Analysis
- max time kernel
12s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe
Resource
win11-20260130-en
11 signatures
150 seconds
General
- Target xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe
- Size 883KB
- Sample260421-eew23aht6r
- SHA256 e9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21
- MD5 820088db308f7a56b6274574e2072435
- SHA1 c58f321d7d95b08a4bc15797fb6f6726fcd76c4d
- SHA512 592219ef2a493867ba4066b9b3b61d48472d1dbf4c63212240708ef8d3aa00b47d94806c7a3993bdd97b0a89a32b8c2fb0a2b81ab97514df5f11d7070b50005f
- SSDEEP 24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIF:N0o01
- TLSH T13B15AE066AEC00FAD1A2E23988D26541D7F73D5787151FCB02E6AE1E3E671D1AA7D330
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x001c00000002b248-2.dat family_xworm behavioral2/memory/2164-19-0x0000000000420000-0x0000000000436000-memory.dmp family_xworm - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe - Executes dropped EXE 64 IoCs
pid Process 2164 audiodg.exe 1956 shost.exe 4608 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21..exe 2276 audiodg.exe 4976 shost.exe 4820 audiodg.exe 4184 shost.exe 3568 audiodg.exe 3396 shost.exe 1100 audiodg.exe 2884 shost.exe 4120 audiodg.exe 3872 shost.exe 3856 audiodg.exe 1608 shost.exe 1840 audiodg.exe 3400 shost.exe 3768 audiodg.exe 3884 shost.exe 2564 audiodg.exe 3700 shost.exe 1080 audiodg.exe 3980 shost.exe 2972 audiodg.exe 1528 shost.exe 4644 audiodg.exe 5004 shost.exe 3696 audiodg.exe 3292 shost.exe 3000 audiodg.exe 2616 shost.exe 3892 audiodg.exe 1284 shost.exe 4160 audiodg.exe 3040 shost.exe 4144 audiodg.exe 3172 shost.exe 2240 audiodg.exe 4024 shost.exe 4916 audiodg.exe 2832 shost.exe 5108 audiodg.exe 1916 shost.exe 3280 audiodg.exe 3108 shost.exe 4680 audiodg.exe 5056 shost.exe 1652 audiodg.exe 4452 shost.exe 3148 audiodg.exe 2580 shost.exe 1012 audiodg.exe 1232 shost.exe 3404 audiodg.exe 4480 shost.exe 4576 audiodg.exe 2808 shost.exe 4700 audiodg.exe 1444 shost.exe 5072 audiodg.exe 4988 shost.exe 1120 audiodg.exe 1168 shost.exe 2800 audiodg.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon" audiodg.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 pastebin.com 2 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\shost.exe \"%1\" %*" shost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2164 audiodg.exe Token: SeDebugPrivilege 2276 audiodg.exe Token: SeDebugPrivilege 4820 audiodg.exe Token: SeDebugPrivilege 3568 audiodg.exe Token: SeDebugPrivilege 1100 audiodg.exe Token: SeDebugPrivilege 4120 audiodg.exe Token: SeDebugPrivilege 3856 audiodg.exe Token: SeDebugPrivilege 1840 audiodg.exe Token: SeDebugPrivilege 3768 audiodg.exe Token: SeDebugPrivilege 2564 audiodg.exe Token: SeDebugPrivilege 1080 audiodg.exe Token: SeDebugPrivilege 2972 audiodg.exe Token: SeDebugPrivilege 4644 audiodg.exe Token: SeDebugPrivilege 3696 audiodg.exe Token: SeDebugPrivilege 3000 audiodg.exe Token: SeDebugPrivilege 3892 audiodg.exe Token: SeDebugPrivilege 4160 audiodg.exe Token: SeDebugPrivilege 4144 audiodg.exe Token: SeDebugPrivilege 2240 audiodg.exe Token: SeDebugPrivilege 4916 audiodg.exe Token: SeDebugPrivilege 5108 audiodg.exe Token: SeDebugPrivilege 3280 audiodg.exe Token: SeDebugPrivilege 4680 audiodg.exe Token: SeDebugPrivilege 1652 audiodg.exe Token: SeDebugPrivilege 3148 audiodg.exe Token: SeDebugPrivilege 1012 audiodg.exe Token: SeDebugPrivilege 3404 audiodg.exe Token: SeDebugPrivilege 4576 audiodg.exe Token: SeDebugPrivilege 4700 audiodg.exe Token: SeDebugPrivilege 5072 audiodg.exe Token: SeDebugPrivilege 1120 audiodg.exe Token: SeDebugPrivilege 2800 audiodg.exe Token: SeDebugPrivilege 2404 audiodg.exe Token: SeDebugPrivilege 1076 audiodg.exe Token: SeDebugPrivilege 4852 audiodg.exe Token: SeDebugPrivilege 4816 audiodg.exe Token: SeDebugPrivilege 4060 audiodg.exe Token: SeDebugPrivilege 4356 audiodg.exe Token: SeDebugPrivilege 228 audiodg.exe Token: SeDebugPrivilege 3308 audiodg.exe Token: SeDebugPrivilege 3384 audiodg.exe Token: SeDebugPrivilege 4200 audiodg.exe Token: SeDebugPrivilege 3460 audiodg.exe Token: SeDebugPrivilege 3132 audiodg.exe Token: SeDebugPrivilege 2792 audiodg.exe Token: SeDebugPrivilege 4900 audiodg.exe Token: SeDebugPrivilege 4760 audiodg.exe Token: SeDebugPrivilege 1260 audiodg.exe Token: SeDebugPrivilege 1488 audiodg.exe Token: SeDebugPrivilege 4948 audiodg.exe Token: SeDebugPrivilege 2972 audiodg.exe Token: SeDebugPrivilege 2004 audiodg.exe Token: SeDebugPrivilege 808 audiodg.exe Token: SeDebugPrivilege 4532 audiodg.exe Token: SeDebugPrivilege 1876 audiodg.exe Token: SeDebugPrivilege 964 audiodg.exe Token: SeDebugPrivilege 3628 audiodg.exe Token: SeDebugPrivilege 4740 audiodg.exe Token: SeDebugPrivilege 4864 audiodg.exe Token: SeDebugPrivilege 868 audiodg.exe Token: SeDebugPrivilege 3856 audiodg.exe Token: SeDebugPrivilege 1996 audiodg.exe Token: SeDebugPrivilege 944 audiodg.exe Token: SeDebugPrivilege 4300 audiodg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4104 wrote to memory of 2164 4104 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe 206 PID 4104 wrote to memory of 1956 4104 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe 81 PID 4104 wrote to memory of 4608 4104 xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe 413 PID 1956 wrote to memory of 2276 1956 shost.exe 83 PID 1956 wrote to memory of 4976 1956 shost.exe 84 PID 4976 wrote to memory of 4820 4976 shost.exe 85 PID 4976 wrote to memory of 4184 4976 shost.exe 86 PID 4184 wrote to memory of 3568 4184 shost.exe 456 PID 4184 wrote to memory of 3396 4184 shost.exe 88 PID 3396 wrote to memory of 1100 3396 shost.exe 489 PID 3396 wrote to memory of 2884 3396 shost.exe 90 PID 2884 wrote to memory of 4120 2884 shost.exe 91 PID 2884 wrote to memory of 3872 2884 shost.exe 92 PID 3872 wrote to memory of 3856 3872 shost.exe 511 PID 3872 wrote to memory of 1608 3872 shost.exe 94 PID 1608 wrote to memory of 1840 1608 shost.exe 328 PID 1608 wrote to memory of 3400 1608 shost.exe 96 PID 3400 wrote to memory of 3768 3400 shost.exe 97 PID 3400 wrote to memory of 3884 3400 shost.exe 98 PID 3884 wrote to memory of 2564 3884 shost.exe 176 PID 3884 wrote to memory of 3700 3884 shost.exe 100 PID 3700 wrote to memory of 1080 3700 shost.exe 839 PID 3700 wrote to memory of 3980 3700 shost.exe 102 PID 3980 wrote to memory of 2972 3980 shost.exe 181 PID 3980 wrote to memory of 1528 3980 shost.exe 104 PID 1528 wrote to memory of 4644 1528 shost.exe 655 PID 1528 wrote to memory of 5004 1528 shost.exe 106 PID 5004 wrote to memory of 3696 5004 shost.exe 451 PID 5004 wrote to memory of 3292 5004 shost.exe 108 PID 3292 wrote to memory of 3000 3292 shost.exe 1061 PID 3292 wrote to memory of 2616 3292 shost.exe 110 PID 2616 wrote to memory of 3892 2616 shost.exe 501 PID 2616 wrote to memory of 1284 2616 shost.exe 112 PID 1284 wrote to memory of 4160 1284 shost.exe 527 PID 1284 wrote to memory of 3040 1284 shost.exe 114 PID 3040 wrote to memory of 4144 3040 shost.exe 1240 PID 3040 wrote to memory of 3172 3040 shost.exe 116 PID 3172 wrote to memory of 2240 3172 shost.exe 1483 PID 3172 wrote to memory of 4024 3172 shost.exe 118 PID 4024 wrote to memory of 4916 4024 shost.exe 865 PID 4024 wrote to memory of 2832 4024 shost.exe 120 PID 2832 wrote to memory of 5108 2832 shost.exe 1146 PID 2832 wrote to memory of 1916 2832 shost.exe 122 PID 1916 wrote to memory of 3280 1916 shost.exe 485 PID 1916 wrote to memory of 3108 1916 shost.exe 124 PID 3108 wrote to memory of 4680 3108 shost.exe 447 PID 3108 wrote to memory of 5056 3108 shost.exe 126 PID 5056 wrote to memory of 1652 5056 shost.exe 1458 PID 5056 wrote to memory of 4452 5056 shost.exe 128 PID 4452 wrote to memory of 3148 4452 shost.exe 1741 PID 4452 wrote to memory of 2580 4452 shost.exe 130 PID 2580 wrote to memory of 1012 2580 shost.exe 629 PID 2580 wrote to memory of 1232 2580 shost.exe 132 PID 1232 wrote to memory of 3404 1232 shost.exe 285 PID 1232 wrote to memory of 4480 1232 shost.exe 134 PID 4480 wrote to memory of 4576 4480 shost.exe 671 PID 4480 wrote to memory of 2808 4480 shost.exe 136 PID 2808 wrote to memory of 4700 2808 shost.exe 137 PID 2808 wrote to memory of 1444 2808 shost.exe 138 PID 1444 wrote to memory of 5072 1444 shost.exe 1549 PID 1444 wrote to memory of 4988 1444 shost.exe 140 PID 4988 wrote to memory of 1120 4988 shost.exe 707 PID 4988 wrote to memory of 1168 4988 shost.exe 142 PID 1168 wrote to memory of 2800 1168 shost.exe 1021
Processes
-
C:\Users\Admin\AppData\Local\Temp\xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe"C:\Users\Admin\AppData\Local\Temp\xe9fe6b4aaf2735551af2fd9f3e4f2aa913c72a27be667518e59b9e7419cc2d21.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"5⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"6⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"7⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"11⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"12⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"13⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"18⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"19⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"23⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"24⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"25⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"27⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"28⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"29⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"31⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"32⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"33⤵
- Modifies system executable filetype association
PID:4032 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"34⤵
- Modifies registry class
PID:3312 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"35⤵PID:1524
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"36⤵
- Modifies system executable filetype association
PID:4508 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"37⤵
- Modifies registry class
PID:2336 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"38⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4016 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"39⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4320 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"40⤵PID:244
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"41⤵
- Modifies registry class
PID:924 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"42⤵
- Modifies system executable filetype association
PID:1704 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"43⤵PID:1544
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"44⤵
- Modifies registry class
PID:4216 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"45⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3100 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"46⤵PID:4196
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"47⤵PID:1692
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"48⤵
- Modifies system executable filetype association
- Modifies registry class
PID:420 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"49⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2564 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"50⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4468 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"51⤵PID:3088
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"52⤵
- Modifies registry class
PID:1640 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"53⤵PID:1708
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"54⤵
- Modifies system executable filetype association
PID:3940 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"55⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1520 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"56⤵PID:1536
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"57⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1628 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"58⤵
- Modifies system executable filetype association
PID:2204 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"59⤵
- Modifies registry class
PID:4040 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"60⤵
- Modifies system executable filetype association
PID:4488 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"61⤵
- Modifies system executable filetype association
PID:916 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"62⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4168 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"63⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2052 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"64⤵PID:2164
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"65⤵PID:720
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"66⤵PID:4336
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"66⤵
- Modifies system executable filetype association
PID:4660 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"67⤵PID:572
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"67⤵
- Modifies system executable filetype association
PID:2172 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"68⤵PID:4496
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"68⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1980 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"69⤵PID:1188
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"69⤵PID:2612
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"70⤵PID:2196
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"70⤵
- Modifies system executable filetype association
PID:3680 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"71⤵PID:1052
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"71⤵
- Modifies registry class
PID:5064 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"72⤵PID:5132
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"72⤵
- Modifies registry class
PID:5164 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"73⤵PID:5180
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"73⤵
- Modifies system executable filetype association
PID:5208 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"74⤵PID:5220
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"74⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5252 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"75⤵PID:5264
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"75⤵
- Modifies registry class
PID:5296 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"76⤵PID:5308
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"76⤵PID:5472
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"77⤵PID:5532
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"77⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5624 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"78⤵PID:5788
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"78⤵
- Modifies system executable filetype association
PID:6052 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"79⤵PID:6140
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"79⤵PID:4912
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"80⤵PID:5128
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"80⤵
- Modifies system executable filetype association
PID:2396 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"81⤵PID:5300
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"81⤵
- Modifies registry class
PID:2032 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"82⤵PID:5496
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"82⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5520 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"83⤵PID:1920
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"83⤵
- Modifies registry class
PID:5664 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"84⤵PID:1832
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"84⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5708 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"85⤵PID:5380
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"85⤵
- Modifies registry class
PID:1020 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"86⤵PID:1376
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"86⤵
- Modifies system executable filetype association
PID:5588 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"87⤵PID:5372
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"87⤵
- Modifies system executable filetype association
PID:1276 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"88⤵PID:5968
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"88⤵
- Modifies registry class
PID:5388 -
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"89⤵PID:3240
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"89⤵PID:5820
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"90⤵PID:4680
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"90⤵PID:5996
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"91⤵PID:4448
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"91⤵PID:6064
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"92⤵PID:2184
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"92⤵PID:2756
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"93⤵PID:4472
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"93⤵PID:6108
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"94⤵PID:1636
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"94⤵PID:5424
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"95⤵PID:5428
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"95⤵PID:4388
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"96⤵PID:1780
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"96⤵PID:4712
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"97⤵PID:4664
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"97⤵PID:5916
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"98⤵PID:5928
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"98⤵PID:2292
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"99⤵PID:5448
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"99⤵PID:6104
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"100⤵PID:6128
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"100⤵PID:664
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"101⤵PID:4340
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"101⤵PID:5464
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"102⤵PID:2852
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"102⤵PID:4648
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"103⤵PID:6056
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"103⤵PID:3404
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"104⤵PID:6136
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"104⤵PID:5592
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"105⤵PID:1176
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"105⤵PID:1172
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"106⤵PID:5260
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"106⤵PID:5016
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"107⤵PID:4652
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"107⤵PID:5500
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"108⤵PID:1056
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"108⤵PID:5684
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"109⤵PID:2508
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"109⤵PID:5752
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"110⤵PID:2500
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"110⤵PID:5680
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"111⤵PID:2440
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"111⤵PID:808
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"112⤵PID:4076
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"112⤵PID:2428
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"113⤵PID:4532
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"113⤵PID:988
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"114⤵PID:2880
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"114⤵PID:3348
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"115⤵PID:3892
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"115⤵PID:1816
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"116⤵PID:1032
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"116⤵PID:2156
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"117⤵PID:560
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"117⤵PID:5608
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"118⤵PID:3944
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"118⤵PID:2840
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"119⤵PID:6040
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"119⤵PID:6100
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"120⤵PID:1312
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"120⤵PID:4884
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"121⤵PID:3128
-
-
C:\Users\Admin\Documents\shost.exe"C:\Users\Admin\Documents\shost.exe"121⤵PID:6048
-
C:\Users\Admin\Documents\audiodg.exe"C:\Users\Admin\Documents\audiodg.exe"122⤵PID:3228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-