Analysis
-
max time kernel
22s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2025, 19:06
Behavioral task
behavioral1
Sample
PC X LEGEND BYPASS.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PC X LEGEND BYPASS.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
PC X LEGEND BYPASS.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
PC X LEGEND BYPASS.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20241010-en
General
-
Target
PC X LEGEND BYPASS.exe
-
Size
1.9MB
-
MD5
0f5d149cd2e3d53211053cc10ab5afe3
-
SHA1
7c6a746d3018e0c9c4fdbb0afeed5d763956614f
-
SHA256
3389ea0da70c332fb4e2cf1bf0ca290ed6c5ab35340d2e9d696e80e023e39436
-
SHA512
0350b4ab55667cc3fa3bb8c26f2e94439827e0d80f6d180c60e6aadc770c016c2ea37352e2a96e62378b2fcad091033658890553218c0efae536108bf5a93949
-
SSDEEP
49152:/iNOmow0zk3ArZeVuW4gPP9l9GBlyXXHeJGU6frQkwrM:qNkBkwrAutgH79GTQeJGRsDM
Malware Config
Extracted
xworm
147.185.221.23:58112
-
Install_directory
%AppData%
-
install_file
Realtek HD Audio Universal Service.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x000d000000023c06-4.dat family_xworm behavioral2/memory/2652-12-0x0000000000630000-0x0000000000644000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4348 powershell.exe 1568 powershell.exe 1708 powershell.exe 1268 powershell.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation PC X LEGEND BYPASS.exe -
Executes dropped EXE 64 IoCs
pid Process 2652 Realtek HD Audio Universal Service.exe 1368 Realtek HD Audio Universal Service.exe 4384 Realtek HD Audio Universal Service.exe 4932 Realtek HD Audio Universal Service.exe 4452 Realtek HD Audio Universal Service.exe 2436 Realtek HD Audio Universal Service.exe 3956 Realtek HD Audio Universal Service.exe 2312 Realtek HD Audio Universal Service.exe 3760 Realtek HD Audio Universal Service.exe 4444 Realtek HD Audio Universal Service.exe 3596 Realtek HD Audio Universal Service.exe 2788 Realtek HD Audio Universal Service.exe 5032 Realtek HD Audio Universal Service.exe 3472 Realtek HD Audio Universal Service.exe 3280 Realtek HD Audio Universal Service.exe 2008 Realtek HD Audio Universal Service.exe 4312 Realtek HD Audio Universal Service.exe 3576 Realtek HD Audio Universal Service.exe 5024 Realtek HD Audio Universal Service.exe 3496 Realtek HD Audio Universal Service.exe 4900 Realtek HD Audio Universal Service.exe 3628 Realtek HD Audio Universal Service.exe 4740 Realtek HD Audio Universal Service.exe 3896 Realtek HD Audio Universal Service.exe 552 Realtek HD Audio Universal Service.exe 5008 Realtek HD Audio Universal Service.exe 1616 Realtek HD Audio Universal Service.exe 1476 Realtek HD Audio Universal Service.exe 4536 Realtek HD Audio Universal Service.exe 2392 Realtek HD Audio Universal Service.exe 1956 Realtek HD Audio Universal Service.exe 2056 Realtek HD Audio Universal Service.exe 1688 Realtek HD Audio Universal Service.exe 3384 Realtek HD Audio Universal Service.exe 4680 Realtek HD Audio Universal Service.exe 1732 Realtek HD Audio Universal Service.exe 2480 Realtek HD Audio Universal Service.exe 1276 Realtek HD Audio Universal Service.exe 3760 Realtek HD Audio Universal Service.exe 4960 Realtek HD Audio Universal Service.exe 2208 Realtek HD Audio Universal Service.exe 3500 Realtek HD Audio Universal Service.exe 2228 Realtek HD Audio Universal Service.exe 1068 Realtek HD Audio Universal Service.exe 3388 Realtek HD Audio Universal Service.exe 2764 Realtek HD Audio Universal Service.exe 1840 Realtek HD Audio Universal Service.exe 1568 Realtek HD Audio Universal Service.exe 1684 Realtek HD Audio Universal Service.exe 2848 Realtek HD Audio Universal Service.exe 2536 Realtek HD Audio Universal Service.exe 3296 Realtek HD Audio Universal Service.exe 3680 Realtek HD Audio Universal Service.exe 800 Realtek HD Audio Universal Service.exe 1876 Realtek HD Audio Universal Service.exe 5012 Realtek HD Audio Universal Service.exe 1060 Realtek HD Audio Universal Service.exe 2468 Realtek HD Audio Universal Service.exe 2224 Realtek HD Audio Universal Service.exe 4368 Realtek HD Audio Universal Service.exe 4536 Realtek HD Audio Universal Service.exe 4128 Realtek HD Audio Universal Service.exe 3756 Realtek HD Audio Universal Service.exe 4856 Realtek HD Audio Universal Service.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC X LEGEND BYPASS.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2652 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1368 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4384 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4932 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4452 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2436 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3956 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2312 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3760 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4444 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3596 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2788 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 5032 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3472 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3280 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2008 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4312 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3576 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 5024 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3496 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4900 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3628 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4740 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3896 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 552 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 5008 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1616 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1476 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4536 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2392 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1956 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2056 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1688 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3384 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4680 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1732 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2480 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1276 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3760 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4960 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2208 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3500 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2228 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1068 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3388 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2764 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1840 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1568 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1684 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2848 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2536 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3296 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3680 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 800 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1876 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 5012 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 1060 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2468 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2224 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4368 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4536 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4128 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 3756 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 4856 Realtek HD Audio Universal Service.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 2652 3896 PC X LEGEND BYPASS.exe 85 PID 3896 wrote to memory of 2652 3896 PC X LEGEND BYPASS.exe 85 PID 3896 wrote to memory of 2820 3896 PC X LEGEND BYPASS.exe 86 PID 3896 wrote to memory of 2820 3896 PC X LEGEND BYPASS.exe 86 PID 3896 wrote to memory of 2820 3896 PC X LEGEND BYPASS.exe 86 PID 2820 wrote to memory of 1368 2820 PC X LEGEND BYPASS.exe 87 PID 2820 wrote to memory of 1368 2820 PC X LEGEND BYPASS.exe 87 PID 2820 wrote to memory of 856 2820 PC X LEGEND BYPASS.exe 88 PID 2820 wrote to memory of 856 2820 PC X LEGEND BYPASS.exe 88 PID 2820 wrote to memory of 856 2820 PC X LEGEND BYPASS.exe 88 PID 856 wrote to memory of 4384 856 PC X LEGEND BYPASS.exe 89 PID 856 wrote to memory of 4384 856 PC X LEGEND BYPASS.exe 89 PID 856 wrote to memory of 3084 856 PC X LEGEND BYPASS.exe 90 PID 856 wrote to memory of 3084 856 PC X LEGEND BYPASS.exe 90 PID 856 wrote to memory of 3084 856 PC X LEGEND BYPASS.exe 90 PID 3084 wrote to memory of 4932 3084 PC X LEGEND BYPASS.exe 91 PID 3084 wrote to memory of 4932 3084 PC X LEGEND BYPASS.exe 91 PID 3084 wrote to memory of 1112 3084 PC X LEGEND BYPASS.exe 92 PID 3084 wrote to memory of 1112 3084 PC X LEGEND BYPASS.exe 92 PID 3084 wrote to memory of 1112 3084 PC X LEGEND BYPASS.exe 92 PID 1112 wrote to memory of 4452 1112 PC X LEGEND BYPASS.exe 182 PID 1112 wrote to memory of 4452 1112 PC X LEGEND BYPASS.exe 182 PID 1112 wrote to memory of 4840 1112 PC X LEGEND BYPASS.exe 94 PID 1112 wrote to memory of 4840 1112 PC X LEGEND BYPASS.exe 94 PID 1112 wrote to memory of 4840 1112 PC X LEGEND BYPASS.exe 94 PID 4840 wrote to memory of 2436 4840 PC X LEGEND BYPASS.exe 96 PID 4840 wrote to memory of 2436 4840 PC X LEGEND BYPASS.exe 96 PID 4840 wrote to memory of 4348 4840 PC X LEGEND BYPASS.exe 97 PID 4840 wrote to memory of 4348 4840 PC X LEGEND BYPASS.exe 97 PID 4840 wrote to memory of 4348 4840 PC X LEGEND BYPASS.exe 97 PID 4348 wrote to memory of 3956 4348 PC X LEGEND BYPASS.exe 98 PID 4348 wrote to memory of 3956 4348 PC X LEGEND BYPASS.exe 98 PID 4348 wrote to memory of 264 4348 PC X LEGEND BYPASS.exe 99 PID 4348 wrote to memory of 264 4348 PC X LEGEND BYPASS.exe 99 PID 4348 wrote to memory of 264 4348 PC X LEGEND BYPASS.exe 99 PID 264 wrote to memory of 2312 264 PC X LEGEND BYPASS.exe 100 PID 264 wrote to memory of 2312 264 PC X LEGEND BYPASS.exe 100 PID 264 wrote to memory of 2844 264 PC X LEGEND BYPASS.exe 266 PID 264 wrote to memory of 2844 264 PC X LEGEND BYPASS.exe 266 PID 264 wrote to memory of 2844 264 PC X LEGEND BYPASS.exe 266 PID 2844 wrote to memory of 3760 2844 PC X LEGEND BYPASS.exe 257 PID 2844 wrote to memory of 3760 2844 PC X LEGEND BYPASS.exe 257 PID 2844 wrote to memory of 2364 2844 PC X LEGEND BYPASS.exe 346 PID 2844 wrote to memory of 2364 2844 PC X LEGEND BYPASS.exe 346 PID 2844 wrote to memory of 2364 2844 PC X LEGEND BYPASS.exe 346 PID 2364 wrote to memory of 4444 2364 PC X LEGEND BYPASS.exe 104 PID 2364 wrote to memory of 4444 2364 PC X LEGEND BYPASS.exe 104 PID 2364 wrote to memory of 728 2364 PC X LEGEND BYPASS.exe 106 PID 2364 wrote to memory of 728 2364 PC X LEGEND BYPASS.exe 106 PID 2364 wrote to memory of 728 2364 PC X LEGEND BYPASS.exe 106 PID 728 wrote to memory of 3596 728 PC X LEGEND BYPASS.exe 107 PID 728 wrote to memory of 3596 728 PC X LEGEND BYPASS.exe 107 PID 728 wrote to memory of 1188 728 PC X LEGEND BYPASS.exe 108 PID 728 wrote to memory of 1188 728 PC X LEGEND BYPASS.exe 108 PID 728 wrote to memory of 1188 728 PC X LEGEND BYPASS.exe 108 PID 1188 wrote to memory of 2788 1188 PC X LEGEND BYPASS.exe 109 PID 1188 wrote to memory of 2788 1188 PC X LEGEND BYPASS.exe 109 PID 1188 wrote to memory of 5104 1188 PC X LEGEND BYPASS.exe 148 PID 1188 wrote to memory of 5104 1188 PC X LEGEND BYPASS.exe 148 PID 1188 wrote to memory of 5104 1188 PC X LEGEND BYPASS.exe 148 PID 5104 wrote to memory of 5032 5104 PC X LEGEND BYPASS.exe 112 PID 5104 wrote to memory of 5032 5104 PC X LEGEND BYPASS.exe 112 PID 5104 wrote to memory of 2228 5104 PC X LEGEND BYPASS.exe 268 PID 5104 wrote to memory of 2228 5104 PC X LEGEND BYPASS.exe 268
Processes
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"14⤵
- Checks computer location settings
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"15⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"16⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"17⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"18⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"19⤵
- System Location Discovery: System Language Discovery
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"20⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:892 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"21⤵
- Checks computer location settings
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"22⤵
- System Location Discovery: System Language Discovery
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"23⤵
- Checks computer location settings
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"24⤵
- Checks computer location settings
PID:976 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"25⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"26⤵
- Checks computer location settings
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"27⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"28⤵
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"29⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"30⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"31⤵
- Checks computer location settings
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"32⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"33⤵
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"34⤵
- Checks computer location settings
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"35⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"36⤵
- Checks computer location settings
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"37⤵
- Checks computer location settings
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"38⤵
- Checks computer location settings
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"39⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"40⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"41⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"42⤵
- Checks computer location settings
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"43⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"45⤵
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"46⤵
- Checks computer location settings
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"47⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"48⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"49⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"50⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"51⤵
- Checks computer location settings
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"52⤵
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"53⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"54⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"55⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"56⤵
- System Location Discovery: System Language Discovery
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"57⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"58⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"59⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"60⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"61⤵
- Checks computer location settings
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"62⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"63⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"64⤵
- System Location Discovery: System Language Discovery
PID:372 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"65⤵
- Checks computer location settings
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"66⤵PID:384
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"66⤵
- Checks computer location settings
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"67⤵PID:1728
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"67⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"68⤵PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"68⤵
- Checks computer location settings
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"69⤵PID:3200
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"69⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"70⤵PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"71⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"71⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"72⤵PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"72⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"73⤵PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"73⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"74⤵PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"74⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"75⤵PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"75⤵
- Checks computer location settings
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"76⤵PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"76⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"77⤵PID:2948
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"77⤵
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"78⤵PID:4704
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"78⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"79⤵PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"79⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"80⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"80⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"81⤵PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"81⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"82⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"82⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"83⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"83⤵
- Checks computer location settings
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"84⤵PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"84⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"85⤵PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"85⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"86⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"86⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"87⤵PID:4156
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"87⤵
- System Location Discovery: System Language Discovery
PID:900 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"88⤵PID:4968
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"88⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"89⤵PID:3440
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"89⤵
- System Location Discovery: System Language Discovery
PID:980 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"90⤵PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"90⤵
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"91⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"91⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"92⤵PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"92⤵
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"93⤵PID:4136
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"93⤵
- Checks computer location settings
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"94⤵PID:1212
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"94⤵
- Checks computer location settings
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"95⤵PID:4208
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"95⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"96⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"96⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"97⤵PID:2096
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"97⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"98⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"98⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"99⤵PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"99⤵
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"100⤵PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"100⤵
- Checks computer location settings
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"101⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"101⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"102⤵PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"102⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"103⤵PID:4460
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"103⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"104⤵PID:532
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"104⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"105⤵PID:3344
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"105⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"106⤵PID:2948
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"106⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"107⤵PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"107⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"108⤵PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"108⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"109⤵PID:976
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"109⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"110⤵PID:3160
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"110⤵
- Checks computer location settings
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"111⤵PID:4436
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"111⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"112⤵PID:5072
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"112⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"113⤵PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"113⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"114⤵PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"114⤵
- Checks computer location settings
PID:440 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"115⤵PID:3124
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"115⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"116⤵PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"116⤵
- Checks computer location settings
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"117⤵PID:3844
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"117⤵
- Checks computer location settings
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"118⤵PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"118⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"119⤵PID:860
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"119⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"120⤵PID:4760
-
-
C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"C:\Users\Admin\AppData\Local\Temp\PC X LEGEND BYPASS.exe"120⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"121⤵PID:3368
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3368 -s 1576122⤵PID:3392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-