Analysis
-
max time kernel
44s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 18:53
General
-
Target
SAM CHEAT bypass.exe
-
Size
762KB
-
MD5
5dde6a5017cbb35cf1710069cf9be274
-
SHA1
a2bb6090abf23364d36210c6fc8ac2c28f8234d2
-
SHA256
83b5438b0b9aebf778440dcb77eb52b0231133487bdb3b372a91523505ab63c2
-
SHA512
c7584c7feb4a90feb330a4c0a7e13ca1e785bea150873f30d61f420d6c917e9cd24f69fcb9acf2fe5b8aa1218abb6ea6f0ca1e76d01a8c70bcf95dffe279031b
-
SSDEEP
12288:5MsLc8V26+8XwREFqAgkRnQWTCoA8JmxfBdEAMjAaDvxCxRc:5MsAT89FDL6oLmhYDjXD4Rc
Score
10/10
Malware Config
Extracted
Family
xworm
C2
147.185.221.23:58112
Attributes
-
Install_directory
%AppData%
-
install_file
Realtek HD Audio Universal Service.exe
Extracted
Family
xworm
Version
5.0
C2
147.185.221.20:65300
Mutex
RMe1pa1UgjNcB2Un
Attributes
-
Install_directory
%AppData%
-
install_file
Windows Shell Experience Host.exe
aes.plain
Signatures
-
Detect Xworm Payload 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 64 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"17⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"21⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"22⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"27⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"31⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"32⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"33⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"33⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"33⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"35⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"36⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"40⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"42⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"43⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"45⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"47⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"49⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"51⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"51⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"52⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"54⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"54⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"55⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"57⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"57⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"58⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"60⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"60⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"61⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"61⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"62⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"62⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"63⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"63⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"63⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"64⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"64⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"65⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"65⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"66⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"66⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"67⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"67⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"68⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"68⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"69⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"69⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"69⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"70⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"70⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"71⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"71⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"72⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"72⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"73⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"73⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"74⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"74⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"74⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"75⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"75⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"75⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"76⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"76⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"77⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"77⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"77⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"78⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"78⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"78⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"79⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"79⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"80⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"81⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"81⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"81⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"83⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"83⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"83⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"84⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"84⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"84⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"86⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"86⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"86⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"88⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"89⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"89⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"90⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"90⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"91⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"92⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"93⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"93⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"93⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"94⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"94⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"95⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"95⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"95⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"96⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"96⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"97⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"99⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"100⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"100⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"100⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"101⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"102⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"102⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"102⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"103⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"104⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"104⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"104⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"105⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"106⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"108⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"108⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"108⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"109⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"110⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"110⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"110⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"111⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"112⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"112⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"113⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"113⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"113⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"114⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"114⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"117⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"118⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"118⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"120⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"120⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"C:\Users\Admin\AppData\Local\Temp\SAM CHEAT bypass.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-