Analysis
- max time kernel
5s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 04:27
Behavioral task
behavioral1
Sample
xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe
Resource
win11-20260513-en
11 signatures
150 seconds
General
- Target xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe
- Size 896KB
- Sample260604-e3atqshz2y
- SHA256 e5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94
- MD5 908ace8f09097bf531e09839a817ddb0
- SHA1 7dd25e65fbcf4451bb89999758e2e6221f2ce43d
- SHA512 2028272579ed13404d479c8e654c6ccf4fc5bc188d06570975ca0347d06561348afdb3ff30c83f7a50bb82ef2cdbed23f089e5321993a317c3f757fe7827dd08
- SSDEEP 12288:pYyDi5rNipDuysMFZzN/E/msumX7sVHTq/zofXyc+MZd0qG5v9KbyEFeaj4Q:6yggUXR/KCtMZd0qgKWEfV
- TLSH T1A0158C16F68100EDD81AC078C79AA632E936789E1B70B9EF07D4C7551E33BE09B38B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 3 IoCs
resource yara_rule behavioral2/files/0x00040000000259e8-4.dat family_xworm behavioral2/files/0x000400000002a768-13.dat family_xworm behavioral2/memory/4948-18-0x0000000000CF0000-0x0000000000D06000-memory.dmp family_xworm - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe - Executes dropped EXE 64 IoCs
pid Process 4948 audiodg.exe 4456 shost.exe 1704 audiodg.exe 2320 shost.exe 5384 audiodg.exe 5968 shost.exe 3472 audiodg.exe 1088 shost.exe 4852 audiodg.exe 4892 shost.exe 5004 audiodg.exe 5216 shost.exe 1792 audiodg.exe 2816 shost.exe 1656 audiodg.exe 4460 shost.exe 5728 audiodg.exe 992 shost.exe 2340 audiodg.exe 3692 shost.exe 5828 audiodg.exe 3448 shost.exe 2196 audiodg.exe 5188 shost.exe 5700 audiodg.exe 4132 shost.exe 4516 audiodg.exe 3976 shost.exe 4208 audiodg.exe 1832 shost.exe 5912 audiodg.exe 2872 shost.exe 1864 audiodg.exe 1868 shost.exe 5404 audiodg.exe 5424 shost.exe 2948 audiodg.exe 1140 shost.exe 5624 audiodg.exe 5908 shost.exe 2980 audiodg.exe 1288 shost.exe 5136 audiodg.exe 1640 shost.exe 3492 audiodg.exe 6004 shost.exe 3392 audiodg.exe 4980 shost.exe 4204 audiodg.exe 5280 shost.exe 4088 audiodg.exe 5584 shost.exe 1956 audiodg.exe 2228 shost.exe 2476 audiodg.exe 920 shost.exe 4016 audiodg.exe 2120 shost.exe 4476 audiodg.exe 572 shost.exe 2244 audiodg.exe 1268 shost.exe 4736 audiodg.exe 1104 shost.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon" audiodg.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 pastebin.com 2 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4948 audiodg.exe Token: SeDebugPrivilege 1704 audiodg.exe Token: SeDebugPrivilege 5384 audiodg.exe Token: SeDebugPrivilege 3472 audiodg.exe Token: SeDebugPrivilege 4852 audiodg.exe Token: SeDebugPrivilege 5004 audiodg.exe Token: SeDebugPrivilege 1792 audiodg.exe Token: SeDebugPrivilege 1656 audiodg.exe Token: SeDebugPrivilege 5728 audiodg.exe Token: SeDebugPrivilege 2340 audiodg.exe Token: SeDebugPrivilege 5828 audiodg.exe Token: SeDebugPrivilege 2196 audiodg.exe Token: SeDebugPrivilege 5700 audiodg.exe Token: SeDebugPrivilege 4516 audiodg.exe Token: SeDebugPrivilege 4208 audiodg.exe Token: SeDebugPrivilege 5912 audiodg.exe Token: SeDebugPrivilege 1864 audiodg.exe Token: SeDebugPrivilege 5404 audiodg.exe Token: SeDebugPrivilege 2948 audiodg.exe Token: SeDebugPrivilege 5624 audiodg.exe Token: SeDebugPrivilege 2980 audiodg.exe Token: SeDebugPrivilege 5136 audiodg.exe Token: SeDebugPrivilege 3492 audiodg.exe Token: SeDebugPrivilege 3392 audiodg.exe Token: SeDebugPrivilege 4204 audiodg.exe Token: SeDebugPrivilege 4088 audiodg.exe Token: SeDebugPrivilege 1956 audiodg.exe Token: SeDebugPrivilege 2476 audiodg.exe Token: SeDebugPrivilege 4016 audiodg.exe Token: SeDebugPrivilege 4476 audiodg.exe Token: SeDebugPrivilege 2244 audiodg.exe Token: SeDebugPrivilege 4736 audiodg.exe Token: SeDebugPrivilege 2028 audiodg.exe Token: SeDebugPrivilege 4600 audiodg.exe Token: SeDebugPrivilege 5316 audiodg.exe Token: SeDebugPrivilege 4492 audiodg.exe Token: SeDebugPrivilege 1696 audiodg.exe Token: SeDebugPrivilege 2956 audiodg.exe Token: SeDebugPrivilege 2184 audiodg.exe Token: SeDebugPrivilege 5836 audiodg.exe Token: SeDebugPrivilege 1348 audiodg.exe Token: SeDebugPrivilege 3328 audiodg.exe Token: SeDebugPrivilege 5372 audiodg.exe Token: SeDebugPrivilege 576 audiodg.exe Token: SeDebugPrivilege 5552 audiodg.exe Token: SeDebugPrivilege 3276 audiodg.exe Token: SeDebugPrivilege 2096 audiodg.exe Token: SeDebugPrivilege 2300 audiodg.exe Token: SeDebugPrivilege 4676 audiodg.exe Token: SeDebugPrivilege 1556 audiodg.exe Token: SeDebugPrivilege 3500 audiodg.exe Token: SeDebugPrivilege 3496 audiodg.exe Token: SeDebugPrivilege 3252 audiodg.exe Token: SeDebugPrivilege 4664 audiodg.exe Token: SeDebugPrivilege 1280 audiodg.exe Token: SeDebugPrivilege 964 audiodg.exe Token: SeDebugPrivilege 2812 audiodg.exe Token: SeDebugPrivilege 1932 audiodg.exe Token: SeDebugPrivilege 5388 audiodg.exe Token: SeDebugPrivilege 3752 audiodg.exe Token: SeDebugPrivilege 4100 audiodg.exe Token: SeDebugPrivilege 4640 audiodg.exe Token: SeDebugPrivilege 4776 audiodg.exe Token: SeDebugPrivilege 4528 audiodg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4948 4868 xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe 80 PID 4868 wrote to memory of 4456 4868 xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe 81 PID 4456 wrote to memory of 1704 4456 shost.exe 82 PID 4456 wrote to memory of 2320 4456 shost.exe 83 PID 2320 wrote to memory of 5384 2320 shost.exe 84 PID 2320 wrote to memory of 5968 2320 shost.exe 85 PID 5968 wrote to memory of 3472 5968 shost.exe 86 PID 5968 wrote to memory of 1088 5968 shost.exe 87 PID 1088 wrote to memory of 4852 1088 shost.exe 336 PID 1088 wrote to memory of 4892 1088 shost.exe 89 PID 4892 wrote to memory of 5004 4892 shost.exe 90 PID 4892 wrote to memory of 5216 4892 shost.exe 91 PID 5216 wrote to memory of 1792 5216 shost.exe 502 PID 5216 wrote to memory of 2816 5216 shost.exe 93 PID 2816 wrote to memory of 1656 2816 shost.exe 94 PID 2816 wrote to memory of 4460 2816 shost.exe 95 PID 4460 wrote to memory of 5728 4460 shost.exe 96 PID 4460 wrote to memory of 992 4460 shost.exe 97 PID 992 wrote to memory of 2340 992 shost.exe 713 PID 992 wrote to memory of 3692 992 shost.exe 99 PID 3692 wrote to memory of 5828 3692 shost.exe 358 PID 3692 wrote to memory of 3448 3692 shost.exe 101 PID 3448 wrote to memory of 2196 3448 shost.exe 102 PID 3448 wrote to memory of 5188 3448 shost.exe 103 PID 5188 wrote to memory of 5700 5188 shost.exe 104 PID 5188 wrote to memory of 4132 5188 shost.exe 105 PID 4132 wrote to memory of 4516 4132 shost.exe 441 PID 4132 wrote to memory of 3976 4132 shost.exe 107 PID 3976 wrote to memory of 4208 3976 shost.exe 952 PID 3976 wrote to memory of 1832 3976 shost.exe 109 PID 1832 wrote to memory of 5912 1832 shost.exe 110 PID 1832 wrote to memory of 2872 1832 shost.exe 111 PID 2872 wrote to memory of 1864 2872 shost.exe 514 PID 2872 wrote to memory of 1868 2872 shost.exe 113 PID 1868 wrote to memory of 5404 1868 shost.exe 640 PID 1868 wrote to memory of 5424 1868 shost.exe 115 PID 5424 wrote to memory of 2948 5424 shost.exe 1031 PID 5424 wrote to memory of 1140 5424 shost.exe 117 PID 1140 wrote to memory of 5624 1140 shost.exe 1279 PID 1140 wrote to memory of 5908 1140 shost.exe 119 PID 5908 wrote to memory of 2980 5908 shost.exe 1412 PID 5908 wrote to memory of 1288 5908 shost.exe 121 PID 1288 wrote to memory of 5136 1288 shost.exe 1479 PID 1288 wrote to memory of 1640 1288 shost.exe 123 PID 1640 wrote to memory of 3492 1640 shost.exe 1409 PID 1640 wrote to memory of 6004 1640 shost.exe 125 PID 6004 wrote to memory of 3392 6004 shost.exe 1021 PID 6004 wrote to memory of 4980 6004 shost.exe 127 PID 4980 wrote to memory of 4204 4980 shost.exe 472 PID 4980 wrote to memory of 5280 4980 shost.exe 129 PID 5280 wrote to memory of 4088 5280 shost.exe 464 PID 5280 wrote to memory of 5584 5280 shost.exe 131 PID 5584 wrote to memory of 1956 5584 shost.exe 322 PID 5584 wrote to memory of 2228 5584 shost.exe 133 PID 2228 wrote to memory of 2476 2228 shost.exe 506 PID 2228 wrote to memory of 920 2228 shost.exe 135 PID 920 wrote to memory of 4016 920 shost.exe 1990 PID 920 wrote to memory of 2120 920 shost.exe 137 PID 2120 wrote to memory of 4476 2120 shost.exe 310 PID 2120 wrote to memory of 572 2120 shost.exe 139 PID 572 wrote to memory of 2244 572 shost.exe 1372 PID 572 wrote to memory of 1268 572 shost.exe 141 PID 1268 wrote to memory of 4736 1268 shost.exe 482 PID 1268 wrote to memory of 1104 1268 shost.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe"C:\Users\Admin\AppData\Local\Temp\xe5c468b17bd5369b28513960d989d47d19ebaf040e8ed3cd17ed6ecf15fefe94.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5384
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"8⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"9⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"14⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5912
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"18⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5404
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"19⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"20⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5624
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"22⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"23⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"24⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"26⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"28⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"29⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"30⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"31⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"32⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"33⤵
- Executes dropped EXE
- Modifies system executable filetype association
PID:1104 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"34⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4556 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"35⤵PID:2288
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"36⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1480 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"37⤵PID:5524
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"38⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4376 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"39⤵
- Modifies system executable filetype association
PID:4416 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"40⤵
- Modifies registry class
PID:3736 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"41⤵PID:5068
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"42⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3584 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"43⤵PID:3800
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:5372
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"44⤵
- Modifies registry class
PID:3216 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"45⤵
- Modifies system executable filetype association
PID:3012 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:5552
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"46⤵
- Modifies registry class
PID:4616 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"47⤵
- Modifies system executable filetype association
PID:1176 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"48⤵
- Modifies registry class
PID:336 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"49⤵PID:5812
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"50⤵
- Modifies system executable filetype association
PID:5132 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"51⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4092 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"52⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5740 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"53⤵
- Modifies system executable filetype association
PID:4200 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"54⤵
- Modifies registry class
PID:3792 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"55⤵
- Modifies system executable filetype association
PID:4156 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"56⤵PID:2240
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"57⤵
- Modifies registry class
PID:1980 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"58⤵
- Modifies system executable filetype association
PID:5148 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"59⤵
- Modifies registry class
PID:5436 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:5388
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"60⤵
- Modifies registry class
PID:3240 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"61⤵PID:2468
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"62⤵PID:1328
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"63⤵
- Modifies registry class
PID:4972 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:4776
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"64⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4832 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"65⤵PID:4408
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"66⤵PID:5048
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"66⤵
- Modifies registry class
PID:4876 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"67⤵PID:560
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"67⤵
- Modifies system executable filetype association
PID:3920 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"68⤵PID:3892
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"68⤵PID:6028
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"69⤵PID:5000
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"69⤵PID:1428
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"70⤵PID:3120
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"70⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2412 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"71⤵PID:3508
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"71⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5628 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"72⤵PID:2152
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"72⤵
- Modifies system executable filetype association
PID:4284 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"73⤵PID:5876
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"73⤵
- Modifies system executable filetype association
PID:5596 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"74⤵PID:4468
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"74⤵
- Modifies system executable filetype association
- Modifies registry class
PID:916 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"75⤵PID:5180
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"75⤵
- Modifies registry class
PID:3360 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"76⤵PID:2968
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"76⤵
- Modifies registry class
PID:2936 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"77⤵PID:1244
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"77⤵
- Modifies registry class
PID:2312 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"78⤵PID:3124
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"78⤵
- Modifies registry class
PID:5652 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"79⤵PID:1720
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"79⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5672 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"80⤵PID:448
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"80⤵
- Modifies system executable filetype association
PID:5956 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"81⤵PID:1708
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"81⤵PID:3624
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"82⤵PID:3000
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"82⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4740 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"83⤵PID:5144
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"83⤵PID:340
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"84⤵PID:3228
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"84⤵PID:5392
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"85⤵PID:4872
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"85⤵
- Modifies system executable filetype association
PID:2432 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"86⤵PID:3336
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"86⤵
- Modifies system executable filetype association
PID:4840 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"87⤵PID:5992
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"87⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1164 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"88⤵PID:4856
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"88⤵
- Modifies system executable filetype association
PID:6044 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"89⤵PID:3312
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"89⤵PID:4404
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"90⤵PID:5948
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"90⤵
- Modifies registry class
PID:5232 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"91⤵PID:5164
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"91⤵
- Modifies registry class
PID:1724 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"92⤵PID:2436
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"92⤵PID:3748
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"93⤵PID:1636
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"93⤵
- Modifies registry class
PID:3128 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"94⤵PID:2464
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"94⤵
- Modifies system executable filetype association
PID:2556 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"95⤵PID:2340
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"95⤵
- Modifies system executable filetype association
PID:1692 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"96⤵PID:2768
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"96⤵
- Modifies system executable filetype association
PID:4112 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"97⤵PID:1180
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"97⤵
- Modifies registry class
PID:5692 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"98⤵PID:1212
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"98⤵
- Modifies system executable filetype association
PID:1992 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"99⤵PID:1424
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"99⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1944 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"100⤵PID:2216
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"100⤵
- Modifies system executable filetype association
PID:3952 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"101⤵PID:904
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"101⤵
- Modifies system executable filetype association
PID:1272 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"102⤵PID:3396
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"102⤵
- Modifies registry class
PID:3884 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"103⤵PID:2716
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"103⤵
- Modifies system executable filetype association
PID:2888 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"104⤵PID:6012
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"104⤵
- Modifies system executable filetype association
PID:1676 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"105⤵PID:5404
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"105⤵PID:5528
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"106⤵PID:4180
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"106⤵
- Modifies system executable filetype association
- Modifies registry class
PID:5384 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"107⤵PID:6112
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"107⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4928 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"108⤵PID:5632
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"108⤵PID:5096
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"109⤵PID:4656
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"109⤵PID:1604
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"110⤵PID:5932
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"110⤵PID:5920
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"111⤵PID:4548
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"111⤵PID:1700
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"112⤵PID:2352
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"112⤵PID:4496
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"113⤵PID:1200
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"113⤵PID:5304
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"114⤵PID:5116
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"114⤵PID:2112
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"115⤵PID:3904
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"115⤵PID:220
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"116⤵PID:4016
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"116⤵PID:4476
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"117⤵PID:2232
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"117⤵PID:3004
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"118⤵PID:4244
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"118⤵PID:2460
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"119⤵PID:708
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"119⤵PID:5644
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"120⤵PID:3260
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"120⤵PID:2108
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"121⤵PID:2844
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"121⤵PID:1048
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"122⤵PID:1552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-