280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c

Resubmissions

05/10/2022, 19:46

221005-yhfc9sfdc4 1

04/10/2022, 14:21

04/10/2022, 14:14

04/10/2022, 09:53

04/10/2022, 07:58

03/10/2022, 15:56

Analysis

max time kernel
1801s
max time network
1761s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
04/10/2022, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Size

766.3MB
MD5

09ea7e2bef5722cdb9ee37a7dab48ff3
SHA1

d4fb2231f80333b1b50e6f790d3b59eb3ff26374
SHA256

280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c
SHA512

eb9d65e42bccf4b700eb51c3f2890ac80f2e61a04ff661cdc3c173ff85a1f8e7f9e1cf2de89fd3517ca0b106240791f60158a7af12a5395b49e5299b22d3bf38
SSDEEP

12582912:whzb6xxr5Ni69eds1tauM0I7j0LFCLw0FEl1oZ+rPAkIYw+oKj7XkFgMKiLVVKYH:whzb639Ni6agtW7ZwU6+8roYwS7dN2jr

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3028	Setup_x64.exe
3236	Setup_x64.exe
4648	dismhost.exe
392	dismhost.exe
4384	sqlwriter.exe
4988	SQLEXPR_x64_ENU.exe
2976	SETUP.EXE

Registers COM server for autorun 1 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58BC9AD6-BF11-40B3-9AB1-E3F2ED784C08}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\SQL Debugging\\120\\ssdebugps.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92C2E038-C009-4338-9A4D-0011A5801654}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceoledb40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0B3A7B75-A9B0-4580-9AA5-1A7DA47AD1CB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceoledb40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFC260B-B433-47CE-89A2-259BB0805652}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40700425-0080-11d2-851f-00c04fc21759}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D56BDAAB-5093-4EC4-91D2-400B44E06917}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	rundll32.exe

Loads dropped DLL 64 IoCs

pid	Process
3028	Setup_x64.exe
3028	Setup_x64.exe
3028	Setup_x64.exe
3028	Setup_x64.exe
1368	MsiExec.exe
1368	MsiExec.exe
1664	MsiExec.exe
2868	MsiExec.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
1664	MsiExec.exe
1664	MsiExec.exe
1664	MsiExec.exe
1664	MsiExec.exe
1664	MsiExec.exe
2868	MsiExec.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
1664	MsiExec.exe
2868	MsiExec.exe
3176	rundll32.exe
3176	rundll32.exe
3176	rundll32.exe
2868	MsiExec.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
1664	MsiExec.exe
1664	MsiExec.exe
1664	MsiExec.exe
3236	Setup_x64.exe
2868	MsiExec.exe
4368	rundll32.exe
4368	rundll32.exe
4368	rundll32.exe
2868	MsiExec.exe
1956	rundll32.exe
1956	rundll32.exe
1956	rundll32.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe
4648	dismhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{82C52A2E-2B10-4059-821F-248F9CDD76B7} = "\"C:\\Users\\Admin\\Desktop\\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\\Setup_x64.exe\" /cmdloc \"HKCU\\Software\\Seagull Scientific AiTemp\\{82C52A2E-2B10-4059-821F-248F9CDD76B7}\""	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	Setup_x64.exe
File opened (read-only)	\??\O:	Setup_x64.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	Setup_x64.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	Setup_x64.exe
File opened (read-only)	\??\Y:	Setup_x64.exe
File opened (read-only)	\??\W:	Setup_x64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	Setup_x64.exe
File opened (read-only)	\??\V:	Setup_x64.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	Setup_x64.exe
File opened (read-only)	\??\K:	Setup_x64.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	Setup_x64.exe
File opened (read-only)	\??\I:	Setup_x64.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	Setup_x64.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	Setup_x64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	Setup_x64.exe
File opened (read-only)	\??\N:	Setup_x64.exe
File opened (read-only)	\??\G:	Setup_x64.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	Setup_x64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	Setup_x64.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	Setup_x64.exe
File opened (read-only)	\??\Z:	Setup_x64.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\5EA9411076914705A44E58C3064FE37C\AUTORUN.INF	SQLEXPR_x64_ENU.exe
File opened for modification	C:\5EA9411076914705A44E58C3064FE37C\AUTORUN.INF	SQLEXPR_x64_ENU.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\SqlServerSpatial120.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1049\odsole70.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Tools\Binn\Resources\ru-RU\SqlLocalDB.rll.mui	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server\120\LocalDB\Binn\Resources\SqlUserInstance.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\3082\xesospkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1028\xesqlpkg.rll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\sqlvdi.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\x86\sqlcecompact40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\Private\x86\sqlceme40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\3082\xepackage0.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\3082\xplog70.rll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\x86\sqlceca40.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\amd64\Microsoft.VC90.CRT\README_ENU.txt	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\Private\amd64\sqlceca40.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\x86\Microsoft.VC90.CRT\msvcr90.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Desktop\System.Data.SqlServerCe.Entity\System.Data.SqlServerCe.Entity.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1046\odsole70.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1033\xepackage0.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1049\xesqlminpkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\Private\System.Data.SqlServerCe.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Shared\xe.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\90\License Terms\1033\license_SQLWriter.txt	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\xmlrw.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\sqlcecompact40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\hkcompile.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Templates\model.mdf	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1049\sqlevn70.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1042\XPStar.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\License Terms\License_SqlLocalDB_3082.txt	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\amd64\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\pt\sqlaccess.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server\120\LocalDB\Binn\Resources\de-DE\SqlUserInstance.rll.mui	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\ru-RU\SqlUserInstance.rll.mui	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\zh-CN\SqlUserInstance.rll.mui	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\xesqlpkg.mof	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1036\xesqlpkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1036\XPStar.rll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\sqlceoledb40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\sqlceca40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\Desktop\System.Data.SqlServerCe.Entity\System.Data.SqlServerCe.Entity.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1049\msxmlsql.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\ru\sqlaccess.resources.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Tools\Binn\Resources\es-ES\SqlLocalDB.rll.mui	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\sqlservr.exe.config	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\Private\x86\sqlceca40.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server\120\LocalDB\Binn\Resources\fr-FR\SqlUserInstance.rll.mui	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1036\xesospkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server Compact Edition\v4.0\sqlceoledb40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1036\xesqlminpkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1046\XPStar.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\Shared\SqlDumper.exe	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\License Terms\License_SqlLocalDB_1028.txt	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1041\xepackage0.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\sqlscm.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\localdbxeventconfig.xml	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\xesospkg.mof	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\amd64\sqlceca40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1041\msxmlsql.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\2052\xepackage0.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\2052\xplog70.rll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server\80\COM\sqlvdi.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\License Terms\License_SqlLocalDB_1033.txt	msiexec.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v4.0\Private\amd64\sqlceme40.dll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1028\xesospkg.rll	msiexec.exe
File created	C:\Program Files\Microsoft SQL Server\120\LocalDB\Binn\Resources\1041\xplog70.rll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164917630.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\Installer\e6e9474.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6A0.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sort00060101.dll	msiexec.exe
File created	C:\Windows\Installer\e6e9477.msi	msiexec.exe
File created	C:\Windows\Installer\{BAF67399-85CD-4555-9B49-1F80EB921C35}\ARPIco	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164927459.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164917630.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164917630.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_msvcp100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CONFIG\machine.config	MsiExec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC55C.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	caspol.exe
File created	C:\Windows\assembly\tmp\6U8TYYPP\System.Data.SqlServerCe.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164917630.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164927459.0\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB112.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_atl100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164926865.0\9.0.30729.4148.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_msvcp100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config	SETUP.EXE
File created	C:\Windows\Installer\e6e9470.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e6e9470.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004164912177.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004164926865.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1E2.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.new	caspol.exe
File opened for modification	C:\Windows\Installer\{8424B163-D1E0-48B7-88A2-C7A61767B3D7}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99376FABDC585554B994F108BE29C153\12.3.6024\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\Installer\SourceHash{8424B163-D1E0-48B7-88A2-C7A61767B3D7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI981A.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\HYYKYYI2\Microsoft.SqlServerCe.VersionManagement.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5CA.tmp	msiexec.exe
File created	C:\Windows\Tasks\{82C52A2E-2B10-4059-821F-248F9CDD76B7}.job	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164912177.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_069f922e.manifest	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config	MsiExec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004164917630.0	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sort00001000.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\assembly\tmp\132CHPQZ\System.Data.SqlServerCe.Entity.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164912177.0\msvcm90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221004164927459.0	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.new	caspol.exe
File created	C:\Windows\WinSxS\InstallTemp\20221004164926865.0\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config	MsiExec.exe
File created	C:\Windows\Installer\{8424B163-D1E0-48B7-88A2-C7A61767B3D7}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB152.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sort00060101.nlp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\MSIF60A.tmp	msiexec.exe
File created	C:\Windows\Installer\e6e9473.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BAF67399-85CD-4555-9B49-1F80EB921C35}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\ProgID\ = "SSCE.Replication.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D633BDA-F290-4449-BCCF-D51C8CE5FB8A}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361B42480E1D7B84882A7C6A71763B7D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\ProgID\ = "SSCE Active Sync Engine.4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.SQLSERVER.CE.OLEDB.4.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSCE.Params.4.0\CLSID\ = "{CAFC260B-B433-47CE-89A2-259BB0805652}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}\4.0\0\win32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\ = "ISSCEErrors"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SSCE.DropTableListener.4.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\TypeLib\ = "{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\361B42480E1D7B84882A7C6A71763B7D\SQLCECore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}\ProgID\ = "Microsoft.SQLSERVER.CE.OLEDB.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9D633BDA-F290-4449-BCCF-D51C8CE5FB8A}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0BE8963-5BA4-4A11-80E2-CBFB534D4C54}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}\4.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft SQL Server Compact Edition Database File\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceme40.dll,-1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99376FABDC585554B994F108BE29C153\Sql_LocalDB_Loc = "Sql_LocalDB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{798B9084-1221-4281-9CED-89654F2ADF8F}\ProgID\ = "Microsoft.SQLSERVER.CE.OLEDB.4.0.ErrorLookup"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D633BDA-F290-4449-BCCF-D51C8CE5FB8A}\TypeLib\ = "{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\v4.0\\sqlceca40.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BFC4A56-A6DE-475D-85CB-DBC1D2BEE02C}\4.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v4.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\ProgID\ = "MSSQL.VDI.Server.2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{87BC18DE-C8B3-11D5-AE96-00B0D0E93CC1}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{87BC18DE-C8B3-11D5-AE96-00B0D0E93CC1}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.SQLSERVER.CE.OLEDB.4.0.ErrorLookup\ = "Microsoft SQL Server Compact OLE DB Provider for Windows Error Lookup"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0770995-2550-4044-9914-66DE7133B024}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}\ = "Active SSCE Replication Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{289EA71A-F86E-4C9F-B75C-A709CA66D781}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{289EA71A-F86E-4C9F-B75C-A709CA66D781}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{971DE37F-E1E0-49F6-A1BB-D6236DE8B193}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87BC18DF-C8B3-11D5-AE96-00B0D0E93CC1}\ProxyStubClsid32\ = "{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSSQL.VDI.Client.2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b5e7a132-a7bd-11d1-84c2-00c04fc21759}\InprocServer32\ = "C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361B42480E1D7B84882A7C6A71763B7D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\361B42480E1D7B84882A7C6A71763B7D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87BC18DF-C8B3-11D5-AE96-00B0D0E93CC1}\ = "IHostDebugBinary"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B69AB1F3-36CE-4FE7-9994-27E66DCFA4F0}\TypeLib\Version = "4.0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99376FABDC585554B994F108BE29C153\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0BE8963-5BA4-4A11-80E2-CBFB534D4C54}\TypeLib\Version = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{289EA71A-F86E-4C9F-B75C-A709CA66D781}\TypeLib\Version = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSQL.VDI.Client\ = "Microsoft SQL Server Virtual Device Interface for Client"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C0770995-2550-4044-9914-66DE7133B024}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2006C53A-C915-41EA-BAA9-9EAB3A1FBF97}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\ProgID\ = "SSCE.Engine.4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B69AB1F3-36CE-4FE7-9994-27E66DCFA4F0}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{68D45319-3702-4837-9F8E-DA6845D82482}\ = "Active SSCE Engine Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D5B2D4-26A4-44F5-A48B-0FAC3A919ED8}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSSQL.VDI.Client.2\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36228F21-B5C7-4054-8DC2-47D3E236E8B5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3187FC8-7DD9-4F1D-8C6F-ACAF10F32437}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF247883-5C10-48DC-838D-DD5B5DAFBED8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 37006f002100500052002b002400590047003f006d004c0038005b005e002d002c00650043006e00530051004c004300450043006f00720065003e007e002700610061005a003d00250060003d00380048006f00420065002a005100300075006300600000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSSQL.VDI.Server.2\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{87BC18DB-C8B3-11D5-AE96-00B0D0E93CC1}\InprocServer32\ThreadingModel = "Both"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe
1112	msiexec.exe
1112	msiexec.exe
1112	msiexec.exe
1112	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3880	7zG.exe
Token: 35	3880	7zG.exe
Token: SeSecurityPrivilege	3880	7zG.exe
Token: SeSecurityPrivilege	3880	7zG.exe
Token: SeSecurityPrivilege	1112	msiexec.exe
Token: SeCreateTokenPrivilege	3028	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	3028	Setup_x64.exe
Token: SeLockMemoryPrivilege	3028	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	3028	Setup_x64.exe
Token: SeMachineAccountPrivilege	3028	Setup_x64.exe
Token: SeTcbPrivilege	3028	Setup_x64.exe
Token: SeSecurityPrivilege	3028	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	3028	Setup_x64.exe
Token: SeLoadDriverPrivilege	3028	Setup_x64.exe
Token: SeSystemProfilePrivilege	3028	Setup_x64.exe
Token: SeSystemtimePrivilege	3028	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	3028	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	3028	Setup_x64.exe
Token: SeCreatePagefilePrivilege	3028	Setup_x64.exe
Token: SeCreatePermanentPrivilege	3028	Setup_x64.exe
Token: SeBackupPrivilege	3028	Setup_x64.exe
Token: SeRestorePrivilege	3028	Setup_x64.exe
Token: SeShutdownPrivilege	3028	Setup_x64.exe
Token: SeDebugPrivilege	3028	Setup_x64.exe
Token: SeAuditPrivilege	3028	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	3028	Setup_x64.exe
Token: SeChangeNotifyPrivilege	3028	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	3028	Setup_x64.exe
Token: SeUndockPrivilege	3028	Setup_x64.exe
Token: SeSyncAgentPrivilege	3028	Setup_x64.exe
Token: SeEnableDelegationPrivilege	3028	Setup_x64.exe
Token: SeManageVolumePrivilege	3028	Setup_x64.exe
Token: SeImpersonatePrivilege	3028	Setup_x64.exe
Token: SeCreateGlobalPrivilege	3028	Setup_x64.exe
Token: SeCreateTokenPrivilege	3028	Setup_x64.exe
Token: SeAssignPrimaryTokenPrivilege	3028	Setup_x64.exe
Token: SeLockMemoryPrivilege	3028	Setup_x64.exe
Token: SeIncreaseQuotaPrivilege	3028	Setup_x64.exe
Token: SeMachineAccountPrivilege	3028	Setup_x64.exe
Token: SeTcbPrivilege	3028	Setup_x64.exe
Token: SeSecurityPrivilege	3028	Setup_x64.exe
Token: SeTakeOwnershipPrivilege	3028	Setup_x64.exe
Token: SeLoadDriverPrivilege	3028	Setup_x64.exe
Token: SeSystemProfilePrivilege	3028	Setup_x64.exe
Token: SeSystemtimePrivilege	3028	Setup_x64.exe
Token: SeProfSingleProcessPrivilege	3028	Setup_x64.exe
Token: SeIncBasePriorityPrivilege	3028	Setup_x64.exe
Token: SeCreatePagefilePrivilege	3028	Setup_x64.exe
Token: SeCreatePermanentPrivilege	3028	Setup_x64.exe
Token: SeBackupPrivilege	3028	Setup_x64.exe
Token: SeRestorePrivilege	3028	Setup_x64.exe
Token: SeShutdownPrivilege	3028	Setup_x64.exe
Token: SeDebugPrivilege	3028	Setup_x64.exe
Token: SeAuditPrivilege	3028	Setup_x64.exe
Token: SeSystemEnvironmentPrivilege	3028	Setup_x64.exe
Token: SeChangeNotifyPrivilege	3028	Setup_x64.exe
Token: SeRemoteShutdownPrivilege	3028	Setup_x64.exe
Token: SeUndockPrivilege	3028	Setup_x64.exe
Token: SeSyncAgentPrivilege	3028	Setup_x64.exe
Token: SeEnableDelegationPrivilege	3028	Setup_x64.exe
Token: SeManageVolumePrivilege	3028	Setup_x64.exe
Token: SeImpersonatePrivilege	3028	Setup_x64.exe
Token: SeCreateGlobalPrivilege	3028	Setup_x64.exe
Token: SeCreateTokenPrivilege	3028	Setup_x64.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3880	7zG.exe
3028	Setup_x64.exe
3028	Setup_x64.exe
1828	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1368	1112	msiexec.exe	103
PID 1112 wrote to memory of 1368	1112	msiexec.exe	103
PID 1112 wrote to memory of 1368	1112	msiexec.exe	103
PID 3028 wrote to memory of 1828	3028	Setup_x64.exe	104
PID 3028 wrote to memory of 1828	3028	Setup_x64.exe	104
PID 3028 wrote to memory of 1828	3028	Setup_x64.exe	104
PID 1112 wrote to memory of 1664	1112	msiexec.exe	105
PID 1112 wrote to memory of 1664	1112	msiexec.exe	105
PID 1112 wrote to memory of 1664	1112	msiexec.exe	105
PID 1112 wrote to memory of 2868	1112	msiexec.exe	106
PID 1112 wrote to memory of 2868	1112	msiexec.exe	106
PID 2868 wrote to memory of 364	2868	MsiExec.exe	107
PID 2868 wrote to memory of 364	2868	MsiExec.exe	107
PID 2868 wrote to memory of 2860	2868	MsiExec.exe	108
PID 2868 wrote to memory of 2860	2868	MsiExec.exe	108
PID 2868 wrote to memory of 3176	2868	MsiExec.exe	109
PID 2868 wrote to memory of 3176	2868	MsiExec.exe	109
PID 2868 wrote to memory of 3708	2868	MsiExec.exe	110
PID 2868 wrote to memory of 3708	2868	MsiExec.exe	110
PID 1664 wrote to memory of 3236	1664	MsiExec.exe	111
PID 1664 wrote to memory of 3236	1664	MsiExec.exe	111
PID 1664 wrote to memory of 3236	1664	MsiExec.exe	111
PID 2868 wrote to memory of 4368	2868	MsiExec.exe	112
PID 2868 wrote to memory of 4368	2868	MsiExec.exe	112
PID 2868 wrote to memory of 1956	2868	MsiExec.exe	113
PID 2868 wrote to memory of 1956	2868	MsiExec.exe	113
PID 1956 wrote to memory of 5072	1956	rundll32.exe	114
PID 1956 wrote to memory of 5072	1956	rundll32.exe	114
PID 5072 wrote to memory of 4648	5072	dism.exe	116
PID 5072 wrote to memory of 4648	5072	dism.exe	116
PID 1956 wrote to memory of 4576	1956	rundll32.exe	119
PID 1956 wrote to memory of 4576	1956	rundll32.exe	119
PID 4576 wrote to memory of 392	4576	dism.exe	121
PID 4576 wrote to memory of 392	4576	dism.exe	121
PID 1956 wrote to memory of 1516	1956	rundll32.exe	144
PID 1956 wrote to memory of 1516	1956	rundll32.exe	144
PID 1664 wrote to memory of 3452	1664	MsiExec.exe	146
PID 1664 wrote to memory of 3452	1664	MsiExec.exe	146
PID 1664 wrote to memory of 3452	1664	MsiExec.exe	146
PID 1112 wrote to memory of 2772	1112	msiexec.exe	147
PID 1112 wrote to memory of 2772	1112	msiexec.exe	147
PID 1112 wrote to memory of 2772	1112	msiexec.exe	147
PID 1112 wrote to memory of 4244	1112	msiexec.exe	151
PID 1112 wrote to memory of 4244	1112	msiexec.exe	151
PID 1112 wrote to memory of 4244	1112	msiexec.exe	151
PID 1664 wrote to memory of 3584	1664	MsiExec.exe	156
PID 1664 wrote to memory of 3584	1664	MsiExec.exe	156
PID 1664 wrote to memory of 3584	1664	MsiExec.exe	156
PID 1112 wrote to memory of 4600	1112	msiexec.exe	157
PID 1112 wrote to memory of 4600	1112	msiexec.exe	157
PID 1112 wrote to memory of 2168	1112	msiexec.exe	161
PID 1112 wrote to memory of 2168	1112	msiexec.exe	161
PID 2868 wrote to memory of 1712	2868	MsiExec.exe	165
PID 2868 wrote to memory of 1712	2868	MsiExec.exe	165
PID 1712 wrote to memory of 4988	1712	rundll32.exe	167
PID 1712 wrote to memory of 4988	1712	rundll32.exe	167
PID 1712 wrote to memory of 4988	1712	rundll32.exe	167
PID 4988 wrote to memory of 2976	4988	SQLEXPR_x64_ENU.exe	168
PID 4988 wrote to memory of 2976	4988	SQLEXPR_x64_ENU.exe	168
PID 2976 wrote to memory of 4984	2976	SETUP.EXE	170
PID 2976 wrote to memory of 4984	2976	SETUP.EXE	170
PID 2976 wrote to memory of 4956	2976	SETUP.EXE	172
PID 2976 wrote to memory of 4956	2976	SETUP.EXE	172
PID 2976 wrote to memory of 4956	2976	SETUP.EXE	172

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip"
1⤵
PID:1008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4820

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" -spe -an -ai#7zMap23992:164:7zEvent7529
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3880

C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi TRANSFORMS=:3082 AI_SETUPEXEPATH="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1664660019 "
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:1828

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8CA6AC2303D1EFAD563EECE36D7A8B13 C
  2⤵
  - Loads dropped DLL
  PID:1368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 00F8517C704F4195DCC0D852F51254A9 C
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe
    "C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" /groupsextract:103;111; /out:"C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites" /callbackid:1664
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3236
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\SQL Server Compact 4.0\SSCERuntime_x64-ENU.msi" /q /norestart
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\SQL Server LocalDB 2014 SP3\SqlLocalDB_x64.msi" /qn /norestart IACCEPTSQLLOCALDBLICENSETERMS=YES
    3⤵
    PID:3584
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 952C9D0D1847C7BCB2EE1E08A340925C C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241078218 2 CustomActions!CustomActions.CustomActions.SilentInstallProperties
    3⤵
    - Loads dropped DLL
    PID:364
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE266.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241099453 74 CustomActions!CustomActions.CustomActions.ForceUpgradeProperty
    3⤵
    - Loads dropped DLL
    PID:2860
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE882.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241101000 79 CustomActions!CustomActions.CustomActions.SetInstalledVersion
    3⤵
    - Loads dropped DLL
    PID:3176
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241106609 84 CustomActions!CustomActions.CustomActions.InstallOptions
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3708
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB761.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241153906 338 CustomActions!CustomActions.CustomActions.ExtractSQLExpress
    3⤵
    - Loads dropped DLL
    PID:4368
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF739.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241171859 348 CustomActions!CustomActions.CustomActions.WindowsOptionalFeatures
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\system32\dism.exe
      "C:\Windows\system32\dism.exe" /Online /Get-Features /Format:Table
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\BF52994D-1AB2-4384-8FFE-077FF1B21897\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\BF52994D-1AB2-4384-8FFE-077FF1B21897\dismhost.exe {5D6C79A2-D1DF-4865-A894-5B6737523B14}
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:4648
  - - C:\Windows\system32\dism.exe
      "C:\Windows\system32\dism.exe" /Online /Enable-Feature /FeatureName:MSMQ-Container /FeatureName:MSMQ-Server /All /NoRestart
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\5387B202-98CF-4958-9B4D-2D9D5BC6CE5E\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\5387B202-98CF-4958-9B4D-2D9D5BC6CE5E\dismhost.exe {1A0B55FF-B093-4232-9549-DEEA9D1A15B0}
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:392
  - - C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ServiceModelReg.exe" -r
      4⤵
      PID:1516
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4D3D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242240828 1458 CustomActions!CustomActions.CustomActions.InstallSQLExpress
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\SQLEXPR_x64_ENU.exe
      "C:\Users\Admin\AppData\Local\Temp\SQLEXPR_x64_ENU.exe" /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage
      4⤵
      Executes dropped EXE
      Drops autorun.inf file
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\5EA9411076914705A44E58C3064FE37C\SETUP.EXE
        
        C:\5EA9411076914705A44E58C3064FE37C\SETUP.EXE /q /ACTION=Install /FEATURES=SQLEngine,FullText /INSTANCENAME=BarTender /SQLSYSADMINACCOUNTS="Builtin\Administrators" "NT AUTHORITY\SYSTEM" /SQLSVCACCOUNT="NT AUTHORITY\SYSTEM" /ADDCURRENTUSERASSQLADMIN /TCPENABLED=1 /IACCEPTSQLSERVERLICENSETERMS /HIDECONSOLE /SkipInstallerRunCheck /UpdateEnabled=0 /SKIPRULES=RebootRequiredCheck SetupCompatibilityCheck NoRebootPackage
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe
        
        -b
        6⤵
        Drops file in Windows directory
        
        PID:4984
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        
        -b
        6⤵
        Drops file in Windows directory
        
        PID:4956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 28CF76F0229EA39355567552C8A8058C
  2⤵
  PID:2772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24DDA5D51A8A74EF3FBA32B525CFE0F1 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  PID:4244
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6CCA8A090EC361B7629E1C24FE8639F3
  2⤵
  PID:4600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F07A9DB1DED9FD369B13AEA46BFD031F E Global\MSI0000
  2⤵
  PID:2168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4572

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1796

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4808" "1468" "2060" "1904" "0" "0" "1452" "1340" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4356

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
1⤵
- Executes dropped EXE
PID:4384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\3082.dll

Filesize
120KB

MD5
a96297c0b3816788f2a8f930c6e9dcf4

SHA1
307b132d720b1b03ecfb96afa1808fd367ed702b

SHA256
fd9fd341073d906645eed1eff1eb53144af5109c73b26a8f9e56de7be82c81ed

SHA512
7897427df575d4c22d2980aea40d37b891ed416b101b697b4b161b3ddb5005671c74e34722052d3cc7f9b3f742100db8065eb0a8259ab2ec6fb69282b852c84a

Download Submit
C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\3082.dll

Filesize
120KB

MD5
a96297c0b3816788f2a8f930c6e9dcf4

SHA1
307b132d720b1b03ecfb96afa1808fd367ed702b

SHA256
fd9fd341073d906645eed1eff1eb53144af5109c73b26a8f9e56de7be82c81ed

SHA512
7897427df575d4c22d2980aea40d37b891ed416b101b697b4b161b3ddb5005671c74e34722052d3cc7f9b3f742100db8065eb0a8259ab2ec6fb69282b852c84a

Download Submit
C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi

Filesize
194.7MB

MD5
cb89850ee9cf83015f30d1df61e97b2a

SHA1
7ebd4b6e0636cc209ed8bc4ac1c1195459dfbab4

SHA256
b8ac3b3c1a2c80ee17c6f8678d6777547477bb726ef7914fac14e2d7f331ba19

SHA512
144272199c96c4eab27a3ad18e1995806d6c439dc00222a7b92979bd5343b422663e6421f68720ffae68a91a8bf1a6f207f6f62126678ee6c83c259fdfc77e24

Download Submit
C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
00bfeb783aeff425ce898d55718d506d

SHA1
aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f

SHA256
d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580

SHA512
2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8398.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8398.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI87DF.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI87DF.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8E63.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8E63.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F1F.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI980E.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI980E.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9858.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9858.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9A5C.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9A5C.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9B2C.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9B2C.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9B5C.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9B5C.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB761.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB761.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB761.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID95A.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID95A.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDBDC.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDBDC.tmp

Filesize
834KB

MD5
b0b2090c4200fb19e335598969a40f26

SHA1
e31d5533f85ef03dd8eb21723df14ff71586bb60

SHA256
e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd

SHA512
177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDF58.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDF58.tmp

Filesize
525KB

MD5
1c62521f4ade74fe465aaf61049c3634

SHA1
758bd079f98c5f1153213a4c78ee25f89eb64fa6

SHA256
ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e

SHA512
4b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE266.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE266.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE266.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE266.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE266.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE7A7.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE7A7.tmp

Filesize
376KB

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE882.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE882.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE882.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE882.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE882.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp

Filesize
780KB

MD5
5ef8fd841c7b39882d909df4b6806db9

SHA1
80cdb05c335fa083262dcccf1ee9930dbf60b139

SHA256
7f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4

SHA512
591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\CustomActions.dll

Filesize
54KB

MD5
9793eda103b3ce9cbff0f08e7353e104

SHA1
c9808ac631aafb99c1350709c904672ea4dc90f9

SHA256
ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa

SHA512
a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\Seagull.InstallWizard.dll

Filesize
372KB

MD5
3061145ea0c0c8378e3d7e678b54eb51

SHA1
432c8f861f196739291b642bb3249b5f08bd5db4

SHA256
7da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d

SHA512
621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFE8C.tmp-\es\Seagull.InstallWizard.resources.dll

Filesize
40KB

MD5
7ce120ec6246d303dee35292b74b90f2

SHA1
cc4a8a188d99c1fa57e7af8709d38031e9630f2c

SHA256
db9273aa7f07d249947b1d64b80c7fe57385fb357783c6c48c01dac1b94e1215

SHA512
5d6b80a7585bfc7942a019125e872eef4a88bb8ec8141456fee116e05b26711ada5d24f129480a14c6e63ad90b5afcb2b6ba39571ac17b9d5b4213a2f1dd8a80

Download Submit
C:\Users\Admin\AppData\Roaming\Seagull\BarTender\prerequisites\decoder.dll

Filesize
182KB

MD5
fc136d5c16573d1d1a64b0a62b586235

SHA1
8363d0d80fb25e4ace7b77efcfe119b7675913a1

SHA256
5a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf

SHA512
0ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe

Filesize
763.6MB

MD5
143d94d5593d64dfd6f5ba8d15137413

SHA1
43af1f03e1dae86f0208369385fb0af8a487ffb9

SHA256
0c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce

SHA512
1a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455

Download Submit
memory/364-160-0x000001EAE2F40000-0x000001EAE3042000-memory.dmp

Filesize
1.0MB

Download
memory/364-161-0x000001EAC91F0000-0x000001EAC9CB1000-memory.dmp

Filesize
10.8MB

Download
memory/364-153-0x000001EAC9CF0000-0x000001EAC9D1E000-memory.dmp

Filesize
184KB

Download
memory/364-156-0x000001EAC9D20000-0x000001EAC9D32000-memory.dmp

Filesize
72KB

Download
memory/364-159-0x000001EAE2130000-0x000001EAE218E000-memory.dmp

Filesize
376KB

Download
memory/1112-237-0x000001ADA9430000-0x000001ADA948F000-memory.dmp

Filesize
380KB

Download
memory/1112-231-0x000001ADAA530000-0x000001ADAA570000-memory.dmp

Filesize
256KB

Download
memory/1112-232-0x000001ADACF20000-0x000001ADACF96000-memory.dmp

Filesize
472KB

Download
memory/1112-233-0x000001ADA9CE0000-0x000001ADA9CEE000-memory.dmp

Filesize
56KB

Download
memory/1712-240-0x00000253D8DE0000-0x00000253D98A1000-memory.dmp

Filesize
10.8MB

Download
memory/1712-242-0x00000253D8DE0000-0x00000253D98A1000-memory.dmp

Filesize
10.8MB

Download
memory/1956-224-0x0000013D8CBC0000-0x0000013D8D681000-memory.dmp

Filesize
10.8MB

Download
memory/1956-222-0x0000013D8CBC0000-0x0000013D8D681000-memory.dmp

Filesize
10.8MB

Download
memory/1956-228-0x0000013D8CBC0000-0x0000013D8D681000-memory.dmp

Filesize
10.8MB

Download
memory/2860-179-0x0000023332BA0000-0x0000023333661000-memory.dmp

Filesize
10.8MB

Download
memory/3176-188-0x0000015F8DE50000-0x0000015F8E911000-memory.dmp

Filesize
10.8MB

Download
memory/3176-189-0x0000015F8DE50000-0x0000015F8E911000-memory.dmp

Filesize
10.8MB

Download
memory/3708-194-0x000002C0B3BA0000-0x000002C0B4661000-memory.dmp

Filesize
10.8MB

Download
memory/3708-203-0x000002C0B3BA0000-0x000002C0B4661000-memory.dmp

Filesize
10.8MB

Download
memory/3708-202-0x000002C0B3BA0000-0x000002C0B4661000-memory.dmp

Filesize
10.8MB

Download
memory/4368-219-0x0000017FAE5D0000-0x0000017FAF091000-memory.dmp

Filesize
10.8MB

Download
memory/4368-218-0x0000017FAE5D0000-0x0000017FAF091000-memory.dmp

Filesize
10.8MB

Download
memory/4368-217-0x0000017FAE5D0000-0x0000017FAF091000-memory.dmp

Filesize
10.8MB

Download
memory/4956-247-0x0000000071CD0000-0x0000000072281000-memory.dmp

Filesize
5.7MB

Download
memory/4956-248-0x0000000071CD0000-0x0000000072281000-memory.dmp

Filesize
5.7MB

Download
memory/4984-245-0x00007FFDCE970000-0x00007FFDCF3A6000-memory.dmp

Filesize
10.2MB

Download