Analysis
-
max time kernel
143s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 17:48
Static task
static1
Behavioral task
behavioral1
Sample
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe
Resource
win7-20220901-en
General
-
Target
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe
-
Size
1.0MB
-
MD5
dc03fdb0261a5e747cd3a83153be2df6
-
SHA1
d27ce5f7f2947e7f914153d572025c6ab75792f3
-
SHA256
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
-
SHA512
83219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
SSDEEP
24576:ySkWMx78Vs5UisGWbNNu6HyVm5L5vCa3cgCObJjRMH:ySix78Vs+fvNJyyqa
Malware Config
Signatures
-
NirSoft MailPassView 17 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1176-60-0x0000000000230000-0x0000000000320000-memory.dmp MailPassView behavioral1/memory/1176-61-0x0000000000230000-0x0000000000320000-memory.dmp MailPassView behavioral1/memory/1176-63-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/1176-64-0x0000000000230000-0x0000000000320000-memory.dmp MailPassView behavioral1/memory/1176-65-0x0000000000230000-0x0000000000320000-memory.dmp MailPassView behavioral1/memory/1176-69-0x0000000000230000-0x0000000000320000-memory.dmp MailPassView behavioral1/memory/1176-72-0x0000000000230000-0x0000000000320000-memory.dmp MailPassView behavioral1/memory/1676-102-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/1676-105-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1676-107-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1864-264-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/816-399-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/1352-479-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/1612-638-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/1096-664-0x00000000004EB17E-mapping.dmp MailPassView behavioral1/memory/1760-670-0x0000000074760000-0x0000000074D0B000-memory.dmp MailPassView behavioral1/memory/2268-710-0x00000000004EB17E-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 59 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1176-60-0x0000000000230000-0x0000000000320000-memory.dmp WebBrowserPassView behavioral1/memory/1176-61-0x0000000000230000-0x0000000000320000-memory.dmp WebBrowserPassView behavioral1/memory/1176-63-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1176-64-0x0000000000230000-0x0000000000320000-memory.dmp WebBrowserPassView behavioral1/memory/1176-65-0x0000000000230000-0x0000000000320000-memory.dmp WebBrowserPassView behavioral1/memory/1176-69-0x0000000000230000-0x0000000000320000-memory.dmp WebBrowserPassView behavioral1/memory/1176-72-0x0000000000230000-0x0000000000320000-memory.dmp WebBrowserPassView behavioral1/memory/1676-102-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1676-105-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1676-107-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1256-118-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1420-133-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1000-148-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1888-163-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/604-179-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/676-194-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1760-249-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1864-264-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1528-299-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1896-354-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/716-369-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1924-384-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/816-399-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1180-414-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/552-429-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1448-444-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1352-479-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1264-494-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/612-510-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1048-525-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/584-540-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1160-555-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1552-568-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1648-581-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1036-612-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1604-625-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1612-638-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/556-651-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1096-664-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/1760-670-0x0000000074760000-0x0000000074D0B000-memory.dmp WebBrowserPassView behavioral1/memory/1584-679-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2268-710-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2400-723-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2508-736-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2604-749-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2696-762-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2808-775-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/3024-807-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2080-820-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2224-833-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2408-846-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2536-859-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2752-890-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2992-921-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2036-934-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2284-947-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2428-960-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2548-973-0x00000000004EB17E-mapping.dmp WebBrowserPassView behavioral1/memory/2676-986-0x00000000004EB17E-mapping.dmp WebBrowserPassView -
Nirsoft 59 IoCs
Processes:
resource yara_rule behavioral1/memory/1176-60-0x0000000000230000-0x0000000000320000-memory.dmp Nirsoft behavioral1/memory/1176-61-0x0000000000230000-0x0000000000320000-memory.dmp Nirsoft behavioral1/memory/1176-63-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1176-64-0x0000000000230000-0x0000000000320000-memory.dmp Nirsoft behavioral1/memory/1176-65-0x0000000000230000-0x0000000000320000-memory.dmp Nirsoft behavioral1/memory/1176-69-0x0000000000230000-0x0000000000320000-memory.dmp Nirsoft behavioral1/memory/1176-72-0x0000000000230000-0x0000000000320000-memory.dmp Nirsoft behavioral1/memory/1676-102-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1676-105-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1676-107-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1256-118-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1420-133-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1000-148-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1888-163-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/604-179-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/676-194-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1760-249-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1864-264-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1528-299-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1896-354-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/716-369-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1924-384-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/816-399-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1180-414-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/552-429-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1448-444-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1352-479-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1264-494-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/612-510-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1048-525-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/584-540-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1160-555-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1552-568-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1648-581-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1036-612-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1604-625-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1612-638-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/556-651-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1096-664-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/1760-670-0x0000000074760000-0x0000000074D0B000-memory.dmp Nirsoft behavioral1/memory/1584-679-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2268-710-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2400-723-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2508-736-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2604-749-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2696-762-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2808-775-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/3024-807-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2080-820-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2224-833-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2408-846-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2536-859-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2752-890-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2992-921-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2036-934-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2284-947-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2428-960-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2548-973-0x00000000004EB17E-mapping.dmp Nirsoft behavioral1/memory/2676-986-0x00000000004EB17E-mapping.dmp Nirsoft -
Executes dropped EXE 64 IoCs
Processes:
BrokerInfrastructure.exeAudioEndpointBuilder.exeBrokerInfrastructure.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exeAudioEndpointBuilder.exepid process 1448 BrokerInfrastructure.exe 652 AudioEndpointBuilder.exe 2020 BrokerInfrastructure.exe 1676 AudioEndpointBuilder.exe 1256 AudioEndpointBuilder.exe 1420 AudioEndpointBuilder.exe 1000 AudioEndpointBuilder.exe 1888 AudioEndpointBuilder.exe 604 AudioEndpointBuilder.exe 676 AudioEndpointBuilder.exe 1488 AudioEndpointBuilder.exe 1732 AudioEndpointBuilder.exe 1760 AudioEndpointBuilder.exe 1864 AudioEndpointBuilder.exe 1240 AudioEndpointBuilder.exe 1528 AudioEndpointBuilder.exe 1960 AudioEndpointBuilder.exe 268 AudioEndpointBuilder.exe 1896 AudioEndpointBuilder.exe 716 AudioEndpointBuilder.exe 1924 AudioEndpointBuilder.exe 816 AudioEndpointBuilder.exe 1180 AudioEndpointBuilder.exe 552 AudioEndpointBuilder.exe 1448 AudioEndpointBuilder.exe 1984 AudioEndpointBuilder.exe 1352 AudioEndpointBuilder.exe 1264 AudioEndpointBuilder.exe 612 AudioEndpointBuilder.exe 1048 AudioEndpointBuilder.exe 584 AudioEndpointBuilder.exe 1160 AudioEndpointBuilder.exe 1552 AudioEndpointBuilder.exe 1648 AudioEndpointBuilder.exe 2008 AudioEndpointBuilder.exe 1036 AudioEndpointBuilder.exe 1604 AudioEndpointBuilder.exe 1612 AudioEndpointBuilder.exe 556 AudioEndpointBuilder.exe 1096 AudioEndpointBuilder.exe 1584 AudioEndpointBuilder.exe 2064 AudioEndpointBuilder.exe 2268 AudioEndpointBuilder.exe 2400 AudioEndpointBuilder.exe 2508 AudioEndpointBuilder.exe 2604 AudioEndpointBuilder.exe 2696 AudioEndpointBuilder.exe 2808 AudioEndpointBuilder.exe 2904 AudioEndpointBuilder.exe 3024 AudioEndpointBuilder.exe 2080 AudioEndpointBuilder.exe 2224 AudioEndpointBuilder.exe 2408 AudioEndpointBuilder.exe 2536 AudioEndpointBuilder.exe 2644 AudioEndpointBuilder.exe 2752 AudioEndpointBuilder.exe 2872 AudioEndpointBuilder.exe 2992 AudioEndpointBuilder.exe 2036 AudioEndpointBuilder.exe 2284 AudioEndpointBuilder.exe 2428 AudioEndpointBuilder.exe 2548 AudioEndpointBuilder.exe 2676 AudioEndpointBuilder.exe 2796 AudioEndpointBuilder.exe -
Loads dropped DLL 64 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exeBrokerInfrastructure.exeAudioEndpointBuilder.exepid process 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com -
Suspicious use of SetThreadContext 64 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exeAudioEndpointBuilder.exedescription pid process target process PID 1104 set thread context of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 652 set thread context of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 604 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1488 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1732 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1760 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1864 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1240 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1528 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1960 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 268 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1896 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 716 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1924 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 816 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1180 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 552 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1448 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1984 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1352 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1264 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 612 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1048 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 584 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1160 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1552 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1648 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2008 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1036 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1604 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1612 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 556 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1096 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 1584 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2064 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2268 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2400 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2508 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2604 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2696 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2808 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2904 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 3024 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2080 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2224 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2408 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2536 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2644 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2752 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2872 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2992 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2036 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2284 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2428 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2548 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2796 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 2912 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 set thread context of 3032 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exeBrokerInfrastructure.exeBrokerInfrastructure.exeAudioEndpointBuilder.exepid process 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1448 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 2020 BrokerInfrastructure.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 2020 BrokerInfrastructure.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 652 AudioEndpointBuilder.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 2020 BrokerInfrastructure.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 652 AudioEndpointBuilder.exe 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exeBrokerInfrastructure.exeAudioEndpointBuilder.exeBrokerInfrastructure.exe60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exedescription pid process Token: SeDebugPrivilege 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe Token: SeDebugPrivilege 1448 BrokerInfrastructure.exe Token: SeDebugPrivilege 652 AudioEndpointBuilder.exe Token: SeDebugPrivilege 2020 BrokerInfrastructure.exe Token: SeDebugPrivilege 1176 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exepid process 1176 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exeBrokerInfrastructure.exeAudioEndpointBuilder.exedescription pid process target process PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1176 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe PID 1104 wrote to memory of 1448 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1104 wrote to memory of 1448 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1104 wrote to memory of 1448 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1104 wrote to memory of 1448 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1448 wrote to memory of 652 1448 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 1448 wrote to memory of 652 1448 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 1448 wrote to memory of 652 1448 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 1448 wrote to memory of 652 1448 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 1104 wrote to memory of 2020 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1104 wrote to memory of 2020 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1104 wrote to memory of 2020 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 1104 wrote to memory of 2020 1104 60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe BrokerInfrastructure.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1676 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1256 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1420 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1000 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 652 wrote to memory of 1888 652 AudioEndpointBuilder.exe AudioEndpointBuilder.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe"C:\Users\Admin\AppData\Local\Temp\60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe"C:\Users\Admin\AppData\Local\Temp\60abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
17KB
MD54cd74165822090fb30ffd34f21a0429a
SHA1679c25004514e1ad69d01dc189c14222d94e9690
SHA256c75bc731cf056028b9d2ca8dead3178d916d77c062c0e3b04d6baee1c519ce55
SHA512f4d999714b7424eab49a7fafd45b10e49aeabe7d1b9f5e905b5633a4739aa8e4154bbdabd19f688151a58c548ac224992f796bc8436322d584f589de3ccf3854
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
17KB
MD54cd74165822090fb30ffd34f21a0429a
SHA1679c25004514e1ad69d01dc189c14222d94e9690
SHA256c75bc731cf056028b9d2ca8dead3178d916d77c062c0e3b04d6baee1c519ce55
SHA512f4d999714b7424eab49a7fafd45b10e49aeabe7d1b9f5e905b5633a4739aa8e4154bbdabd19f688151a58c548ac224992f796bc8436322d584f589de3ccf3854
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
17KB
MD54cd74165822090fb30ffd34f21a0429a
SHA1679c25004514e1ad69d01dc189c14222d94e9690
SHA256c75bc731cf056028b9d2ca8dead3178d916d77c062c0e3b04d6baee1c519ce55
SHA512f4d999714b7424eab49a7fafd45b10e49aeabe7d1b9f5e905b5633a4739aa8e4154bbdabd19f688151a58c548ac224992f796bc8436322d584f589de3ccf3854
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1.0MB
MD5dc03fdb0261a5e747cd3a83153be2df6
SHA1d27ce5f7f2947e7f914153d572025c6ab75792f3
SHA25660abc37cfc4bfc4ddd45356493f78ffd441d9fc133eee7b954d6d0350ffcabb2
SHA51283219bd8fade6479500a30fc0a249d188d569dd9cd802b7c508690b5540dd2e0c0e5f0f4cea1ed5756f2833e7f40adb19a2ce2d0fa2faf5431835faddcc85af1
-
\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
17KB
MD54cd74165822090fb30ffd34f21a0429a
SHA1679c25004514e1ad69d01dc189c14222d94e9690
SHA256c75bc731cf056028b9d2ca8dead3178d916d77c062c0e3b04d6baee1c519ce55
SHA512f4d999714b7424eab49a7fafd45b10e49aeabe7d1b9f5e905b5633a4739aa8e4154bbdabd19f688151a58c548ac224992f796bc8436322d584f589de3ccf3854
-
memory/268-334-0x00000000004EB17E-mapping.dmp
-
memory/268-346-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/552-429-0x00000000004EB17E-mapping.dmp
-
memory/552-436-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/556-651-0x00000000004EB17E-mapping.dmp
-
memory/556-657-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/584-547-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/584-540-0x00000000004EB17E-mapping.dmp
-
memory/604-186-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/604-179-0x00000000004EB17E-mapping.dmp
-
memory/612-517-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/612-510-0x00000000004EB17E-mapping.dmp
-
memory/652-86-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/652-89-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/652-81-0x0000000000000000-mapping.dmp
-
memory/676-201-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/676-194-0x00000000004EB17E-mapping.dmp
-
memory/716-369-0x00000000004EB17E-mapping.dmp
-
memory/716-376-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/816-406-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/816-399-0x00000000004EB17E-mapping.dmp
-
memory/1000-155-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1000-148-0x00000000004EB17E-mapping.dmp
-
memory/1036-612-0x00000000004EB17E-mapping.dmp
-
memory/1036-618-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1048-525-0x00000000004EB17E-mapping.dmp
-
memory/1048-532-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1096-671-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1096-664-0x00000000004EB17E-mapping.dmp
-
memory/1096-672-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1104-55-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmpFilesize
8KB
-
memory/1104-56-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1160-561-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1160-555-0x00000000004EB17E-mapping.dmp
-
memory/1176-60-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-65-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-64-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-63-0x00000000004EB17E-mapping.dmp
-
memory/1176-72-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-57-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-58-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-84-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1176-69-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1176-87-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1176-61-0x0000000000230000-0x0000000000320000-memory.dmpFilesize
960KB
-
memory/1180-414-0x00000000004EB17E-mapping.dmp
-
memory/1180-421-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1240-291-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1240-279-0x00000000004EB17E-mapping.dmp
-
memory/1256-118-0x00000000004EB17E-mapping.dmp
-
memory/1256-125-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1264-494-0x00000000004EB17E-mapping.dmp
-
memory/1264-501-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1352-486-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1352-479-0x00000000004EB17E-mapping.dmp
-
memory/1420-140-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1420-133-0x00000000004EB17E-mapping.dmp
-
memory/1448-75-0x0000000000000000-mapping.dmp
-
memory/1448-451-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1448-85-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1448-444-0x00000000004EB17E-mapping.dmp
-
memory/1448-90-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1448-88-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1488-209-0x00000000004EB17E-mapping.dmp
-
memory/1488-221-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1528-299-0x00000000004EB17E-mapping.dmp
-
memory/1528-306-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1552-568-0x00000000004EB17E-mapping.dmp
-
memory/1552-574-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1584-685-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1584-679-0x00000000004EB17E-mapping.dmp
-
memory/1604-631-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1604-625-0x00000000004EB17E-mapping.dmp
-
memory/1612-644-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1612-638-0x00000000004EB17E-mapping.dmp
-
memory/1648-587-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1648-581-0x00000000004EB17E-mapping.dmp
-
memory/1676-110-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1676-102-0x00000000004EB17E-mapping.dmp
-
memory/1676-105-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1676-107-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/1676-109-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1732-241-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1732-229-0x00000000004EB17E-mapping.dmp
-
memory/1760-258-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1760-249-0x00000000004EB17E-mapping.dmp
-
memory/1760-670-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1864-264-0x00000000004EB17E-mapping.dmp
-
memory/1864-271-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1888-163-0x00000000004EB17E-mapping.dmp
-
memory/1888-171-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1888-170-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1896-354-0x00000000004EB17E-mapping.dmp
-
memory/1896-361-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1924-800-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1924-391-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1924-384-0x00000000004EB17E-mapping.dmp
-
memory/1960-326-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/1960-314-0x00000000004EB17E-mapping.dmp
-
memory/1984-459-0x00000000004EB17E-mapping.dmp
-
memory/1984-471-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2008-594-0x00000000004EB17E-mapping.dmp
-
memory/2008-605-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2020-94-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2020-91-0x0000000000000000-mapping.dmp
-
memory/2020-503-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2036-934-0x00000000004EB17E-mapping.dmp
-
memory/2064-703-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2064-692-0x00000000004EB17E-mapping.dmp
-
memory/2080-826-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2080-820-0x00000000004EB17E-mapping.dmp
-
memory/2224-833-0x00000000004EB17E-mapping.dmp
-
memory/2268-710-0x00000000004EB17E-mapping.dmp
-
memory/2268-716-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2284-947-0x00000000004EB17E-mapping.dmp
-
memory/2400-723-0x00000000004EB17E-mapping.dmp
-
memory/2400-729-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2408-846-0x00000000004EB17E-mapping.dmp
-
memory/2428-960-0x00000000004EB17E-mapping.dmp
-
memory/2508-742-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2508-736-0x00000000004EB17E-mapping.dmp
-
memory/2536-859-0x00000000004EB17E-mapping.dmp
-
memory/2548-973-0x00000000004EB17E-mapping.dmp
-
memory/2604-755-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2604-749-0x00000000004EB17E-mapping.dmp
-
memory/2644-872-0x00000000004EB17E-mapping.dmp
-
memory/2676-986-0x00000000004EB17E-mapping.dmp
-
memory/2696-768-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2696-762-0x00000000004EB17E-mapping.dmp
-
memory/2752-890-0x00000000004EB17E-mapping.dmp
-
memory/2808-775-0x00000000004EB17E-mapping.dmp
-
memory/2808-781-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2872-903-0x00000000004EB17E-mapping.dmp
-
memory/2904-799-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2904-788-0x00000000004EB17E-mapping.dmp
-
memory/2992-921-0x00000000004EB17E-mapping.dmp
-
memory/3024-807-0x00000000004EB17E-mapping.dmp
-
memory/3024-813-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB