Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/11/2024, 19:39
Behavioral task
behavioral1
Sample
SAM X222C#.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
SAM X222C#.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
SAM X222C#.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
SAM X222C#.exe
Resource
win10v2004-20241007-en
General
-
Target
SAM X222C#.exe
-
Size
3.3MB
-
MD5
918951c4657e9cdf39ac1b275bfd2e95
-
SHA1
7323e59b2c4d60b6639bfcba11f4c02bcb94e347
-
SHA256
b50d25c24ba5f1f096e883b3a9970d2c080afb37dfe2f55a25a1c7ed3ca36505
-
SHA512
438c7554d8b72db63d598085b2c6fae9bfa1895154ebbaf96a5d2a498459b9a3516611613515f04dbc198edb8b2d7ce2ce63975064f28af63f3efa1e50e3e0d7
-
SSDEEP
98304:n5rc//PaUFOFWiRbNqz1xC4fkkbcZvqaVRn0:oi1Bc144M5vqaPn0
Malware Config
Extracted
xworm
147.185.221.23:25808
-
Install_directory
%LocalAppData%
-
install_file
Realtek HD Audio Universal Service.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000e000000012263-4.dat family_xworm behavioral1/memory/2456-7-0x00000000000D0000-0x00000000000EA000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2220 powershell.exe 1768 powershell.exe 1480 powershell.exe 3020 powershell.exe -
Executes dropped EXE 64 IoCs
pid Process 2456 Realtek HD Audio Universal Service.exe 3052 Realtek HD Audio Universal Service.exe 2712 Realtek HD Audio Universal Service.exe 2884 Realtek HD Audio Universal Service.exe 2676 Realtek HD Audio Universal Service.exe 2796 Realtek HD Audio Universal Service.exe 1456 Realtek HD Audio Universal Service.exe 3012 Realtek HD Audio Universal Service.exe 2616 Realtek HD Audio Universal Service.exe 2188 Realtek HD Audio Universal Service.exe 2984 Realtek HD Audio Universal Service.exe 3004 Realtek HD Audio Universal Service.exe 2320 Realtek HD Audio Universal Service.exe 2176 Realtek HD Audio Universal Service.exe 1972 Realtek HD Audio Universal Service.exe 764 Realtek HD Audio Universal Service.exe 2404 Realtek HD Audio Universal Service.exe 1956 Realtek HD Audio Universal Service.exe 980 Realtek HD Audio Universal Service.exe 1848 Realtek HD Audio Universal Service.exe 1288 Realtek HD Audio Universal Service.exe 1044 Realtek HD Audio Universal Service.exe 852 Realtek HD Audio Universal Service.exe 1572 Realtek HD Audio Universal Service.exe 1508 Realtek HD Audio Universal Service.exe 2824 Realtek HD Audio Universal Service.exe 2892 Realtek HD Audio Universal Service.exe 2752 Realtek HD Audio Universal Service.exe 1240 Realtek HD Audio Universal Service.exe 2412 Realtek HD Audio Universal Service.exe 2372 Realtek HD Audio Universal Service.exe 368 Realtek HD Audio Universal Service.exe 1400 Realtek HD Audio Universal Service.exe 2348 Realtek HD Audio Universal Service.exe 1600 Realtek HD Audio Universal Service.exe 2024 Realtek HD Audio Universal Service.exe 840 Realtek HD Audio Universal Service.exe 1444 Realtek HD Audio Universal Service.exe 592 Realtek HD Audio Universal Service.exe 1304 Realtek HD Audio Universal Service.exe 2528 Realtek HD Audio Universal Service.exe 1652 Realtek HD Audio Universal Service.exe 2352 Realtek HD Audio Universal Service.exe 3032 Realtek HD Audio Universal Service.exe 2836 Realtek HD Audio Universal Service.exe 2848 Realtek HD Audio Universal Service.exe 2228 Realtek HD Audio Universal Service.exe 2332 Realtek HD Audio Universal Service.exe 2172 Realtek HD Audio Universal Service.exe 332 Realtek HD Audio Universal Service.exe 2500 Realtek HD Audio Universal Service.exe 1544 Realtek HD Audio Universal Service.exe 1428 Realtek HD Audio Universal Service.exe 1732 Realtek HD Audio Universal Service.exe 1924 Realtek HD Audio Universal Service.exe 1708 Realtek HD Audio Universal Service.exe 2128 Realtek HD Audio Universal Service.exe 2472 Realtek HD Audio Universal Service.exe 2684 Realtek HD Audio Universal Service.exe 2980 Realtek HD Audio Universal Service.exe 2436 Realtek HD Audio Universal Service.exe 2484 Realtek HD Audio Universal Service.exe 2440 Realtek HD Audio Universal Service.exe 368 Realtek HD Audio Universal Service.exe -
Loads dropped DLL 64 IoCs
pid Process 2900 SAM X222C#.exe 2780 SAM X222C#.exe 3048 SAM X222C#.exe 2980 SAM X222C#.exe 2932 SAM X222C#.exe 2692 SAM X222C#.exe 2228 SAM X222C#.exe 1120 SAM X222C#.exe 2332 SAM X222C#.exe 2608 SAM X222C#.exe 3016 SAM X222C#.exe 2992 SAM X222C#.exe 2212 SAM X222C#.exe 1148 SAM X222C#.exe 2948 SAM X222C#.exe 1400 SAM X222C#.exe 2376 SAM X222C#.exe 2276 SAM X222C#.exe 1476 SAM X222C#.exe 3044 SAM X222C#.exe 2136 SAM X222C#.exe 1872 SAM X222C#.exe 1648 SAM X222C#.exe 1776 SAM X222C#.exe 884 SAM X222C#.exe 1528 SAM X222C#.exe 2900 SAM X222C#.exe 2704 SAM X222C#.exe 2696 SAM X222C#.exe 1120 SAM X222C#.exe 1468 SAM X222C#.exe 1404 SAM X222C#.exe 2408 SAM X222C#.exe 2452 SAM X222C#.exe 2360 SAM X222C#.exe 2792 SAM X222C#.exe 3052 SAM X222C#.exe 2884 SAM X222C#.exe 1924 SAM X222C#.exe 2072 SAM X222C#.exe 2660 SAM X222C#.exe 1904 SAM X222C#.exe 1500 SAM X222C#.exe 3068 SAM X222C#.exe 564 SAM X222C#.exe 2684 SAM X222C#.exe 2984 SAM X222C#.exe 2696 SAM X222C#.exe 2388 SAM X222C#.exe 2968 SAM X222C#.exe 1844 SAM X222C#.exe 2440 SAM X222C#.exe 2520 SAM X222C#.exe 1916 SAM X222C#.exe 936 SAM X222C#.exe 2796 SAM X222C#.exe 112 SAM X222C#.exe 1932 SAM X222C#.exe 2572 SAM X222C#.exe 944 SAM X222C#.exe 2856 SAM X222C#.exe 2752 SAM X222C#.exe 1844 SAM X222C#.exe 2096 SAM X222C#.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Local\\Realtek HD Audio Universal Service.exe" Realtek HD Audio Universal Service.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X222C#.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1768 powershell.exe 1480 powershell.exe 3020 powershell.exe 2220 powershell.exe 2456 Realtek HD Audio Universal Service.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3052 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2712 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2456 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2884 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2676 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2796 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1456 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3012 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2616 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2188 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2984 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3004 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2320 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2176 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1972 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 764 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2404 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1956 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 980 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1848 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1288 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1044 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 852 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1572 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1508 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2824 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2892 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2752 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1240 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2412 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2372 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 368 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1400 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2348 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1600 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2024 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 840 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1444 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 592 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1304 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2528 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1652 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2352 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3032 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2836 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2848 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2228 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2332 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2172 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 332 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1768 powershell.exe Token: SeDebugPrivilege 2500 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1544 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1428 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1732 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1924 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1708 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 2128 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2472 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2684 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2980 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2436 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3020 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2456 Realtek HD Audio Universal Service.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2456 2900 SAM X222C#.exe 30 PID 2900 wrote to memory of 2456 2900 SAM X222C#.exe 30 PID 2900 wrote to memory of 2456 2900 SAM X222C#.exe 30 PID 2900 wrote to memory of 2456 2900 SAM X222C#.exe 30 PID 2900 wrote to memory of 2780 2900 SAM X222C#.exe 31 PID 2900 wrote to memory of 2780 2900 SAM X222C#.exe 31 PID 2900 wrote to memory of 2780 2900 SAM X222C#.exe 31 PID 2900 wrote to memory of 2780 2900 SAM X222C#.exe 31 PID 2780 wrote to memory of 3052 2780 SAM X222C#.exe 32 PID 2780 wrote to memory of 3052 2780 SAM X222C#.exe 32 PID 2780 wrote to memory of 3052 2780 SAM X222C#.exe 32 PID 2780 wrote to memory of 3052 2780 SAM X222C#.exe 32 PID 2780 wrote to memory of 3048 2780 SAM X222C#.exe 33 PID 2780 wrote to memory of 3048 2780 SAM X222C#.exe 33 PID 2780 wrote to memory of 3048 2780 SAM X222C#.exe 33 PID 2780 wrote to memory of 3048 2780 SAM X222C#.exe 33 PID 3048 wrote to memory of 2712 3048 SAM X222C#.exe 34 PID 3048 wrote to memory of 2712 3048 SAM X222C#.exe 34 PID 3048 wrote to memory of 2712 3048 SAM X222C#.exe 34 PID 3048 wrote to memory of 2712 3048 SAM X222C#.exe 34 PID 3048 wrote to memory of 2980 3048 SAM X222C#.exe 35 PID 3048 wrote to memory of 2980 3048 SAM X222C#.exe 35 PID 3048 wrote to memory of 2980 3048 SAM X222C#.exe 35 PID 3048 wrote to memory of 2980 3048 SAM X222C#.exe 35 PID 2980 wrote to memory of 2884 2980 SAM X222C#.exe 36 PID 2980 wrote to memory of 2884 2980 SAM X222C#.exe 36 PID 2980 wrote to memory of 2884 2980 SAM X222C#.exe 36 PID 2980 wrote to memory of 2884 2980 SAM X222C#.exe 36 PID 2980 wrote to memory of 2932 2980 SAM X222C#.exe 37 PID 2980 wrote to memory of 2932 2980 SAM X222C#.exe 37 PID 2980 wrote to memory of 2932 2980 SAM X222C#.exe 37 PID 2980 wrote to memory of 2932 2980 SAM X222C#.exe 37 PID 2932 wrote to memory of 2676 2932 SAM X222C#.exe 38 PID 2932 wrote to memory of 2676 2932 SAM X222C#.exe 38 PID 2932 wrote to memory of 2676 2932 SAM X222C#.exe 38 PID 2932 wrote to memory of 2676 2932 SAM X222C#.exe 38 PID 2932 wrote to memory of 2692 2932 SAM X222C#.exe 39 PID 2932 wrote to memory of 2692 2932 SAM X222C#.exe 39 PID 2932 wrote to memory of 2692 2932 SAM X222C#.exe 39 PID 2932 wrote to memory of 2692 2932 SAM X222C#.exe 39 PID 2692 wrote to memory of 2796 2692 SAM X222C#.exe 40 PID 2692 wrote to memory of 2796 2692 SAM X222C#.exe 40 PID 2692 wrote to memory of 2796 2692 SAM X222C#.exe 40 PID 2692 wrote to memory of 2796 2692 SAM X222C#.exe 40 PID 2692 wrote to memory of 2228 2692 SAM X222C#.exe 41 PID 2692 wrote to memory of 2228 2692 SAM X222C#.exe 41 PID 2692 wrote to memory of 2228 2692 SAM X222C#.exe 41 PID 2692 wrote to memory of 2228 2692 SAM X222C#.exe 41 PID 2228 wrote to memory of 1456 2228 SAM X222C#.exe 42 PID 2228 wrote to memory of 1456 2228 SAM X222C#.exe 42 PID 2228 wrote to memory of 1456 2228 SAM X222C#.exe 42 PID 2228 wrote to memory of 1456 2228 SAM X222C#.exe 42 PID 2228 wrote to memory of 1120 2228 SAM X222C#.exe 88 PID 2228 wrote to memory of 1120 2228 SAM X222C#.exe 88 PID 2228 wrote to memory of 1120 2228 SAM X222C#.exe 88 PID 2228 wrote to memory of 1120 2228 SAM X222C#.exe 88 PID 1120 wrote to memory of 3012 1120 SAM X222C#.exe 44 PID 1120 wrote to memory of 3012 1120 SAM X222C#.exe 44 PID 1120 wrote to memory of 3012 1120 SAM X222C#.exe 44 PID 1120 wrote to memory of 3012 1120 SAM X222C#.exe 44 PID 1120 wrote to memory of 2332 1120 SAM X222C#.exe 125 PID 1120 wrote to memory of 2332 1120 SAM X222C#.exe 125 PID 1120 wrote to memory of 2332 1120 SAM X222C#.exe 125 PID 1120 wrote to memory of 2332 1120 SAM X222C#.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2220
-
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"9⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"10⤵
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"11⤵
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"14⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"15⤵
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"16⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"17⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"18⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"19⤵
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"20⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"21⤵
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"23⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"24⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"25⤵
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"26⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"27⤵
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"28⤵
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"29⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"30⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"31⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"32⤵
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"33⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"34⤵
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"35⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"36⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"37⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"38⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"39⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"40⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"41⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"43⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"44⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"45⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:564 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"46⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"47⤵
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"48⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"49⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"50⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"51⤵
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"53⤵
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"54⤵
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"55⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:936 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"56⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"57⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:112 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"58⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"59⤵
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"60⤵
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"61⤵
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"63⤵
- Executes dropped EXE
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"63⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"64⤵
- Executes dropped EXE
PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"64⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"65⤵
- Executes dropped EXE
PID:368
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"65⤵
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"66⤵PID:964
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"66⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"67⤵PID:1848
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"67⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"68⤵PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"68⤵
- System Location Discovery: System Language Discovery
PID:304 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"69⤵PID:1464
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"69⤵
- System Location Discovery: System Language Discovery
PID:840 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"70⤵PID:880
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"70⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"71⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"71⤵
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"72⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"72⤵
- System Location Discovery: System Language Discovery
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"73⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"73⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"74⤵PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"74⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"75⤵PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"75⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"76⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"76⤵
- System Location Discovery: System Language Discovery
PID:564 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"77⤵PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"77⤵
- System Location Discovery: System Language Discovery
PID:688 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"78⤵PID:320
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"78⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"79⤵PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"79⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"80⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"80⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"81⤵PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"81⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"82⤵PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"82⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"83⤵PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"83⤵
- System Location Discovery: System Language Discovery
PID:524 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"84⤵PID:588
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"84⤵
- System Location Discovery: System Language Discovery
PID:580 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"85⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"85⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"86⤵PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"86⤵
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"87⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"87⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"88⤵PID:772
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"88⤵
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"89⤵PID:1664
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"89⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"90⤵PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"90⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"91⤵PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"91⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"92⤵PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"92⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"93⤵PID:592
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"93⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"94⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"94⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"95⤵PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"95⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"96⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"96⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"97⤵PID:2408
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"97⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"98⤵PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"98⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"99⤵PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"99⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"100⤵PID:1028
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"100⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"101⤵PID:332
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"101⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"102⤵PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"102⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"103⤵PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"103⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"104⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"104⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"105⤵PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"105⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"106⤵PID:888
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"106⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"107⤵PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"107⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"108⤵PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"108⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"109⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"109⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"110⤵PID:700
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"110⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"111⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"111⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"112⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"112⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"113⤵PID:1792
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"113⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"114⤵PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"114⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"115⤵PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"115⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"116⤵PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"116⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"117⤵PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"117⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"118⤵PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"118⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"119⤵PID:1468
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"119⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"120⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"120⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"121⤵PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"C:\Users\Admin\AppData\Local\Temp\SAM X222C#.exe"121⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-