280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c

Resubmissions

05/10/2022, 19:46

221005-yhfc9sfdc4 1

04/10/2022, 14:21

04/10/2022, 14:14

04/10/2022, 09:53

04/10/2022, 07:58

03/10/2022, 15:56

Analysis

max time kernel
1455s
max time network
1616s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Size

766.3MB
MD5

09ea7e2bef5722cdb9ee37a7dab48ff3
SHA1

d4fb2231f80333b1b50e6f790d3b59eb3ff26374
SHA256

280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c
SHA512

eb9d65e42bccf4b700eb51c3f2890ac80f2e61a04ff661cdc3c173ff85a1f8e7f9e1cf2de89fd3517ca0b106240791f60158a7af12a5395b49e5299b22d3bf38
SSDEEP

12582912:whzb6xxr5Ni69eds1tauM0I7j0LFCLw0FEl1oZ+rPAkIYw+oKj7XkFgMKiLVVKYH:whzb639Ni6agtW7ZwU6+8roYwS7dN2jr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
760	Setup_x64.exe

Loads dropped DLL 26 IoCs

pid	Process
760	Setup_x64.exe
760	Setup_x64.exe
1476	MsiExec.exe
1476	MsiExec.exe
1336	MsiExec.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
2008	MsiExec.exe
1336	MsiExec.exe
1720	rundll32.exe
1720	rundll32.exe
1720	rundll32.exe
2008	MsiExec.exe
1336	MsiExec.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1336	MsiExec.exe
1748	rundll32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	Setup_x64.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	Setup_x64.exe
File opened (read-only)	\??\I:	Setup_x64.exe
File opened (read-only)	\??\L:	Setup_x64.exe
File opened (read-only)	\??\N:	Setup_x64.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	Setup_x64.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	Setup_x64.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	Setup_x64.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	Setup_x64.exe
File opened (read-only)	\??\V:	Setup_x64.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	Setup_x64.exe
File opened (read-only)	\??\K:	Setup_x64.exe
File opened (read-only)	\??\T:	Setup_x64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	Setup_x64.exe
File opened (read-only)	\??\M:	Setup_x64.exe
File opened (read-only)	\??\O:	Setup_x64.exe
File opened (read-only)	\??\R:	Setup_x64.exe
File opened (read-only)	\??\E:	Setup_x64.exe
File opened (read-only)	\??\Y:	Setup_x64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	Setup_x64.exe
File opened (read-only)	\??\U:	Setup_x64.exe
File opened (read-only)	\??\W:	Setup_x64.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	Setup_x64.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1156	AUDIODG.EXE
Token: 33	1156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1156	AUDIODG.EXE
Token: SeRestorePrivilege	1964	7zG.exe
Token: 35	1964	7zG.exe
Token: SeSecurityPrivilege	1964	7zG.exe
Token: SeSecurityPrivilege	1964	7zG.exe
Token: SeRestorePrivilege	272	msiexec.exe
Token: SeTakeOwnershipPrivilege	272	msiexec.exe
Token: SeSecurityPrivilege	272	msiexec.exe
Token: SeCreateTokenPrivilege	760	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	760	Setup_x64.exe
Token: SeLockMemoryPrivilege	760	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	760	Setup_x64.exe
Token: SeMachineAccountPrivilege	760	Setup_x64.exe
Token: SeTcbPrivilege	760	Setup_x64.exe
Token: SeSecurityPrivilege	760	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	760	Setup_x64.exe
Token: SeLoadDriverPrivilege	760	Setup_x64.exe
Token: SeSystemProfilePrivilege	760	Setup_x64.exe
Token: SeSystemtimePrivilege	760	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	760	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	760	Setup_x64.exe
Token: SeCreatePagefilePrivilege	760	Setup_x64.exe
Token: SeCreatePermanentPrivilege	760	Setup_x64.exe
Token: SeBackupPrivilege	760	Setup_x64.exe
Token: SeRestorePrivilege	760	Setup_x64.exe
Token: SeShutdownPrivilege	760	Setup_x64.exe
Token: SeDebugPrivilege	760	Setup_x64.exe
Token: SeAuditPrivilege	760	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	760	Setup_x64.exe
Token: SeChangeNotifyPrivilege	760	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	760	Setup_x64.exe
Token: SeUndockPrivilege	760	Setup_x64.exe
Token: SeSyncAgentPrivilege	760	Setup_x64.exe
Token: SeEnableDelegationPrivilege	760	Setup_x64.exe
Token: SeManageVolumePrivilege	760	Setup_x64.exe
Token: SeImpersonatePrivilege	760	Setup_x64.exe
Token: SeCreateGlobalPrivilege	760	Setup_x64.exe
Token: SeCreateTokenPrivilege	760	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	760	Setup_x64.exe
Token: SeLockMemoryPrivilege	760	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	760	Setup_x64.exe
Token: SeMachineAccountPrivilege	760	Setup_x64.exe
Token: SeTcbPrivilege	760	Setup_x64.exe
Token: SeSecurityPrivilege	760	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	760	Setup_x64.exe
Token: SeLoadDriverPrivilege	760	Setup_x64.exe
Token: SeSystemProfilePrivilege	760	Setup_x64.exe
Token: SeSystemtimePrivilege	760	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	760	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	760	Setup_x64.exe
Token: SeCreatePagefilePrivilege	760	Setup_x64.exe
Token: SeCreatePermanentPrivilege	760	Setup_x64.exe
Token: SeBackupPrivilege	760	Setup_x64.exe
Token: SeRestorePrivilege	760	Setup_x64.exe
Token: SeShutdownPrivilege	760	Setup_x64.exe
Token: SeDebugPrivilege	760	Setup_x64.exe
Token: SeAuditPrivilege	760	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	760	Setup_x64.exe
Token: SeChangeNotifyPrivilege	760	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	760	Setup_x64.exe
Token: SeUndockPrivilege	760	Setup_x64.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1964	7zG.exe
760	Setup_x64.exe
760	Setup_x64.exe
1160	msiexec.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 272 wrote to memory of 1476	272	msiexec.exe	39
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 760 wrote to memory of 1160	760	Setup_x64.exe	40
PID 272 wrote to memory of 1336	272	msiexec.exe	41
PID 272 wrote to memory of 1336	272	msiexec.exe	41
PID 272 wrote to memory of 1336	272	msiexec.exe	41
PID 272 wrote to memory of 1336	272	msiexec.exe	41
PID 272 wrote to memory of 1336	272	msiexec.exe	41
PID 1336 wrote to memory of 540	1336	MsiExec.exe	42
PID 1336 wrote to memory of 540	1336	MsiExec.exe	42
PID 1336 wrote to memory of 540	1336	MsiExec.exe	42
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 272 wrote to memory of 2008	272	msiexec.exe	43
PID 1336 wrote to memory of 1720	1336	MsiExec.exe	44
PID 1336 wrote to memory of 1720	1336	MsiExec.exe	44
PID 1336 wrote to memory of 1720	1336	MsiExec.exe	44
PID 1336 wrote to memory of 1756	1336	MsiExec.exe	45
PID 1336 wrote to memory of 1756	1336	MsiExec.exe	45
PID 1336 wrote to memory of 1756	1336	MsiExec.exe	45
PID 1336 wrote to memory of 1748	1336	MsiExec.exe	46
PID 1336 wrote to memory of 1748	1336	MsiExec.exe	46
PID 1336 wrote to memory of 1748	1336	MsiExec.exe	46

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip"
1⤵
PID:1900

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:692

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:1880

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" -spe -an -ai#7zMap29291:164:7zEvent30756
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1964

C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi AI_SETUPEXEPATH="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1664870922 "
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:1160

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 27C705CE439A5E158117DCA41CC08654 C
  2⤵
  - Loads dropped DLL
  PID:1476
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 0385B4C4A84646C07DB1A853AD384D47 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI66A1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8087341 1 CustomActions!CustomActions.CustomActions.SilentInstallProperties
    3⤵
    - Loads dropped DLL
    PID:540
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBAED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8108853 73 CustomActions!CustomActions.CustomActions.ForceUpgradeProperty
    3⤵
    - Loads dropped DLL
    PID:1720
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC26E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8111271 78 CustomActions!CustomActions.CustomActions.SetInstalledVersion
    3⤵
    - Loads dropped DLL
    PID:1756
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICAF7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8112941 83 CustomActions!CustomActions.CustomActions.InstallOptions
    3⤵
    - Loads dropped DLL
    PID:1748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1355329F3CF3ACA15FDCD9DB2E9D9090 C
  2⤵
  - Loads dropped DLL
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi

Filesize
194.7MB

MD5
cb89850ee9cf83015f30d1df61e97b2a

SHA1
7ebd4b6e0636cc209ed8bc4ac1c1195459dfbab4

SHA256
b8ac3b3c1a2c80ee17c6f8678d6777547477bb726ef7914fac14e2d7f331ba19

SHA512
144272199c96c4eab27a3ad18e1995806d6c439dc00222a7b92979bd5343b422663e6421f68720ffae68a91a8bf1a6f207f6f62126678ee6c83c259fdfc77e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4C3F.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI607B.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI66A1.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAC48.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB0BC.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB178.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB57F.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB995.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBAED.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBDBC.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC26E.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICAF7.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4C3F.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSI607B.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
\Users\Admin\AppData\Local\Temp\MSI66A1.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI66A1.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI66A1.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI66A1.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI66A1.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI66A1.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSIAC48.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB0BC.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB178.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB57F.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB995.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Local\Temp\MSIBAED.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIBAED.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIBAED.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIBAED.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIBDBC.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC26E.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC26E.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC26E.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC26E.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSICAF7.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSICAF7.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
memory/540-79-0x0000000001F30000-0x0000000001F5E000-memory.dmp

Filesize
184KB

Download
memory/540-82-0x0000000001F60000-0x0000000001F72000-memory.dmp

Filesize
72KB

Download
memory/540-85-0x0000000002040000-0x000000000209E000-memory.dmp

Filesize
376KB

Download
memory/692-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/760-58-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/760-60-0x0000000073871000-0x0000000073873000-memory.dmp

Filesize
8KB

Download
memory/1720-104-0x0000000001BF0000-0x0000000001C02000-memory.dmp

Filesize
72KB

Download