886d455e1dcd6d99
SHA2569095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA5129ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
-
Filesize
215KB
MD5f68f43f809840328f4e993a54b0d5e62
SHA101da48ce6c81df4835b4c2eca7e1d447be893d39
SHA256e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
SHA512a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
-
Filesize
780KB
MD598b6ac90f0e0a7f43e3c88f9099ad70c
SHA1564ee5e09f06404a37c9ef685f2336e5d86a44f7
SHA256cdb9f64aa7845a05713ba42ece610a18c3db1aeb9b11dd33d8ad010c2c0fbd8d
SHA5125feeebaa78617f46b424c4e3e17ff9ea65ec226c8e0a79d8434df3d92aa9e131f96909a64956569c36e1d23f0b9b2c6abb245ca3c89ce3c07b7c93d149028cdd
-
Filesize
848KB
MD5357c01acfdb40c0d8fe9be487170da5d
SHA1eeaf7b56b79013f8ddb1b9d90421f2e03378d81b
SHA2564952b61ca4cd19c4690a24f30f1f437cb416d06756330345e3fa821b9b90f44f
SHA512152556764f958e8c3a9096e0e87ce4893ff93358be279a9a2ad9ada58f011a99a7fd4342ab0685998b0e90673a341e02fb18bc92d8ce0d5dcf7156eb70c4aec7
-
Filesize
26.2MB
MD59616c0869dffc30a2923a890d8b14a67
SHA1174affdbc38a3c7fc15e48528c80e7168d228be0
SHA2565b58566f0b0520d92aa9fbe75b75d6942bf1cf012d80c44d3af96ded3824c3d4
SHA512d5252b4a86a674fcf460a65223dd3261816b6e7865f7b6c1f387b682090e8e6f92601e7b67cff57856b52c086add10e4d55189451ef26829f2a256ba621bcf24
-
Filesize
29.3MB
MD57f7a2c9903b501e6be319643903bd746
SHA1a9701397d76ad81cb24ab9839c1f6a55fe6c53f8
SHA256fc0dd518f516da1c1d23a7bf46872a36e2010fd34f5e1218d1bbc13982e5ce8f
SHA512eacb67d3cb534bb87d34f57049592f164e26f3669317e0524e0ae784bb4414e63ffbde24d82a8971629c203e689a64e15631f62754feae1ad65718d772d660b2
