Analysis
- max time kernel
8s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
08/09/2025, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5dea41ecd8b53c4355679ced6a72862f.exe
Resource
win10v2004-20250619-en
13 signatures
150 seconds
General
- Target 5dea41ecd8b53c4355679ced6a72862f.exe
- Size 1005KB
- Sample250908-e2syxser4x
- SHA256 9feb9ec3d5a0801f2399a8556aa4fc6cb1be1ba13af8f877c70d6e94d2cbb84d
- MD5 5dea41ecd8b53c4355679ced6a72862f
- SHA1 1d22a538188c5e91243ca80ad2549c6b52d16988
- SHA512 fa1828f8d90c33942a33c845ae9ab185d9ccb4fad433930ad5bb1494f5f957b9ca58b1101a5ea04378572790a5d64138da0d17690a03201ffc85b7d6f702f7d5
- SSDEEP 24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIF:N0oY
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x00070000000240cb-3.dat family_xworm behavioral1/memory/5004-14-0x00000000007F0000-0x0000000000806000-memory.dmp family_xworm - Xworm family
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe - Executes dropped EXE 64 IoCs
pid Process 5004 audiodg.exe 1688 shost.exe 4880 5dea41ecd8b53c4355679ced6a72862f..exe 3652 audiodg.exe 5072 shost.exe 3636 audiodg.exe 4520 shost.exe 568 audiodg.exe 3080 shost.exe 1836 audiodg.exe 1220 shost.exe 1676 audiodg.exe 1440 shost.exe 3780 audiodg.exe 4464 shost.exe 860 audiodg.exe 1252 shost.exe 4264 audiodg.exe 3600 shost.exe 3148 audiodg.exe 4952 shost.exe 1900 audiodg.exe 208 shost.exe 2752 audiodg.exe 2564 shost.exe 3848 audiodg.exe 4252 shost.exe 4956 audiodg.exe 1244 shost.exe 756 audiodg.exe 2500 shost.exe 2892 audiodg.exe 2060 shost.exe 508 audiodg.exe 1612 shost.exe 4552 audiodg.exe 5112 shost.exe 2992 audiodg.exe 728 shost.exe 1088 audiodg.exe 408 shost.exe 5108 audiodg.exe 2188 shost.exe 2288 audiodg.exe 2036 shost.exe 1420 audiodg.exe 2348 shost.exe 1036 audiodg.exe 3036 shost.exe 5088 audiodg.exe 808 shost.exe 4016 audiodg.exe 432 shost.exe 3796 audiodg.exe 3988 shost.exe 4448 audiodg.exe 4688 shost.exe 2372 audiodg.exe 1044 shost.exe 4864 audiodg.exe 3092 shost.exe 1680 audiodg.exe 1348 shost.exe 2140 audiodg.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" 5dea41ecd8b53c4355679ced6a72862f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon" audiodg.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 47 IoCs
flow ioc 48 pastebin.com 60 pastebin.com 62 pastebin.com 73 pastebin.com 74 pastebin.com 77 pastebin.com 49 pastebin.com 50 pastebin.com 52 pastebin.com 63 pastebin.com 65 pastebin.com 90 pastebin.com 92 pastebin.com 15 pastebin.com 59 pastebin.com 66 pastebin.com 20 pastebin.com 24 pastebin.com 45 pastebin.com 51 pastebin.com 54 pastebin.com 57 pastebin.com 79 pastebin.com 84 pastebin.com 61 pastebin.com 82 pastebin.com 86 pastebin.com 91 pastebin.com 25 pastebin.com 64 pastebin.com 81 pastebin.com 85 pastebin.com 88 pastebin.com 14 pastebin.com 22 pastebin.com 32 pastebin.com 80 pastebin.com 83 pastebin.com 87 pastebin.com 89 pastebin.com 17 pastebin.com 30 pastebin.com 53 pastebin.com 58 pastebin.com 72 pastebin.com 23 pastebin.com 47 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4880 5dea41ecd8b53c4355679ced6a72862f..exe 4880 5dea41ecd8b53c4355679ced6a72862f..exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5004 audiodg.exe Token: SeDebugPrivilege 3652 audiodg.exe Token: SeDebugPrivilege 3636 audiodg.exe Token: SeDebugPrivilege 568 audiodg.exe Token: SeDebugPrivilege 1836 audiodg.exe Token: SeDebugPrivilege 1676 audiodg.exe Token: SeDebugPrivilege 3780 audiodg.exe Token: SeDebugPrivilege 860 audiodg.exe Token: SeDebugPrivilege 4264 audiodg.exe Token: SeDebugPrivilege 3148 audiodg.exe Token: SeDebugPrivilege 1900 audiodg.exe Token: SeDebugPrivilege 2752 audiodg.exe Token: SeDebugPrivilege 3848 audiodg.exe Token: SeDebugPrivilege 4956 audiodg.exe Token: SeDebugPrivilege 756 audiodg.exe Token: SeDebugPrivilege 2892 audiodg.exe Token: SeDebugPrivilege 508 audiodg.exe Token: SeDebugPrivilege 4552 audiodg.exe Token: SeDebugPrivilege 2992 audiodg.exe Token: SeDebugPrivilege 1088 audiodg.exe Token: SeDebugPrivilege 5108 audiodg.exe Token: SeDebugPrivilege 2288 audiodg.exe Token: SeDebugPrivilege 1420 audiodg.exe Token: SeDebugPrivilege 1036 audiodg.exe Token: SeDebugPrivilege 5088 audiodg.exe Token: SeDebugPrivilege 4016 audiodg.exe Token: SeDebugPrivilege 3796 audiodg.exe Token: SeDebugPrivilege 4448 audiodg.exe Token: SeDebugPrivilege 2372 audiodg.exe Token: SeDebugPrivilege 4864 audiodg.exe Token: SeDebugPrivilege 1680 audiodg.exe Token: SeDebugPrivilege 2140 audiodg.exe Token: SeDebugPrivilege 2652 audiodg.exe Token: SeDebugPrivilege 4312 audiodg.exe Token: SeDebugPrivilege 864 audiodg.exe Token: SeDebugPrivilege 2584 audiodg.exe Token: SeDebugPrivilege 4196 audiodg.exe Token: SeDebugPrivilege 384 audiodg.exe Token: SeDebugPrivilege 2484 audiodg.exe Token: SeDebugPrivilege 4488 audiodg.exe Token: SeDebugPrivilege 948 audiodg.exe Token: SeDebugPrivilege 3008 audiodg.exe Token: SeDebugPrivilege 3916 audiodg.exe Token: SeDebugPrivilege 1908 audiodg.exe Token: SeDebugPrivilege 4424 audiodg.exe Token: SeDebugPrivilege 1244 audiodg.exe Token: SeDebugPrivilege 2368 audiodg.exe Token: SeDebugPrivilege 3860 audiodg.exe Token: SeDebugPrivilege 5100 audiodg.exe Token: SeDebugPrivilege 2440 audiodg.exe Token: SeDebugPrivilege 552 audiodg.exe Token: SeDebugPrivilege 808 audiodg.exe Token: SeDebugPrivilege 3516 audiodg.exe Token: SeDebugPrivilege 4688 audiodg.exe Token: SeDebugPrivilege 3680 audiodg.exe Token: SeDebugPrivilege 3812 audiodg.exe Token: SeDebugPrivilege 1124 audiodg.exe Token: SeDebugPrivilege 2796 audiodg.exe Token: SeDebugPrivilege 2240 audiodg.exe Token: SeDebugPrivilege 5056 audiodg.exe Token: SeDebugPrivilege 1952 audiodg.exe Token: SeDebugPrivilege 1912 audiodg.exe Token: SeDebugPrivilege 2764 audiodg.exe Token: SeDebugPrivilege 4184 audiodg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 5004 2860 5dea41ecd8b53c4355679ced6a72862f.exe 83 PID 2860 wrote to memory of 5004 2860 5dea41ecd8b53c4355679ced6a72862f.exe 83 PID 2860 wrote to memory of 1688 2860 5dea41ecd8b53c4355679ced6a72862f.exe 84 PID 2860 wrote to memory of 1688 2860 5dea41ecd8b53c4355679ced6a72862f.exe 84 PID 2860 wrote to memory of 4880 2860 5dea41ecd8b53c4355679ced6a72862f.exe 85 PID 2860 wrote to memory of 4880 2860 5dea41ecd8b53c4355679ced6a72862f.exe 85 PID 1688 wrote to memory of 3652 1688 shost.exe 87 PID 1688 wrote to memory of 3652 1688 shost.exe 87 PID 1688 wrote to memory of 5072 1688 shost.exe 88 PID 1688 wrote to memory of 5072 1688 shost.exe 88 PID 5072 wrote to memory of 3636 5072 shost.exe 89 PID 5072 wrote to memory of 3636 5072 shost.exe 89 PID 5072 wrote to memory of 4520 5072 shost.exe 90 PID 5072 wrote to memory of 4520 5072 shost.exe 90 PID 4520 wrote to memory of 568 4520 shost.exe 91 PID 4520 wrote to memory of 568 4520 shost.exe 91 PID 4520 wrote to memory of 3080 4520 shost.exe 92 PID 4520 wrote to memory of 3080 4520 shost.exe 92 PID 3080 wrote to memory of 1836 3080 shost.exe 411 PID 3080 wrote to memory of 1836 3080 shost.exe 411 PID 3080 wrote to memory of 1220 3080 shost.exe 94 PID 3080 wrote to memory of 1220 3080 shost.exe 94 PID 1220 wrote to memory of 1676 1220 shost.exe 404 PID 1220 wrote to memory of 1676 1220 shost.exe 404 PID 1220 wrote to memory of 1440 1220 shost.exe 96 PID 1220 wrote to memory of 1440 1220 shost.exe 96 PID 1440 wrote to memory of 3780 1440 shost.exe 553 PID 1440 wrote to memory of 3780 1440 shost.exe 553 PID 1440 wrote to memory of 4464 1440 shost.exe 530 PID 1440 wrote to memory of 4464 1440 shost.exe 530 PID 4464 wrote to memory of 860 4464 shost.exe 497 PID 4464 wrote to memory of 860 4464 shost.exe 497 PID 4464 wrote to memory of 1252 4464 shost.exe 100 PID 4464 wrote to memory of 1252 4464 shost.exe 100 PID 1252 wrote to memory of 4264 1252 shost.exe 101 PID 1252 wrote to memory of 4264 1252 shost.exe 101 PID 1252 wrote to memory of 3600 1252 shost.exe 102 PID 1252 wrote to memory of 3600 1252 shost.exe 102 PID 3600 wrote to memory of 3148 3600 shost.exe 103 PID 3600 wrote to memory of 3148 3600 shost.exe 103 PID 3600 wrote to memory of 4952 3600 shost.exe 775 PID 3600 wrote to memory of 4952 3600 shost.exe 775 PID 4952 wrote to memory of 1900 4952 shost.exe 756 PID 4952 wrote to memory of 1900 4952 shost.exe 756 PID 4952 wrote to memory of 208 4952 shost.exe 437 PID 4952 wrote to memory of 208 4952 shost.exe 437 PID 208 wrote to memory of 2752 208 shost.exe 107 PID 208 wrote to memory of 2752 208 shost.exe 107 PID 208 wrote to memory of 2564 208 shost.exe 108 PID 208 wrote to memory of 2564 208 shost.exe 108 PID 2564 wrote to memory of 3848 2564 shost.exe 109 PID 2564 wrote to memory of 3848 2564 shost.exe 109 PID 2564 wrote to memory of 4252 2564 shost.exe 663 PID 2564 wrote to memory of 4252 2564 shost.exe 663 PID 4252 wrote to memory of 4956 4252 shost.exe 647 PID 4252 wrote to memory of 4956 4252 shost.exe 647 PID 4252 wrote to memory of 1244 4252 shost.exe 175 PID 4252 wrote to memory of 1244 4252 shost.exe 175 PID 1244 wrote to memory of 756 1244 shost.exe 113 PID 1244 wrote to memory of 756 1244 shost.exe 113 PID 1244 wrote to memory of 2500 1244 shost.exe 895 PID 1244 wrote to memory of 2500 1244 shost.exe 895 PID 2500 wrote to memory of 2892 2500 shost.exe 476 PID 2500 wrote to memory of 2892 2500 shost.exe 476
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dea41ecd8b53c4355679ced6a72862f.exe"C:\Users\Admin\AppData\Local\Temp\5dea41ecd8b53c4355679ced6a72862f.exe"1⤵
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"5⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"8⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"10⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"12⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"17⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
PID:2060 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:508
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"18⤵
- Executes dropped EXE
- Modifies registry class
PID:1612 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"19⤵
- Executes dropped EXE
- Modifies registry class
PID:5112 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"20⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:728 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"21⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:408 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"22⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"23⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:2036 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"24⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"25⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:3036 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"26⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"27⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"28⤵
- Executes dropped EXE
- Modifies registry class
PID:3988 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"29⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:4688 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"30⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:1044 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"31⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
PID:3092 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"32⤵
- Executes dropped EXE
- Modifies registry class
PID:1348 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"33⤵
- Modifies system executable filetype association
PID:1384 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"34⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1924 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"35⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4292 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"36⤵PID:2308
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"37⤵
- Modifies system executable filetype association
PID:4600 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"38⤵
- Modifies system executable filetype association
PID:4420 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:384
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"39⤵
- Modifies system executable filetype association
PID:2796 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"40⤵
- Modifies registry class
PID:652 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"41⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4304 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"42⤵PID:1596
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"43⤵
- Modifies system executable filetype association
PID:4524 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"44⤵PID:4952
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"45⤵
- Modifies registry class
PID:5056 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"46⤵
- Modifies registry class
PID:4252 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"47⤵
- Modifies registry class
PID:2864 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"48⤵
- Modifies registry class
PID:1952 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"49⤵PID:2208
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"50⤵
- Modifies system executable filetype association
PID:3188 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"51⤵
- Modifies registry class
PID:1912 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"52⤵PID:2348
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"53⤵
- Modifies registry class
PID:2320 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"54⤵PID:3664
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"55⤵
- Modifies registry class
PID:4760 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"56⤵
- Modifies system executable filetype association
- Modifies registry class
PID:448 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"57⤵
- Modifies system executable filetype association
PID:3116 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"58⤵
- Modifies registry class
PID:4600 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"59⤵PID:652
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"60⤵
- Modifies registry class
PID:2504 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"61⤵PID:1672
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"62⤵PID:3552
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"63⤵
- Modifies registry class
PID:4904 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"64⤵
- Modifies registry class
PID:2912 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"65⤵
- Modifies registry class
PID:4532 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"66⤵PID:4316
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"66⤵PID:1868
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"67⤵PID:1544
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"67⤵PID:652
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"68⤵PID:372
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"68⤵
- Modifies registry class
PID:1020 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"69⤵PID:3024
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"69⤵
- Modifies registry class
PID:1836 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"70⤵PID:4160
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"70⤵PID:4904
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"71⤵PID:2912
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"71⤵
- Modifies registry class
PID:1144 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"72⤵PID:2948
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"72⤵
- Modifies system executable filetype association
PID:4020 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"73⤵PID:804
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"73⤵PID:5036
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"74⤵PID:652
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"74⤵
- Modifies registry class
PID:2864 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"75⤵PID:3700
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"75⤵PID:4472
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"76⤵PID:4524
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"76⤵
- Modifies system executable filetype association
PID:3900 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"77⤵PID:1868
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"77⤵
- Modifies registry class
PID:4752 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"78⤵PID:4020
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"78⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1900 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"79⤵PID:2864
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"79⤵
- Modifies registry class
PID:3864 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"80⤵PID:2832
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"80⤵PID:4472
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"81⤵PID:3044
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"81⤵PID:2308
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"82⤵PID:3368
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"82⤵
- Modifies system executable filetype association
PID:4904 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"83⤵PID:5140
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"83⤵
- Modifies system executable filetype association
PID:5184 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"84⤵PID:5228
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"84⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5252 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"85⤵PID:5268
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"85⤵PID:5280
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"86⤵PID:5312
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"86⤵PID:5340
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"87⤵PID:5376
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"87⤵
- Modifies system executable filetype association
PID:5400 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"88⤵PID:5424
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"88⤵
- Modifies registry class
PID:5436 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"89⤵PID:5460
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"89⤵
- Modifies registry class
PID:5488 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"90⤵PID:5508
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"90⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5516 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"91⤵PID:5552
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"91⤵PID:5584
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"92⤵PID:5620
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"92⤵
- Modifies system executable filetype association
PID:5636 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"93⤵PID:5660
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"93⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5668 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"94⤵PID:5700
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"94⤵
- Modifies system executable filetype association
PID:5728 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"95⤵PID:5756
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"95⤵PID:5768
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"96⤵PID:5796
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"96⤵
- Modifies system executable filetype association
PID:5832 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"97⤵PID:5868
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"97⤵
- Modifies registry class
PID:5888 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"98⤵PID:5924
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"98⤵
- Modifies system executable filetype association
PID:5936 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"99⤵PID:5980
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"99⤵PID:6012
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"100⤵PID:6044
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"100⤵
- Modifies registry class
PID:6076 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"101⤵PID:6092
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"101⤵
- Modifies registry class
PID:6104 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"102⤵PID:6132
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"102⤵PID:4392
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"103⤵PID:732
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"103⤵PID:2308
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"104⤵PID:5156
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"104⤵
- Modifies system executable filetype association
PID:5224 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"105⤵PID:4552
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"105⤵
- Modifies system executable filetype association
PID:1776 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"106⤵PID:2212
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"106⤵
- Modifies registry class
PID:5332 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"107⤵PID:400
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"107⤵
- Modifies system executable filetype association
PID:5308 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"108⤵PID:5368
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"108⤵PID:620
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"109⤵PID:1820
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"109⤵PID:5448
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"110⤵PID:524
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"110⤵PID:5528
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"111⤵PID:3644
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"111⤵
- Modifies system executable filetype association
PID:5600 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"112⤵PID:5636
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"112⤵
- Modifies registry class
PID:5668 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"113⤵PID:1416
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"113⤵PID:4336
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"114⤵PID:2708
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"114⤵PID:960
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"115⤵PID:5804
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"115⤵PID:4616
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"116⤵PID:3500
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"116⤵
- Modifies system executable filetype association
PID:2536 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"117⤵PID:5892
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"117⤵
- Modifies system executable filetype association
PID:5956 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"118⤵PID:5976
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"118⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1800 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"119⤵PID:6016
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"119⤵PID:4604
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"120⤵PID:6024
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"120⤵PID:6088
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"121⤵PID:2100
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"121⤵
- Modifies registry class
PID:3612 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-