280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c

Resubmissions

05/10/2022, 19:46

221005-yhfc9sfdc4 1

04/10/2022, 14:21

04/10/2022, 14:14

04/10/2022, 09:53

04/10/2022, 07:58

03/10/2022, 15:56

Analysis

max time kernel
1934s
max time network
2087s
platform
windows7_x64
resource
win7-20220901-es
resource tags

arch:x64arch:x86image:win7-20220901-eslocale:es-esos:windows7-x64systemwindows
submitted
03/10/2022, 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Size

766.3MB
MD5

09ea7e2bef5722cdb9ee37a7dab48ff3
SHA1

d4fb2231f80333b1b50e6f790d3b59eb3ff26374
SHA256

280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c
SHA512

eb9d65e42bccf4b700eb51c3f2890ac80f2e61a04ff661cdc3c173ff85a1f8e7f9e1cf2de89fd3517ca0b106240791f60158a7af12a5395b49e5299b22d3bf38
SSDEEP

12582912:whzb6xxr5Ni69eds1tauM0I7j0LFCLw0FEl1oZ+rPAkIYw+oKj7XkFgMKiLVVKYH:whzb639Ni6agtW7ZwU6+8roYwS7dN2jr

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
1552	Setup_x64.exe
1712	Setup_x64.exe
2044	dismhost.exe
1548	dismhost.exe
1652	sqlwriter.exe
1004	SQLEXPR_x64_ENU.exe
1776	SETUP.EXE
1616	ScenarioEngine.exe
1080	FixSqlRegistryKey_x64.exe
1624	FixSqlRegistryKey_x86.exe
768	FixSqlRegistryKey_x64.exe
1536	FixSqlRegistryKey_x86.exe
1612	sqlwriter.exe
1848	FixSqlRegistryKey_x64.exe
1640	FixSqlRegistryKey_x86.exe

Registers COM server for autorun 1 TTPs 57 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\SQL Debugging\\120\\ssdebugps.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceoledb40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceoledb40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe

Loads dropped DLL 64 IoCs

pid	Process
1552	Setup_x64.exe
1552	Setup_x64.exe
1552	Setup_x64.exe
972	MsiExec.exe
972	MsiExec.exe
652	MsiExec.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
652	MsiExec.exe
108	rundll32.exe
108	rundll32.exe
108	rundll32.exe
1564	MsiExec.exe
652	MsiExec.exe
1404	rundll32.exe
1404	rundll32.exe
1404	rundll32.exe
652	MsiExec.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1564	MsiExec.exe
1712	Setup_x64.exe
652	MsiExec.exe
1508	rundll32.exe
1508	rundll32.exe
1508	rundll32.exe
652	MsiExec.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
308	dism.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe
2044	dismhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{82C52A2E-2B10-4059-821F-248F9CDD76B7} = "\"C:\\Users\\Admin\\Desktop\\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\\Setup_x64.exe\" /cmdloc \"HKCU\\Software\\Seagull Scientific AiTemp\\{82C52A2E-2B10-4059-821F-248F9CDD76B7}\""	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	Setup_x64.exe
File opened (read-only)	\??\U:	Setup_x64.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	Setup_x64.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	Setup_x64.exe
File opened (read-only)	\??\V:	Setup_x64.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	Setup_x64.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	Setup_x64.exe
File opened (read-only)	\??\K:	Setup_x64.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	Setup_x64.exe
File opened (read-only)	\??\Z:	Setup_x64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	Setup_x64.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	Setup_x64.exe
File opened (read-only)	\??\Y:	Setup_x64.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	Setup_x64.exe
File opened (read-only)	\??\Q:	Setup_x64.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	Setup_x64.exe
File opened (read-only)	\??\X:	Setup_x64.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	Setup_x64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	Setup_x64.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	Setup_x64.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\5EA9411076914705A44E58C3A5CF13EC\AUTORUN.INF	SQLEXPR_x64_ENU.exe
File opened for modification	C:\5EA9411076914705A44E58C3A5CF13EC\AUTORUN.INF	SQLEXPR_x64_ENU.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msodbcsql11.dll	msiexec.exe
File created	C:\Windows\system32\1033\msodbcsqlr11.rll	msiexec.exe
File created	C:\Windows\system32\SqlServerSpatial120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sqlncli11.dll	msiexec.exe
File created	C:\Windows\system32\1033\s11ch_msodbcsql.chm	msiexec.exe
File created	C:\Windows\SysWOW64\1033\s11ch_sqlncli.chm	msiexec.exe
File created	C:\Windows\SysWOW64\1033\sqlnclir11.rll	msiexec.exe
File created	C:\Windows\SysWOW64\msodbcdiag11.dll	msiexec.exe
File created	C:\Windows\system32\msodbcsql11.dll	msiexec.exe
File created	C:\Windows\system32\sqlncli11.dll	msiexec.exe
File created	C:\Windows\system32\1033\sqlnclir11.rll	msiexec.exe
File created	C:\Windows\system32\msodbcdiag11.dll	msiexec.exe
File created	C:\Windows\system32\1033\s11ch_sqlncli.chm	msiexec.exe
File created	C:\Windows\SysWOW64\1033\s11ch_msodbcsql.chm	msiexec.exe
File created	C:\Windows\SysWOW64\1033\msodbcsqlr11.rll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Datastore\_Scenario_GlobalObjects_DetectSqlSupportPackageIdFilter.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\manifest\A705GF63.IF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ru\LANDINGPAGE.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-cht\MICROSOFT.SQLSERVER.CONFIGURATION.DISTRIBUTEDREPLAYEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\qds.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ru\MICROSOFT.SQLSERVER.CONFIGURATION.SQLCONFIGBASE.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ja\MICROSOFT.SQLSERVER.CONFIGURATION.RSEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Sqlmu.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\x64\AMARBVVQ.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\MICROSOFT.SQLSERVER.SETUP.CHAINER.WORKFLOW.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ja\MICROSOFT.SQLSERVER.CONFIGURATION.UTILITYEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\ShellObjects.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\5705gf63.if\E705GF63.IF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\Setup\sql_engine_core_inst_msi\SQL_ENGINE_CORE_INST.MSP	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\manifest\E2RG91XW.1P4	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\pt\MICROSOFT.SQLSERVER.CONFIGURATION.MANAGEMENTTOOLSEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\5z1v718o.6n8\DZ1V718O.6N8	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\de\MICROSOFT.SQLSERVER.CONFIGURATION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\de\MICROSOFT.SQLSERVER.CONFIGURATION.SQLBROWSEREXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Watson_8\Datastore\ProductSettings_ASSIP_Public.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1041\msxmlsql.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\es\MICROSOFT.SQLSERVER.CONFIGURATION.CLUSTER.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ko\MICROSOFT.SQL.CHAINER.PACKAGE.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\Microsoft.SqlServer.Configuration.ASExtension.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Watson_8\Datastore\ProductSettings_ClusterDisk_Private.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\1033\help\S11CH_UPDATE.CHM	ScenarioEngine.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Datastore\_Extension_Slp_OriginalInputSettingValues.xml	ScenarioEngine.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Datastore\_Extensions_Config_ActionCollection.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\e4grzzmx\x64\1033\JQ3Z04B3.RTF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\it\MICROSOFT.SQLSERVER.CONFIGURATION.SNISERVERCONFIGEXT.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ko\MICROSOFT.SQL.CHAINER.PRODUCT.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Shared\xe.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\sqlceme40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.SQLSERVER.CONFIGURATION.MSIEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-chs\MICROSOFT.SQLSERVER.CONFIGURATION.SCOEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.SQLSERVER.CONFIGURATION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Datastore\ProductSettings_ClusterIPAddresses_Private.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\it\MICROSOFT.SQLSERVER.CONFIGURATION.INSTALLWIZARDFRAMEWORK.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.AnalysisServices.SPClient.Interfaces.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Datastore\InputSettings_FeatureSpecific_SlpInputSettings.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ko\MICROSOFT.SQLSERVER.CONFIGURATION.SQLENUM.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Watson_4\Datastore\ProductSettings_Fulltext_Public.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Watson_8\Datastore\ProductSettings_SqlLegacyDiscovery_Private.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\FUSIONCHECK.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\vlv6b2rp.6fi\4MV6B2RP.6FI	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\vlv6b2rp.6fi\ZLV6B2RP.6FI	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.SQLSERVER.CONFIGURATION.DISTRIBUTEDREPLAYEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-chs\MICROSOFT.SQLSERVER.SETUP.CHAINER.WORKFLOW.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Configuration.UtilityExtension.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\Microsoft.SqlServer.InstApi.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\b2rg91xw.1p4\G2RG91XW.1P4	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\SQLCONF.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-cht\MICROSOFT.SQLSERVER.CONFIGURATION.XTP.CONFIGEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SQL.Chainer.Package.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\Microsoft.SQL.Chainer.Product.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1033\xepackage0.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\system32\37HPRAVQ.LM8	ScenarioEngine.exe
File created	C:\Program Files (x86)\Microsoft SQL Server\120\SDK\Assemblies\pt\Microsoft.SqlServer.TransactSql.ScriptDom.Resources.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\DBGHELP.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\License Terms\License_SqlLocalDB_2052.txt	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\vlv6b2rp.6fi\5MV6B2RP.6FI	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Configuration.RulesEngineExtension.XmlSerializers.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_072632\Watson_4\Datastore\ProductSettings_SqlEngine_Private.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1033\xesqlpkg.rll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20221004073600613.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004074036187.1\8.0.50727.1833.policy	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\Z1MXQBZWRY\Microsoft.SqlServer.CustomControls.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1452.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073818860.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_f19a562a.cat	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\XH7SW9SZ78\Microsoft.SqlServer.CustomControls.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004073023700.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI577.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2311.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI455C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA89C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_atl100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073028894.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI55BA.tmp	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\73OV1BLA9D\Microsoft.SqlServer.CustomControls.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004073818954.1	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004072803970.0\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004073256517.2	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073519476.0\mfc80CHS.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI156C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073600613.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073818922.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_bf90704a.cat	msiexec.exe
File created	C:\Windows\assembly\tmp\2DB948SI\Microsoft.SqlServer.WizardFrameworkLite.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004074252952.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_85260ed9.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004072803830.0\mfc80ITA.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FF4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073021952.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073256486.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073519491.3\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073600613.0\mfc80DEU.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\78ebe8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI713.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\A6NRFIW9\Microsoft.SqlServer.GridControl.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073819016.0\msvcm80.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\X50DB5QT66\Microsoft.NetEnterpriseServers.ExceptionMessageBox.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\763D39D9CC2A8734DB3697FEF37EC687\11.4.7462\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004074036124.0\8.0.50727.1833.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004074036218.1\8.0.50727.1833.policy	msiexec.exe
File created	C:\Windows\Installer\{BAF67399-85CD-4555-9B49-1F80EB921C35}\ARPIco	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073819172.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073519476.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_9cdcab35.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073519491.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_6ad2c555.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073519444.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_a53d26c6.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073519491.3\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\N97MJ164YN\Microsoft.SqlServer.CustomControls.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\HG986090\Microsoft.SqlServer.WizardFrameworkLite.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004072803846.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073024823.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\6YTE5M8H\Microsoft.SqlServer.GridControl.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{6292D514-17A4-403F-98F9-E150F10C043D}\ARPIco	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004074036171.1\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_b72ff4b9.manifest	msiexec.exe
File created	C:\Windows\assembly\tmp\HXL6CLDV\Microsoft.NetEnterpriseServers.ExceptionMessageBox.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004073028567.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BA7.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073256346.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\78ebca.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004074253358.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI605.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073819063.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004073256517.0\msvcp80.dll	msiexec.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
516	sc.exe
912	sc.exe
1508	sc.exe
368	sc.exe
724	sc.exe
1052	sc.exe
1200	sc.exe
2012	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 32 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\500B6D056D0BF52459B31033E1C2F7BC\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.SqlServer.CustomControls,fileVersion="10.0.5500.0",version="10.0.0.0000",culture="neutral",publicKeyToken="89845DCD8080CC91",processorArchitecture="MSIL" = 5d003d0077006200470064002900300060003800420038005e007e0041006800350074005b0037003e005b006300390067005e0027005b0060006e003800470052007100390058007500510047002d00450000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\415D29264A71F304899F1E051FC040D3\SourceList\Media\MediaPackage = "\\1033_ENU_LP\\x64\\setup\\sql2008support\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F0BE8963-5BA4-4A11-80E2-CBFB534D4C54}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\Implemented Categories\{D267E19A-0B97-11D2-BB1C-00C04FC9B532}	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,version="8.0.50727.1833",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5d003d0077006200470064002900300060003800420038005e007e0041006800350074005b0037003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\ProgID\ = "SSCE.Replication.4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18BD6746362F40C45847AA3D11633C40	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.SQLSERVER.CE.OLEDB.4.0\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C0770995-2550-4044-9914-66DE7133B024}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18BD6746362F40C45847AA3D11633C40\SourceList\Net\1 = "C:\\5EA9411076914705A44E58C3A5CF13EC\\x64\\setup\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}\4.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\ = "SSCE Params Collection"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99376FABDC585554B994F108BE29C153\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\500B6D056D0BF52459B31033E1C2F7BC\Version = "201529224"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0BE8963-5BA4-4A11-80E2-CBFB534D4C54}\ = "ISSCEError"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361B42480E1D7B84882A7C6A71763B7D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Seagull\\BarTender\\prerequisites\\SQL Server Compact 4.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{87BC18DD-C8B3-11D5-AE96-00B0D0E93CC1}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\VersionIndependentProgID\ = "SQLNCLI11.AdvancedPage"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,version="8.0.50727.1833",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5d003d0077006200470064002900300060003800420038005e007e0041006800350074005b0037003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.NetEnterpriseServers.ExceptionMessageBox,fileVersion="12.0.2000.8",version="12.0.0.0000",culture="neutral",publicKeyToken="89845DCD8080CC91",processorArchitecture="MSIL" = 2a00510069006800740066005f005d0053003f0028007e0031002e00750035002100320051006a003e002a00680056004e003400680063004b0036003f007800720069007100700070005d0024007600450000002a00510069006800740066005f005d0053003f0028007e0031002e00750035002100320051006a003e007d00460063006c00310047006400290039003d007b0077006c0053004d00550039006f005100300000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}\4.0\0\win64\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\System.Data.SqlServerCe.Entity,FileVersion="4.0.8482.1",version="4.0.0.0",culture="neutral",publicKeyToken="89845DCD8080CC91",processorArchitecture="MSIL" = 37006f002100500052002b002400590047003f006d004c0038005b005e002d002c00650043006e00530051004c004300450043006f00720065003e002c00570063004200460063002700720021003f0049004c0032003d00700065005f004f0055004b0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99376FABDC585554B994F108BE29C153\ProductName = "Microsoft SQL Server 2014 Express LocalDB "	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99376FABDC585554B994F108BE29C153\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Seagull\\BarTender\\prerequisites\\SQL Server LocalDB 2014 SP3\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SQLNCLI11.ErrorLookup.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\ExtendedErrors\{798B9084-1221-4281-9CED-89654F2ADF8F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\ = "Active SSCE Engine Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B376CC6347FDA7498260CC05A030061	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\ = "SSCE Errors Collection"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SQLNCLI11\ = "SQL Server Native Client 11.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\VersionIndependentProgID\ = "SQLNCLI11.Enumerator"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\18BD6746362F40C45847AA3D11633C40\SQM_SHARED	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B69AB1F3-36CE-4FE7-9994-27E66DCFA4F0}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F3187FC8-7DD9-4F1D-8C6F-ACAF10F32437}\ProxyStubClsid32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18BD6746362F40C45847AA3D11633C40\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\415D29264A71F304899F1E051FC040D3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3832ED3604299694485363D0A7641F95\18BD6746362F40C45847AA3D11633C40	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,version="8.0.50727.1833",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 5d003d0077006200470064002900300060003800420038005e007e0041006800350074005b0037003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\TypeLib\Version = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\ = "SSCE DropTable Listener Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\ProxyStubClsid32\ = "{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87BC18DC-C8B3-11D5-AE96-00B0D0E93CC1}\NumMethods\ = "5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21850BBE57BA829498300ECE5107FBBC\SourceList\Media\1 = "SqlSupp;"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\OLE DB Provider\ = "SQL Server Native Client 11.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\500B6D056D0BF52459B31033E1C2F7BC\SourceList\LastUsedSource = "n;1;C:\\Program Files\\Microsoft SQL Server\\120\\Setup Bootstrap\\Update Cache\\KB4022619\\ServicePack\\1033_ENU_LP\\x64\\setup\\x64\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
320	rundll32.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
1768	msiexec.exe
764	rundll32.exe
764	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1152	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1772	AUDIODG.EXE
Token: 33	1772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1772	AUDIODG.EXE
Token: SeRestorePrivilege	2044	7zG.exe
Token: 35	2044	7zG.exe
Token: SeSecurityPrivilege	2044	7zG.exe
Token: SeSecurityPrivilege	2044	7zG.exe
Token: SeRestorePrivilege	1768	msiexec.exe
Token: SeTakeOwnershipPrivilege	1768	msiexec.exe
Token: SeSecurityPrivilege	1768	msiexec.exe
Token: SeCreateTokenPrivilege	1552	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1552	Setup_x64.exe
Token: SeLockMemoryPrivilege	1552	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	1552	Setup_x64.exe
Token: SeMachineAccountPrivilege	1552	Setup_x64.exe
Token: SeTcbPrivilege	1552	Setup_x64.exe
Token: SeSecurityPrivilege	1552	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	1552	Setup_x64.exe
Token: SeLoadDriverPrivilege	1552	Setup_x64.exe
Token: SeSystemProfilePrivilege	1552	Setup_x64.exe
Token: SeSystemtimePrivilege	1552	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	1552	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	1552	Setup_x64.exe
Token: SeCreatePagefilePrivilege	1552	Setup_x64.exe
Token: SeCreatePermanentPrivilege	1552	Setup_x64.exe
Token: SeBackupPrivilege	1552	Setup_x64.exe
Token: SeRestorePrivilege	1552	Setup_x64.exe
Token: SeShutdownPrivilege	1552	Setup_x64.exe
Token: SeDebugPrivilege	1552	Setup_x64.exe
Token: SeAuditPrivilege	1552	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	1552	Setup_x64.exe
Token: SeChangeNotifyPrivilege	1552	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	1552	Setup_x64.exe
Token: SeUndockPrivilege	1552	Setup_x64.exe
Token: SeSyncAgentPrivilege	1552	Setup_x64.exe
Token: SeEnableDelegationPrivilege	1552	Setup_x64.exe
Token: SeManageVolumePrivilege	1552	Setup_x64.exe
Token: SeImpersonatePrivilege	1552	Setup_x64.exe
Token: SeCreateGlobalPrivilege	1552	Setup_x64.exe
Token: SeCreateTokenPrivilege	1552	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1552	Setup_x64.exe
Token: SeLockMemoryPrivilege	1552	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	1552	Setup_x64.exe
Token: SeMachineAccountPrivilege	1552	Setup_x64.exe
Token: SeTcbPrivilege	1552	Setup_x64.exe
Token: SeSecurityPrivilege	1552	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	1552	Setup_x64.exe
Token: SeLoadDriverPrivilege	1552	Setup_x64.exe
Token: SeSystemProfilePrivilege	1552	Setup_x64.exe
Token: SeSystemtimePrivilege	1552	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	1552	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	1552	Setup_x64.exe
Token: SeCreatePagefilePrivilege	1552	Setup_x64.exe
Token: SeCreatePermanentPrivilege	1552	Setup_x64.exe
Token: SeBackupPrivilege	1552	Setup_x64.exe
Token: SeRestorePrivilege	1552	Setup_x64.exe
Token: SeShutdownPrivilege	1552	Setup_x64.exe
Token: SeDebugPrivilege	1552	Setup_x64.exe
Token: SeAuditPrivilege	1552	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	1552	Setup_x64.exe
Token: SeChangeNotifyPrivilege	1552	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	1552	Setup_x64.exe
Token: SeUndockPrivilege	1552	Setup_x64.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2044	7zG.exe
1552	Setup_x64.exe
1552	Setup_x64.exe
1152	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1768 wrote to memory of 972	1768	msiexec.exe	37
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1552 wrote to memory of 1152	1552	Setup_x64.exe	38
PID 1768 wrote to memory of 652	1768	msiexec.exe	39
PID 1768 wrote to memory of 652	1768	msiexec.exe	39
PID 1768 wrote to memory of 652	1768	msiexec.exe	39
PID 1768 wrote to memory of 652	1768	msiexec.exe	39
PID 1768 wrote to memory of 652	1768	msiexec.exe	39
PID 652 wrote to memory of 320	652	MsiExec.exe	40
PID 652 wrote to memory of 320	652	MsiExec.exe	40
PID 652 wrote to memory of 320	652	MsiExec.exe	40
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 1768 wrote to memory of 1564	1768	msiexec.exe	41
PID 652 wrote to memory of 108	652	MsiExec.exe	42
PID 652 wrote to memory of 108	652	MsiExec.exe	42
PID 652 wrote to memory of 108	652	MsiExec.exe	42
PID 652 wrote to memory of 1404	652	MsiExec.exe	43
PID 652 wrote to memory of 1404	652	MsiExec.exe	43
PID 652 wrote to memory of 1404	652	MsiExec.exe	43
PID 652 wrote to memory of 320	652	MsiExec.exe	44
PID 652 wrote to memory of 320	652	MsiExec.exe	44
PID 652 wrote to memory of 320	652	MsiExec.exe	44
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 1564 wrote to memory of 1712	1564	MsiExec.exe	45
PID 652 wrote to memory of 1508	652	MsiExec.exe	46
PID 652 wrote to memory of 1508	652	MsiExec.exe	46
PID 652 wrote to memory of 1508	652	MsiExec.exe	46
PID 652 wrote to memory of 1852	652	MsiExec.exe	47
PID 652 wrote to memory of 1852	652	MsiExec.exe	47
PID 652 wrote to memory of 1852	652	MsiExec.exe	47
PID 1852 wrote to memory of 308	1852	rundll32.exe	48
PID 1852 wrote to memory of 308	1852	rundll32.exe	48
PID 1852 wrote to memory of 308	1852	rundll32.exe	48
PID 308 wrote to memory of 2044	308	dism.exe	50
PID 308 wrote to memory of 2044	308	dism.exe	50
PID 308 wrote to memory of 2044	308	dism.exe	50
PID 1852 wrote to memory of 1864	1852	rundll32.exe	52
PID 1852 wrote to memory of 1864	1852	rundll32.exe	52
PID 1852 wrote to memory of 1864	1852	rundll32.exe	52
PID 1864 wrote to memory of 1548	1864	dism.exe	53
PID 1864 wrote to memory of 1548	1864	dism.exe	53
PID 1864 wrote to memory of 1548	1864	dism.exe	53
PID 1852 wrote to memory of 1176	1852	rundll32.exe	54

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip"
1⤵
PID:844

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" -spe -an -ai#7zMap20123:164:7zEvent25280
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Read me.txt
1⤵
PID:1664

C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi TRANSFORMS=:3082 AI_SETUPEXEPATH="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1664860346 "
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7435E8EC4E957468F3374E9895CF471 C
  2⤵
  - Loads dropped DLL
  PID:972
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 865E85D9A82903BB99D015DCFC65A40E C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7316883 1 CustomActions!CustomActions.CustomActions.SilentInstallProperties
    3⤵
    - Loads dropped DLL
    PID:320
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA45.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7342670 73 CustomActions!CustomActions.CustomActions.ForceUpgradeProperty
    3⤵
    - Loads dropped DLL
    PID:108
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5470.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7362638 78 CustomActions!CustomActions.CustomActions.SetInstalledVersion
    3⤵
    - Loads dropped DLL
    PID:1404
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7347.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7369783 83 CustomActions!CustomActions.CustomActions.InstallOptions
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:320
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC2C1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7784356 337 CustomActions!CustomActions.CustomActions.ExtractSQLExpress
    3⤵
    - Loads dropped DLL
    PID:1508
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1A15.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7807272 347 CustomActions!CustomActions.CustomActions.WindowsOptionalFeatures
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\system32\dism.exe
      "C:\Windows\system32\dism.exe" /Online /Get-Features /Format:Table
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\DC624F8C-593E-43EA-99C7-19C10AA953A4\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\DC624F8C-593E-43EA-99C7-19C10AA953A4\dismhost.exe {0EA1D888-9665-4CB7-85A7-DB5371B560E4}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2044
  - - C:\Windows\system32\dism.exe
      "C:\Windows\system32\dism.exe" /Online /Enable-Feature /FeatureName:MSMQ-Container /FeatureName:MSMQ-Server /NoRestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\8A66B1DE-44BA-4669-8EDC-E09984ADA6C6\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\8A66B1DE-44BA-4669-8EDC-E09984ADA6C6\dismhost.exe {38D4DE8F-2E75-4FB3-9CDA-8D31C63DC540}
        5⤵
        Executes dropped EXE
        
        PID:1548
  - - C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ServiceModelReg.exe" -r
      4⤵
      PID:1176
    - - C:\Windows\system32\sc.exe
        
        sidtype NetTcpPortSharing restricted
        5⤵
        Launches sc.exe
        
        PID:724
    - - C:\Windows\system32\sc.exe
        
        privs NetTcpPortSharing SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:1052
    - - C:\Windows\system32\sc.exe
        
        sidtype NetTcpActivator restricted
        5⤵
        Launches sc.exe
        
        PID:1200
    - - C:\Windows\system32\sc.exe
        
        privs NetTcpActivator SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:2012
    - - C:\Windows\system32\sc.exe
        
        sidtype NetPipeActivator restricted
        5⤵
        Launches sc.exe
        
        PID:516
    - - C:\Windows\system32\sc.exe
        
        privs NetPipeActivator SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:912
    - - C:\Windows\system32\sc.exe
        
        sidtype NetMsmqActivator restricted
        5⤵
        Launches sc.exe
        
        PID:1508
    - - C:\Windows\system32\sc.exe
        
        privs NetMsmqActivator SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:368
    - - C:\Windows\system32\wevtutil.exe
        
        um C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
        5⤵
        
        PID:1056
    - - C:\Windows\system32\wevtutil.exe
        
        im C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
        5⤵
        
        PID:1800
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI542A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8016938 1456 CustomActions!CustomActions.CustomActions.InstallSQLExpress
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\SQLEXPR_x64_ENU.exe
      "C:\Users\Admin\AppData\Local\Temp\SQLEXPR_x64_ENU.exe" /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage
      4⤵
      Executes dropped EXE
      Drops autorun.inf file
      PID:1004
    - - C:\5EA9411076914705A44E58C3A5CF13EC\SETUP.EXE
        
        C:\5EA9411076914705A44E58C3A5CF13EC\SETUP.EXE /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage
        5⤵
        Executes dropped EXE
        
        PID:1776
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe
        
        -b
        6⤵
        
        PID:1608
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        
        -b
        6⤵
        
        PID:1800
      - C:\5EA9411076914705A44E58C3A5CF13EC\x64\ScenarioEngine.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\ScenarioEngine.exe" /WORKFLOW=Install /TIMESTAMP=20221004_072632 /LOGMARKER= /MEDIASOURCE="C:\5EA9411076914705A44E58C3A5CF13EC\\" /INSTALLMEDIAPATH="C:\5EA9411076914705A44E58C3A5CF13EC\x64\setup\\" /ENU /MEDIALAYOUT="Core" /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage /ACTION=Install
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2iwg86nm.cmdline"
        7⤵
        
        PID:1336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAEA.tmp"
        8⤵
        
        PID:1160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\inhr_mmb.cmdline"
        7⤵
        
        PID:1240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF3E.tmp"
        8⤵
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\swvq3i6z.cmdline"
        7⤵
        
        PID:764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1058.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1057.tmp"
        8⤵
        
        PID:1620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iouffhjg.cmdline"
        7⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1289.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1279.tmp"
        8⤵
        
        PID:1772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ur-da7ge.cmdline"
        7⤵
        
        PID:1704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1345.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1344.tmp"
        8⤵
        
        PID:1756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ufs4ysli.cmdline"
        7⤵
        
        PID:1140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES141F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC141E.tmp"
        8⤵
        
        PID:516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hajzzgsv.cmdline"
        7⤵
        
        PID:768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES173B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC173A.tmp"
        8⤵
        
        PID:1220
        
        C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x64.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x64.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x86.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x86.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jfnqxqgw.cmdline"
        7⤵
        
        PID:1576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2ADA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2AD9.tmp"
        8⤵
        
        PID:2044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qp7abmjq.cmdline"
        7⤵
        
        PID:1416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C41.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2C40.tmp"
        8⤵
        
        PID:188
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n2g-tbyl.cmdline"
        7⤵
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E4A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3E49.tmp"
        8⤵
        
        PID:1500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\naejyouw.cmdline"
        7⤵
        
        PID:2040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F34.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3F33.tmp"
        8⤵
        
        PID:764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mxmlc3t1.cmdline"
        7⤵
        
        PID:1656
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES432A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC431A.tmp"
        8⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lxwehs2g.cmdline"
        7⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44C0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC44BF.tmp"
        8⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jzrzk93z.cmdline"
        7⤵
        
        PID:1080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES453D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC453C.tmp"
        8⤵
        
        PID:1948
        
        C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x64.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x64.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:768
        
        C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x86.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x86.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aq402y_x.cmdline"
        7⤵
        
        PID:1332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES673E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC672D.tmp"
        8⤵
        
        PID:2012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xuj_wkbp.cmdline"
        7⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7735.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7734.tmp"
        8⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zipeadzk.cmdline"
        7⤵
        
        PID:1948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES828A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8289.tmp"
        8⤵
        
        PID:1080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u0tu8km9.cmdline"
        7⤵
        
        PID:676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8FC4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8FC3.tmp"
        8⤵
        
        PID:1568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v0fkoukr.cmdline"
        7⤵
        
        PID:1788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES907F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC907E.tmp"
        8⤵
        
        PID:1612
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlyp4fob.cmdline"
        7⤵
        
        PID:1608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91A7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC91A6.tmp"
        8⤵
        
        PID:340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w-a5tfg6.cmdline"
        7⤵
        
        PID:876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A6E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9A6D.tmp"
        8⤵
        
        PID:1264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pe5xszki.cmdline"
        7⤵
        
        PID:1520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CBE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9CBD.tmp"
        8⤵
        
        PID:1548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\as6z6bbj.cmdline"
        7⤵
        
        PID:1856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D4B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9D4A.tmp"
        8⤵
        
        PID:2040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\amltcnuc.cmdline"
        7⤵
        
        PID:1536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB473.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB472.tmp"
        8⤵
        
        PID:1772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dxq_tpm2.cmdline"
        7⤵
        
        PID:1880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6B4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB6B3.tmp"
        8⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7rktfokl.cmdline"
        7⤵
        
        PID:1656
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB84A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB849.tmp"
        8⤵
        
        PID:1756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l4vhcqb-.cmdline"
        7⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB972.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB971.tmp"
        8⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2l8tcy7n.cmdline"
        7⤵
        
        PID:1080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA8B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBA8A.tmp"
        8⤵
        
        PID:1948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7-nlh--k.cmdline"
        7⤵
        
        PID:1568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB08.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBAF7.tmp"
        8⤵
        
        PID:676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rzljyqd8.cmdline"
        7⤵
        
        PID:1612
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBB3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBBB2.tmp"
        8⤵
        
        PID:1788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\peaexqfk.cmdline"
        7⤵
        
        PID:340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD78.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBD77.tmp"
        8⤵
        
        PID:1608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p8quvy0f.cmdline"
        7⤵
        
        PID:1240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE23.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBE22.tmp"
        8⤵
        
        PID:1264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ztszqarr.cmdline"
        7⤵
        
        PID:876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF7A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBF79.tmp"
        8⤵
        
        PID:1548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zyrlfwf7.cmdline"
        7⤵
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC016.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC015.tmp"
        8⤵
        
        PID:764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nzfhbrbn.cmdline"
        7⤵
        
        PID:1696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC5A2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC5A1.tmp"
        8⤵
        
        PID:1772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9w6x11td.cmdline"
        7⤵
        
        PID:1536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCC3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCCC2.tmp"
        8⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w7dflzx6.cmdline"
        7⤵
        
        PID:1880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD50.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD4F.tmp"
        8⤵
        
        PID:1756
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1656
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1620
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1132
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1612
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:1364
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1312
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1640
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:956
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:956
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1940
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1096
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:724
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1432
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1624
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:676
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:992
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1580
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:2044
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:1796
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1708
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1848
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:636
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1416
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1536
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1160
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1572
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:932
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1800
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1624
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1788
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:992
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:764
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue continue
        7⤵
        
        PID:1796
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue continue
        7⤵
        
        PID:1620
        
        C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x64.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x64.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x86.exe
        
        "C:\5EA9411076914705A44E58C3A5CF13EC\x64\FixSqlRegistryKey_x86.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1640
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI560F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_9065998 1463 CustomActions!CustomActions.CustomActions.SetupInterrupted
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 275129DF942EDD32B186DC53914F8745 C
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
    "C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" /groupsextract:103;111; /out:"C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites" /callbackid:1564
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1712
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\SQL Server Compact 4.0\SSCERuntime_x64-ENU.msi" /q /norestart
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\SQL Server LocalDB 2014 SP3\SqlLocalDB_x64.msi" /qn /norestart IACCEPTSQLLOCALDBLICENSETERMS=YES
    3⤵
    PID:1696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 53C6955CC9C1CF1ADBF1C7C152C52703
  2⤵
  PID:1752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 56B27633184EF8644297BCFB12A9A509 M Global\MSI0000
  2⤵
  PID:808
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding FC040D7D0DA1271B4FA91FA733FCF35F
  2⤵
  PID:980
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 1BB5224C71A747A420B20E56C20A4E59 M Global\MSI0000
  2⤵
  PID:1772
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding CEA33E1B6924A081D958B26A9F6E6F78
  2⤵
  PID:1568
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C413D1D4CC05D097B157A69D17566C15
  2⤵
  PID:1428
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 5F6D7081B6E565C9BFC1E8043A71C0F4 M Global\MSI0000
  2⤵
  PID:676
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 01CEBAB88C880F2AB94DDCFD5333D228
  2⤵
  PID:904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4D650218AD6E057134C0C2E8AD244C6F
  2⤵
  PID:1312
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding D6769E8B7814CA96DB20D3972B8E3EE4 M Global\MSI0000
  2⤵
  PID:1848
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 5F27E62E043585EE28A08BB6C0312D99
  2⤵
  PID:1416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2295103DAA35BA3A5436501B915AFE1C
  2⤵
  PID:1364
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 1931AB9612DD4AA34DE13C16E971EE08 M Global\MSI0000
  2⤵
  PID:1620
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding C124582A00A7B24946885EA7DA756EE2
  2⤵
  PID:2044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4CD326F5AD315922DEDE6AE0C59D51FD
  2⤵
  PID:1708
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 3233BAD69F7C838A033A19933B508FEA M Global\MSI0000
  2⤵
  PID:1364
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding A4B6A6880DD362B979CE7A9B8E09415A
  2⤵
  PID:1520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 074FA4452EFA807E2449DF4BF81551E6 M Global\MSI0000
  2⤵
  PID:1096
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 03FBA47B6B2A39C50D5CE6B155E88152 M Global\MSI0000
  2⤵
  PID:1380
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding C1576F64D5605BE091F611B10F2D4DB6
  2⤵
  PID:1120
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 1CFDEC17AAE8FE63206D9243B52387DB
  2⤵
  PID:2012
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B34224A99385E18154E072A21A7CD761 M Global\MSI0000
  2⤵
  PID:1392
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding D02AA29554D1EFDD441D79A864B14FA0
  2⤵
  PID:1948
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B2F6E1FC287E94668C3CF1582EAC5E33
  2⤵
  PID:1688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D3B11B2A0A1379A2C031A797CB131774
  2⤵
  PID:1496
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding C6D3E08680DFC60CCBD39DE9DD4AAD04 M Global\MSI0000
  2⤵
  PID:980
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 79C273DF566D18E17B5D4227DABB1E92
  2⤵
  PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9EF39299F6F48158CE63904FFDDAE3EF
  2⤵
  PID:880
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 85D08358E73DA482339DA84FDE7F71E1 M Global\MSI0000
  2⤵
  PID:2040
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding BFE4C78FCBA3F9A95D5539965CB666F9
  2⤵
  PID:1868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 25F9D0F014B86C66647F7A9E4366F27B
  2⤵
  PID:2032
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 727BBA7F8A6C31A004E13C79C14607F7 M Global\MSI0000
  2⤵
  PID:960
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding A9CD2D26315E51147E85F99E38F8CDAE
  2⤵
  PID:2012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DA70B6084D119C5BCF837068342860E2
  2⤵
  PID:1496
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding D942D9A8EF0D516BAE61D55B7DA9D59A M Global\MSI0000
  2⤵
  PID:932
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding EE21BE9B8D5EF4F7544D7C89A37D3FD0
  2⤵
  PID:340

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
1⤵
- Executes dropped EXE
PID:1652

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
1⤵
- Executes dropped EXE
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi

Filesize
194.7MB

MD5
cb89850ee9cf83015f30d1df61e97b2a

SHA1
7ebd4b6e0636cc209ed8bc4ac1c1195459dfbab4

SHA256
b8ac3b3c1a2c80ee17c6f8678d6777547477bb726ef7914fac14e2d7f331ba19

SHA512
144272199c96c4eab27a3ad18e1995806d6c439dc00222a7b92979bd5343b422663e6421f68720ffae68a91a8bf1a6f207f6f62126678ee6c83c259fdfc77e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1DB9.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI21A1.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI222E.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4755.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5470.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6606.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6D09.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7347.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA45.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC2C1.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE3CC.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEAFE.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEEB6.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF981.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFDE5.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Read me.txt

Filesize
325B

MD5
c6267db741610636b6ae1de379021160

SHA1
950f6291383ad22b7bc1ef5bde6646de5e29007b

SHA256
10c69ad0be26996b39d166b405958f6636097b597ee88637355faeda8f9f33a4

SHA512
2100e02e2755a7dfeb547214958dfb32c920c0c93f76f333355b8c158f9a8ef3bf1c3a4ecb6491662bb197e6461080c33c92fa3d667116f8311ad59f0100a08f

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\3082.dll

Filesize
120KB

MD5
a96297c0b3816788f2a8f930c6e9dcf4

SHA1
307b132d720b1b03ecfb96afa1808fd367ed702b

SHA256
fd9fd341073d906645eed1eff1eb53144af5109c73b26a8f9e56de7be82c81ed

SHA512
7897427df575d4c22d2980aea40d37b891ed416b101b697b4b161b3ddb5005671c74e34722052d3cc7f9b3f742100db8065eb0a8259ab2ec6fb69282b852c84a

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1DB9.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSI21A1.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Local\Temp\MSI222E.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4755.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5470.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5470.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5470.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5470.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6606.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6D09.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
\Users\Admin\AppData\Local\Temp\MSI7347.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9F0E.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA45.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA45.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA45.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIA45.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC2C1.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE3CC.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIEAFE.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIEEB6.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF981.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
\Users\Admin\AppData\Local\Temp\MSIFDE5.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
memory/108-105-0x0000000001C00000-0x0000000001C12000-memory.dmp

Filesize
72KB

Download
memory/320-126-0x000000001A99F000-0x000000001A9BE000-memory.dmp

Filesize
124KB

Download
memory/320-124-0x0000000002120000-0x000000000217E000-memory.dmp

Filesize
376KB

Download
memory/320-131-0x000000001A99F000-0x000000001A9BE000-memory.dmp

Filesize
124KB

Download
memory/320-132-0x000000001A99F000-0x000000001A9BE000-memory.dmp

Filesize
124KB

Download
memory/320-129-0x0000000001C30000-0x0000000001C3E000-memory.dmp

Filesize
56KB

Download
memory/320-80-0x0000000001F00000-0x0000000001F2E000-memory.dmp

Filesize
184KB

Download
memory/320-86-0x000000001A310000-0x000000001A36E000-memory.dmp

Filesize
376KB

Download
memory/320-83-0x0000000001F40000-0x0000000001F52000-memory.dmp

Filesize
72KB

Download
memory/320-119-0x0000000000480000-0x00000000004AE000-memory.dmp

Filesize
184KB

Download
memory/768-236-0x000007FEEBE00000-0x000007FEEC823000-memory.dmp

Filesize
10.1MB

Download
memory/1080-218-0x000007FEEBE00000-0x000007FEEC823000-memory.dmp

Filesize
10.1MB

Download
memory/1404-114-0x0000000001ED0000-0x0000000001EE2000-memory.dmp

Filesize
72KB

Download
memory/1508-150-0x0000000001CE0000-0x0000000001CF2000-memory.dmp

Filesize
72KB

Download
memory/1536-238-0x000000006FF30000-0x00000000704DB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-58-0x0000000075691000-0x0000000075693000-memory.dmp

Filesize
8KB

Download
memory/1552-61-0x0000000072DE1000-0x0000000072DE3000-memory.dmp

Filesize
8KB

Download
memory/1588-187-0x0000000002060000-0x0000000002072000-memory.dmp

Filesize
72KB

Download
memory/1608-193-0x000007FEEC610000-0x000007FEED033000-memory.dmp

Filesize
10.1MB

Download
memory/1608-194-0x000000001BBD0000-0x000000001BECF000-memory.dmp

Filesize
3.0MB

Download
memory/1616-235-0x0000000002332000-0x0000000002337000-memory.dmp

Filesize
20KB

Download
memory/1616-201-0x0000000002332000-0x0000000002337000-memory.dmp

Filesize
20KB

Download
memory/1616-202-0x000000001F0D0000-0x000000001F3CF000-memory.dmp

Filesize
3.0MB

Download
memory/1616-200-0x000007FEEAB20000-0x000007FEEBBB6000-memory.dmp

Filesize
16.6MB

Download
memory/1616-199-0x000007FEEBE00000-0x000007FEEC823000-memory.dmp

Filesize
10.1MB

Download
memory/1616-223-0x000000000233B000-0x000000000235A000-memory.dmp

Filesize
124KB

Download
memory/1616-239-0x000000000233B000-0x000000000235A000-memory.dmp

Filesize
124KB

Download
memory/1616-300-0x000007FEE8AC0000-0x000007FEE994F000-memory.dmp

Filesize
14.6MB

Download
memory/1624-221-0x00000000700F0000-0x000000007069B000-memory.dmp

Filesize
5.7MB

Download
memory/1624-222-0x00000000700F0000-0x000000007069B000-memory.dmp

Filesize
5.7MB

Download
memory/1768-247-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/1768-285-0x00000000006C0000-0x00000000006E2000-memory.dmp

Filesize
136KB

Download
memory/1768-183-0x0000000000C20000-0x0000000000C7F000-memory.dmp

Filesize
380KB

Download
memory/1768-308-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/1768-176-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/1768-309-0x0000000000B80000-0x0000000000B8A000-memory.dmp

Filesize
40KB

Download
memory/1768-175-0x0000000001E40000-0x0000000001EB6000-memory.dmp

Filesize
472KB

Download
memory/1768-174-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1768-307-0x00000000006F0000-0x00000000006FC000-memory.dmp

Filesize
48KB

Download
memory/1768-306-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/1768-305-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/1768-304-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/1768-303-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download
memory/1768-302-0x0000000002B10000-0x0000000002DD4000-memory.dmp

Filesize
2.8MB

Download
memory/1768-290-0x0000000001B50000-0x0000000001BE2000-memory.dmp

Filesize
584KB

Download
memory/1768-289-0x0000000001B50000-0x0000000001BE2000-memory.dmp

Filesize
584KB

Download
memory/1768-288-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/1768-287-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/1768-286-0x00000000006C0000-0x00000000006E2000-memory.dmp

Filesize
136KB

Download
memory/1768-242-0x00000000006D0000-0x0000000000704000-memory.dmp

Filesize
208KB

Download
memory/1768-243-0x0000000000C20000-0x0000000000C54000-memory.dmp

Filesize
208KB

Download
memory/1768-244-0x0000000000C60000-0x0000000000C84000-memory.dmp

Filesize
144KB

Download
memory/1768-245-0x0000000001070000-0x0000000001094000-memory.dmp

Filesize
144KB

Download
memory/1768-246-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/1768-283-0x0000000001BF0000-0x0000000001C82000-memory.dmp

Filesize
584KB

Download
memory/1768-248-0x0000000001A40000-0x0000000001AD4000-memory.dmp

Filesize
592KB

Download
memory/1768-249-0x0000000001BF0000-0x0000000001C84000-memory.dmp

Filesize
592KB

Download
memory/1768-251-0x00000000006D0000-0x0000000000704000-memory.dmp

Filesize
208KB

Download
memory/1768-252-0x00000000006D0000-0x00000000006F4000-memory.dmp

Filesize
144KB

Download
memory/1768-253-0x00000000006D0000-0x00000000006F4000-memory.dmp

Filesize
144KB

Download
memory/1768-254-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/1768-255-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/1768-256-0x0000000001A40000-0x0000000001AD4000-memory.dmp

Filesize
592KB

Download
memory/1768-257-0x0000000001A40000-0x0000000001AD4000-memory.dmp

Filesize
592KB

Download
memory/1768-276-0x00000000006C0000-0x00000000006F4000-memory.dmp

Filesize
208KB

Download
memory/1768-277-0x0000000000C40000-0x0000000000C72000-memory.dmp

Filesize
200KB

Download
memory/1768-278-0x0000000001070000-0x0000000001092000-memory.dmp

Filesize
136KB

Download
memory/1768-279-0x00000000010B0000-0x00000000010D2000-memory.dmp

Filesize
136KB

Download
memory/1768-280-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/1768-281-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download
memory/1768-282-0x0000000001B50000-0x0000000001BE2000-memory.dmp

Filesize
584KB

Download
memory/1800-197-0x00000000716D0000-0x0000000071C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1800-228-0x00000000716D0000-0x0000000071C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1852-152-0x0000000001E50000-0x0000000001E62000-memory.dmp

Filesize
72KB

Download
memory/2044-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download