Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Extra Xite...V5.exe
windows7-x64
10Extra Xite...V5.exe
windows10-2004-x64
10Extra Xite...V5.exe
windows7-x64
10Extra Xite...V5.exe
windows10-2004-x64
10Extra Xite...V5.exe
windows7-x64
1Extra Xite...V5.exe
windows10-2004-x64
1Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Analysis
-
max time kernel
53s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2024, 18:48
Behavioral task
behavioral1
Sample
Extra Xiters Premium V5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Extra Xiters Premium V5.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Extra Xiters Premium V5.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Extra Xiters Premium V5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Windows Shell Experience Host.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Windows Shell Experience Host.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
General
-
Target
Extra Xiters Premium V5.exe
-
Size
5.8MB
-
MD5
41ea3928c2700aeacdc9ed241d9aa033
-
SHA1
45ada2718ff189d4827d65a91215811cc4146471
-
SHA256
16203d565fa1fd81e1349b8d168c646cf2455431062ed9f2beac9155b7189883
-
SHA512
e567d85afec1ab16b8cee7f288a7072a73685414bc6ff3471e2769e73aa9e95f8a84a83aa36d8c157382e9906a26a2a0f9eaa7b2e766e4f41caf0e950e5d3a08
-
SSDEEP
98304:0ZmXPDwhA4u+aFyUo552ec2PsF1iSREmPsD9poItjZ1V33cEEzcrb1oI97x:0ZkLwhAt+IyZtPsb3Pm9pokZTnKib9x
Malware Config
Extracted
xworm
5.0
147.185.221.23:53638
147.185.221.20:65300
Itj6uNzPbdGmJ8JP
-
Install_directory
%LocalAppData%
-
install_file
Realtek HD Audio Universal Service.exe
Signatures
-
Detect Xworm Payload 4 IoCs
resource yara_rule behavioral4/files/0x000e000000023bba-5.dat family_xworm behavioral4/files/0x0008000000023bc3-15.dat family_xworm behavioral4/memory/740-23-0x0000000000A50000-0x0000000000A60000-memory.dmp family_xworm behavioral4/memory/976-24-0x0000000000A20000-0x0000000000A3A000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2296 powershell.exe 1904 powershell.exe 808 powershell.exe 3264 powershell.exe 1108 powershell.exe 1256 powershell.exe 2240 powershell.exe 3208 powershell.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Realtek HD Audio Universal Service.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Extra Xiters Premium V5.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk Windows Shell Experience Host.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk Windows Shell Experience Host.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek HD Audio Universal Service.lnk Realtek HD Audio Universal Service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek HD Audio Universal Service.lnk Realtek HD Audio Universal Service.exe -
Executes dropped EXE 64 IoCs
pid Process 740 Realtek HD Audio Universal Service.exe 976 Windows Shell Experience Host.exe 1488 Realtek HD Audio Universal Service.exe 4980 Windows Shell Experience Host.exe 4040 Realtek HD Audio Universal Service.exe 736 Windows Shell Experience Host.exe 2280 Realtek HD Audio Universal Service.exe 1844 Windows Shell Experience Host.exe 3088 Realtek HD Audio Universal Service.exe 1972 Windows Shell Experience Host.exe 3208 Realtek HD Audio Universal Service.exe 4480 Windows Shell Experience Host.exe 2572 Realtek HD Audio Universal Service.exe 1348 Windows Shell Experience Host.exe 516 Realtek HD Audio Universal Service.exe 2964 Windows Shell Experience Host.exe 2216 Realtek HD Audio Universal Service.exe 396 Windows Shell Experience Host.exe 3480 Realtek HD Audio Universal Service.exe 2328 Windows Shell Experience Host.exe 1540 Realtek HD Audio Universal Service.exe 1500 Windows Shell Experience Host.exe 2868 Realtek HD Audio Universal Service.exe 4012 Windows Shell Experience Host.exe 4644 Realtek HD Audio Universal Service.exe 1236 Windows Shell Experience Host.exe 4400 Realtek HD Audio Universal Service.exe 812 Windows Shell Experience Host.exe 4584 Realtek HD Audio Universal Service.exe 4540 Windows Shell Experience Host.exe 1232 Realtek HD Audio Universal Service.exe 1076 Windows Shell Experience Host.exe 4868 Realtek HD Audio Universal Service.exe 4848 Windows Shell Experience Host.exe 1560 Realtek HD Audio Universal Service.exe 2440 Windows Shell Experience Host.exe 5092 Realtek HD Audio Universal Service.exe 4764 Windows Shell Experience Host.exe 3708 Realtek HD Audio Universal Service.exe 4092 Windows Shell Experience Host.exe 1260 Realtek HD Audio Universal Service.exe 2852 Windows Shell Experience Host.exe 1480 Realtek HD Audio Universal Service.exe 4028 Windows Shell Experience Host.exe 3728 Realtek HD Audio Universal Service.exe 1972 Windows Shell Experience Host.exe 4160 Realtek HD Audio Universal Service.exe 4116 Windows Shell Experience Host.exe 4080 Realtek HD Audio Universal Service.exe 516 Windows Shell Experience Host.exe 2332 Realtek HD Audio Universal Service.exe 1068 Windows Shell Experience Host.exe 3156 Realtek HD Audio Universal Service.exe 4620 Windows Shell Experience Host.exe 4040 Realtek HD Audio Universal Service.exe 3840 Windows Shell Experience Host.exe 4836 Realtek HD Audio Universal Service.exe 2124 Windows Shell Experience Host.exe 680 Realtek HD Audio Universal Service.exe 2620 Windows Shell Experience Host.exe 3740 Realtek HD Audio Universal Service.exe 4384 Windows Shell Experience Host.exe 756 Realtek HD Audio Universal Service.exe 1980 Windows Shell Experience Host.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Shell Experience Host = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Shell Experience Host.exe" Windows Shell Experience Host.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Extra Xiters Premium V5.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1256 powershell.exe 1256 powershell.exe 1108 powershell.exe 1108 powershell.exe 1256 powershell.exe 1108 powershell.exe 2240 powershell.exe 2240 powershell.exe 2240 powershell.exe 3208 powershell.exe 3208 powershell.exe 2296 powershell.exe 2296 powershell.exe 3208 powershell.exe 2296 powershell.exe 1904 powershell.exe 1904 powershell.exe 808 powershell.exe 808 powershell.exe 808 powershell.exe 1904 powershell.exe 3264 powershell.exe 3264 powershell.exe 3264 powershell.exe 740 Realtek HD Audio Universal Service.exe 740 Realtek HD Audio Universal Service.exe 976 Windows Shell Experience Host.exe 976 Windows Shell Experience Host.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 740 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 976 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1488 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4980 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4040 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 736 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2280 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1844 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3088 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1972 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3208 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4480 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2572 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1348 Windows Shell Experience Host.exe Token: SeDebugPrivilege 516 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2964 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2216 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 396 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3480 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2328 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1540 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1500 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2868 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4012 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4644 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1236 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4400 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 812 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4584 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4540 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1232 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1076 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4868 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4848 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2440 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1560 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 5092 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4764 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3708 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4092 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1260 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2852 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1256 powershell.exe Token: SeDebugPrivilege 1108 powershell.exe Token: SeDebugPrivilege 1480 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4028 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1972 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3728 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4160 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4116 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2240 powershell.exe Token: SeDebugPrivilege 4080 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 516 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3208 powershell.exe Token: SeDebugPrivilege 2332 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1068 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2296 powershell.exe Token: SeDebugPrivilege 3156 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4620 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4040 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3840 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4836 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1904 powershell.exe Token: SeDebugPrivilege 808 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 740 Realtek HD Audio Universal Service.exe 976 Windows Shell Experience Host.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 740 4060 Extra Xiters Premium V5.exe 84 PID 4060 wrote to memory of 740 4060 Extra Xiters Premium V5.exe 84 PID 4060 wrote to memory of 976 4060 Extra Xiters Premium V5.exe 85 PID 4060 wrote to memory of 976 4060 Extra Xiters Premium V5.exe 85 PID 4060 wrote to memory of 384 4060 Extra Xiters Premium V5.exe 86 PID 4060 wrote to memory of 384 4060 Extra Xiters Premium V5.exe 86 PID 4060 wrote to memory of 384 4060 Extra Xiters Premium V5.exe 86 PID 384 wrote to memory of 1488 384 Extra Xiters Premium V5.exe 88 PID 384 wrote to memory of 1488 384 Extra Xiters Premium V5.exe 88 PID 384 wrote to memory of 4980 384 Extra Xiters Premium V5.exe 89 PID 384 wrote to memory of 4980 384 Extra Xiters Premium V5.exe 89 PID 384 wrote to memory of 3676 384 Extra Xiters Premium V5.exe 90 PID 384 wrote to memory of 3676 384 Extra Xiters Premium V5.exe 90 PID 384 wrote to memory of 3676 384 Extra Xiters Premium V5.exe 90 PID 3676 wrote to memory of 4040 3676 Extra Xiters Premium V5.exe 92 PID 3676 wrote to memory of 4040 3676 Extra Xiters Premium V5.exe 92 PID 3676 wrote to memory of 736 3676 Extra Xiters Premium V5.exe 93 PID 3676 wrote to memory of 736 3676 Extra Xiters Premium V5.exe 93 PID 3676 wrote to memory of 1352 3676 Extra Xiters Premium V5.exe 134 PID 3676 wrote to memory of 1352 3676 Extra Xiters Premium V5.exe 134 PID 3676 wrote to memory of 1352 3676 Extra Xiters Premium V5.exe 134 PID 1352 wrote to memory of 2280 1352 Extra Xiters Premium V5.exe 95 PID 1352 wrote to memory of 2280 1352 Extra Xiters Premium V5.exe 95 PID 1352 wrote to memory of 1844 1352 Extra Xiters Premium V5.exe 96 PID 1352 wrote to memory of 1844 1352 Extra Xiters Premium V5.exe 96 PID 1352 wrote to memory of 2820 1352 Extra Xiters Premium V5.exe 97 PID 1352 wrote to memory of 2820 1352 Extra Xiters Premium V5.exe 97 PID 1352 wrote to memory of 2820 1352 Extra Xiters Premium V5.exe 97 PID 2820 wrote to memory of 3088 2820 Extra Xiters Premium V5.exe 98 PID 2820 wrote to memory of 3088 2820 Extra Xiters Premium V5.exe 98 PID 2820 wrote to memory of 1972 2820 Extra Xiters Premium V5.exe 158 PID 2820 wrote to memory of 1972 2820 Extra Xiters Premium V5.exe 158 PID 2820 wrote to memory of 3272 2820 Extra Xiters Premium V5.exe 196 PID 2820 wrote to memory of 3272 2820 Extra Xiters Premium V5.exe 196 PID 2820 wrote to memory of 3272 2820 Extra Xiters Premium V5.exe 196 PID 3272 wrote to memory of 3208 3272 Extra Xiters Premium V5.exe 168 PID 3272 wrote to memory of 3208 3272 Extra Xiters Premium V5.exe 168 PID 3272 wrote to memory of 4480 3272 Extra Xiters Premium V5.exe 200 PID 3272 wrote to memory of 4480 3272 Extra Xiters Premium V5.exe 200 PID 3272 wrote to memory of 4848 3272 Extra Xiters Premium V5.exe 136 PID 3272 wrote to memory of 4848 3272 Extra Xiters Premium V5.exe 136 PID 3272 wrote to memory of 4848 3272 Extra Xiters Premium V5.exe 136 PID 4848 wrote to memory of 2572 4848 Extra Xiters Premium V5.exe 104 PID 4848 wrote to memory of 2572 4848 Extra Xiters Premium V5.exe 104 PID 4848 wrote to memory of 1348 4848 Extra Xiters Premium V5.exe 105 PID 4848 wrote to memory of 1348 4848 Extra Xiters Premium V5.exe 105 PID 4848 wrote to memory of 456 4848 Extra Xiters Premium V5.exe 106 PID 4848 wrote to memory of 456 4848 Extra Xiters Premium V5.exe 106 PID 4848 wrote to memory of 456 4848 Extra Xiters Premium V5.exe 106 PID 456 wrote to memory of 516 456 Extra Xiters Premium V5.exe 166 PID 456 wrote to memory of 516 456 Extra Xiters Premium V5.exe 166 PID 456 wrote to memory of 2964 456 Extra Xiters Premium V5.exe 235 PID 456 wrote to memory of 2964 456 Extra Xiters Premium V5.exe 235 PID 456 wrote to memory of 4192 456 Extra Xiters Premium V5.exe 109 PID 456 wrote to memory of 4192 456 Extra Xiters Premium V5.exe 109 PID 456 wrote to memory of 4192 456 Extra Xiters Premium V5.exe 109 PID 4192 wrote to memory of 2216 4192 Extra Xiters Premium V5.exe 110 PID 4192 wrote to memory of 2216 4192 Extra Xiters Premium V5.exe 110 PID 4192 wrote to memory of 396 4192 Extra Xiters Premium V5.exe 111 PID 4192 wrote to memory of 396 4192 Extra Xiters Premium V5.exe 111 PID 4192 wrote to memory of 2784 4192 Extra Xiters Premium V5.exe 112 PID 4192 wrote to memory of 2784 4192 Extra Xiters Premium V5.exe 112 PID 4192 wrote to memory of 2784 4192 Extra Xiters Premium V5.exe 112 PID 2784 wrote to memory of 3480 2784 Extra Xiters Premium V5.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3264
-
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"11⤵
- System Location Discovery: System Language Discovery
PID:668 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"12⤵
- Checks computer location settings
PID:916 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"13⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"14⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"15⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"16⤵
- Checks computer location settings
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"17⤵
- Checks computer location settings
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"18⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"19⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"20⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"21⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"22⤵
- System Location Discovery: System Language Discovery
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"23⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"26⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"27⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"28⤵
- Checks computer location settings
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"29⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"30⤵
- Executes dropped EXE
PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"30⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"31⤵
- Executes dropped EXE
PID:680
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"31⤵
- Executes dropped EXE
PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"31⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"32⤵
- Executes dropped EXE
PID:3740
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"32⤵
- Executes dropped EXE
PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"32⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"33⤵
- Executes dropped EXE
PID:756
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"33⤵
- Executes dropped EXE
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"33⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"34⤵PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"34⤵PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"34⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"35⤵PID:5016
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"35⤵PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"35⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"36⤵PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"36⤵PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"36⤵
- Checks computer location settings
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"37⤵PID:2224
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"37⤵PID:668
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"37⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"38⤵PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"38⤵PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"38⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"39⤵PID:4568
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"39⤵PID:3752
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"39⤵
- System Location Discovery: System Language Discovery
PID:212 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"40⤵PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"40⤵PID:3268
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"40⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"41⤵PID:1948
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"41⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"41⤵
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"42⤵PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"42⤵PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"42⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"43⤵PID:4956
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"43⤵PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"43⤵
- Checks computer location settings
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"44⤵PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"44⤵PID:4428
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"44⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"45⤵PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"45⤵PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"45⤵
- Checks computer location settings
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"46⤵PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"46⤵PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"46⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"47⤵PID:880
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"47⤵PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"47⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"48⤵PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"48⤵PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"48⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"49⤵PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"49⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"49⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"50⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"50⤵PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"50⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"51⤵PID:3584
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"51⤵PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"51⤵
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"52⤵PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"52⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"52⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"53⤵PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"53⤵PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"53⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"54⤵PID:532
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"54⤵PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"54⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"55⤵PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"55⤵PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"55⤵
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"56⤵PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"56⤵PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"56⤵
- Checks computer location settings
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"57⤵PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"57⤵PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"57⤵
- Checks computer location settings
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"58⤵PID:3708
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"58⤵PID:312
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"58⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"59⤵PID:4588
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"59⤵PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"59⤵
- System Location Discovery: System Language Discovery
PID:336 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"60⤵PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"60⤵PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"60⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"61⤵PID:3776
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"61⤵PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"61⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"62⤵PID:3736
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"62⤵PID:3824
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"62⤵
- System Location Discovery: System Language Discovery
PID:8 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"63⤵PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"63⤵PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"63⤵
- Checks computer location settings
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"64⤵PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"64⤵PID:3820
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"64⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"65⤵PID:4436
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"65⤵PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"65⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"66⤵PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"66⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"66⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"67⤵PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"67⤵PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"67⤵
- Checks computer location settings
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"68⤵PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"68⤵PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"68⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"69⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"69⤵PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"69⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"70⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"70⤵PID:724
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"70⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"71⤵PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"71⤵PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"71⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"72⤵PID:440
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"72⤵PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"72⤵
- Checks computer location settings
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"73⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"73⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"73⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"74⤵PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"74⤵PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"74⤵
- Checks computer location settings
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"75⤵PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"75⤵PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"75⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"76⤵PID:680
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"76⤵PID:3096
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"76⤵
- Checks computer location settings
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"77⤵PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"77⤵PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"77⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"78⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"78⤵PID:3520
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"78⤵
- Checks computer location settings
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"79⤵PID:3332
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"79⤵PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"79⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"80⤵PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"80⤵PID:4840
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"80⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"81⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"81⤵PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"81⤵
- Checks computer location settings
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"82⤵PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"82⤵PID:3368
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"82⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"83⤵PID:3992
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"83⤵PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"83⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"84⤵PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"84⤵PID:668
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"84⤵
- Checks computer location settings
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"85⤵PID:4992
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"85⤵PID:3820
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"85⤵
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"86⤵PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"86⤵PID:4856
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"86⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"87⤵PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"87⤵PID:4636
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"87⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"88⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"88⤵PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"88⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"89⤵PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"89⤵PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"89⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"90⤵PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"90⤵PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"90⤵
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"91⤵PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"91⤵PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"91⤵
- Checks computer location settings
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"92⤵PID:5176
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"92⤵PID:5200
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"92⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"93⤵PID:5288
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"93⤵PID:5304
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"93⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"94⤵PID:5404
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"94⤵PID:5420
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"94⤵
- System Location Discovery: System Language Discovery
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"95⤵PID:5516
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"95⤵PID:5524
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"95⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"96⤵PID:5628
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"96⤵PID:5644
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"96⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"97⤵PID:5744
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"97⤵PID:5752
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"97⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"98⤵PID:5860
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"98⤵PID:5872
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"98⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"99⤵PID:5972
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"99⤵PID:5980
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"99⤵
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"100⤵PID:6084
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"100⤵PID:6092
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"100⤵
- System Location Discovery: System Language Discovery
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"101⤵PID:4744
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"101⤵PID:5156
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"101⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"102⤵PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"102⤵PID:5244
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"102⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"103⤵PID:5356
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"103⤵PID:5352
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"103⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:980 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"104⤵PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"104⤵PID:4032
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"104⤵
- Checks computer location settings
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"105⤵PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"105⤵PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"105⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"106⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"106⤵PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"106⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"107⤵PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"107⤵PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"107⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"108⤵PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"108⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"108⤵
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"109⤵PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"109⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"109⤵
- Checks computer location settings
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"110⤵PID:6076
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"110⤵PID:6040
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"110⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"111⤵PID:724
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"111⤵PID:6140
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"111⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"112⤵PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"112⤵PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"112⤵
- Checks computer location settings
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"113⤵PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"113⤵PID:1348
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"113⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"114⤵PID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"114⤵PID:4580
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"114⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"115⤵PID:3708
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"115⤵PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"115⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"116⤵PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"116⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"116⤵
- System Location Discovery: System Language Discovery
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"117⤵PID:5828
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"117⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"117⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"118⤵PID:5960
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"118⤵PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"118⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"119⤵PID:6072
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"119⤵PID:5896
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"119⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"120⤵PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"120⤵PID:5188
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"120⤵
- Checks computer location settings
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"121⤵PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"121⤵PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"C:\Users\Admin\AppData\Local\Temp\Extra Xiters Premium V5.exe"121⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"122⤵PID:5136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-