Analysis
- max time kernel
3s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 04:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260130-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11-20260130-en
5 signatures
150 seconds
General
- Target 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe
- Size 757KB
- Sample260425-e3cy4aft4z
- SHA256 01b1e75952c9c9c0af28fba3cbaf372af86a4faedf556efc674a0430ad0a6b3a
- MD5 8a0e30dab116a9dec7baf64d4819cec9
- SHA1 5fde8aef8caa25784983bfb98e2db45b8f667256
- SHA512 3ebd8c65e635fa1ecf6c1637aacd94266413dc276286843542f31debc3bc8da57f15e48e92c75d31854541804acea018dce1f3c9494c873ae26e8d82a8e18ec1
- SSDEEP 12288:SYyDi5eJQ7uysMFZzN/E/msxBm1Wd97pK12Db6WXQo:FavgsBrtWWXd
- TLSH T154F47D02EB8804EAD877C630C1B19656DB37B8D56BA1DBDF12983A3D3E226D09D35734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
resource yara_rule behavioral2/files/0x001a00000002b45f-4.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/files/0x001900000002b461-13.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Executes dropped EXE 37 IoCs
pid Process 3152 audiodg.exe 4452 shost.exe 2056 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm..exe 920 audiodg.exe 1788 shost.exe 1736 audiodg.exe 3020 shost.exe 3000 audiodg.exe 3068 shost.exe 3368 audiodg.exe 2900 shost.exe 3780 audiodg.exe 5008 shost.exe 2856 audiodg.exe 1064 shost.exe 1912 audiodg.exe 2556 shost.exe 3660 audiodg.exe 4324 shost.exe 4116 audiodg.exe 4612 shost.exe 4556 audiodg.exe 1704 shost.exe 1344 audiodg.exe 3416 shost.exe 4860 audiodg.exe 5088 shost.exe 1104 audiodg.exe 2664 shost.exe 4480 audiodg.exe 3100 shost.exe 448 audiodg.exe 4076 shost.exe 1892 audiodg.exe 1616 shost.exe 1088 audiodg.exe 1528 shost.exe - Modifies system executable filetype association 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3652 wrote to memory of 3152 3652 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe 80 PID 3652 wrote to memory of 4452 3652 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe 81 PID 3652 wrote to memory of 2056 3652 2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe 82 PID 4452 wrote to memory of 920 4452 shost.exe 83 PID 4452 wrote to memory of 1788 4452 shost.exe 85 PID 1788 wrote to memory of 1736 1788 shost.exe 86 PID 1788 wrote to memory of 3020 1788 shost.exe 87 PID 3020 wrote to memory of 3000 3020 shost.exe 88 PID 3020 wrote to memory of 3068 3020 shost.exe 89 PID 3068 wrote to memory of 3368 3068 shost.exe 90 PID 3068 wrote to memory of 2900 3068 shost.exe 91 PID 2900 wrote to memory of 3780 2900 shost.exe 92 PID 2900 wrote to memory of 5008 2900 shost.exe 93 PID 5008 wrote to memory of 2856 5008 shost.exe 94 PID 5008 wrote to memory of 1064 5008 shost.exe 95 PID 1064 wrote to memory of 1912 1064 shost.exe 96 PID 1064 wrote to memory of 2556 1064 shost.exe 97 PID 2556 wrote to memory of 3660 2556 shost.exe 98 PID 2556 wrote to memory of 4324 2556 shost.exe 99 PID 4324 wrote to memory of 4116 4324 shost.exe 100 PID 4324 wrote to memory of 4612 4324 shost.exe 101 PID 4612 wrote to memory of 4556 4612 shost.exe 102 PID 4612 wrote to memory of 1704 4612 shost.exe 103 PID 1704 wrote to memory of 1344 1704 shost.exe 104 PID 1704 wrote to memory of 3416 1704 shost.exe 105 PID 3416 wrote to memory of 4860 3416 shost.exe 106 PID 3416 wrote to memory of 5088 3416 shost.exe 107 PID 5088 wrote to memory of 1104 5088 shost.exe 108 PID 5088 wrote to memory of 2664 5088 shost.exe 109 PID 2664 wrote to memory of 4480 2664 shost.exe 110 PID 2664 wrote to memory of 3100 2664 shost.exe 111 PID 3100 wrote to memory of 448 3100 shost.exe 112 PID 3100 wrote to memory of 4076 3100 shost.exe 113 PID 4076 wrote to memory of 1892 4076 shost.exe 114 PID 4076 wrote to memory of 1616 4076 shost.exe 115 PID 1616 wrote to memory of 1088 1616 shost.exe 116 PID 1616 wrote to memory of 1528 1616 shost.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_8a0e30dab116a9dec7baf64d4819cec9_cobalt-strike_icedid_ryuk_satacom_stealc_vidar_xworm.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes dropped EXE
PID:3152
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
PID:920
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"4⤵
- Executes dropped EXE
PID:1736
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"5⤵
- Executes dropped EXE
PID:3000
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"5⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"6⤵
- Executes dropped EXE
PID:3368
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"6⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"7⤵
- Executes dropped EXE
PID:3780
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"7⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"8⤵
- Executes dropped EXE
PID:2856
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"8⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"9⤵
- Executes dropped EXE
PID:1912
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"9⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"10⤵
- Executes dropped EXE
PID:3660
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"10⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"11⤵
- Executes dropped EXE
PID:4116
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"11⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"12⤵
- Executes dropped EXE
PID:4556
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"12⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"13⤵
- Executes dropped EXE
PID:1344
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"13⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"14⤵
- Executes dropped EXE
PID:4860
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"14⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"15⤵
- Executes dropped EXE
PID:1104
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"15⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"16⤵
- Executes dropped EXE
PID:4480
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"16⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"17⤵
- Executes dropped EXE
PID:448
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"17⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"18⤵
- Executes dropped EXE
PID:1892
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"19⤵
- Executes dropped EXE
PID:1088
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"19⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"20⤵PID:2760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"20⤵PID:4956
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"21⤵PID:32
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"21⤵PID:228
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"22⤵PID:5056
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"22⤵PID:1124
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"23⤵PID:5072
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"23⤵PID:4900
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"24⤵PID:1884
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"24⤵PID:2844
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"25⤵PID:5028
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"25⤵PID:4624
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"26⤵PID:960
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"26⤵PID:2136
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"27⤵PID:1548
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"27⤵PID:564
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"28⤵PID:2604
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"28⤵PID:4516
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"29⤵PID:2692
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"29⤵PID:852
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"30⤵PID:1136
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"30⤵PID:4652
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"31⤵PID:4844
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"31⤵PID:4456
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"32⤵PID:2676
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"32⤵PID:3936
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"33⤵PID:4812
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"33⤵PID:1688
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"34⤵PID:1224
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"34⤵PID:4524
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"35⤵PID:1924
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"35⤵PID:3192
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"36⤵PID:2404
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"36⤵PID:3676
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"37⤵PID:1216
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"37⤵PID:1968
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"38⤵PID:3380
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"38⤵PID:3044
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"39⤵PID:2928
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"39⤵PID:360
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"40⤵PID:3224
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"40⤵PID:4884
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"41⤵PID:2912
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"41⤵PID:3700
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"42⤵PID:5080
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"42⤵PID:2444
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"43⤵PID:4472
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"43⤵PID:4448
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"44⤵PID:3656
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"44⤵PID:1964
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"45⤵PID:1448
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"45⤵PID:4276
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"46⤵PID:2592
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"46⤵PID:468
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"47⤵PID:3896
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"47⤵PID:4944
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"48⤵PID:908
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"48⤵PID:2644
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"49⤵PID:2164
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"49⤵PID:1596
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"50⤵PID:2960
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"50⤵PID:4816
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"51⤵PID:2196
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"51⤵PID:3568
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"52⤵PID:2580
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"52⤵PID:3932
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"53⤵PID:3480
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"53⤵PID:1000
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"54⤵PID:1352
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"54⤵PID:1876
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"55⤵PID:2768
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"55⤵PID:2892
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"56⤵PID:2304
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"56⤵PID:2344
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"57⤵PID:4744
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"57⤵PID:4560
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"58⤵PID:1764
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"58⤵PID:1756
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"59⤵PID:128
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"59⤵PID:3096
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"60⤵PID:3684
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"60⤵PID:2948
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"61⤵PID:3132
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"61⤵PID:1932
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"62⤵PID:2144
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"62⤵PID:752
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"63⤵PID:3208
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"63⤵PID:3332
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"64⤵PID:4408
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"64⤵PID:1400
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"65⤵PID:5108
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"65⤵PID:832
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"66⤵PID:4484
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"66⤵PID:1660
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"67⤵PID:1460
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"67⤵PID:3284
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"68⤵PID:1132
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"68⤵PID:1480
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"69⤵PID:1108
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"69⤵PID:4888
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"70⤵PID:1120
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"70⤵PID:3988
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"71⤵PID:4316
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"71⤵PID:3364
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"72⤵PID:1684
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"72⤵PID:3188
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"73⤵PID:1772
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"73⤵PID:1068
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"74⤵PID:4428
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"74⤵PID:4104
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"75⤵PID:4280
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"75⤵PID:4952
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"76⤵PID:1292
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"76⤵PID:4216
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"77⤵PID:2484
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"77⤵PID:2320
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"78⤵PID:2520
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"78⤵PID:4164
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"79⤵PID:3572
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"79⤵PID:3860
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"80⤵PID:3768
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"80⤵PID:4244
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"81⤵PID:1952
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"81⤵PID:4460
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"82⤵PID:728
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"82⤵PID:816
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"83⤵PID:1148
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"83⤵PID:1368
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"84⤵PID:4892
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"84⤵PID:2276
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"85⤵PID:4256
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"85⤵PID:2872
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"86⤵PID:4720
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"86⤵PID:4684
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"87⤵PID:760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"87⤵PID:2116
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"88⤵PID:3492
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"88⤵PID:4120
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"89⤵PID:1356
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"89⤵PID:2756
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"90⤵PID:4784
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"90⤵PID:2500
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"91⤵PID:4992
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"91⤵PID:4672
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"92⤵PID:4124
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"92⤵PID:3164
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"93⤵PID:2784
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"93⤵PID:496
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"94⤵PID:5132
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"94⤵PID:5152
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"95⤵PID:5168
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"95⤵PID:5192
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"96⤵PID:5208
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"96⤵PID:5228
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"97⤵PID:5248
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"97⤵PID:5264
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"98⤵PID:5280
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"98⤵PID:5300
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"99⤵PID:5312
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"99⤵PID:5328
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"100⤵PID:5348
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"100⤵PID:5376
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"101⤵PID:5400
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"101⤵PID:5416
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"102⤵PID:5436
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"102⤵PID:5472
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"103⤵PID:5492
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"103⤵PID:5512
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"104⤵PID:5536
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"104⤵PID:5552
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"105⤵PID:5572
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"105⤵PID:5580
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"106⤵PID:5608
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"106⤵PID:5616
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"107⤵PID:5644
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"107⤵PID:5660
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"108⤵PID:5680
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"108⤵PID:5688
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"109⤵PID:5704
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"109⤵PID:5732
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"110⤵PID:5756
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"110⤵PID:5772
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"111⤵PID:5792
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"111⤵PID:5808
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"112⤵PID:5828
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"112⤵PID:5844
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"113⤵PID:5856
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"113⤵PID:5904
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"114⤵PID:5932
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"114⤵PID:5948
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"115⤵PID:5968
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"115⤵PID:5984
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"116⤵PID:5996
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"116⤵PID:6020
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"117⤵PID:6040
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"117⤵PID:6052
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"118⤵PID:6072
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"118⤵PID:6092
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"119⤵PID:6112
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"119⤵PID:6120
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"120⤵PID:2208
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"120⤵PID:236
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"121⤵PID:5156
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"121⤵PID:3852
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"122⤵PID:5240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-