d314cbad13af12a9bcc3178b54b78d477a1f3e7dc49f562d3a0b2e87e1387539

Analysis

max time kernel
218s
max time network
141s
platform
windows11_x64
resource
win11
submitted
15-10-2021 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.msi
Size

279KB
MD5

996ed694f0957931dd986e12ad361aea
SHA1

7a7577b960d8025a97e49ebe03ae8cc0b936b697
SHA256

d314cbad13af12a9bcc3178b54b78d477a1f3e7dc49f562d3a0b2e87e1387539
SHA512

4c9310ce8cfb1a92a575fd95256726ee9602a5596e93b89bf8d87743b1a048bb9e3425d8decd803b3e0cb41068fe2a24d433c3b56760c9fc31fa1a6974a91ff8

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

MsiExec.exe

flow pid process

21 2496 MsiExec.exe
28 2496 MsiExec.exe
Executes dropped EXE 1 IoCs

Processes:

SGvwcAWceb.exe

pid process

5096 SGvwcAWceb.exe

flow	pid	process
21	2496	MsiExec.exe
28	2496	MsiExec.exe

pid	process
5096	SGvwcAWceb.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeSGvwcAWceb.exe

pid	process
2496	MsiExec.exe
2496	MsiExec.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{82FA035E-0995-43C9-BDE2-BDC2B0C71F38}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC09D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f73bb0d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC46.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE5A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6AA73351CC263121.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCDE9CBDC3727A6E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB3D17B1148D8CDDC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC509F9856316E272.TMP	msiexec.exe
File created	C:\Windows\Installer\f73bb0d.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4252 schtasks.exe

pid	process
4252	schtasks.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

sihclient.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msiexec.exeSGvwcAWceb.exe

pid	process
2540	msiexec.exe
2540	msiexec.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

svchost.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeSystemtimePrivilege	3776	svchost.exe
Token: SeShutdownPrivilege	4952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4952	msiexec.exe
Token: SeSystemtimePrivilege	3776	svchost.exe
Token: SeIncBasePriorityPrivilege	3776	svchost.exe
Token: SeSecurityPrivilege	2540	msiexec.exe
Token: SeCreateTokenPrivilege	4952	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4952	msiexec.exe
Token: SeLockMemoryPrivilege	4952	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4952	msiexec.exe
Token: SeMachineAccountPrivilege	4952	msiexec.exe
Token: SeTcbPrivilege	4952	msiexec.exe
Token: SeSecurityPrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeLoadDriverPrivilege	4952	msiexec.exe
Token: SeSystemProfilePrivilege	4952	msiexec.exe
Token: SeSystemtimePrivilege	4952	msiexec.exe
Token: SeProfSingleProcessPrivilege	4952	msiexec.exe
Token: SeIncBasePriorityPrivilege	4952	msiexec.exe
Token: SeCreatePagefilePrivilege	4952	msiexec.exe
Token: SeCreatePermanentPrivilege	4952	msiexec.exe
Token: SeBackupPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeShutdownPrivilege	4952	msiexec.exe
Token: SeDebugPrivilege	4952	msiexec.exe
Token: SeAuditPrivilege	4952	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4952	msiexec.exe
Token: SeChangeNotifyPrivilege	4952	msiexec.exe
Token: SeRemoteShutdownPrivilege	4952	msiexec.exe
Token: SeUndockPrivilege	4952	msiexec.exe
Token: SeSyncAgentPrivilege	4952	msiexec.exe
Token: SeEnableDelegationPrivilege	4952	msiexec.exe
Token: SeManageVolumePrivilege	4952	msiexec.exe
Token: SeImpersonatePrivilege	4952	msiexec.exe
Token: SeCreateGlobalPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe
Token: SeRestorePrivilege	2540	msiexec.exe
Token: SeTakeOwnershipPrivilege	2540	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4952 msiexec.exe
4952 msiexec.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SGvwcAWceb.exe

pid process

5096 SGvwcAWceb.exe
5096 SGvwcAWceb.exe

pid	process
4952	msiexec.exe
4952	msiexec.exe

pid	process
5096	SGvwcAWceb.exe
5096	SGvwcAWceb.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

msiexec.exeMsiExec.exeSGvwcAWceb.execmd.exe

description	pid	process	target process
PID 2540 wrote to memory of 2496	2540	msiexec.exe	MsiExec.exe
PID 2540 wrote to memory of 2496	2540	msiexec.exe	MsiExec.exe
PID 2540 wrote to memory of 2496	2540	msiexec.exe	MsiExec.exe
PID 2496 wrote to memory of 5096	2496	MsiExec.exe	SGvwcAWceb.exe
PID 2496 wrote to memory of 5096	2496	MsiExec.exe	SGvwcAWceb.exe
PID 2496 wrote to memory of 5096	2496	MsiExec.exe	SGvwcAWceb.exe
PID 5096 wrote to memory of 3988	5096	SGvwcAWceb.exe	cmd.exe
PID 5096 wrote to memory of 3988	5096	SGvwcAWceb.exe	cmd.exe
PID 5096 wrote to memory of 3988	5096	SGvwcAWceb.exe	cmd.exe
PID 3988 wrote to memory of 4252	3988	cmd.exe	schtasks.exe
PID 3988 wrote to memory of 4252	3988	cmd.exe	schtasks.exe
PID 3988 wrote to memory of 4252	3988	cmd.exe	schtasks.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4952

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv 5cJdBqz8IEWF3cnbfLhqjQ.0
1⤵
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4736

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv bIwyp2o330q1fggh9KFnew.0.2
1⤵
- Modifies data under HKEY_USERS
PID:4672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CE081B2A54CD2C4D7BC01FB237566C0C
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496

C:\Users\Admin\IGBDSGYO.microsoft\SGvwcAWceb.exe
"C:\Users\Admin\IGBDSGYO.microsoft\SGvwcAWceb.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /C schtasks /CREATE /TN "update-kl " /TR C:\\Users\Admin\IGBDSGYO.microsoft\SGvwcAWceb.exe /SC minute /MO 2 /IT /RU %USERNAME%
4⤵
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "update-kl " /TR C:\\Users\Admin\IGBDSGYO.microsoft\SGvwcAWceb.exe /SC minute /MO 2 /IT /RU Admin
5⤵
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\IGBDSGYO.microsoft\Core.dll
MD5
8198bb1b12b41a286c7bbfa51fc45e46

SHA1
6c954fea8676904c0999f179bab8067896e9a14a

SHA256
d37968ee7da25c83b9417218249d13a3cd177d8f30e012246a0ac4e32a307c77

SHA512
a385332fdfa5d032283624cbf2e56f9b3618bac3a6b2cd96a0ce3923ebde8db5e27694d25f6d0ff22c1baa2ad458c12584ca3e067762e021f99479f9e732d703

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\Core.dll
MD5
8198bb1b12b41a286c7bbfa51fc45e46

SHA1
6c954fea8676904c0999f179bab8067896e9a14a

SHA256
d37968ee7da25c83b9417218249d13a3cd177d8f30e012246a0ac4e32a307c77

SHA512
a385332fdfa5d032283624cbf2e56f9b3618bac3a6b2cd96a0ce3923ebde8db5e27694d25f6d0ff22c1baa2ad458c12584ca3e067762e021f99479f9e732d703

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\Host.hst
MD5
636751d2275aa408143eee52e57ceabd

SHA1
40ed9674b1f954c97da18d21892288e0f52683b3

SHA256
bb6c1fe37ab3f9e348aca3c969e1b3ba7c7134d5cea912c9c0c3f3795122de0c

SHA512
1768518400f40bfbdf75146bf3f9e55538956dac3f0320b1152d2ef1fc7ec050f4248241601682922e5ce9d474a69fdc0445c2d3d9af0387b07bdc4dc828b0da

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\SGvwcAWceb.exe
MD5
113badfe1404cd59640cad6b409acb98

SHA1
2621f79b2143ae3704e814756e01d326d5145a5a

SHA256
35a42f9ea63f72cda8a6c7af60a3fac081154128cba2bf7a7392d85383b6d18a

SHA512
f861e831b8311094e32071191585eaceaa512d2bc42096e243a1f94309546614cd788231ce08484039bc70c41824f6c6055b9add233b4793a79f3f399b3cbafb

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\SGvwcAWceb.exe
MD5
113badfe1404cd59640cad6b409acb98

SHA1
2621f79b2143ae3704e814756e01d326d5145a5a

SHA256
35a42f9ea63f72cda8a6c7af60a3fac081154128cba2bf7a7392d85383b6d18a

SHA512
f861e831b8311094e32071191585eaceaa512d2bc42096e243a1f94309546614cd788231ce08484039bc70c41824f6c6055b9add233b4793a79f3f399b3cbafb

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\VoiceRemover.dll
MD5
f82d4f0dae5b9fec3a2c9eda117a3e7d

SHA1
a85ecba1354fa9fe9c1df86ecd0f6c4f97fb55c5

SHA256
81f82b73951aadbf02acc849bf0f262e74c0b274db73a188e2016154f0bff0e5

SHA512
d2eb4b2d54666dada213fbd67ef92d980b180fc10f29e044fb1c0ff6adb74d7be412ef20a902a8c8deab5ba6dcf55c846de13cf40cd27f5baefac3663944c0cb

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\VoiceRemover.dll
MD5
f82d4f0dae5b9fec3a2c9eda117a3e7d

SHA1
a85ecba1354fa9fe9c1df86ecd0f6c4f97fb55c5

SHA256
81f82b73951aadbf02acc849bf0f262e74c0b274db73a188e2016154f0bff0e5

SHA512
d2eb4b2d54666dada213fbd67ef92d980b180fc10f29e044fb1c0ff6adb74d7be412ef20a902a8c8deab5ba6dcf55c846de13cf40cd27f5baefac3663944c0cb

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bass.dll
MD5
c0b11a7e60f69241ddcb278722ab962f

SHA1
ff855961eb5ed8779498915bab3d642044fc9bb1

SHA256
a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021

SHA512
cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bass.dll
MD5
c0b11a7e60f69241ddcb278722ab962f

SHA1
ff855961eb5ed8779498915bab3d642044fc9bb1

SHA256
a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021

SHA512
cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bass_fx.dll
MD5
ea245b00b9d27ef2bd96548a50a9cc2c

SHA1
8463fdcdd5ced10c519ee0b406408ae55368e094

SHA256
4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3

SHA512
ef1e107571402925ab5b1d9b096d7ceff39c1245a23692a3976164d0de0314f726cca0cb10246fe58a13618fd5629a92025628373b3264153fc1d79b0415d9a7

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bass_fx.dll
MD5
ea245b00b9d27ef2bd96548a50a9cc2c

SHA1
8463fdcdd5ced10c519ee0b406408ae55368e094

SHA256
4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3

SHA512
ef1e107571402925ab5b1d9b096d7ceff39c1245a23692a3976164d0de0314f726cca0cb10246fe58a13618fd5629a92025628373b3264153fc1d79b0415d9a7

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassenc.dll
MD5
55bb778fba7c0e7680d9536c26faff11

SHA1
228b4cc2e25ab11d6d17511d2dcf54481589777c

SHA256
71b779210d17cb75342fd229c6355a833927a76a9de3face5b88b3b18c345133

SHA512
be4089ceb47469d1d89707eb5ae79fb474a505886bcd83c662ebd6ac9cae92cc03b9689cb937c5df5862e6c3f1e0495e5011d59521a910dd3277527ac424c155

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassenc.dll
MD5
55bb778fba7c0e7680d9536c26faff11

SHA1
228b4cc2e25ab11d6d17511d2dcf54481589777c

SHA256
71b779210d17cb75342fd229c6355a833927a76a9de3face5b88b3b18c345133

SHA512
be4089ceb47469d1d89707eb5ae79fb474a505886bcd83c662ebd6ac9cae92cc03b9689cb937c5df5862e6c3f1e0495e5011d59521a910dd3277527ac424c155

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassmidi.dll
MD5
d0a54eb738b9820b51ed73d72feb07ef

SHA1
8946aa2c6f58cd13746ce42ede3b57fda262c6e0

SHA256
a008e8fd7dec540c7d1d90e89dedaa3760902cb9a2d87bfc32af29efc7228e95

SHA512
f74eb0522a1a5aeb2208485007fb1ee8ef537bc4fd739a10c597c37a2bf72ba0c1c8ad332aa3387f7eaef8bca20b9861f771af049ec18d6aafc7c2399523f91c

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassmidi.dll
MD5
d0a54eb738b9820b51ed73d72feb07ef

SHA1
8946aa2c6f58cd13746ce42ede3b57fda262c6e0

SHA256
a008e8fd7dec540c7d1d90e89dedaa3760902cb9a2d87bfc32af29efc7228e95

SHA512
f74eb0522a1a5aeb2208485007fb1ee8ef537bc4fd739a10c597c37a2bf72ba0c1c8ad332aa3387f7eaef8bca20b9861f771af049ec18d6aafc7c2399523f91c

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassmidi.dll
MD5
d0a54eb738b9820b51ed73d72feb07ef

SHA1
8946aa2c6f58cd13746ce42ede3b57fda262c6e0

SHA256
a008e8fd7dec540c7d1d90e89dedaa3760902cb9a2d87bfc32af29efc7228e95

SHA512
f74eb0522a1a5aeb2208485007fb1ee8ef537bc4fd739a10c597c37a2bf72ba0c1c8ad332aa3387f7eaef8bca20b9861f771af049ec18d6aafc7c2399523f91c

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassmix.dll
MD5
2358e10faa66a1c38caf7c3bcecf3386

SHA1
17a05b02fbb619a874996c32267fb49a19335eb4

SHA256
b0197e1bae8448c4e334e1e8706be354d79b3a700860e9c2589905fb74b8672a

SHA512
6801931659430be3996686a7466bb9dc2692499521b6d165cd1002616609833d119d17c30b1ba7fae50e8ca95bda5961115eee4ed47db25e0e69f423562f2eeb

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\bassmix.dll
MD5
2358e10faa66a1c38caf7c3bcecf3386

SHA1
17a05b02fbb619a874996c32267fb49a19335eb4

SHA256
b0197e1bae8448c4e334e1e8706be354d79b3a700860e9c2589905fb74b8672a

SHA512
6801931659430be3996686a7466bb9dc2692499521b6d165cd1002616609833d119d17c30b1ba7fae50e8ca95bda5961115eee4ed47db25e0e69f423562f2eeb

Download Submit
C:\Users\Admin\IGBDSGYO.microsoft\win_sparkle_check_update_with_ui_and_install
MD5
aca8cda74e0853bb17c9378060be5493

SHA1
14f76ba9e4c8547b8fb28ea27d907ae000dd5220

SHA256
2903a54f02576e3ceae76617ce4c169502cb53de2f62d9bd05bcd56a292343c9

SHA512
3b03fd5ddb0b2320b773208bd1e6ab8c0cdf6628ea8793ef1fa440b025af5168ef2ebf3178765fe1de0d49d479fae9a00ccff681351f32e5a8371cf1db7d3540

Download Submit
C:\Windows\Installer\MSIBC46.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSIBC46.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSIBE5A.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSIBE5A.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
memory/2496-154-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/2496-155-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/2496-153-0x0000000000000000-mapping.dmp

Download
memory/2540-149-0x0000022EBA950000-0x0000022EBA952000-memory.dmp

Filesize
8KB

Download
memory/2540-148-0x0000022EBA950000-0x0000022EBA952000-memory.dmp

Filesize
8KB

Download
memory/3988-251-0x0000000000000000-mapping.dmp

Download
memory/4252-252-0x0000000000000000-mapping.dmp

Download
memory/4736-151-0x00000242941B0000-0x00000242941C0000-memory.dmp

Filesize
64KB

Download
memory/4736-152-0x00000242943E0000-0x00000242943E4000-memory.dmp

Filesize
16KB

Download
memory/4736-150-0x0000024293F60000-0x0000024293F70000-memory.dmp

Filesize
64KB

Download
memory/4952-146-0x0000024E38B10000-0x0000024E38B12000-memory.dmp

Filesize
8KB

Download
memory/4952-147-0x0000024E38B10000-0x0000024E38B12000-memory.dmp

Filesize
8KB

Download
memory/5096-194-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/5096-211-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/5096-183-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-184-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-185-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/5096-186-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-187-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-188-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/5096-189-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-190-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-192-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-191-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/5096-193-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-181-0x0000000072A10000-0x0000000072A1C000-memory.dmp

Filesize
48KB

Download
memory/5096-195-0x0000000002BC0000-0x0000000002BC4000-memory.dmp

Filesize
16KB

Download
memory/5096-197-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/5096-198-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-199-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/5096-200-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-196-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-202-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/5096-203-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-201-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-204-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-206-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-205-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/5096-207-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-208-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/5096-209-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-210-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-212-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-182-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/5096-213-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-214-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/5096-216-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-215-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-217-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/5096-218-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-219-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-220-0x00000000034B0000-0x00000000034B1000-memory.dmp

Filesize
4KB

Download
memory/5096-221-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-223-0x00000000034C0000-0x00000000034C1000-memory.dmp

Filesize
4KB

Download
memory/5096-224-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-222-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-225-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-226-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/5096-227-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-228-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-229-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/5096-230-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-231-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-233-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-232-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/5096-234-0x00000000030C0000-0x0000000003200000-memory.dmp

Filesize
1.2MB

Download
memory/5096-235-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/5096-244-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/5096-245-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/5096-180-0x0000000002B00000-0x0000000002B18000-memory.dmp

Filesize
96KB

Download
memory/5096-248-0x0000000004EA1000-0x00000000052DF000-memory.dmp

Filesize
4.2MB

Download
memory/5096-249-0x0000000004E30000-0x0000000004E75000-memory.dmp

Filesize
276KB

Download
memory/5096-250-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/5096-179-0x0000000072A20000-0x0000000072A70000-memory.dmp

Filesize
320KB

Download
memory/5096-178-0x0000000000F71000-0x0000000001243000-memory.dmp

Filesize
2.8MB

Download
memory/5096-160-0x0000000000000000-mapping.dmp

Download