hawkeye | 7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

Analysis

max time kernel
249s
max time network
240s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
Size

1021KB
MD5

b227e39632a6e762d314a52e11371f4d
SHA1

6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d
SHA256

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059
SHA512

a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39
SSDEEP

12288:i17xZdTqvTCSF1QLvRRXuAwmOk19nvPDRWMmOeaed6st7Cenls8aWKNALFXeBQjk:iLX4p1QLv/+fmHDRBrHG6sYwBXeF9KX

Score

10^/10

hawkeye collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
importsapeangineer@gmail.com
Password:
collins123

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/1796-135-0x0000000000400000-0x00000000004F0000-memory.dmp	MailPassView
behavioral2/memory/3152-148-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/3152-149-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3152-151-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3152-152-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1796-135-0x0000000000400000-0x00000000004F0000-memory.dmp	WebBrowserPassView
behavioral2/memory/3004-191-0x0000000000000000-mapping.dmp	WebBrowserPassView
behavioral2/memory/3004-192-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral2/memory/3004-195-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral2/memory/3004-199-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral2/memory/3004-202-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView

Nirsoft 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1796-135-0x0000000000400000-0x00000000004F0000-memory.dmp	Nirsoft
behavioral2/memory/3152-148-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/3152-149-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3152-151-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3152-152-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3004-191-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/3004-192-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/3004-195-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/3004-199-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/3004-202-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/208-246-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/208-247-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral2/memory/208-249-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral2/memory/208-251-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral2/memory/4900-300-0x0000000000400000-0x000000000044F000-memory.dmp	Nirsoft
behavioral2/memory/4900-299-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/4900-302-0x0000000000400000-0x000000000044F000-memory.dmp	Nirsoft
behavioral2/memory/4900-304-0x0000000000400000-0x000000000044F000-memory.dmp	Nirsoft

Executes dropped EXE 64 IoCs

Processes:

BrokerInfrastructure.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeBrokerInfrastructure.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exe

pid	process
5024	BrokerInfrastructure.exe
3920	AudioEndpointBuilder.exe
3340	AudioEndpointBuilder.exe
2508	BrokerInfrastructure.exe
3960	AudioEndpointBuilder.exe
2464	AudioEndpointBuilder.exe
5112	AudioEndpointBuilder.exe
4568	AudioEndpointBuilder.exe
2468	AudioEndpointBuilder.exe
2472	AudioEndpointBuilder.exe
4260	AudioEndpointBuilder.exe
1436	AudioEndpointBuilder.exe
3860	AudioEndpointBuilder.exe
2432	AudioEndpointBuilder.exe
4252	AudioEndpointBuilder.exe
1364	AudioEndpointBuilder.exe
1692	AudioEndpointBuilder.exe
5072	AudioEndpointBuilder.exe
3792	AudioEndpointBuilder.exe
1756	AudioEndpointBuilder.exe
4940	AudioEndpointBuilder.exe
3352	AudioEndpointBuilder.exe
928	AudioEndpointBuilder.exe
1168	AudioEndpointBuilder.exe
2692	AudioEndpointBuilder.exe
4560	AudioEndpointBuilder.exe
2184	AudioEndpointBuilder.exe
4812	AudioEndpointBuilder.exe
5020	AudioEndpointBuilder.exe
1232	AudioEndpointBuilder.exe
904	AudioEndpointBuilder.exe
4348	AudioEndpointBuilder.exe
2124	AudioEndpointBuilder.exe
524	AudioEndpointBuilder.exe
4708	AudioEndpointBuilder.exe
4748	AudioEndpointBuilder.exe
5088	AudioEndpointBuilder.exe
4356	AudioEndpointBuilder.exe
2724	AudioEndpointBuilder.exe
1536	AudioEndpointBuilder.exe
3112	AudioEndpointBuilder.exe
2668	AudioEndpointBuilder.exe
4300	AudioEndpointBuilder.exe
1052	AudioEndpointBuilder.exe
1240	AudioEndpointBuilder.exe
856	AudioEndpointBuilder.exe
1696	AudioEndpointBuilder.exe
3212	AudioEndpointBuilder.exe
1124	AudioEndpointBuilder.exe
5016	AudioEndpointBuilder.exe
4076	AudioEndpointBuilder.exe
860	AudioEndpointBuilder.exe
2712	AudioEndpointBuilder.exe
4140	AudioEndpointBuilder.exe
1548	AudioEndpointBuilder.exe
2984	AudioEndpointBuilder.exe
1332	AudioEndpointBuilder.exe
1428	AudioEndpointBuilder.exe
4780	AudioEndpointBuilder.exe
1176	AudioEndpointBuilder.exe
960	AudioEndpointBuilder.exe
3216	AudioEndpointBuilder.exe
1116	AudioEndpointBuilder.exe
3296	AudioEndpointBuilder.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BrokerInfrastructure.exeAudioEndpointBuilder.exe7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	BrokerInfrastructure.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	AudioEndpointBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 whatismyipaddress.com
38 whatismyipaddress.com

flow	ioc
35	whatismyipaddress.com
38	whatismyipaddress.com

Suspicious use of SetThreadContext 64 IoCs

Processes:

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exeAudioEndpointBuilder.exe

description	pid	process	target process
PID 3616 set thread context of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 1796 set thread context of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 3920 set thread context of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2468	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2472	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1796 set thread context of 3004	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 3920 set thread context of 4260	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1436	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 3860	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2432	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4252	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1364	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1692	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 5072	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 3792	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1756	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4940	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1796 set thread context of 208	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 3920 set thread context of 3352	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 928	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1168	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2692	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4560	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2184	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4812	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 5020	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1232	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 904	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1796 set thread context of 4900	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 3920 set thread context of 4348	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2124	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 524	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4708	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4748	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 5088	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4356	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2724	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1536	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 3112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2668	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4300	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1052	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1240	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 856	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1696	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 3212	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1124	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 5016	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4076	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 860	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2712	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4140	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1548	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 2984	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1332	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1428	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 4780	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 1176	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 set thread context of 3216	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exeBrokerInfrastructure.exe7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

pid	process
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
5024	BrokerInfrastructure.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
5024	BrokerInfrastructure.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
5024	BrokerInfrastructure.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
5024	BrokerInfrastructure.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
5024	BrokerInfrastructure.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exeBrokerInfrastructure.exe7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exeAudioEndpointBuilder.exeBrokerInfrastructure.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
Token: SeDebugPrivilege	5024	BrokerInfrastructure.exe
Token: SeDebugPrivilege	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
Token: SeDebugPrivilege	3920	AudioEndpointBuilder.exe
Token: SeDebugPrivilege	2508	BrokerInfrastructure.exe
Token: SeRestorePrivilege	1504	dw20.exe
Token: SeBackupPrivilege	1504	dw20.exe
Token: SeBackupPrivilege	1504	dw20.exe
Token: SeBackupPrivilege	1504	dw20.exe
Token: SeBackupPrivilege	1504	dw20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

pid process

1796 7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

pid	process
1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exeBrokerInfrastructure.exe7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exeAudioEndpointBuilder.exe

description	pid	process	target process
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 1796	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
PID 3616 wrote to memory of 5024	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	BrokerInfrastructure.exe
PID 3616 wrote to memory of 5024	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	BrokerInfrastructure.exe
PID 3616 wrote to memory of 5024	3616	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	BrokerInfrastructure.exe
PID 5024 wrote to memory of 3920	5024	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 5024 wrote to memory of 3920	5024	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 5024 wrote to memory of 3920	5024	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 1796 wrote to memory of 3152	1796	7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe	vbc.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3340	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2508	3920	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 3920 wrote to memory of 2508	3920	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 3920 wrote to memory of 2508	3920	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 3960	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 2464	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 5112	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 3920 wrote to memory of 4568	3920	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe

C:\Users\Admin\AppData\Local\Temp\7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
"C:\Users\Admin\AppData\Local\Temp\7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616

C:\Users\Admin\AppData\Local\Temp\7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe
"C:\Users\Admin\AppData\Local\Temp\7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059.exe"
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:3152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"
3⤵
PID:208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"
3⤵
PID:4900

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3340

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3960

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2464

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4568

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2468

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2472

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4260

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1436

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3860

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2432

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4252

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1364

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1692

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3792

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1756

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4940

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3352

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:928

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1168

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4560

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2184

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4812

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5020

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1232

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:904

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4348

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2124

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:524

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4708

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4748

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5088

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2724

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1536

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3112

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2668

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4300

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1052

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1240

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:856

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3212

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1124

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5016

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4076

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:860

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2712

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4140

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1548

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2984

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1332

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1428

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4780

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1176

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:960

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3216

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1116

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3296

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3648

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2696

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4564

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4784

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1588

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:528

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3592

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1388

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3484

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3136

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2904

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2328

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1180

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3600

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3832

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:788

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3044

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3420

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:384

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3104

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4284

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3092

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4600

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3192

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1360

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:460

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3464

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1636

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3132

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2760

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2780

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4924

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4704

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4488

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4916

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 464
5⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3552

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1968

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3456

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4472

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2272

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2568

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:920

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4616

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:984

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1156

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1532

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4576

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1940

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1688

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4088

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:452

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3120

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2144

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4612

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3564

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2604

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:708

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:368

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3640

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2740

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4752

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:204

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4020

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1456

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1316

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2832

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2396

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4884

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3636

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4184

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2728

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1996

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4892

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3052

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:872

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2340

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4432

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1132

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:668

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1816

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2564

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1472

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:432

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2348

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3568

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5108

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4944

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1312

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3000

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:436

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4588

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3248

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4012

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5136

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5188

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5244

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5296

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5348

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5404

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5456

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5508

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5564

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5616

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5668

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5720

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5772

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5828

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5880

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5936

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5992

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6044

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6096

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5132

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5148

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5216

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5260

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5316

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5384

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5428

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5480

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5572

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5624

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5676

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5748

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5784

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5860

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5924

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5948

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6060

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AudioEndpointBuilder.exe.log
Filesize
774B

MD5
049b2c7e274ebb68f3ada1961c982a22

SHA1
796b9f03c8cd94617ea26aaf861af9fb2a5731db

SHA256
5c69c41dceda1bb32d4054d6b483bb3e3af84c8cf0a6191c79068168a1d506b3

SHA512
fb2ee642e1401772d514e86b0b8dd117659335066242e85c158b40e8912572f2bd7b9a0f63f9b9f4d7a2e051579345215f6b1f147881f3d1e78f335c45d78ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BrokerInfrastructure.exe.log
Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt
Filesize
725B

MD5
e1d32c21176fa680eb89fd90f80948da

SHA1
f637b89c1f92c37746c77c9ee6b522292460ba4e

SHA256
8872fd252bc29861336a3a3dcb55ffc1eb005359aa13d3de6b6f50bc16b327c3

SHA512
e872c829c1634176e3efbf071e10a974af5f4a67856ed99f23c536234fc83a4d9e96e7f278d36db215d81eeddd2bac557412d9384f11aaec1bf5496c91c8f202

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt
Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1021KB

MD5
b227e39632a6e762d314a52e11371f4d

SHA1
6449ff3fc9c6f9bec7cf25a6ec16f274ebfc6e6d

SHA256
7cecee939109a2585a2534d5d7587ca6aa568bdb1a051df2bd37ea5731d20059

SHA512
a2b2fc1d9fc00979b7eec334917316934403b6e2b721a3b30a713e3830ecb351a0af40b726922ee97f92c0c87763c45af1c900e54abd65a656d10890de5f9f39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
59882082f35cfab34acb407b7e95241c

SHA1
caa21d2c0d24e317b48cc6d998e70e863f5a509d

SHA256
c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d

SHA512
727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
59882082f35cfab34acb407b7e95241c

SHA1
caa21d2c0d24e317b48cc6d998e70e863f5a509d

SHA256
c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d

SHA512
727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
59882082f35cfab34acb407b7e95241c

SHA1
caa21d2c0d24e317b48cc6d998e70e863f5a509d

SHA256
c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d

SHA512
727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
12KB

MD5
59882082f35cfab34acb407b7e95241c

SHA1
caa21d2c0d24e317b48cc6d998e70e863f5a509d

SHA256
c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d

SHA512
727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98

Download Submit
memory/208-246-0x0000000000000000-mapping.dmp

Download
memory/208-247-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/208-249-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/208-251-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/524-318-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/524-315-0x0000000000000000-mapping.dmp

Download
memory/856-365-0x0000000000000000-mapping.dmp

Download
memory/860-390-0x0000000000000000-mapping.dmp

Download
memory/904-296-0x0000000000000000-mapping.dmp

Download
memory/904-306-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/904-305-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/928-262-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/928-259-0x0000000000000000-mapping.dmp

Download
memory/1052-357-0x0000000000000000-mapping.dmp

Download
memory/1124-377-0x0000000000000000-mapping.dmp

Download
memory/1168-263-0x0000000000000000-mapping.dmp

Download
memory/1168-266-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1232-294-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1232-291-0x0000000000000000-mapping.dmp

Download
memory/1232-295-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1240-361-0x0000000000000000-mapping.dmp

Download
memory/1332-411-0x0000000000000000-mapping.dmp

Download
memory/1364-227-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1364-224-0x0000000000000000-mapping.dmp

Download
memory/1428-414-0x0000000000000000-mapping.dmp

Download
memory/1436-208-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1436-204-0x0000000000000000-mapping.dmp

Download
memory/1436-207-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1536-340-0x0000000000000000-mapping.dmp

Download
memory/1548-403-0x0000000000000000-mapping.dmp

Download
memory/1692-228-0x0000000000000000-mapping.dmp

Download
memory/1696-369-0x0000000000000000-mapping.dmp

Download
memory/1756-242-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1756-239-0x0000000000000000-mapping.dmp

Download
memory/1796-145-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1796-135-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/1796-139-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/1796-134-0x0000000000000000-mapping.dmp

Download
memory/2124-311-0x0000000000000000-mapping.dmp

Download
memory/2124-314-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2184-276-0x0000000000000000-mapping.dmp

Download
memory/2184-280-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2184-279-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2432-213-0x0000000000000000-mapping.dmp

Download
memory/2432-216-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2432-217-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2464-173-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2464-170-0x0000000000000000-mapping.dmp

Download
memory/2468-186-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2468-187-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2468-183-0x0000000000000000-mapping.dmp

Download
memory/2472-188-0x0000000000000000-mapping.dmp

Download
memory/2472-193-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2508-158-0x0000000000000000-mapping.dmp

Download
memory/2508-221-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2508-168-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2668-349-0x0000000000000000-mapping.dmp

Download
memory/2692-270-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2692-267-0x0000000000000000-mapping.dmp

Download
memory/2712-394-0x0000000000000000-mapping.dmp

Download
memory/2724-336-0x0000000000000000-mapping.dmp

Download
memory/2984-406-0x0000000000000000-mapping.dmp

Download
memory/3004-199-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3004-191-0x0000000000000000-mapping.dmp

Download
memory/3004-192-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3004-202-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3004-195-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3112-345-0x0000000000000000-mapping.dmp

Download
memory/3152-148-0x0000000000000000-mapping.dmp

Download
memory/3152-149-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3152-151-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3152-152-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3212-373-0x0000000000000000-mapping.dmp

Download
memory/3340-155-0x0000000000000000-mapping.dmp

Download
memory/3340-162-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3352-258-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3352-257-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3352-254-0x0000000000000000-mapping.dmp

Download
memory/3616-153-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3616-133-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3616-132-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3792-235-0x0000000000000000-mapping.dmp

Download
memory/3792-238-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3860-212-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3860-209-0x0000000000000000-mapping.dmp

Download
memory/3920-147-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3920-144-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3920-142-0x0000000000000000-mapping.dmp

Download
memory/3960-169-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3960-167-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3960-163-0x0000000000000000-mapping.dmp

Download
memory/4076-385-0x0000000000000000-mapping.dmp

Download
memory/4140-399-0x0000000000000000-mapping.dmp

Download
memory/4252-218-0x0000000000000000-mapping.dmp

Download
memory/4252-222-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4252-223-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4260-196-0x0000000000000000-mapping.dmp

Download
memory/4260-203-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4260-200-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4300-353-0x0000000000000000-mapping.dmp

Download
memory/4348-310-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4348-307-0x0000000000000000-mapping.dmp

Download
memory/4356-332-0x0000000000000000-mapping.dmp

Download
memory/4560-274-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4560-271-0x0000000000000000-mapping.dmp

Download
memory/4560-275-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4568-179-0x0000000000000000-mapping.dmp

Download
memory/4568-182-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4708-319-0x0000000000000000-mapping.dmp

Download
memory/4708-322-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4708-323-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4748-324-0x0000000000000000-mapping.dmp

Download
memory/4780-418-0x0000000000000000-mapping.dmp

Download
memory/4812-281-0x0000000000000000-mapping.dmp

Download
memory/4812-284-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4812-285-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4900-304-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4900-302-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4900-299-0x0000000000000000-mapping.dmp

Download
memory/4900-300-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4940-253-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4940-243-0x0000000000000000-mapping.dmp

Download
memory/4940-252-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5016-381-0x0000000000000000-mapping.dmp

Download
memory/5020-286-0x0000000000000000-mapping.dmp

Download
memory/5020-290-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5020-289-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5024-154-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5024-146-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5024-140-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5024-136-0x0000000000000000-mapping.dmp

Download
memory/5072-234-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5072-231-0x0000000000000000-mapping.dmp

Download
memory/5088-328-0x0000000000000000-mapping.dmp

Download
memory/5112-174-0x0000000000000000-mapping.dmp

Download
memory/5112-177-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/5112-178-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download