Overview
overview
10Static
static
10SAM X CHEA...k1.exe
windows7-x64
10SAM X CHEA...k1.exe
windows10-2004-x64
10Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10SAM X CHEA...k1.exe
windows7-x64
6SAM X CHEA...k1.exe
windows10-2004-x64
6Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Analysis
-
max time kernel
42s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 18:51
Behavioral task
behavioral1
Sample
SAM X CHEAT crack1.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
SAM X CHEAT crack1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
SAM X CHEAT crack1.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
SAM X CHEAT crack1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Windows Shell Experience Host.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
General
-
Target
SAM X CHEAT crack1.exe
-
Size
3.1MB
-
MD5
82a95b30418e5c4c3cba62b7805b09c9
-
SHA1
4921781362aae55b41c03f9aafd9e38e4555e5e3
-
SHA256
3ac3efee88adab86a250a53dd9448453fcc4223662f5c6c21453606b6eb91b77
-
SHA512
5775e02245ee0158f8f99796edc448a79f580f9c8c6c4188b491084eb9cecf48a341c3231ece8be43e005882a05dfe24dea98aeafbebe3bde0c2ef30cca9dc8b
-
SSDEEP
49152:opVFMHivibdm/rr3TxQrl18gOCNWofUNRvO3NwSS3Br+BT/KrqqXVbCuuTQjMk4P:KV4K2GTpCNJXWMxKrrlvsQRG9AmB
Malware Config
Extracted
xworm
147.185.221.23:58112
-
Install_directory
%AppData%
-
install_file
Realtek HD Audio Universal Service.exe
Extracted
xworm
5.0
147.185.221.20:65300
RMe1pa1UgjNcB2Un
-
Install_directory
%AppData%
-
install_file
Windows Shell Experience Host.exe
Signatures
-
Detect Xworm Payload 4 IoCs
resource yara_rule behavioral2/files/0x0009000000023caf-5.dat family_xworm behavioral2/files/0x0007000000023cb0-15.dat family_xworm behavioral2/memory/4828-23-0x0000000000BC0000-0x0000000000BD4000-memory.dmp family_xworm behavioral2/memory/4768-24-0x0000000000180000-0x000000000019A000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2092 powershell.exe 4356 powershell.exe 956 powershell.exe 1268 powershell.exe 4820 powershell.exe 4740 powershell.exe 2144 powershell.exe 3300 powershell.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation SAM X CHEAT crack1.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk Windows Shell Experience Host.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk Windows Shell Experience Host.exe -
Executes dropped EXE 64 IoCs
pid Process 4828 Realtek HD Audio Universal Service.exe 4768 Windows Shell Experience Host.exe 2840 Realtek HD Audio Universal Service.exe 4028 Windows Shell Experience Host.exe 2784 Realtek HD Audio Universal Service.exe 540 Windows Shell Experience Host.exe 1160 Realtek HD Audio Universal Service.exe 3552 Windows Shell Experience Host.exe 1592 Realtek HD Audio Universal Service.exe 4300 Windows Shell Experience Host.exe 1148 Realtek HD Audio Universal Service.exe 2992 Windows Shell Experience Host.exe 3900 Realtek HD Audio Universal Service.exe 2436 Windows Shell Experience Host.exe 4376 Realtek HD Audio Universal Service.exe 4800 Windows Shell Experience Host.exe 1176 Realtek HD Audio Universal Service.exe 1956 Windows Shell Experience Host.exe 4268 Realtek HD Audio Universal Service.exe 2612 Windows Shell Experience Host.exe 3328 Realtek HD Audio Universal Service.exe 3452 Windows Shell Experience Host.exe 3928 Realtek HD Audio Universal Service.exe 3496 Windows Shell Experience Host.exe 1304 Realtek HD Audio Universal Service.exe 3252 Windows Shell Experience Host.exe 5020 Realtek HD Audio Universal Service.exe 720 Windows Shell Experience Host.exe 1492 Realtek HD Audio Universal Service.exe 4680 Windows Shell Experience Host.exe 1800 Realtek HD Audio Universal Service.exe 3544 Windows Shell Experience Host.exe 224 Realtek HD Audio Universal Service.exe 1368 Windows Shell Experience Host.exe 536 Realtek HD Audio Universal Service.exe 1628 Windows Shell Experience Host.exe 4084 Realtek HD Audio Universal Service.exe 1340 Windows Shell Experience Host.exe 4888 Realtek HD Audio Universal Service.exe 4104 Windows Shell Experience Host.exe 2232 Realtek HD Audio Universal Service.exe 2648 Windows Shell Experience Host.exe 4508 Realtek HD Audio Universal Service.exe 2524 Windows Shell Experience Host.exe 2928 Realtek HD Audio Universal Service.exe 4880 Windows Shell Experience Host.exe 2484 Realtek HD Audio Universal Service.exe 744 Windows Shell Experience Host.exe 3668 Realtek HD Audio Universal Service.exe 4908 Windows Shell Experience Host.exe 2212 Realtek HD Audio Universal Service.exe 2736 Windows Shell Experience Host.exe 4028 Realtek HD Audio Universal Service.exe 768 Windows Shell Experience Host.exe 1264 Realtek HD Audio Universal Service.exe 2436 Windows Shell Experience Host.exe 1104 Realtek HD Audio Universal Service.exe 1712 Windows Shell Experience Host.exe 4004 Realtek HD Audio Universal Service.exe 3652 Windows Shell Experience Host.exe 3116 Realtek HD Audio Universal Service.exe 4064 Windows Shell Experience Host.exe 2840 Realtek HD Audio Universal Service.exe 1744 Windows Shell Experience Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Service.exe" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Shell Experience Host = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Shell Experience Host.exe" Windows Shell Experience Host.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAM X CHEAT crack1.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3300 powershell.exe 3300 powershell.exe 2092 powershell.exe 2092 powershell.exe 3300 powershell.exe 2092 powershell.exe 4356 powershell.exe 4356 powershell.exe 4356 powershell.exe 956 powershell.exe 956 powershell.exe 956 powershell.exe 1268 powershell.exe 1268 powershell.exe 4820 powershell.exe 4820 powershell.exe 4820 powershell.exe 1268 powershell.exe 4740 powershell.exe 4740 powershell.exe 2144 powershell.exe 2144 powershell.exe 4740 powershell.exe 2144 powershell.exe 4828 Realtek HD Audio Universal Service.exe 4828 Realtek HD Audio Universal Service.exe 4768 Windows Shell Experience Host.exe 4768 Windows Shell Experience Host.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4828 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4768 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2840 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4028 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2784 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 540 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1160 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3552 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1592 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4300 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2992 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1148 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2436 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3900 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4376 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4800 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1176 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1956 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4268 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2612 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3328 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3452 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3928 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3496 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1304 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3252 Windows Shell Experience Host.exe Token: SeDebugPrivilege 5020 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 720 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1492 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4680 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1800 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3544 Windows Shell Experience Host.exe Token: SeDebugPrivilege 224 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1368 Windows Shell Experience Host.exe Token: SeDebugPrivilege 536 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1628 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3300 powershell.exe Token: SeDebugPrivilege 2092 powershell.exe Token: SeDebugPrivilege 4084 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1340 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4888 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4104 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2232 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2648 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4356 powershell.exe Token: SeDebugPrivilege 2524 Windows Shell Experience Host.exe Token: SeDebugPrivilege 4508 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2928 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4880 Windows Shell Experience Host.exe Token: SeDebugPrivilege 956 powershell.exe Token: SeDebugPrivilege 2484 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 744 Windows Shell Experience Host.exe Token: SeDebugPrivilege 3668 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4908 Windows Shell Experience Host.exe Token: SeDebugPrivilege 2212 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2736 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1268 powershell.exe Token: SeDebugPrivilege 4820 powershell.exe Token: SeDebugPrivilege 4028 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 768 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1264 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2436 Windows Shell Experience Host.exe Token: SeDebugPrivilege 1104 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4740 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4828 Realtek HD Audio Universal Service.exe 4768 Windows Shell Experience Host.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 4828 4532 SAM X CHEAT crack1.exe 82 PID 4532 wrote to memory of 4828 4532 SAM X CHEAT crack1.exe 82 PID 4532 wrote to memory of 4768 4532 SAM X CHEAT crack1.exe 83 PID 4532 wrote to memory of 4768 4532 SAM X CHEAT crack1.exe 83 PID 4532 wrote to memory of 664 4532 SAM X CHEAT crack1.exe 84 PID 4532 wrote to memory of 664 4532 SAM X CHEAT crack1.exe 84 PID 4532 wrote to memory of 664 4532 SAM X CHEAT crack1.exe 84 PID 664 wrote to memory of 2840 664 SAM X CHEAT crack1.exe 85 PID 664 wrote to memory of 2840 664 SAM X CHEAT crack1.exe 85 PID 664 wrote to memory of 4028 664 SAM X CHEAT crack1.exe 86 PID 664 wrote to memory of 4028 664 SAM X CHEAT crack1.exe 86 PID 664 wrote to memory of 4924 664 SAM X CHEAT crack1.exe 87 PID 664 wrote to memory of 4924 664 SAM X CHEAT crack1.exe 87 PID 664 wrote to memory of 4924 664 SAM X CHEAT crack1.exe 87 PID 4924 wrote to memory of 2784 4924 SAM X CHEAT crack1.exe 88 PID 4924 wrote to memory of 2784 4924 SAM X CHEAT crack1.exe 88 PID 4924 wrote to memory of 540 4924 SAM X CHEAT crack1.exe 89 PID 4924 wrote to memory of 540 4924 SAM X CHEAT crack1.exe 89 PID 4924 wrote to memory of 2368 4924 SAM X CHEAT crack1.exe 90 PID 4924 wrote to memory of 2368 4924 SAM X CHEAT crack1.exe 90 PID 4924 wrote to memory of 2368 4924 SAM X CHEAT crack1.exe 90 PID 2368 wrote to memory of 1160 2368 SAM X CHEAT crack1.exe 91 PID 2368 wrote to memory of 1160 2368 SAM X CHEAT crack1.exe 91 PID 2368 wrote to memory of 3552 2368 SAM X CHEAT crack1.exe 92 PID 2368 wrote to memory of 3552 2368 SAM X CHEAT crack1.exe 92 PID 2368 wrote to memory of 4204 2368 SAM X CHEAT crack1.exe 93 PID 2368 wrote to memory of 4204 2368 SAM X CHEAT crack1.exe 93 PID 2368 wrote to memory of 4204 2368 SAM X CHEAT crack1.exe 93 PID 4204 wrote to memory of 1592 4204 SAM X CHEAT crack1.exe 94 PID 4204 wrote to memory of 1592 4204 SAM X CHEAT crack1.exe 94 PID 4204 wrote to memory of 4300 4204 SAM X CHEAT crack1.exe 95 PID 4204 wrote to memory of 4300 4204 SAM X CHEAT crack1.exe 95 PID 4204 wrote to memory of 220 4204 SAM X CHEAT crack1.exe 96 PID 4204 wrote to memory of 220 4204 SAM X CHEAT crack1.exe 96 PID 4204 wrote to memory of 220 4204 SAM X CHEAT crack1.exe 96 PID 220 wrote to memory of 1148 220 SAM X CHEAT crack1.exe 97 PID 220 wrote to memory of 1148 220 SAM X CHEAT crack1.exe 97 PID 220 wrote to memory of 2992 220 SAM X CHEAT crack1.exe 98 PID 220 wrote to memory of 2992 220 SAM X CHEAT crack1.exe 98 PID 220 wrote to memory of 3740 220 SAM X CHEAT crack1.exe 136 PID 220 wrote to memory of 3740 220 SAM X CHEAT crack1.exe 136 PID 220 wrote to memory of 3740 220 SAM X CHEAT crack1.exe 136 PID 3740 wrote to memory of 3900 3740 SAM X CHEAT crack1.exe 100 PID 3740 wrote to memory of 3900 3740 SAM X CHEAT crack1.exe 100 PID 3740 wrote to memory of 2436 3740 SAM X CHEAT crack1.exe 181 PID 3740 wrote to memory of 2436 3740 SAM X CHEAT crack1.exe 181 PID 3740 wrote to memory of 3980 3740 SAM X CHEAT crack1.exe 184 PID 3740 wrote to memory of 3980 3740 SAM X CHEAT crack1.exe 184 PID 3740 wrote to memory of 3980 3740 SAM X CHEAT crack1.exe 184 PID 3980 wrote to memory of 4376 3980 SAM X CHEAT crack1.exe 202 PID 3980 wrote to memory of 4376 3980 SAM X CHEAT crack1.exe 202 PID 3980 wrote to memory of 4800 3980 SAM X CHEAT crack1.exe 104 PID 3980 wrote to memory of 4800 3980 SAM X CHEAT crack1.exe 104 PID 3980 wrote to memory of 1388 3980 SAM X CHEAT crack1.exe 105 PID 3980 wrote to memory of 1388 3980 SAM X CHEAT crack1.exe 105 PID 3980 wrote to memory of 1388 3980 SAM X CHEAT crack1.exe 105 PID 1388 wrote to memory of 1176 1388 SAM X CHEAT crack1.exe 108 PID 1388 wrote to memory of 1176 1388 SAM X CHEAT crack1.exe 108 PID 1388 wrote to memory of 1956 1388 SAM X CHEAT crack1.exe 163 PID 1388 wrote to memory of 1956 1388 SAM X CHEAT crack1.exe 163 PID 1388 wrote to memory of 4212 1388 SAM X CHEAT crack1.exe 209 PID 1388 wrote to memory of 4212 1388 SAM X CHEAT crack1.exe 209 PID 1388 wrote to memory of 4212 1388 SAM X CHEAT crack1.exe 209 PID 4212 wrote to memory of 4268 4212 SAM X CHEAT crack1.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4828 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3980
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4768 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2144
-
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"11⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"12⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"13⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:840 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"15⤵
- Checks computer location settings
PID:872 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"16⤵
- System Location Discovery: System Language Discovery
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"17⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:936 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"18⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"19⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"20⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"21⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"22⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"23⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"24⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"25⤵
- System Location Discovery: System Language Discovery
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"26⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"27⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"28⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"29⤵
- Checks computer location settings
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"30⤵
- Executes dropped EXE
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"30⤵
- Checks computer location settings
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"31⤵
- Executes dropped EXE
PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"31⤵
- Executes dropped EXE
PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"31⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"32⤵
- Executes dropped EXE
PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"32⤵
- Executes dropped EXE
PID:4064
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"32⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"33⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"33⤵
- Executes dropped EXE
PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"33⤵
- Checks computer location settings
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"34⤵PID:1208
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"34⤵PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"34⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"35⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"35⤵PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"35⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"36⤵PID:3692
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"36⤵PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"36⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"37⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"37⤵PID:4212
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"37⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"38⤵PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"38⤵PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"38⤵
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"39⤵PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"39⤵PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"39⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"40⤵PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"40⤵PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"40⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"41⤵PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"41⤵PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"41⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"42⤵PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"42⤵PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"42⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"43⤵PID:4368
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"43⤵PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"43⤵
- Checks computer location settings
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"44⤵PID:812
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"44⤵PID:3420
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:872 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"45⤵PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"45⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"45⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"46⤵PID:1316
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"46⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"46⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"47⤵PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"47⤵PID:3648
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"47⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"48⤵PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"48⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"48⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"49⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"49⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"49⤵
- Checks computer location settings
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"50⤵PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"50⤵PID:1592
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"50⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"51⤵PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"51⤵PID:3280
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"51⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"52⤵PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"52⤵PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"52⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"53⤵PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"53⤵PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"53⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"54⤵PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"54⤵PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"54⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"55⤵PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"55⤵PID:3724
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"55⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"56⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"56⤵PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"56⤵
- System Location Discovery: System Language Discovery
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"57⤵PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"57⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"57⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"58⤵PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"58⤵PID:3740
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"58⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"59⤵PID:212
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"59⤵PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"59⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"60⤵PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"60⤵PID:2492
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"60⤵
- Checks computer location settings
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"61⤵PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"61⤵PID:4684
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"61⤵
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"62⤵PID:3104
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"62⤵PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"62⤵
- System Location Discovery: System Language Discovery
PID:872 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"63⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"63⤵PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"63⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"64⤵PID:3568
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"64⤵PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"64⤵
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"65⤵PID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"65⤵PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"65⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"66⤵PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"66⤵PID:116
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"66⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"67⤵PID:1196
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"67⤵PID:3648
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"67⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"68⤵PID:4632
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"68⤵PID:3516
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"68⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"69⤵PID:920
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"69⤵PID:3236
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"69⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"70⤵PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"70⤵PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"71⤵PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"71⤵PID:2924
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"71⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"72⤵PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"72⤵PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"72⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"73⤵PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"73⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"73⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:388 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"74⤵PID:1764
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"74⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"74⤵
- Checks computer location settings
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"75⤵PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"75⤵PID:3092
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"75⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"76⤵PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"76⤵PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"76⤵
- Checks computer location settings
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"77⤵PID:212
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"77⤵PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"77⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"78⤵PID:3652
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"78⤵PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"78⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"79⤵PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"79⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"79⤵
- Checks computer location settings
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"80⤵PID:956
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"80⤵PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"80⤵
- Checks computer location settings
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"81⤵PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"81⤵PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"81⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"82⤵PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"82⤵PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"82⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"83⤵PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"83⤵PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"83⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"84⤵PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"84⤵PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"84⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"85⤵PID:4632
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"85⤵PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"85⤵
- System Location Discovery: System Language Discovery
PID:620 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"86⤵PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"86⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"86⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"87⤵PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"87⤵PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"87⤵
- Checks computer location settings
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"88⤵PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"88⤵PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"88⤵
- Checks computer location settings
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"89⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"89⤵PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"89⤵
- Checks computer location settings
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"90⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"90⤵PID:4684
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"90⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"91⤵PID:3912
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"91⤵PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"91⤵
- Checks computer location settings
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"92⤵PID:4348
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"92⤵PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"92⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"93⤵PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"93⤵PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"93⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"94⤵PID:664
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"94⤵PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"94⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"95⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"95⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"95⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"96⤵PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"96⤵PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"96⤵
- Checks computer location settings
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"97⤵PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"97⤵PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"97⤵
- Checks computer location settings
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"98⤵PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"98⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"98⤵
- Checks computer location settings
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"99⤵PID:3536
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"99⤵PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"99⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"100⤵PID:3872
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"100⤵PID:3132
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"100⤵
- Checks computer location settings
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"101⤵PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"101⤵PID:1232
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"101⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"102⤵PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"102⤵PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"102⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"103⤵PID:2460
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"103⤵PID:4460
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"103⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"104⤵PID:2928
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"104⤵PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"104⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"105⤵PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"105⤵PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"105⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"106⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"106⤵PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"106⤵
- System Location Discovery: System Language Discovery
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"107⤵PID:4272
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"107⤵PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"107⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"108⤵PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"108⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"108⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"109⤵PID:1380
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"109⤵PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"109⤵
- Checks computer location settings
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"110⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"110⤵PID:976
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"110⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"111⤵PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"111⤵PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"111⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"112⤵PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"112⤵PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"112⤵
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"113⤵PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"113⤵PID:1376
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"113⤵
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"114⤵PID:4804
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"114⤵PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"114⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"115⤵PID:1592
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"115⤵PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"115⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"116⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"116⤵PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"116⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"117⤵PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"117⤵PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"117⤵
- System Location Discovery: System Language Discovery
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"118⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"118⤵PID:948
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"118⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"119⤵PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"119⤵PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"119⤵
- Checks computer location settings
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"120⤵PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"120⤵PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"120⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"121⤵PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"121⤵PID:4464
-
-
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"121⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-