Analysis
- max time kernel
8s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe
Resource
win11-20260130-en
11 signatures
150 seconds
General
- Target xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe
- Size 883KB
- Sample260421-eew23aht6r
- SHA256 e9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21
- MD5 820088db308f7a56b6274574e2072435
- SHA1 c58f321d7d95b08a4bc15797fb6f6726fcd76c4d
- SHA512 592219ef2a493867ba4066b9b3b61d48472d1dbf4c63212240708ef8d3aa00b47d94806c7a3993bdd97b0a89a32b8c2fb0a2b81ab97514df5f11d7070b50005f
- SSDEEP 24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIF:N0o01
- TLSH T13B15AE066AEC00FAD1A2E23988D26541D7F73D5787151FCB02E6AE1E3E671D1AA7D330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000024505-2.dat family_xworm behavioral1/memory/5768-20-0x0000000000300000-0x0000000000316000-memory.dmp family_xworm - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe - Executes dropped EXE 64 IoCs
pid Process 5768 audiodg.exe 440 shost.exe 2640 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21..exe 3480 audiodg.exe 4756 shost.exe 436 audiodg.exe 4960 shost.exe 3412 audiodg.exe 4104 shost.exe 3736 audiodg.exe 2200 shost.exe 556 audiodg.exe 5816 shost.exe 4688 audiodg.exe 5440 shost.exe 3672 audiodg.exe 2180 shost.exe 2820 audiodg.exe 5760 shost.exe 4732 audiodg.exe 4940 shost.exe 2920 audiodg.exe 1676 shost.exe 2096 audiodg.exe 5320 shost.exe 3192 audiodg.exe 5860 shost.exe 3060 audiodg.exe 2388 shost.exe 4592 audiodg.exe 5944 shost.exe 5792 audiodg.exe 5300 shost.exe 1216 audiodg.exe 5168 shost.exe 5936 audiodg.exe 5660 shost.exe 6076 audiodg.exe 5160 shost.exe 5188 audiodg.exe 5124 shost.exe 1312 audiodg.exe 3936 shost.exe 3900 audiodg.exe 3968 shost.exe 3132 audiodg.exe 6100 shost.exe 2336 audiodg.exe 3904 shost.exe 4100 audiodg.exe 5024 shost.exe 2580 audiodg.exe 1476 shost.exe 3976 audiodg.exe 4384 shost.exe 1796 audiodg.exe 4004 shost.exe 1212 audiodg.exe 5752 shost.exe 468 audiodg.exe 1080 shost.exe 2256 audiodg.exe 1680 shost.exe 2272 audiodg.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon" audiodg.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 10 pastebin.com 11 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5768 audiodg.exe Token: SeDebugPrivilege 3480 audiodg.exe Token: SeDebugPrivilege 436 audiodg.exe Token: SeDebugPrivilege 3412 audiodg.exe Token: SeDebugPrivilege 3736 audiodg.exe Token: SeDebugPrivilege 556 audiodg.exe Token: SeDebugPrivilege 4688 audiodg.exe Token: SeDebugPrivilege 3672 audiodg.exe Token: SeDebugPrivilege 2820 audiodg.exe Token: SeDebugPrivilege 4732 audiodg.exe Token: SeDebugPrivilege 2920 audiodg.exe Token: SeDebugPrivilege 2096 audiodg.exe Token: SeDebugPrivilege 3192 audiodg.exe Token: SeDebugPrivilege 3060 audiodg.exe Token: SeDebugPrivilege 4592 audiodg.exe Token: SeDebugPrivilege 5792 audiodg.exe Token: SeDebugPrivilege 1216 audiodg.exe Token: SeDebugPrivilege 5936 audiodg.exe Token: SeDebugPrivilege 6076 audiodg.exe Token: SeDebugPrivilege 5188 audiodg.exe Token: SeDebugPrivilege 1312 audiodg.exe Token: SeDebugPrivilege 3900 audiodg.exe Token: SeDebugPrivilege 3132 audiodg.exe Token: SeDebugPrivilege 2336 audiodg.exe Token: SeDebugPrivilege 4100 audiodg.exe Token: SeDebugPrivilege 2580 audiodg.exe Token: SeDebugPrivilege 3976 audiodg.exe Token: SeDebugPrivilege 1796 audiodg.exe Token: SeDebugPrivilege 1212 audiodg.exe Token: SeDebugPrivilege 468 audiodg.exe Token: SeDebugPrivilege 2256 audiodg.exe Token: SeDebugPrivilege 2272 audiodg.exe Token: SeDebugPrivilege 736 audiodg.exe Token: SeDebugPrivilege 4512 audiodg.exe Token: SeDebugPrivilege 5704 audiodg.exe Token: SeDebugPrivilege 2424 audiodg.exe Token: SeDebugPrivilege 5772 audiodg.exe Token: SeDebugPrivilege 6096 audiodg.exe Token: SeDebugPrivilege 5992 audiodg.exe Token: SeDebugPrivilege 4388 audiodg.exe Token: SeDebugPrivilege 3848 audiodg.exe Token: SeDebugPrivilege 1540 audiodg.exe Token: SeDebugPrivilege 3888 audiodg.exe Token: SeDebugPrivilege 1300 audiodg.exe Token: SeDebugPrivilege 2868 audiodg.exe Token: SeDebugPrivilege 1536 audiodg.exe Token: SeDebugPrivilege 4084 audiodg.exe Token: SeDebugPrivilege 4624 audiodg.exe Token: SeDebugPrivilege 4844 audiodg.exe Token: SeDebugPrivilege 3780 audiodg.exe Token: SeDebugPrivilege 5708 audiodg.exe Token: SeDebugPrivilege 5564 audiodg.exe Token: SeDebugPrivilege 4840 audiodg.exe Token: SeDebugPrivilege 396 audiodg.exe Token: SeDebugPrivilege 5020 audiodg.exe Token: SeDebugPrivilege 456 audiodg.exe Token: SeDebugPrivilege 1936 audiodg.exe Token: SeDebugPrivilege 5040 audiodg.exe Token: SeDebugPrivilege 3964 audiodg.exe Token: SeDebugPrivilege 5328 audiodg.exe Token: SeDebugPrivilege 5852 audiodg.exe Token: SeDebugPrivilege 5712 audiodg.exe Token: SeDebugPrivilege 4364 audiodg.exe Token: SeDebugPrivilege 4236 audiodg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 5768 4712 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe 84 PID 4712 wrote to memory of 440 4712 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe 85 PID 4712 wrote to memory of 2640 4712 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe 86 PID 440 wrote to memory of 3480 440 shost.exe 87 PID 440 wrote to memory of 4756 440 shost.exe 88 PID 4756 wrote to memory of 436 4756 shost.exe 219 PID 4756 wrote to memory of 4960 4756 shost.exe 90 PID 4960 wrote to memory of 3412 4960 shost.exe 91 PID 4960 wrote to memory of 4104 4960 shost.exe 92 PID 4104 wrote to memory of 3736 4104 shost.exe 93 PID 4104 wrote to memory of 2200 4104 shost.exe 94 PID 2200 wrote to memory of 556 2200 shost.exe 95 PID 2200 wrote to memory of 5816 2200 shost.exe 96 PID 5816 wrote to memory of 4688 5816 shost.exe 97 PID 5816 wrote to memory of 5440 5816 shost.exe 98 PID 5440 wrote to memory of 3672 5440 shost.exe 407 PID 5440 wrote to memory of 2180 5440 shost.exe 100 PID 2180 wrote to memory of 2820 2180 shost.exe 101 PID 2180 wrote to memory of 5760 2180 shost.exe 102 PID 5760 wrote to memory of 4732 5760 shost.exe 824 PID 5760 wrote to memory of 4940 5760 shost.exe 104 PID 4940 wrote to memory of 2920 4940 shost.exe 105 PID 4940 wrote to memory of 1676 4940 shost.exe 106 PID 1676 wrote to memory of 2096 1676 shost.exe 660 PID 1676 wrote to memory of 5320 1676 shost.exe 108 PID 5320 wrote to memory of 3192 5320 shost.exe 109 PID 5320 wrote to memory of 5860 5320 shost.exe 110 PID 5860 wrote to memory of 3060 5860 shost.exe 246 PID 5860 wrote to memory of 2388 5860 shost.exe 112 PID 2388 wrote to memory of 4592 2388 shost.exe 626 PID 2388 wrote to memory of 5944 2388 shost.exe 114 PID 5944 wrote to memory of 5792 5944 shost.exe 990 PID 5944 wrote to memory of 5300 5944 shost.exe 116 PID 5300 wrote to memory of 1216 5300 shost.exe 117 PID 5300 wrote to memory of 5168 5300 shost.exe 118 PID 5168 wrote to memory of 5936 5168 shost.exe 1322 PID 5168 wrote to memory of 5660 5168 shost.exe 120 PID 5660 wrote to memory of 6076 5660 shost.exe 121 PID 5660 wrote to memory of 5160 5660 shost.exe 122 PID 5160 wrote to memory of 5188 5160 shost.exe 123 PID 5160 wrote to memory of 5124 5160 shost.exe 124 PID 5124 wrote to memory of 1312 5124 shost.exe 599 PID 5124 wrote to memory of 3936 5124 shost.exe 126 PID 3936 wrote to memory of 3900 3936 shost.exe 1538 PID 3936 wrote to memory of 3968 3936 shost.exe 128 PID 3968 wrote to memory of 3132 3968 shost.exe 424 PID 3968 wrote to memory of 6100 3968 shost.exe 130 PID 6100 wrote to memory of 2336 6100 shost.exe 615 PID 6100 wrote to memory of 3904 6100 shost.exe 132 PID 3904 wrote to memory of 4100 3904 shost.exe 1059 PID 3904 wrote to memory of 5024 3904 shost.exe 134 PID 5024 wrote to memory of 2580 5024 shost.exe 1708 PID 5024 wrote to memory of 1476 5024 shost.exe 136 PID 1476 wrote to memory of 3976 1476 shost.exe 1991 PID 1476 wrote to memory of 4384 1476 shost.exe 138 PID 4384 wrote to memory of 1796 4384 shost.exe 139 PID 4384 wrote to memory of 4004 4384 shost.exe 140 PID 4004 wrote to memory of 1212 4004 shost.exe 141 PID 4004 wrote to memory of 5752 4004 shost.exe 142 PID 5752 wrote to memory of 468 5752 shost.exe 1104 PID 5752 wrote to memory of 1080 5752 shost.exe 144 PID 1080 wrote to memory of 2256 1080 shost.exe 145 PID 1080 wrote to memory of 1680 1080 shost.exe 146 PID 1680 wrote to memory of 2272 1680 shost.exe 1242
Processes
-
C:\Users\Admin\AppData\Local\Temp\xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe"C:\Users\Admin\AppData\Local\Temp\xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5768
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"6⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"8⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"9⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"10⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"12⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"13⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"14⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"15⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5792
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5936
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5188
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"24⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"27⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"28⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"29⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"30⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"33⤵PID:3092
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"34⤵
- Modifies registry class
PID:2088 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"35⤵PID:5212
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:5704
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"36⤵
- Modifies system executable filetype association
- Modifies registry class
PID:216 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"37⤵
- Modifies registry class
PID:2648 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:5772
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"38⤵PID:1624
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"39⤵
- Modifies system executable filetype association
PID:2908 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:5992
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"40⤵PID:4312
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"41⤵PID:764
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"42⤵PID:5036
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"43⤵
- Modifies system executable filetype association
PID:5888 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"44⤵
- Modifies system executable filetype association
PID:8 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"45⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1468 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"46⤵PID:3740
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"47⤵
- Modifies registry class
PID:5844 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"48⤵PID:4664
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"49⤵PID:4504
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"50⤵PID:3380
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"50⤵
- Modifies registry class
PID:4760 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"51⤵
- Modifies system executable filetype association
PID:3680 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"52⤵PID:3372
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:5708
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"53⤵
- Modifies system executable filetype association
PID:4048 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:5564
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"54⤵PID:5480
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"55⤵PID:4292
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"56⤵PID:896
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"57⤵PID:2608
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"58⤵
- Modifies system executable filetype association
- Modifies registry class
PID:760 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"59⤵PID:2320
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"60⤵
- Modifies registry class
PID:5360 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"61⤵
- Modifies system executable filetype association
PID:5836 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:5328
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"62⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1552 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:5852
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"63⤵PID:4420
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"64⤵PID:1532
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"65⤵
- Modifies registry class
PID:2452 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"66⤵
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"66⤵PID:2444
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"67⤵PID:4980
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"67⤵
- Modifies registry class
PID:2988 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"68⤵PID:5404
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"68⤵PID:436
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"69⤵PID:4260
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"69⤵PID:6124
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"70⤵PID:3428
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"70⤵
- Modifies registry class
PID:3300 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"71⤵PID:5640
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"71⤵
- Modifies registry class
PID:5912 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"72⤵PID:3032
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"72⤵PID:5200
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"73⤵PID:4876
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"73⤵
- Modifies system executable filetype association
PID:2724 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"74⤵PID:3240
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"74⤵
- Modifies system executable filetype association
PID:3652 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"75⤵PID:4896
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"75⤵
- Modifies registry class
PID:2544 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"76⤵PID:1776
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"76⤵
- Modifies system executable filetype association
PID:3188 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"77⤵PID:5092
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"77⤵PID:5236
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"78⤵PID:3716
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"78⤵
- Modifies system executable filetype association
PID:6016 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"79⤵PID:5504
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"79⤵
- Modifies system executable filetype association
PID:1392 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"80⤵PID:4864
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"80⤵PID:5468
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"81⤵PID:4324
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"81⤵
- Modifies registry class
PID:4932 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"82⤵PID:3060
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"82⤵PID:916
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"83⤵PID:5756
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"83⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5840 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"84⤵PID:4472
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"84⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5824 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"85⤵PID:1832
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"85⤵
- Modifies registry class
PID:1596 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"86⤵PID:560
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"86⤵PID:4916
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"87⤵PID:5740
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"87⤵PID:3944
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"88⤵PID:1096
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"88⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3912 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"89⤵PID:2380
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"89⤵
- Modifies system executable filetype association
PID:4872 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"90⤵PID:3152
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"90⤵
- Modifies system executable filetype association
PID:3356 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"91⤵PID:4640
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"91⤵
- Modifies system executable filetype association
PID:4748 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"92⤵PID:5804
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"92⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1104 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"93⤵PID:4028
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"93⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5060 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"94⤵PID:3900
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"94⤵PID:2420
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"95⤵PID:3132
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"95⤵PID:5868
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"96⤵PID:5156
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"96⤵PID:5152
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"97⤵PID:2652
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"97⤵
- Modifies registry class
PID:5216 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"98⤵PID:2064
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"98⤵PID:5460
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"99⤵PID:4684
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"99⤵
- Modifies system executable filetype association
PID:4656 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"100⤵PID:2576
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"100⤵PID:1668
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"101⤵PID:3488
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"101⤵
- Modifies system executable filetype association
PID:4152 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"102⤵PID:716
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"102⤵
- Modifies system executable filetype association
PID:5544 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"103⤵PID:3296
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"103⤵
- Modifies system executable filetype association
PID:3748 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"104⤵PID:5224
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"104⤵
- Modifies system executable filetype association
PID:920 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"105⤵PID:5580
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"105⤵PID:5332
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"106⤵PID:4072
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"106⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3744 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"107⤵PID:4304
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"107⤵PID:3952
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"108⤵PID:1760
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"108⤵PID:3960
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"109⤵PID:3980
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"109⤵PID:3752
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"110⤵PID:1912
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"110⤵
- Modifies system executable filetype association
- Modifies registry class
PID:736 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"111⤵PID:3436
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"111⤵
- Modifies registry class
PID:4984 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"112⤵PID:2808
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"112⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4508 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"113⤵PID:4100
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"113⤵PID:5628
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"114⤵PID:5548
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"114⤵
- Modifies registry class
PID:5772 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"115⤵PID:4744
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"115⤵PID:6136
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"116⤵PID:5996
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"116⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1980 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"117⤵PID:1236
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"117⤵
- Modifies system executable filetype association
PID:1800 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"118⤵PID:1284
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"118⤵
- Modifies registry class
PID:4388 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"119⤵PID:1720
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"119⤵
- Modifies system executable filetype association
PID:3820 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"120⤵PID:6020
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"120⤵PID:1560
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"121⤵PID:2532
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"121⤵PID:1408
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"122⤵PID:3220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-