280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c

Resubmissions

05/10/2022, 19:46

221005-yhfc9sfdc4 1

04/10/2022, 14:21

04/10/2022, 14:14

04/10/2022, 09:53

04/10/2022, 07:58

03/10/2022, 15:56

Analysis

max time kernel
1798s
max time network
1857s
platform
windows7_x64
resource
win7-20220901-es
resource tags

arch:x64arch:x86image:win7-20220901-eslocale:es-esos:windows7-x64systemwindows
submitted
04/10/2022, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Size

766.3MB
MD5

09ea7e2bef5722cdb9ee37a7dab48ff3
SHA1

d4fb2231f80333b1b50e6f790d3b59eb3ff26374
SHA256

280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c
SHA512

eb9d65e42bccf4b700eb51c3f2890ac80f2e61a04ff661cdc3c173ff85a1f8e7f9e1cf2de89fd3517ca0b106240791f60158a7af12a5395b49e5299b22d3bf38
SSDEEP

12582912:whzb6xxr5Ni69eds1tauM0I7j0LFCLw0FEl1oZ+rPAkIYw+oKj7XkFgMKiLVVKYH:whzb639Ni6agtW7ZwU6+8roYwS7dN2jr

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
1136	Setup_x64.exe
880	Setup_x64.exe
1816	dismhost.exe
904	dismhost.exe
1656	sqlwriter.exe
844	SQLEXPR_x64_ENU.exe
1796	SETUP.EXE
628	ScenarioEngine.exe
1140	FixSqlRegistryKey_x64.exe
1160	FixSqlRegistryKey_x86.exe
1448	FixSqlRegistryKey_x64.exe
560	FixSqlRegistryKey_x86.exe
692	sqlwriter.exe
788	FixSqlRegistryKey_x64.exe
1760	FixSqlRegistryKey_x86.exe

Registers COM server for autorun 1 TTPs 57 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceoledb40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceoledb40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\SQL Debugging\\120\\ssdebugps.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ = "C:\\Windows\\system32\\sqlncli11.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2E5582D-7771-4777-89A2-90C374777FDB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe

Loads dropped DLL 64 IoCs

pid	Process
1136	Setup_x64.exe
1136	Setup_x64.exe
1136	Setup_x64.exe
1504	MsiExec.exe
1504	MsiExec.exe
1476	MsiExec.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
1476	MsiExec.exe
188	rundll32.exe
188	rundll32.exe
188	rundll32.exe
544	MsiExec.exe
1476	MsiExec.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1476	MsiExec.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
880	Setup_x64.exe
1476	MsiExec.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1476	MsiExec.exe
1568	rundll32.exe
1568	rundll32.exe
1568	rundll32.exe
1088	dism.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe
1816	dismhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{82C52A2E-2B10-4059-821F-248F9CDD76B7} = "\"C:\\Users\\Admin\\Desktop\\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\\Setup_x64.exe\" /cmdloc \"HKCU\\Software\\Seagull Scientific AiTemp\\{82C52A2E-2B10-4059-821F-248F9CDD76B7}\""	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Setup_x64.exe
File opened (read-only)	\??\N:	Setup_x64.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	Setup_x64.exe
File opened (read-only)	\??\L:	Setup_x64.exe
File opened (read-only)	\??\O:	Setup_x64.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\F:	Setup_x64.exe
File opened (read-only)	\??\H:	Setup_x64.exe
File opened (read-only)	\??\I:	Setup_x64.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	Setup_x64.exe
File opened (read-only)	\??\U:	Setup_x64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	Setup_x64.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	Setup_x64.exe
File opened (read-only)	\??\S:	Setup_x64.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	Setup_x64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	Setup_x64.exe
File opened (read-only)	\??\R:	Setup_x64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	Setup_x64.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	Setup_x64.exe
File opened (read-only)	\??\W:	Setup_x64.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	Setup_x64.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	Setup_x64.exe
File opened (read-only)	\??\Z:	Setup_x64.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\5EA9411076914705A44E58C372FA634C\AUTORUN.INF	SQLEXPR_x64_ENU.exe
File opened for modification	C:\5EA9411076914705A44E58C372FA634C\AUTORUN.INF	SQLEXPR_x64_ENU.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\system32\SqlServerSpatial120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msodbcdiag11.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sqlncli11.dll	msiexec.exe
File created	C:\Windows\system32\msodbcdiag11.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msodbcsql11.dll	msiexec.exe
File created	C:\Windows\SysWOW64\1033\msodbcsqlr11.rll	msiexec.exe
File created	C:\Windows\system32\1033\msodbcsqlr11.rll	msiexec.exe
File created	C:\Windows\system32\1033\sqlnclir11.rll	msiexec.exe
File created	C:\Windows\SysWOW64\1033\s11ch_msodbcsql.chm	msiexec.exe
File created	C:\Windows\system32\1033\s11ch_msodbcsql.chm	msiexec.exe
File created	C:\Windows\SysWOW64\1033\sqlnclir11.rll	msiexec.exe
File created	C:\Windows\system32\msodbcsql11.dll	msiexec.exe
File created	C:\Windows\SysWOW64\1033\s11ch_sqlncli.chm	msiexec.exe
File created	C:\Windows\system32\1033\s11ch_sqlncli.chm	msiexec.exe
File created	C:\Windows\system32\sqlncli11.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\3082\xepackage0.rll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\ProductSettings_DReplayController_Private.xml	ScenarioEngine.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\ProductSettings_SqlPowershell_Public.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\x64\ANOOMSQE.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Watson_8\Datastore\RunRuleResults_RunStandaloneRules.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\sqlmin.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\e4grzzmx\x64\1033\GOCTS2LR.RTF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\es\MICROSOFT.SQLSERVER.CONFIGURATION.RULESENGINEEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ja\MICROSOFT.SQL.CHAINER.PRODUCT.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\sqlceca40.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\ProductSettings_Slp_Public.xml	ScenarioEngine.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\Datastore_Discovery.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\zwubcbxg.etb\4XUBCBXG.ETB	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.NETENTERPRISESERVERS.EXCEPTIONMESSAGEBOX.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.SQLSERVER.CONFIGURATION.ASEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.SQLSERVER.CONFIGURATION.RSSHPEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-chs\MICROSOFT.SQLSERVER.CONFIGURATION.SSISEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\1033_ENU_LP\x64\1033\license_Dev.rtf	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Configuration.Sfc.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\7705gf63.if\C705GF63.IF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\sqlncli_Cpu64_1.log	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Watson_8\Datastore\_Extensions_Config_FeatureScenario.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\e4grzzmx\x64\1033\CXDIVBTW.RTF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\e4grzzmx\x64\1033\DUG05ZFZ.RTF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-cht\MICROSOFT.SQLSERVER.CONFIGURATION.FULLTEXT_CONFIGEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\CompleteImageWizard.xml	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1042\odsole70.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\it\MICROSOFT.SQLSERVER.CONFIGURATION.XTP.CONFIGEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\KeyFile\1033\sqlsupport12_0_keyfile.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\1033_ENU_LP\x64\1033\license_Expr_SSDTBI.rtf	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\FixSqlRegistryKey_x64.exe.config	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\3082\xesqlpkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-cht\MICROSOFT.SQLSERVER.CONFIGURATION.UTILITYEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\Microsoft.SqlServer.Configuration.RSExtension.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\e4grzzmx\x64\1033\VF8YHCQ7.RTF	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-cht\MICROSOFT.SQLSERVER.MANAGEMENT.CONTROLS.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Configuration.ScoExtension.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\SqlSupport_KatmaiRTM_Cpu64_1.log	ScenarioEngine.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\ProductSettings_Agent_Public.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\x64\AKH3WXJN.XML	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\PFiles\SqlServr\120\Setup\1-l9bmi0\x64\MSVCR80.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\1033_ENU_LP\x64\Setup\sqlsupport_msi\Windows\winsxs\manifest\D2RG91XW.1P4	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\InstallWizard.xml	msiexec.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\ProductSettings_ClusterNodesStatus_Public.xml	ScenarioEngine.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\_Extension_Slp_OriginalInputSettingValues.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\fr\MICROSOFT.SQLSERVER.CONFIGURATION.DISTRIBUTEDREPLAYEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\zh-cht\MICROSOFT.SQLSERVER.CONFIGURATION.SQLBROWSEREXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\1033_ENU_LP\x64\1033\license_Ent_OEM.rtf	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Configuration.RulesEngineExtension.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\License Terms\License_SqlLocalDB_1049.txt	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\MICROSOFT.SQLSERVER.CONFIGURATION.SSTRING.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Watson_4\Datastore\ProductSettings_ASSIP_Public.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\1033\license_Web.rtf	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\fr\sqlaccess.resources.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\UPGRADEWIZARD.XML	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Chainer.Infrastructure.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Datastore\RunRuleResults_RunFeatureSpecificRules.xml	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\es\MICROSOFT.SQLSERVER.CONFIGURATION.FULLTEXT_CONFIGEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Update Cache\KB4022619\ServicePack\x64\ja\MICROSOFT.SQLSERVER.CONFIGURATION.MSIEXTENSION.RESOURCES.DLL	ScenarioEngine.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\Log\20221004_143558\Watson_8\Datastore\ProductSettings_SqlEngine_Private.xml	ScenarioEngine.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Desktop\System.Data.SqlServerCe.Entity\System.Data.SqlServerCe.Entity.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Templates\model.mdf	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Chainer.ExtensionCommon.XmlSerializers.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Setup Bootstrap\SQLServer2014\x64\Microsoft.SqlServer.Chainer.WorkflowData.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143730267.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143953210.1\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143953210.2\8.0.50727.6229.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004144213860.2	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004144213860.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144434384.3\8.0.50727.6229.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\517DC6634FF24B048A4B0AE5D5129A54\12.0.2000\SLP_sqlboot_dll_SHARED_64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144950768.0\8.0.50727.1833.policy	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\OOP08UTWH3\Microsoft.SqlServer.GridControl.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\assembly\tmp\C24PD68F\Microsoft.SqlServer.GridControl.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144434400.1\mfc80DEU.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\753575.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\18BD6746362F40C45847AA3D11633C40\12.0.2000\SLP_Microsoft_SqlServer_SqlSqmQueries_dll_64	msiexec.exe
File created	C:\Windows\assembly\tmp\9FFMYQT4\Microsoft.NetEnterpriseServers.ExceptionMessageBox.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\4EPU4J5D\Microsoft.SqlServer.WizardFrameworkLite.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144213875.3\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_6ad2c555.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144213891.0\msvcm80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\517DC6634FF24B048A4B0AE5D5129A54\12.0.2000\ENG_SEI_COM__sqlvdi_dll_64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144730056.2\8.0.50727.1833.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\75354b.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143730111.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144730103.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.lock	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004143953241.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144213860.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144213860.2\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144434338.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144434416.1\mfcm80u.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\500B6D056D0BF52459B31033E1C2F7BC\12.3.6024\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004144730087.2	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004145211324.2	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143953210.1\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\Installer\753579.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144950846.3\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_2fd6f5db.manifest	msiexec.exe
File created	C:\Windows\assembly\tmp\BASSG8M7\Microsoft.SqlServer.WizardFrameworkLite.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4A8.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143953226.1\mfc80CHT.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DEC.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144434400.1\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144730009.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_f19a562a.manifest	msiexec.exe
File created	C:\Windows\assembly\tmp\1ULWY0LX\Microsoft.SqlServer.GridControl.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config	MsiExec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143730298.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004144213922.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\517DC6634FF24B048A4B0AE5D5129A54\12.0.2000\ENG_SEI_COM__sqlvdi_dll_32	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI135.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144730056.0\ATL80.dll	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143953304.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\Installer\75356e.msi	msiexec.exe
File created	C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.lock	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144514336.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_2fd6f5db.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144730056.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.1833_x-ww_bf90704a.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE329.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144213860.2\mfc80CHS.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCE0.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004145210669.0\ATL80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE973.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004143953319.1\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004144514336.1\8.0.50727.1833.cat	msiexec.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
972	sc.exe
1392	sc.exe
836	sc.exe
1564	sc.exe
636	sc.exe
1628	sc.exe
608	sc.exe
1220	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\63C768CF	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B376CC6347FDA7498260CC05A030061\ProductIcon = "C:\\Windows\\Installer\\{6CC673B9-F743-47AD-8962-C00CA5300016}\\ARPIco"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SSCE.DropTableListener.4.0\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B69AB1F3-36CE-4FE7-9994-27E66DCFA4F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2CE1F06F8A56C44EA8607910D599ADB	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SQLNCLI11.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\ProgID\ = "MSSQL.VDI.Server.2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99376FABDC585554B994F108BE29C153\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA99D701-E6E7-4db4-A5CC-81541C75188A}\VersionIndependentProgID\ = "SQLNCLI11.ErrorLookup"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.SqlServer.TransactSql.ScriptDom,fileVersion="12.0.6024.0",version="12.0.0.0000",culture="neutral",publicKeyToken="89845DCD8080CC91",processorArchitecture="MSIL" = 2e0057005d007a004a0058005400350026003f003200450046002b0027006a002700260029002a003e002900310065006b00280078003f0024004b003900380054002d00370029003100580053006700660000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSCE.DropTableListener.4.0\ = "SSCE DropTable Listener Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3187FC8-7DD9-4F1D-8C6F-ACAF10F32437}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99376FABDC585554B994F108BE29C153	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 2a00510069006800740066005f005d0053003f0028007e0031002e00750035002100320051006a003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\ = "Microsoft SQL Server Compact OLE DB Provider for Windows Error Lookup"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21850BBE57BA829498300ECE5107FBBC\SourceList\Media\MediaPackage = "\\Setup\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F612DD2-7E28-424f-A2FD-C2EECC314AA2}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\517DC6634FF24B048A4B0AE5D5129A54\SourceList\Media\MediaPackage = "\\1033_ENU_LP\\x64\\setup\\x64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9B376CC6347FDA7498260CC05A030061\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{289EA71A-F86E-4C9F-B75C-A709CA66D781}\TypeLib\ = "{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0BE8963-5BA4-4A11-80E2-CBFB534D4C54}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6961309E93DD52C4ABBE24F52F2897AE\517DC6634FF24B048A4B0AE5D5129A54	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\415D29264A71F304899F1E051FC040D3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{397C2819-8272-4532-AD3A-FB5E43BEAA39}\ProgID\ = "SQLNCLI11.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SQLNCLI11.ErrorLookup.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SQLNCLI11.Enumerator\Clsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3832ED3604299694485363D0A7641F95\18BD6746362F40C45847AA3D11633C40	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\415D29264A71F304899F1E051FC040D3\SourceList\Media\1 = "SqlSupp;"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\ = "SSCE Error Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SQLNCLI11.ErrorLookup\Clsid\ = "{CA99D701-E6E7-4db4-A5CC-81541C75188A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\ExtendedErrors\{798B9084-1221-4281-9CED-89654F2ADF8F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0BE8963-5BA4-4A11-80E2-CBFB534D4C54}\ = "ISSCEError"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F8A2489-F677-43bf-B991-0BBE263147C8}\ProgID\ = "SQLNCLI11.ConnectionPage.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\517DC6634FF24B048A4B0AE5D5129A54\SourceList\Media\100 = "WRITER200864Hotfix;"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\415D29264A71F304899F1E051FC040D3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft SQL Server Compact Edition Database File\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceme40.dll,-1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B69AB1F3-36CE-4FE7-9994-27E66DCFA4F0}\ = "ISSCEParams"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{289EA71A-F86E-4C9F-B75C-A709CA66D781}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99376FABDC585554B994F108BE29C153	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SQLNCLI11.AdvancedPage\Clsid\ = "{D2E5582D-7771-4777-89A2-90C374777FDB}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\763D39D9CC2A8734DB3697FEF37EC687\SourceList\LastUsedSource = "n;1;C:\\Program Files\\Microsoft SQL Server\\120\\Setup Bootstrap\\Update Cache\\KB4022619\\ServicePack\\1033_ENU_LP\\x64\\setup\\x64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}\4.0\ = "Microsoft SQL Server Compact Control"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\ = "Microsoft SQL Server Virtual Device Interface for Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\0D53F32E59C00524888BF1AD1D92214A\SourceList\Media\100 = "WRITER200864Hotfix;"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\ = "Active SSCE Engine Object"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 2a00510069006800740066005f005d0053003f0028007e0031002e00750035002100320051006a003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSCE.Replication.4.0\ = "Active SSCE Replication Object"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
308	rundll32.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
1224	rundll32.exe
1224	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
828	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	564	AUDIODG.EXE
Token: 33	564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	564	AUDIODG.EXE
Token: SeRestorePrivilege	308	7zG.exe
Token: 35	308	7zG.exe
Token: SeSecurityPrivilege	308	7zG.exe
Token: SeSecurityPrivilege	308	7zG.exe
Token: SeRestorePrivilege	992	msiexec.exe
Token: SeTakeOwnershipPrivilege	992	msiexec.exe
Token: SeSecurityPrivilege	992	msiexec.exe
Token: SeCreateTokenPrivilege	1136	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1136	Setup_x64.exe
Token: SeLockMemoryPrivilege	1136	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	1136	Setup_x64.exe
Token: SeMachineAccountPrivilege	1136	Setup_x64.exe
Token: SeTcbPrivilege	1136	Setup_x64.exe
Token: SeSecurityPrivilege	1136	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	1136	Setup_x64.exe
Token: SeLoadDriverPrivilege	1136	Setup_x64.exe
Token: SeSystemProfilePrivilege	1136	Setup_x64.exe
Token: SeSystemtimePrivilege	1136	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	1136	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	1136	Setup_x64.exe
Token: SeCreatePagefilePrivilege	1136	Setup_x64.exe
Token: SeCreatePermanentPrivilege	1136	Setup_x64.exe
Token: SeBackupPrivilege	1136	Setup_x64.exe
Token: SeRestorePrivilege	1136	Setup_x64.exe
Token: SeShutdownPrivilege	1136	Setup_x64.exe
Token: SeDebugPrivilege	1136	Setup_x64.exe
Token: SeAuditPrivilege	1136	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	1136	Setup_x64.exe
Token: SeChangeNotifyPrivilege	1136	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	1136	Setup_x64.exe
Token: SeUndockPrivilege	1136	Setup_x64.exe
Token: SeSyncAgentPrivilege	1136	Setup_x64.exe
Token: SeEnableDelegationPrivilege	1136	Setup_x64.exe
Token: SeManageVolumePrivilege	1136	Setup_x64.exe
Token: SeImpersonatePrivilege	1136	Setup_x64.exe
Token: SeCreateGlobalPrivilege	1136	Setup_x64.exe
Token: SeCreateTokenPrivilege	1136	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1136	Setup_x64.exe
Token: SeLockMemoryPrivilege	1136	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	1136	Setup_x64.exe
Token: SeMachineAccountPrivilege	1136	Setup_x64.exe
Token: SeTcbPrivilege	1136	Setup_x64.exe
Token: SeSecurityPrivilege	1136	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	1136	Setup_x64.exe
Token: SeLoadDriverPrivilege	1136	Setup_x64.exe
Token: SeSystemProfilePrivilege	1136	Setup_x64.exe
Token: SeSystemtimePrivilege	1136	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	1136	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	1136	Setup_x64.exe
Token: SeCreatePagefilePrivilege	1136	Setup_x64.exe
Token: SeCreatePermanentPrivilege	1136	Setup_x64.exe
Token: SeBackupPrivilege	1136	Setup_x64.exe
Token: SeRestorePrivilege	1136	Setup_x64.exe
Token: SeShutdownPrivilege	1136	Setup_x64.exe
Token: SeDebugPrivilege	1136	Setup_x64.exe
Token: SeAuditPrivilege	1136	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	1136	Setup_x64.exe
Token: SeChangeNotifyPrivilege	1136	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	1136	Setup_x64.exe
Token: SeUndockPrivilege	1136	Setup_x64.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
308	7zG.exe
1136	Setup_x64.exe
1136	Setup_x64.exe
828	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 992 wrote to memory of 1504	992	msiexec.exe	34
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 1136 wrote to memory of 828	1136	Setup_x64.exe	35
PID 992 wrote to memory of 1476	992	msiexec.exe	36
PID 992 wrote to memory of 1476	992	msiexec.exe	36
PID 992 wrote to memory of 1476	992	msiexec.exe	36
PID 992 wrote to memory of 1476	992	msiexec.exe	36
PID 992 wrote to memory of 1476	992	msiexec.exe	36
PID 1476 wrote to memory of 880	1476	MsiExec.exe	37
PID 1476 wrote to memory of 880	1476	MsiExec.exe	37
PID 1476 wrote to memory of 880	1476	MsiExec.exe	37
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 992 wrote to memory of 544	992	msiexec.exe	38
PID 1476 wrote to memory of 188	1476	MsiExec.exe	39
PID 1476 wrote to memory of 188	1476	MsiExec.exe	39
PID 1476 wrote to memory of 188	1476	MsiExec.exe	39
PID 1476 wrote to memory of 1524	1476	MsiExec.exe	40
PID 1476 wrote to memory of 1524	1476	MsiExec.exe	40
PID 1476 wrote to memory of 1524	1476	MsiExec.exe	40
PID 1476 wrote to memory of 308	1476	MsiExec.exe	41
PID 1476 wrote to memory of 308	1476	MsiExec.exe	41
PID 1476 wrote to memory of 308	1476	MsiExec.exe	41
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 544 wrote to memory of 880	544	MsiExec.exe	42
PID 1476 wrote to memory of 1624	1476	MsiExec.exe	43
PID 1476 wrote to memory of 1624	1476	MsiExec.exe	43
PID 1476 wrote to memory of 1624	1476	MsiExec.exe	43
PID 1476 wrote to memory of 1568	1476	MsiExec.exe	44
PID 1476 wrote to memory of 1568	1476	MsiExec.exe	44
PID 1476 wrote to memory of 1568	1476	MsiExec.exe	44
PID 1568 wrote to memory of 1088	1568	rundll32.exe	45
PID 1568 wrote to memory of 1088	1568	rundll32.exe	45
PID 1568 wrote to memory of 1088	1568	rundll32.exe	45
PID 1088 wrote to memory of 1816	1088	dism.exe	47
PID 1088 wrote to memory of 1816	1088	dism.exe	47
PID 1088 wrote to memory of 1816	1088	dism.exe	47
PID 1568 wrote to memory of 1716	1568	rundll32.exe	48
PID 1568 wrote to memory of 1716	1568	rundll32.exe	48
PID 1568 wrote to memory of 1716	1568	rundll32.exe	48
PID 1716 wrote to memory of 904	1716	dism.exe	50
PID 1716 wrote to memory of 904	1716	dism.exe	50
PID 1716 wrote to memory of 904	1716	dism.exe	50
PID 1568 wrote to memory of 1692	1568	rundll32.exe	52

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip"
1⤵
PID:1504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" -spe -an -ai#7zMap28205:164:7zEvent11924
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:308

C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi TRANSFORMS=:3082 AI_SETUPEXEPATH="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1664886318 "
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:828

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F181B62E208571D0AD00C086A41B05FC C
  2⤵
  - Loads dropped DLL
  PID:1504
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 225F3344329FADDB59049963A7F6894D C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9628.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7314496 1 CustomActions!CustomActions.CustomActions.SilentInstallProperties
    3⤵
    - Loads dropped DLL
    PID:880
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE392.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7333372 73 CustomActions!CustomActions.CustomActions.ForceUpgradeProperty
    3⤵
    - Loads dropped DLL
    PID:188
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF4D3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7337413 78 CustomActions!CustomActions.CustomActions.SetInstalledVersion
    3⤵
    - Loads dropped DLL
    PID:1524
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6DE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7341999 83 CustomActions!CustomActions.CustomActions.InstallOptions
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:308
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4E1F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7491121 337 CustomActions!CustomActions.CustomActions.ExtractSQLExpress
    3⤵
    - Loads dropped DLL
    PID:1624
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2E9E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7548591 347 CustomActions!CustomActions.CustomActions.WindowsOptionalFeatures
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\system32\dism.exe
      "C:\Windows\system32\dism.exe" /Online /Get-Features /Format:Table
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\8994A3E3-29A5-489E-8080-D46CF1E6B54F\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\8994A3E3-29A5-489E-8080-D46CF1E6B54F\dismhost.exe {C87BCF86-800E-4B8B-97D5-8544927B5813}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1816
  - - C:\Windows\system32\dism.exe
      "C:\Windows\system32\dism.exe" /Online /Enable-Feature /FeatureName:MSMQ-Container /FeatureName:MSMQ-Server /NoRestart
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\418AFBA4-CF20-4F9C-B885-532F28223BAC\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\418AFBA4-CF20-4F9C-B885-532F28223BAC\dismhost.exe {6B24DD9E-D3B9-4926-8B77-D6416363C165}
        5⤵
        Executes dropped EXE
        
        PID:904
  - - C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ServiceModelReg.exe" -r
      4⤵
      PID:1692
    - - C:\Windows\system32\sc.exe
        
        sidtype NetTcpPortSharing restricted
        5⤵
        Launches sc.exe
        
        PID:836
    - - C:\Windows\system32\sc.exe
        
        privs NetTcpPortSharing SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:1564
    - - C:\Windows\system32\sc.exe
        
        sidtype NetTcpActivator restricted
        5⤵
        Launches sc.exe
        
        PID:636
    - - C:\Windows\system32\sc.exe
        
        privs NetTcpActivator SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:1628
    - - C:\Windows\system32\sc.exe
        
        sidtype NetPipeActivator restricted
        5⤵
        Launches sc.exe
        
        PID:608
    - - C:\Windows\system32\sc.exe
        
        privs NetPipeActivator SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:1220
    - - C:\Windows\system32\sc.exe
        
        sidtype NetMsmqActivator restricted
        5⤵
        Launches sc.exe
        
        PID:972
    - - C:\Windows\system32\sc.exe
        
        privs NetMsmqActivator SeCreateGlobalPrivilege
        5⤵
        Launches sc.exe
        
        PID:1392
    - - C:\Windows\system32\wevtutil.exe
        
        um C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
        5⤵
        
        PID:2000
    - - C:\Windows\system32\wevtutil.exe
        
        im C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
        5⤵
        
        PID:1536
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI30C2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7811282 1456 CustomActions!CustomActions.CustomActions.InstallSQLExpress
    3⤵
    PID:904
  - - C:\Users\Admin\AppData\Local\Temp\SQLEXPR_x64_ENU.exe
      "C:\Users\Admin\AppData\Local\Temp\SQLEXPR_x64_ENU.exe" /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage
      4⤵
      Executes dropped EXE
      Drops autorun.inf file
      PID:844
    - - C:\5EA9411076914705A44E58C372FA634C\SETUP.EXE
        
        C:\5EA9411076914705A44E58C372FA634C\SETUP.EXE /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage
        5⤵
        Executes dropped EXE
        
        PID:1796
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe
        
        -b
        6⤵
        
        PID:808
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        
        -b
        6⤵
        
        PID:1536
      - C:\5EA9411076914705A44E58C372FA634C\x64\ScenarioEngine.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\ScenarioEngine.exe" /WORKFLOW=Install /TIMESTAMP=20221004_143558 /LOGMARKER= /MEDIASOURCE="C:\5EA9411076914705A44E58C372FA634C\\" /INSTALLMEDIAPATH="C:\5EA9411076914705A44E58C372FA634C\x64\setup\\" /ENU /MEDIALAYOUT="Core" /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage /ACTION=Install
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5awgodle.cmdline"
        7⤵
        
        PID:332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB7A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEB79.tmp"
        8⤵
        
        PID:1204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fiwcw4nx.cmdline"
        7⤵
        
        PID:1332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC92.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEC91.tmp"
        8⤵
        
        PID:2020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x0fxqdoy.cmdline"
        7⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE09.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEE08.tmp"
        8⤵
        
        PID:1500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lxexmsw8.cmdline"
        7⤵
        
        PID:832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF04A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF049.tmp"
        8⤵
        
        PID:1816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_d9ut18p.cmdline"
        7⤵
        
        PID:1392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF115.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF114.tmp"
        8⤵
        
        PID:1508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\achjvef1.cmdline"
        7⤵
        
        PID:1380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1EF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF1DF.tmp"
        8⤵
        
        PID:608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pqtoxp0r.cmdline"
        7⤵
        
        PID:560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF50B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF50A.tmp"
        8⤵
        
        PID:788
        
        C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x64.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x64.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x86.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x86.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mxrrb9hs.cmdline"
        7⤵
        
        PID:1096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC9F.tmp"
        8⤵
        
        PID:1508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_em-a1qf.cmdline"
        7⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF0.tmp"
        8⤵
        
        PID:608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\54ewzehr.cmdline"
        7⤵
        
        PID:1572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C12.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2C11.tmp"
        8⤵
        
        PID:1628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fsqqbdxg.cmdline"
        7⤵
        
        PID:876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D0B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2D0A.tmp"
        8⤵
        
        PID:1224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dl9ahoul.cmdline"
        7⤵
        
        PID:2020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES319D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC319C.tmp"
        8⤵
        
        PID:1804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6qgqbqb-.cmdline"
        7⤵
        
        PID:1632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3352.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3342.tmp"
        8⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mjffk50n.cmdline"
        7⤵
        
        PID:1160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES345B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC345A.tmp"
        8⤵
        
        PID:1140
        
        C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x64.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x64.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x86.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x86.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bvpesvu.cmdline"
        7⤵
        
        PID:960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AFE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5AFD.tmp"
        8⤵
        
        PID:1732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7b6m-1kf.cmdline"
        7⤵
        
        PID:1500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B62.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6B61.tmp"
        8⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vprn8sm1.cmdline"
        7⤵
        
        PID:1492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7438.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7428.tmp"
        8⤵
        
        PID:956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lmyasa8h.cmdline"
        7⤵
        
        PID:1872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80E5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC80E4.tmp"
        8⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rf9hozfk.cmdline"
        7⤵
        
        PID:780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81C0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC81BF.tmp"
        8⤵
        
        PID:976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hbafsdrp.cmdline"
        7⤵
        
        PID:1068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83A3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC83A2.tmp"
        8⤵
        
        PID:1352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s7_te42a.cmdline"
        7⤵
        
        PID:2000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DA2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8DA1.tmp"
        8⤵
        
        PID:1092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pbnyldxt.cmdline"
        7⤵
        
        PID:1868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9012.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9011.tmp"
        8⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hwiuwkce.cmdline"
        7⤵
        
        PID:1556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90AE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC90AD.tmp"
        8⤵
        
        PID:1224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lmzqwpdr.cmdline"
        7⤵
        
        PID:692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6DC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA6DB.tmp"
        8⤵
        
        PID:1132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ewqx79o_.cmdline"
        7⤵
        
        PID:1628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA91D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA91C.tmp"
        8⤵
        
        PID:1568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqaydfx0.cmdline"
        7⤵
        
        PID:1732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAC2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAAC1.tmp"
        8⤵
        
        PID:960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\12j3q5su.cmdline"
        7⤵
        
        PID:1936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC0A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAC09.tmp"
        8⤵
        
        PID:1500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-n1rmy6c.cmdline"
        7⤵
        
        PID:1204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD71.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAD70.tmp"
        8⤵
        
        PID:956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lc433inq.cmdline"
        7⤵
        
        PID:1492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEC8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAEC7.tmp"
        8⤵
        
        PID:1768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zdd4la8q.cmdline"
        7⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB010.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB00F.tmp"
        8⤵
        
        PID:1872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ojoyhmz8.cmdline"
        7⤵
        
        PID:1736
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1E4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB1E3.tmp"
        8⤵
        
        PID:580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g-2zstos.cmdline"
        7⤵
        
        PID:1940
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2AE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB2AD.tmp"
        8⤵
        
        PID:788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uom7zaqg.cmdline"
        7⤵
        
        PID:784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB454.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB453.tmp"
        8⤵
        
        PID:1808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mj-gdn-d.cmdline"
        7⤵
        
        PID:1572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB5F8.tmp"
        8⤵
        
        PID:364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2oepfhbk.cmdline"
        7⤵
        
        PID:876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBAAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBAA9.tmp"
        8⤵
        
        PID:1008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fy2ywj06.cmdline"
        7⤵
        
        PID:1640
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC007.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC006.tmp"
        8⤵
        
        PID:2044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0wnhsjpu.cmdline"
        7⤵
        
        PID:2020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1AC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC19B.tmp"
        8⤵
        
        PID:560
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:960
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:308
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1872
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1628
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1448
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1376
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1128
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:512
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1852
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1128
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1380
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:788
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:852
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:1936
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:308
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:2024
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1008
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1088
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1508
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1496
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:636
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1936
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1328
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1624
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        Drops file in Windows directory
        
        PID:1364
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1048
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:768
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1852
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1536
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1548
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:1888
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue pause
        7⤵
        
        PID:932
        
        C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework\v2.0.50727\ngen.exe" queue continue
        7⤵
        
        PID:1400
        
        C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe
        
        "C:\Windows\Microsoft.Net\Framework64\v2.0.50727\ngen.exe" queue continue
        7⤵
        
        PID:528
        
        C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x64.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x64.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:788
        
        C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x86.exe
        
        "C:\5EA9411076914705A44E58C372FA634C\x64\FixSqlRegistryKey_x86.exe" /fix
        7⤵
        Executes dropped EXE
        
        PID:1760
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1E9B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8855209 1463 CustomActions!CustomActions.CustomActions.SetupInterrupted
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62DC3190C77A7DCEBA49D7F33FF35C9F C
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
    "C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" /groupsextract:103;111; /out:"C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites" /callbackid:544
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:880
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\SQL Server Compact 4.0\SSCERuntime_x64-ENU.msi" /q /norestart
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\SQL Server LocalDB 2014 SP3\SqlLocalDB_x64.msi" /qn /norestart IACCEPTSQLLOCALDBLICENSETERMS=YES
    3⤵
    PID:1628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8AC96A4E3807F8711251812715A11CC5
  2⤵
  PID:1596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2932B2867AF4A31899D40E29ECDCFB24 M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  PID:1912
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding FC3C5E6507C533A78FE1C115B9C1C121
  2⤵
  PID:1624
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding A8A415905227F97699568F54DDC2589F M Global\MSI0000
  2⤵
  PID:780
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 6A95ADCFCFB83DCD3D4885C6DFF24A0C
  2⤵
  PID:1128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CCEAA0E58C0F37417D963E224C0D2C4
  2⤵
  PID:1068
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 1C39680AB220C05CDE5EF5344B25D01C M Global\MSI0000
  2⤵
  PID:1500
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B44F427D91270FD0DC810BC6668C8E94
  2⤵
  PID:832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46885B7C679A5D5DE7C417A582A26E56
  2⤵
  PID:876
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding EACB213733A18C4045D0880DBD31D437 M Global\MSI0000
  2⤵
  PID:1536
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 56DF605453D51A741074035BEEF2CF5A
  2⤵
  PID:1392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9C026A52979743D9B170D5251617754C
  2⤵
  PID:780
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 47A34AEBE323BBDCBB77E9F2DBAB3FCB M Global\MSI0000
  2⤵
  PID:1872
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding FEB1B99A805E965B906803B24446C9DC
  2⤵
  PID:560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 44F2C177D2FC7C94DC1921D5DDC31F50
  2⤵
  PID:1008
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 23A0955A95090D9E76C8F50A9C7DCF2C M Global\MSI0000
  2⤵
  PID:1768
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding ACD64C1BC163A3C28703819244F15411
  2⤵
  PID:976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46A283CE65B634E0B61BF89A4438D91D M Global\MSI0000
  2⤵
  PID:1048
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 970E3E9B9414A5826A3725B6339A895B M Global\MSI0000
  2⤵
  PID:1608
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 341DA5493B5213258E10643A7D4B04D6
  2⤵
  PID:984
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding F14D22694F47B598CF74740794027BDA
  2⤵
  PID:1328
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 57239A0850ED8BEE4BA2A01338970FE2 M Global\MSI0000
  2⤵
  PID:1872
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding A47638DDB9DF16D7AAA0C41654CD31E5
  2⤵
  PID:956
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding CD635133C1DC652B2B127C030C83B26E
  2⤵
  PID:188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79346594DC2928014952E69C81C2BC4A
  2⤵
  PID:808
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding F4D82D77CF96BA0A7A39BB974AB1F3E5 M Global\MSI0000
  2⤵
  PID:1352
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B4F3D9DBBB2CBC85EBBF04A2FDC535B5
  2⤵
  PID:1492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B07327A5E5763B757EEAE02727FED6E
  2⤵
  PID:1432
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 9DF4E913EFA652A26481A03786883811 M Global\MSI0000
  2⤵
  PID:1404
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 4A63892803341403E6BE3C9FF1FC455E
  2⤵
  PID:1072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C552F063115E80A25E4A1666F3C09E71
  2⤵
  PID:280
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding EE505C63C6AF9D20B7ED82B8AD46DE51 M Global\MSI0000
  2⤵
  PID:1204
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 0D82BC685BA2E63CC95A2AADB3AC9763
  2⤵
  PID:1820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97E4A17117961DD9357322AB43042D21
  2⤵
  PID:1048
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 76919A2AD94D75A05289DAD263D48CA8 M Global\MSI0000
  2⤵
  PID:1940
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding BC2EF0CE756793720A9076E157FBDE93
  2⤵
  PID:976

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
1⤵
- Executes dropped EXE
PID:1656

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
1⤵
- Executes dropped EXE
PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi

Filesize
194.7MB

MD5
cb89850ee9cf83015f30d1df61e97b2a

SHA1
7ebd4b6e0636cc209ed8bc4ac1c1195459dfbab4

SHA256
b8ac3b3c1a2c80ee17c6f8678d6777547477bb726ef7914fac14e2d7f331ba19

SHA512
144272199c96c4eab27a3ad18e1995806d6c439dc00222a7b92979bd5343b422663e6421f68720ffae68a91a8bf1a6f207f6f62126678ee6c83c259fdfc77e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3D2B.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4112.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI41AF.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4E1F.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5DBD.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6DE.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI72A5.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9628.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC841.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID617.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID878.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDC02.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDF7C.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE392.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIED06.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF4D3.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\3082.dll

Filesize
120KB

MD5
a96297c0b3816788f2a8f930c6e9dcf4

SHA1
307b132d720b1b03ecfb96afa1808fd367ed702b

SHA256
fd9fd341073d906645eed1eff1eb53144af5109c73b26a8f9e56de7be82c81ed

SHA512
7897427df575d4c22d2980aea40d37b891ed416b101b697b4b161b3ddb5005671c74e34722052d3cc7f9b3f742100db8065eb0a8259ab2ec6fb69282b852c84a

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\Users\Admin\AppData\Local\Temp\MSI3D2B.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4112.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Local\Temp\MSI41AF.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4E1F.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI4E1F.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5DBD.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
\Users\Admin\AppData\Local\Temp\MSI6DE.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
\Users\Admin\AppData\Local\Temp\MSI72A5.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9628.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9628.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9628.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9628.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9628.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9628.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC841.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSID617.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSID878.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIDC02.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
\Users\Admin\AppData\Local\Temp\MSIDF7C.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE392.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE392.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE392.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIE392.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIED06.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF4D3.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF4D3.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF4D3.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Local\Temp\MSIF4D3.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
memory/188-103-0x0000000001C50000-0x0000000001C62000-memory.dmp

Filesize
72KB

Download
memory/308-131-0x000000001A48F000-0x000000001A4AE000-memory.dmp

Filesize
124KB

Download
memory/308-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download
memory/308-125-0x000000001A48F000-0x000000001A4AE000-memory.dmp

Filesize
124KB

Download
memory/308-130-0x000000001A48F000-0x000000001A4AE000-memory.dmp

Filesize
124KB

Download
memory/308-123-0x0000000001F10000-0x0000000001F6E000-memory.dmp

Filesize
376KB

Download
memory/308-117-0x0000000001E10000-0x0000000001E3E000-memory.dmp

Filesize
184KB

Download
memory/308-120-0x0000000001E50000-0x0000000001E62000-memory.dmp

Filesize
72KB

Download
memory/308-128-0x0000000001F70000-0x0000000001F7E000-memory.dmp

Filesize
56KB

Download
memory/560-237-0x000000006FF30000-0x00000000704DB000-memory.dmp

Filesize
5.7MB

Download
memory/628-227-0x00000000004F0000-0x0000000000570000-memory.dmp

Filesize
512KB

Download
memory/628-199-0x000007FEEBC20000-0x000007FEEC643000-memory.dmp

Filesize
10.1MB

Download
memory/628-202-0x000000001F0D0000-0x000000001F3CF000-memory.dmp

Filesize
3.0MB

Download
memory/628-297-0x000007FEE89F0000-0x000007FEE987F000-memory.dmp

Filesize
14.6MB

Download
memory/628-200-0x000007FEEA940000-0x000007FEEB9D6000-memory.dmp

Filesize
16.6MB

Download
memory/628-201-0x00000000004F0000-0x0000000000570000-memory.dmp

Filesize
512KB

Download
memory/628-222-0x00000000004F0000-0x0000000000570000-memory.dmp

Filesize
512KB

Download
memory/628-234-0x00000000004F0000-0x0000000000570000-memory.dmp

Filesize
512KB

Download
memory/788-310-0x000007FEEBC20000-0x000007FEEC643000-memory.dmp

Filesize
10.1MB

Download
memory/808-194-0x000000001BC00000-0x000000001BEFF000-memory.dmp

Filesize
3.0MB

Download
memory/808-193-0x000007FEEC430000-0x000007FEECE53000-memory.dmp

Filesize
10.1MB

Download
memory/880-78-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/880-81-0x0000000001C50000-0x0000000001C62000-memory.dmp

Filesize
72KB

Download
memory/880-84-0x0000000001E70000-0x0000000001ECE000-memory.dmp

Filesize
376KB

Download
memory/904-187-0x0000000001C30000-0x0000000001C42000-memory.dmp

Filesize
72KB

Download
memory/992-250-0x0000000000AC0000-0x0000000000AE4000-memory.dmp

Filesize
144KB

Download
memory/992-301-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/992-285-0x00000000009D0000-0x00000000009DC000-memory.dmp

Filesize
48KB

Download
memory/992-183-0x0000000001390000-0x00000000013EF000-memory.dmp

Filesize
380KB

Download
memory/992-280-0x0000000001AB0000-0x0000000001B42000-memory.dmp

Filesize
584KB

Download
memory/992-176-0x0000000000F40000-0x0000000000F4E000-memory.dmp

Filesize
56KB

Download
memory/992-175-0x0000000001E00000-0x0000000001E76000-memory.dmp

Filesize
472KB

Download
memory/992-174-0x0000000000F00000-0x0000000000F40000-memory.dmp

Filesize
256KB

Download
memory/992-307-0x0000000000A40000-0x0000000000A4C000-memory.dmp

Filesize
48KB

Download
memory/992-279-0x0000000001320000-0x00000000013B2000-memory.dmp

Filesize
584KB

Download
memory/992-306-0x0000000000A30000-0x0000000000A3A000-memory.dmp

Filesize
40KB

Download
memory/992-278-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download
memory/992-277-0x00000000009D0000-0x00000000009DC000-memory.dmp

Filesize
48KB

Download
memory/992-276-0x0000000001260000-0x0000000001282000-memory.dmp

Filesize
136KB

Download
memory/992-305-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Filesize
40KB

Download
memory/992-275-0x0000000001230000-0x0000000001252000-memory.dmp

Filesize
136KB

Download
memory/992-274-0x0000000000FF0000-0x0000000001022000-memory.dmp

Filesize
200KB

Download
memory/992-304-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Filesize
48KB

Download
memory/992-273-0x00000000009F0000-0x0000000000A24000-memory.dmp

Filesize
208KB

Download
memory/992-303-0x0000000000A00000-0x0000000000A0A000-memory.dmp

Filesize
40KB

Download
memory/992-255-0x00000000018A0000-0x0000000001934000-memory.dmp

Filesize
592KB

Download
memory/992-254-0x00000000018A0000-0x0000000001934000-memory.dmp

Filesize
592KB

Download
memory/992-302-0x00000000009F0000-0x00000000009FA000-memory.dmp

Filesize
40KB

Download
memory/992-283-0x00000000009F0000-0x0000000000A12000-memory.dmp

Filesize
136KB

Download
memory/992-253-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

Filesize
56KB

Download
memory/992-300-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/992-299-0x0000000002B70000-0x0000000002E34000-memory.dmp

Filesize
2.8MB

Download
memory/992-252-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

Filesize
56KB

Download
memory/992-251-0x0000000000AC0000-0x0000000000AE4000-memory.dmp

Filesize
144KB

Download
memory/992-249-0x0000000000AC0000-0x0000000000AF4000-memory.dmp

Filesize
208KB

Download
memory/992-247-0x0000000001A90000-0x0000000001B24000-memory.dmp

Filesize
592KB

Download
memory/992-246-0x00000000018A0000-0x0000000001934000-memory.dmp

Filesize
592KB

Download
memory/992-282-0x00000000009F0000-0x0000000000A12000-memory.dmp

Filesize
136KB

Download
memory/992-286-0x0000000001320000-0x00000000013B2000-memory.dmp

Filesize
584KB

Download
memory/992-287-0x0000000001320000-0x00000000013B2000-memory.dmp

Filesize
584KB

Download
memory/992-245-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

Filesize
56KB

Download
memory/992-284-0x00000000009D0000-0x00000000009DC000-memory.dmp

Filesize
48KB

Download
memory/992-244-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

Filesize
56KB

Download
memory/992-240-0x0000000000AC0000-0x0000000000AF4000-memory.dmp

Filesize
208KB

Download
memory/992-243-0x00000000012E0000-0x0000000001304000-memory.dmp

Filesize
144KB

Download
memory/992-242-0x00000000012B0000-0x00000000012D4000-memory.dmp

Filesize
144KB

Download
memory/992-241-0x0000000000FF0000-0x0000000001024000-memory.dmp

Filesize
208KB

Download
memory/1136-59-0x0000000072DE1000-0x0000000072DE3000-memory.dmp

Filesize
8KB

Download
memory/1136-56-0x0000000075691000-0x0000000075693000-memory.dmp

Filesize
8KB

Download
memory/1140-218-0x000007FEEBC20000-0x000007FEEC643000-memory.dmp

Filesize
10.1MB

Download
memory/1160-221-0x00000000700F0000-0x000000007069B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-235-0x000007FEEBC20000-0x000007FEEC643000-memory.dmp

Filesize
10.1MB

Download
memory/1524-112-0x0000000001D70000-0x0000000001D82000-memory.dmp

Filesize
72KB

Download
memory/1536-197-0x00000000716D0000-0x0000000071C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1568-152-0x0000000001D40000-0x0000000001D52000-memory.dmp

Filesize
72KB

Download
memory/1624-150-0x0000000001D60000-0x0000000001D72000-memory.dmp

Filesize
72KB

Download