darkcomet | 648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
Size

1.3MB
MD5

310e3e424725c337340aa702d282f6be
SHA1

29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0
SHA256

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac
SHA512

d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d
SSDEEP

24576:L4qhhBAlGFf3pyKMzu7qx98AorMpOX+69BD71HZTo4FCKtoMi:L4qhhBA8F5y1398AovX+6b1HZE4FCKtJ

Score

10^/10

darkcomet hawkeye ez 15/02 collection keylogger persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Ez 15/02

daviswc.zapto.org:1211

Mutex

DC_MUTEX-1P47F32

Attributes

gencode
fvDZQsoQbRFd
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4848-137-0x0000000000400000-0x00000000004F0000-memory.dmp	MailPassView
behavioral2/memory/312-377-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/312-378-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/312-380-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4848-137-0x0000000000400000-0x00000000004F0000-memory.dmp	WebBrowserPassView
behavioral2/memory/1420-451-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral2/memory/1420-453-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4848-137-0x0000000000400000-0x00000000004F0000-memory.dmp	Nirsoft
behavioral2/memory/312-377-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/312-378-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/312-380-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1420-451-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/1420-453-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft

Executes dropped EXE 64 IoCs

Processes:

BrokerInfrastructure.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeBrokerInfrastructure.exeBrokerInfrastructure.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exe

pid	process
4268	BrokerInfrastructure.exe
1704	AudioEndpointBuilder.exe
3428	AudioEndpointBuilder.exe
3984	BrokerInfrastructure.exe
3556	BrokerInfrastructure.exe
5044	AudioEndpointBuilder.exe
4984	AudioEndpointBuilder.exe
3676	AudioEndpointBuilder.exe
3180	AudioEndpointBuilder.exe
3944	AudioEndpointBuilder.exe
4444	AudioEndpointBuilder.exe
4308	AudioEndpointBuilder.exe
552	AudioEndpointBuilder.exe
2848	AudioEndpointBuilder.exe
1276	AudioEndpointBuilder.exe
4040	AudioEndpointBuilder.exe
1480	AudioEndpointBuilder.exe
1692	AudioEndpointBuilder.exe
1640	AudioEndpointBuilder.exe
3184	AudioEndpointBuilder.exe
3992	AudioEndpointBuilder.exe
392	AudioEndpointBuilder.exe
4596	AudioEndpointBuilder.exe
3444	AudioEndpointBuilder.exe
5096	AudioEndpointBuilder.exe
3672	AudioEndpointBuilder.exe
1356	AudioEndpointBuilder.exe
1432	AudioEndpointBuilder.exe
2792	AudioEndpointBuilder.exe
4804	AudioEndpointBuilder.exe
2180	AudioEndpointBuilder.exe
4488	AudioEndpointBuilder.exe
4172	AudioEndpointBuilder.exe
1592	AudioEndpointBuilder.exe
1864	AudioEndpointBuilder.exe
640	AudioEndpointBuilder.exe
1568	AudioEndpointBuilder.exe
1256	AudioEndpointBuilder.exe
540	AudioEndpointBuilder.exe
2588	AudioEndpointBuilder.exe
1500	AudioEndpointBuilder.exe
4936	AudioEndpointBuilder.exe
2704	AudioEndpointBuilder.exe
868	AudioEndpointBuilder.exe
3368	AudioEndpointBuilder.exe
4856	AudioEndpointBuilder.exe
1444	AudioEndpointBuilder.exe
2672	AudioEndpointBuilder.exe
3860	AudioEndpointBuilder.exe
2712	AudioEndpointBuilder.exe
2196	AudioEndpointBuilder.exe
932	AudioEndpointBuilder.exe
2264	AudioEndpointBuilder.exe
3552	AudioEndpointBuilder.exe
2336	AudioEndpointBuilder.exe
2280	AudioEndpointBuilder.exe
1468	AudioEndpointBuilder.exe
2256	AudioEndpointBuilder.exe
2028	AudioEndpointBuilder.exe
428	AudioEndpointBuilder.exe
3700	AudioEndpointBuilder.exe
5052	AudioEndpointBuilder.exe
3156	AudioEndpointBuilder.exe
1284	AudioEndpointBuilder.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/208-159-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/208-161-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/208-163-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/208-167-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/208-171-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/208-207-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exeBrokerInfrastructure.exeAudioEndpointBuilder.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	BrokerInfrastructure.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	AudioEndpointBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

BrokerInfrastructure.exeBrokerInfrastructure.exeBrokerInfrastructure.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokerInfrastructure = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BrokerInfrastructure.exe"	BrokerInfrastructure.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokerInfrastructure = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BrokerInfrastructure.exe"	BrokerInfrastructure.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrokerInfrastructure = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BrokerInfrastructure.exe"	BrokerInfrastructure.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 whatismyipaddress.com

flow	ioc
11	whatismyipaddress.com

Suspicious use of SetThreadContext 64 IoCs

Processes:

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exeAudioEndpointBuilder.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

description	pid	process	target process
PID 4464 set thread context of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 set thread context of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 1704 set thread context of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 2512 set thread context of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 1704 set thread context of 5044	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4984	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3676	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3180	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3944	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4444	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4308	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 552	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2848	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1276	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4040	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1480	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1692	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1640	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3184	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3992	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 392	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4596	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3444	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 5096	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3672	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1356	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1432	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2792	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4804	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2180	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4488	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4172	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1592	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1864	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 640	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1568	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1256	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 540	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2588	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1500	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4936	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2704	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 868	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3368	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 4856	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1444	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2672	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3860	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 4848 set thread context of 312	4848	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 1704 set thread context of 2712	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2196	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 932	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2264	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3552	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2336	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2280	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1468	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2256	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 2028	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3700	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 5052	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 3156	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 set thread context of 1284	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3664 4784 WerFault.exe AudioEndpointBuilder.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

pid	pid_target	process	target process
3664	4784	WerFault.exe	AudioEndpointBuilder.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exeBrokerInfrastructure.exe

pid	process
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4268	BrokerInfrastructure.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4268	BrokerInfrastructure.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4268	BrokerInfrastructure.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4268	BrokerInfrastructure.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4268	BrokerInfrastructure.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4268	BrokerInfrastructure.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exeBrokerInfrastructure.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exeAudioEndpointBuilder.exeBrokerInfrastructure.exeBrokerInfrastructure.exevbc.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exedw20.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
Token: SeDebugPrivilege	4268	BrokerInfrastructure.exe
Token: SeDebugPrivilege	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
Token: SeDebugPrivilege	1704	AudioEndpointBuilder.exe
Token: SeDebugPrivilege	3984	BrokerInfrastructure.exe
Token: SeDebugPrivilege	3556	BrokerInfrastructure.exe
Token: SeIncreaseQuotaPrivilege	208	vbc.exe
Token: SeSecurityPrivilege	208	vbc.exe
Token: SeTakeOwnershipPrivilege	208	vbc.exe
Token: SeLoadDriverPrivilege	208	vbc.exe
Token: SeSystemProfilePrivilege	208	vbc.exe
Token: SeSystemtimePrivilege	208	vbc.exe
Token: SeProfSingleProcessPrivilege	208	vbc.exe
Token: SeIncBasePriorityPrivilege	208	vbc.exe
Token: SeCreatePagefilePrivilege	208	vbc.exe
Token: SeBackupPrivilege	208	vbc.exe
Token: SeRestorePrivilege	208	vbc.exe
Token: SeShutdownPrivilege	208	vbc.exe
Token: SeDebugPrivilege	208	vbc.exe
Token: SeSystemEnvironmentPrivilege	208	vbc.exe
Token: SeChangeNotifyPrivilege	208	vbc.exe
Token: SeRemoteShutdownPrivilege	208	vbc.exe
Token: SeUndockPrivilege	208	vbc.exe
Token: SeManageVolumePrivilege	208	vbc.exe
Token: SeImpersonatePrivilege	208	vbc.exe
Token: SeCreateGlobalPrivilege	208	vbc.exe
Token: 33	208	vbc.exe
Token: 34	208	vbc.exe
Token: 35	208	vbc.exe
Token: 36	208	vbc.exe
Token: SeDebugPrivilege	4848	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
Token: SeRestorePrivilege	3888	dw20.exe
Token: SeBackupPrivilege	3888	dw20.exe
Token: SeBackupPrivilege	3888	dw20.exe
Token: SeBackupPrivilege	3888	dw20.exe
Token: SeBackupPrivilege	3888	dw20.exe
Token: SeBackupPrivilege	4780	dw20.exe
Token: SeBackupPrivilege	4780	dw20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vbc.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

pid process

208 vbc.exe
4848 648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

pid	process
208	vbc.exe
4848	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exeBrokerInfrastructure.exeAudioEndpointBuilder.exe648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exevbc.exe

description	pid	process	target process
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 2512	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4848	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
PID 4464 wrote to memory of 4268	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	BrokerInfrastructure.exe
PID 4464 wrote to memory of 4268	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	BrokerInfrastructure.exe
PID 4464 wrote to memory of 4268	4464	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	BrokerInfrastructure.exe
PID 4268 wrote to memory of 1704	4268	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 4268 wrote to memory of 1704	4268	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 4268 wrote to memory of 1704	4268	BrokerInfrastructure.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 1704 wrote to memory of 3428	1704	AudioEndpointBuilder.exe	AudioEndpointBuilder.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 2512 wrote to memory of 208	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	vbc.exe
PID 1704 wrote to memory of 3984	1704	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 1704 wrote to memory of 3984	1704	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 1704 wrote to memory of 3984	1704	AudioEndpointBuilder.exe	BrokerInfrastructure.exe
PID 2512 wrote to memory of 3556	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	BrokerInfrastructure.exe
PID 2512 wrote to memory of 3556	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	BrokerInfrastructure.exe
PID 2512 wrote to memory of 3556	2512	648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe	BrokerInfrastructure.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe
PID 208 wrote to memory of 772	208	vbc.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
"C:\Users\Admin\AppData\Local\Temp\648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464

C:\Users\Admin\AppData\Local\Temp\648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
"C:\Users\Admin\AppData\Local\Temp\648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:772

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Users\Admin\AppData\Local\Temp\648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe
"C:\Users\Admin\AppData\Local\Temp\648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
PID:1420

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"
3⤵
PID:1696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"
3⤵
PID:3172

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3428

C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5044

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3676

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3180

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3944

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4444

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4308

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:552

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2848

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1276

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4040

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1480

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1692

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3184

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3992

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:392

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4596

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3444

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5096

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1356

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1432

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2792

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2180

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4488

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1592

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1864

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:640

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1568

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1256

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:540

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1500

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4936

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2704

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:868

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3368

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:4856

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1444

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2672

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3860

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2712

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2196

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:932

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3552

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2336

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1468

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2256

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:2028

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:428

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3700

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:5052

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:3156

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
- Executes dropped EXE
PID:1284

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3836

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4128

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4092

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2160

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2932

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 420
5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4696

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4460

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4112

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:916

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4476

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:880

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1604

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:712

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1932

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3008

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4416

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1840

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1872

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4604

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3940

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2092

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:720

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4684

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4400

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:532

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4000

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4760

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:444

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3580

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4524

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 412
5⤵
- Program crash
PID:3664

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5068

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1092

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:820

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2040

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1552

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3564

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3176

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5092

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3520

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4956

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1832

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2660

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4608

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1352

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2620

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3616

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2720

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2872

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1032

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:632

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4708

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4976

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:548

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5008

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3132

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4652

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4376

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4300

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4320

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1248

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4052

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2612

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3708

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3584

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4388

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2236

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2464

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4356

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4148

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2904

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:1924

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2960

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:3792

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2136

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4592

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5132

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5184

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5240

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5308

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5360

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5416

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5468

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5528

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5584

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5640

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5692

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5744

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5796

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5852

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5904

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5960

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6020

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6072

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:6124

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:4492

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5224

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:2560

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5316

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5388

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5424

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5432

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5500

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5552

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5604

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5684

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5716

C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"
4⤵
PID:5788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 476
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4784 -ip 4784
1⤵
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AudioEndpointBuilder.exe.log
Filesize
774B

MD5
049b2c7e274ebb68f3ada1961c982a22

SHA1
796b9f03c8cd94617ea26aaf861af9fb2a5731db

SHA256
5c69c41dceda1bb32d4054d6b483bb3e3af84c8cf0a6191c79068168a1d506b3

SHA512
fb2ee642e1401772d514e86b0b8dd117659335066242e85c158b40e8912572f2bd7b9a0f63f9b9f4d7a2e051579345215f6b1f147881f3d1e78f335c45d78ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BrokerInfrastructure.exe.log
Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe
Filesize
1.3MB

MD5
310e3e424725c337340aa702d282f6be

SHA1
29787ca73e67ac6d7c3f69b32d2ba9fb9f2bd4f0

SHA256
648b86a010f142c2acf60a108564011860a47a21d44285af4f6f56ecc79f4bac

SHA512
d1a50df2e973618ebe20624206afa35acf2137bc967371172c49b964688205d71317fdb21d1fbd6c5ed96aeca429f020b5d02f17d5701fd5acb6f293cfec287d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
16KB

MD5
db4ce531dd8aed45cc4c2b8fd3f4e035

SHA1
3c315807facc3656301805640f84e08e38c2df33

SHA256
61f6ba9c213d8e9aac5325f30d75d3822de945c2d26d5ed7c70233274485d9b0

SHA512
0069d6ddb20001a1c7b4677311ddd03da552db64e840b9134c8c9adfa68d8a2ad10a1cdb75db553afc93de6e077c91556180cd47b54223e5962cb5db2c4e6202

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
16KB

MD5
db4ce531dd8aed45cc4c2b8fd3f4e035

SHA1
3c315807facc3656301805640f84e08e38c2df33

SHA256
61f6ba9c213d8e9aac5325f30d75d3822de945c2d26d5ed7c70233274485d9b0

SHA512
0069d6ddb20001a1c7b4677311ddd03da552db64e840b9134c8c9adfa68d8a2ad10a1cdb75db553afc93de6e077c91556180cd47b54223e5962cb5db2c4e6202

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
16KB

MD5
db4ce531dd8aed45cc4c2b8fd3f4e035

SHA1
3c315807facc3656301805640f84e08e38c2df33

SHA256
61f6ba9c213d8e9aac5325f30d75d3822de945c2d26d5ed7c70233274485d9b0

SHA512
0069d6ddb20001a1c7b4677311ddd03da552db64e840b9134c8c9adfa68d8a2ad10a1cdb75db553afc93de6e077c91556180cd47b54223e5962cb5db2c4e6202

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
16KB

MD5
db4ce531dd8aed45cc4c2b8fd3f4e035

SHA1
3c315807facc3656301805640f84e08e38c2df33

SHA256
61f6ba9c213d8e9aac5325f30d75d3822de945c2d26d5ed7c70233274485d9b0

SHA512
0069d6ddb20001a1c7b4677311ddd03da552db64e840b9134c8c9adfa68d8a2ad10a1cdb75db553afc93de6e077c91556180cd47b54223e5962cb5db2c4e6202

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
16KB

MD5
db4ce531dd8aed45cc4c2b8fd3f4e035

SHA1
3c315807facc3656301805640f84e08e38c2df33

SHA256
61f6ba9c213d8e9aac5325f30d75d3822de945c2d26d5ed7c70233274485d9b0

SHA512
0069d6ddb20001a1c7b4677311ddd03da552db64e840b9134c8c9adfa68d8a2ad10a1cdb75db553afc93de6e077c91556180cd47b54223e5962cb5db2c4e6202

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe
Filesize
16KB

MD5
db4ce531dd8aed45cc4c2b8fd3f4e035

SHA1
3c315807facc3656301805640f84e08e38c2df33

SHA256
61f6ba9c213d8e9aac5325f30d75d3822de945c2d26d5ed7c70233274485d9b0

SHA512
0069d6ddb20001a1c7b4677311ddd03da552db64e840b9134c8c9adfa68d8a2ad10a1cdb75db553afc93de6e077c91556180cd47b54223e5962cb5db2c4e6202

Download Submit
memory/208-207-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/208-158-0x0000000000000000-mapping.dmp

Download
memory/208-171-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/208-159-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/208-163-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/208-161-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/208-167-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/312-380-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/312-377-0x0000000000000000-mapping.dmp

Download
memory/312-378-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/392-254-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/392-255-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/392-251-0x0000000000000000-mapping.dmp

Download
memory/540-328-0x0000000000000000-mapping.dmp

Download
memory/552-214-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/552-210-0x0000000000000000-mapping.dmp

Download
memory/640-316-0x0000000000000000-mapping.dmp

Download
memory/772-170-0x0000000000000000-mapping.dmp

Download
memory/868-349-0x0000000000000000-mapping.dmp

Download
memory/932-393-0x0000000000000000-mapping.dmp

Download
memory/1256-323-0x0000000000000000-mapping.dmp

Download
memory/1276-223-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1276-220-0x0000000000000000-mapping.dmp

Download
memory/1356-274-0x0000000000000000-mapping.dmp

Download
memory/1356-277-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1356-278-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1420-451-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1420-453-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1432-279-0x0000000000000000-mapping.dmp

Download
memory/1432-282-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1444-365-0x0000000000000000-mapping.dmp

Download
memory/1468-414-0x0000000000000000-mapping.dmp

Download
memory/1480-232-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1480-231-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1480-228-0x0000000000000000-mapping.dmp

Download
memory/1500-337-0x0000000000000000-mapping.dmp

Download
memory/1568-320-0x0000000000000000-mapping.dmp

Download
memory/1592-309-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1592-306-0x0000000000000000-mapping.dmp

Download
memory/1640-241-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1640-240-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1640-237-0x0000000000000000-mapping.dmp

Download
memory/1692-236-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1692-233-0x0000000000000000-mapping.dmp

Download
memory/1704-144-0x0000000000000000-mapping.dmp

Download
memory/1704-151-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1704-147-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1864-311-0x0000000000000000-mapping.dmp

Download
memory/2180-296-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2180-292-0x0000000000000000-mapping.dmp

Download
memory/2196-389-0x0000000000000000-mapping.dmp

Download
memory/2256-418-0x0000000000000000-mapping.dmp

Download
memory/2264-397-0x0000000000000000-mapping.dmp

Download
memory/2280-410-0x0000000000000000-mapping.dmp

Download
memory/2336-405-0x0000000000000000-mapping.dmp

Download
memory/2512-135-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2512-148-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2512-138-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2512-134-0x0000000000000000-mapping.dmp

Download
memory/2588-332-0x0000000000000000-mapping.dmp

Download
memory/2672-369-0x0000000000000000-mapping.dmp

Download
memory/2704-344-0x0000000000000000-mapping.dmp

Download
memory/2712-383-0x0000000000000000-mapping.dmp

Download
memory/2792-287-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2792-288-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2792-283-0x0000000000000000-mapping.dmp

Download
memory/2848-215-0x0000000000000000-mapping.dmp

Download
memory/2848-219-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2848-218-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3156-431-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/3180-191-0x0000000000000000-mapping.dmp

Download
memory/3180-195-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3180-192-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/3180-194-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3184-242-0x0000000000000000-mapping.dmp

Download
memory/3184-245-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3368-353-0x0000000000000000-mapping.dmp

Download
memory/3428-155-0x0000000000000000-mapping.dmp

Download
memory/3428-160-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3428-172-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3444-263-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3444-264-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3444-265-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3444-260-0x0000000000000000-mapping.dmp

Download
memory/3552-401-0x0000000000000000-mapping.dmp

Download
memory/3556-175-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3556-165-0x0000000000000000-mapping.dmp

Download
memory/3556-209-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3672-273-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3672-269-0x0000000000000000-mapping.dmp

Download
memory/3676-186-0x0000000000000000-mapping.dmp

Download
memory/3676-189-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3676-190-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-374-0x0000000000000000-mapping.dmp

Download
memory/3888-363-0x0000000000000000-mapping.dmp

Download
memory/3944-196-0x0000000000000000-mapping.dmp

Download
memory/3944-199-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3984-174-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3984-208-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3984-164-0x0000000000000000-mapping.dmp

Download
memory/3992-249-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-250-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-246-0x0000000000000000-mapping.dmp

Download
memory/4040-227-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4040-224-0x0000000000000000-mapping.dmp

Download
memory/4172-305-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4172-302-0x0000000000000000-mapping.dmp

Download
memory/4268-140-0x0000000000000000-mapping.dmp

Download
memory/4268-153-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4268-150-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4268-146-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4308-212-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4308-204-0x0000000000000000-mapping.dmp

Download
memory/4308-286-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4444-203-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4444-200-0x0000000000000000-mapping.dmp

Download
memory/4464-152-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4464-133-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4464-132-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4488-297-0x0000000000000000-mapping.dmp

Download
memory/4488-300-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4488-301-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-259-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4596-256-0x0000000000000000-mapping.dmp

Download
memory/4696-450-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4804-289-0x0000000000000000-mapping.dmp

Download
memory/4804-295-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4848-136-0x0000000000000000-mapping.dmp

Download
memory/4848-137-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4848-149-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4848-139-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4856-360-0x0000000000000000-mapping.dmp

Download
memory/4936-341-0x0000000000000000-mapping.dmp

Download
memory/4984-185-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4984-184-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4984-181-0x0000000000000000-mapping.dmp

Download
memory/5044-173-0x0000000000000000-mapping.dmp

Download
memory/5044-179-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/5044-180-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/5096-270-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/5096-266-0x0000000000000000-mapping.dmp

Download