Analysis
- max time kernel
5s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260709-en
General
- Target 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe
- Size 12.4MB
- Sample260808-dffk2ayeqe
- SHA256 14c71a9c11b531857e15b713a9895989ba7a57a754e2c4c5901721843c79c185
- MD5 ad2457d4f3f80bf242446036abdd4881
- SHA1 e78968bdd73cd86f95c709e5bba6a3f61da31db4
- SHA512 0898d9c5496defaa6655c8ea93067a7be77aadf59a8f11c6e021078dcf15adfb0393f60733f12aef9e3cdba4749ffc1a91207783cd9b0311a10dd8994081fde2
- SSDEEP 98304:EnmQKRICbaWUV+m1oW5lVFwAuHTVk1hZxhu:945EH5GhY
- TLSH T13AD69D0DBBE51032C56721799B9F6101F736C00BA219C99A799CC7D81FA4A7142BBFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
xworm
-
XWorm V5.6
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/files/0x00070000000244b1-4.dat family_xworm behavioral1/memory/4680-5-0x0000000000360000-0x0000000000376000-memory.dmp family_xworm behavioral1/files/0x00070000000244b3-14.dat family_xworm - Detects Windows executables referencing non-Windows User-Agents 3 IoCs
resource yara_rule behavioral1/files/0x00070000000244b1-4.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/4680-5-0x0000000000360000-0x0000000000376000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x00070000000244b3-14.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk audiodg.exe - Executes dropped EXE 64 IoCs
pid Process 4680 audiodg.exe 3312 shost.exe 2484 audiodg.exe 4552 shost.exe 556 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr..exe 1708 audiodg.exe 3804 shost.exe 1904 audiodg.exe 4068 shost.exe 2176 audiodg.exe 4608 shost.exe 2936 audiodg.exe 4136 shost.exe 3756 audiodg.exe 4040 shost.exe 864 audiodg.exe 3728 shost.exe 3976 audiodg.exe 2304 shost.exe 3364 audiodg.exe 4112 shost.exe 4468 audiodg.exe 4264 shost.exe 4484 audiodg.exe 220 shost.exe 4364 audiodg.exe 4912 shost.exe 4316 audiodg.exe 3820 shost.exe 3836 audiodg.exe 4584 shost.exe 4640 audiodg.exe 4988 shost.exe 1616 audiodg.exe 3152 shost.exe 3076 audiodg.exe 4656 shost.exe 2376 audiodg.exe 2088 shost.exe 4100 audiodg.exe 3612 shost.exe 2552 audiodg.exe 1756 shost.exe 752 audiodg.exe 4536 shost.exe 1952 audiodg.exe 1920 shost.exe 1244 audiodg.exe 4032 shost.exe 1916 audiodg.exe 2516 shost.exe 4060 audiodg.exe 1380 shost.exe 1652 audiodg.exe 4344 shost.exe 2660 audiodg.exe 3408 shost.exe 1752 audiodg.exe 3936 shost.exe 1884 audiodg.exe 5068 shost.exe 2964 audiodg.exe 4732 shost.exe 4164 audiodg.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon" audiodg.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 3 pastebin.com 4 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3140 556 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr..exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4680 audiodg.exe Token: SeDebugPrivilege 2484 audiodg.exe Token: SeDebugPrivilege 1708 audiodg.exe Token: SeDebugPrivilege 1904 audiodg.exe Token: SeDebugPrivilege 2176 audiodg.exe Token: SeDebugPrivilege 2936 audiodg.exe Token: SeDebugPrivilege 3756 audiodg.exe Token: SeDebugPrivilege 864 audiodg.exe Token: SeDebugPrivilege 3976 audiodg.exe Token: SeDebugPrivilege 3364 audiodg.exe Token: SeDebugPrivilege 4468 audiodg.exe Token: SeDebugPrivilege 4484 audiodg.exe Token: SeDebugPrivilege 4364 audiodg.exe Token: SeDebugPrivilege 4316 audiodg.exe Token: SeDebugPrivilege 3836 audiodg.exe Token: SeDebugPrivilege 4640 audiodg.exe Token: SeDebugPrivilege 1616 audiodg.exe Token: SeDebugPrivilege 3076 audiodg.exe Token: SeDebugPrivilege 2376 audiodg.exe Token: SeDebugPrivilege 4100 audiodg.exe Token: SeDebugPrivilege 2552 audiodg.exe Token: SeDebugPrivilege 752 audiodg.exe Token: SeDebugPrivilege 1952 audiodg.exe Token: SeDebugPrivilege 1244 audiodg.exe Token: SeDebugPrivilege 1916 audiodg.exe Token: SeDebugPrivilege 4060 audiodg.exe Token: SeDebugPrivilege 1652 audiodg.exe Token: SeDebugPrivilege 2660 audiodg.exe Token: SeDebugPrivilege 1752 audiodg.exe Token: SeDebugPrivilege 1884 audiodg.exe Token: SeDebugPrivilege 2964 audiodg.exe Token: SeDebugPrivilege 4164 audiodg.exe Token: SeDebugPrivilege 4180 audiodg.exe Token: SeDebugPrivilege 2160 audiodg.exe Token: SeDebugPrivilege 2436 audiodg.exe Token: SeDebugPrivilege 808 audiodg.exe Token: SeDebugPrivilege 4224 audiodg.exe Token: SeDebugPrivilege 4644 audiodg.exe Token: SeDebugPrivilege 3296 audiodg.exe Token: SeDebugPrivilege 964 audiodg.exe Token: SeDebugPrivilege 4128 audiodg.exe Token: SeDebugPrivilege 1740 audiodg.exe Token: SeDebugPrivilege 116 audiodg.exe Token: SeDebugPrivilege 3140 audiodg.exe Token: SeDebugPrivilege 3876 audiodg.exe Token: SeDebugPrivilege 2988 audiodg.exe Token: SeDebugPrivilege 1836 audiodg.exe Token: SeDebugPrivilege 1912 audiodg.exe Token: SeDebugPrivilege 3136 audiodg.exe Token: SeDebugPrivilege 2860 audiodg.exe Token: SeDebugPrivilege 3556 audiodg.exe Token: SeDebugPrivilege 4000 audiodg.exe Token: SeDebugPrivilege 1116 audiodg.exe Token: SeDebugPrivilege 456 audiodg.exe Token: SeDebugPrivilege 2096 audiodg.exe Token: SeDebugPrivilege 3780 audiodg.exe Token: SeDebugPrivilege 1580 audiodg.exe Token: SeDebugPrivilege 2864 audiodg.exe Token: SeDebugPrivilege 720 audiodg.exe Token: SeDebugPrivilege 4228 audiodg.exe Token: SeDebugPrivilege 744 audiodg.exe Token: SeDebugPrivilege 4996 audiodg.exe Token: SeDebugPrivilege 2472 audiodg.exe Token: SeDebugPrivilege 3760 audiodg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 4680 1676 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe 85 PID 1676 wrote to memory of 3312 1676 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe 86 PID 3312 wrote to memory of 2484 3312 shost.exe 87 PID 3312 wrote to memory of 4552 3312 shost.exe 89 PID 1676 wrote to memory of 556 1676 2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe 88 PID 4552 wrote to memory of 1708 4552 shost.exe 90 PID 4552 wrote to memory of 3804 4552 shost.exe 91 PID 3804 wrote to memory of 1904 3804 shost.exe 236 PID 3804 wrote to memory of 4068 3804 shost.exe 95 PID 4068 wrote to memory of 2176 4068 shost.exe 511 PID 4068 wrote to memory of 4608 4068 shost.exe 98 PID 4608 wrote to memory of 2936 4608 shost.exe 365 PID 4608 wrote to memory of 4136 4608 shost.exe 100 PID 4136 wrote to memory of 3756 4136 shost.exe 649 PID 4136 wrote to memory of 4040 4136 shost.exe 102 PID 4040 wrote to memory of 864 4040 shost.exe 103 PID 4040 wrote to memory of 3728 4040 shost.exe 104 PID 3728 wrote to memory of 3976 3728 shost.exe 553 PID 3728 wrote to memory of 2304 3728 shost.exe 106 PID 2304 wrote to memory of 3364 2304 shost.exe 107 PID 2304 wrote to memory of 4112 2304 shost.exe 108 PID 4112 wrote to memory of 4468 4112 shost.exe 756 PID 4112 wrote to memory of 4264 4112 shost.exe 110 PID 4264 wrote to memory of 4484 4264 shost.exe 1075 PID 4264 wrote to memory of 220 4264 shost.exe 112 PID 220 wrote to memory of 4364 220 shost.exe 113 PID 220 wrote to memory of 4912 220 shost.exe 114 PID 4912 wrote to memory of 4316 4912 shost.exe 231 PID 4912 wrote to memory of 3820 4912 shost.exe 116 PID 3820 wrote to memory of 3836 3820 shost.exe 758 PID 3820 wrote to memory of 4584 3820 shost.exe 118 PID 4584 wrote to memory of 4640 4584 shost.exe 119 PID 4584 wrote to memory of 4988 4584 shost.exe 120 PID 4988 wrote to memory of 1616 4988 shost.exe 1095 PID 4988 wrote to memory of 3152 4988 shost.exe 122 PID 3152 wrote to memory of 3076 3152 shost.exe 1378 PID 3152 wrote to memory of 4656 3152 shost.exe 124 PID 4656 wrote to memory of 2376 4656 shost.exe 1184 PID 4656 wrote to memory of 2088 4656 shost.exe 126 PID 2088 wrote to memory of 4100 2088 shost.exe 837 PID 2088 wrote to memory of 3612 2088 shost.exe 128 PID 3612 wrote to memory of 2552 3612 shost.exe 784 PID 3612 wrote to memory of 1756 3612 shost.exe 130 PID 1756 wrote to memory of 752 1756 shost.exe 1643 PID 1756 wrote to memory of 4536 1756 shost.exe 132 PID 4536 wrote to memory of 1952 4536 shost.exe 1636 PID 4536 wrote to memory of 1920 4536 shost.exe 134 PID 1920 wrote to memory of 1244 1920 shost.exe 964 PID 1920 wrote to memory of 4032 1920 shost.exe 136 PID 4032 wrote to memory of 1916 4032 shost.exe 1284 PID 4032 wrote to memory of 2516 4032 shost.exe 138 PID 2516 wrote to memory of 4060 2516 shost.exe 1064 PID 2516 wrote to memory of 1380 2516 shost.exe 140 PID 1380 wrote to memory of 1652 1380 shost.exe 1478 PID 1380 wrote to memory of 4344 1380 shost.exe 142 PID 4344 wrote to memory of 2660 4344 shost.exe 656 PID 4344 wrote to memory of 3408 4344 shost.exe 144 PID 3408 wrote to memory of 1752 3408 shost.exe 1259 PID 3408 wrote to memory of 3936 3408 shost.exe 146 PID 3936 wrote to memory of 1884 3936 shost.exe 147 PID 3936 wrote to memory of 5068 3936 shost.exe 148 PID 5068 wrote to memory of 2964 5068 shost.exe 3113 PID 5068 wrote to memory of 4732 5068 shost.exe 150 PID 4732 wrote to memory of 4164 4732 shost.exe 948
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ad2457d4f3f80bf242446036abdd4881_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njr.exe"1⤵
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"5⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"7⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"9⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"10⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"11⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"13⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"14⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"17⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"19⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"20⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"21⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"23⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"24⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"25⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"28⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"29⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"30⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"33⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3228 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"34⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4812 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"35⤵
- Modifies registry class
PID:4816 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"36⤵
- Modifies registry class
PID:3692 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"37⤵
- Modifies system executable filetype association
PID:2164 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"38⤵
- Modifies system executable filetype association
- Modifies registry class
PID:404 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"39⤵
- Modifies registry class
PID:2028 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"40⤵
- Modifies system executable filetype association
PID:4704 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"41⤵
- Modifies system executable filetype association
PID:2220 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"42⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2040 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"43⤵
- Modifies registry class
PID:2060 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:116
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"44⤵
- Modifies system executable filetype association
PID:2416 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"45⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1948 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"46⤵
- Modifies registry class
PID:4240 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"47⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4620 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"48⤵
- Modifies system executable filetype association
PID:1356 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"49⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2032 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"50⤵
- Modifies system executable filetype association
- Modifies registry class
PID:452 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"51⤵
- Modifies system executable filetype association
PID:2460 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"52⤵
- Modifies system executable filetype association
PID:392 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"53⤵
- Modifies system executable filetype association
PID:4848 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"54⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2428 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"55⤵
- Modifies registry class
PID:1844 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"56⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3456 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"57⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4044 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"58⤵
- Modifies system executable filetype association
PID:4304 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"59⤵
- Modifies registry class
PID:848 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"60⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2316 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"61⤵
- Modifies registry class
PID:4896 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"62⤵
- Modifies registry class
PID:3252 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"63⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1780 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"64⤵
- Modifies registry class
PID:1336 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"65⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1612 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"66⤵PID:4636
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"66⤵
- Modifies registry class
PID:4356 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"67⤵PID:2756
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"67⤵
- Modifies system executable filetype association
PID:3712 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"68⤵PID:2520
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"68⤵
- Modifies system executable filetype association
PID:1872 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"69⤵PID:3488
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"69⤵
- Modifies registry class
PID:2588 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"70⤵PID:5036
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"70⤵PID:1696
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"71⤵PID:1532
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"71⤵PID:4612
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"72⤵PID:2312
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"72⤵PID:4316
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"73⤵PID:1284
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"73⤵PID:1880
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"74⤵PID:2592
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"74⤵PID:4604
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"75⤵PID:1904
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"75⤵PID:2232
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"76⤵PID:4684
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"76⤵PID:1256
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"77⤵PID:2604
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"77⤵PID:3584
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"78⤵PID:3348
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"78⤵PID:4296
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"79⤵PID:1744
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"79⤵PID:4436
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"80⤵PID:2464
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"80⤵PID:2796
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"81⤵PID:1636
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"81⤵PID:2992
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"82⤵PID:5128
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"82⤵PID:5148
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"83⤵PID:5184
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"83⤵PID:5204
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"84⤵PID:5228
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"84⤵PID:5244
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"85⤵PID:5264
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"85⤵PID:5284
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"86⤵PID:5304
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"86⤵PID:5312
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"87⤵PID:5340
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"87⤵PID:5400
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"88⤵PID:5424
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"88⤵PID:5460
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"89⤵PID:5476
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"89⤵PID:5488
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"90⤵PID:5516
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"90⤵PID:5536
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"91⤵PID:5572
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"91⤵PID:5608
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"92⤵PID:5628
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"92⤵PID:5640
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"93⤵PID:5668
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"93⤵PID:5692
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"94⤵PID:5708
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"94⤵PID:5736
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"95⤵PID:5760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"95⤵PID:5788
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"96⤵PID:5820
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"96⤵PID:5860
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"97⤵PID:5880
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"97⤵PID:5904
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"98⤵PID:5928
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"98⤵PID:5964
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"99⤵PID:5996
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"99⤵PID:6028
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"100⤵PID:6048
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"100⤵PID:6080
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"101⤵PID:6124
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"101⤵PID:3184
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"102⤵PID:1132
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"102⤵PID:1100
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"103⤵PID:1952
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"103⤵PID:5176
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"104⤵PID:1244
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"104⤵PID:5272
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"105⤵PID:3740
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"105⤵PID:1828
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"106⤵PID:2480
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"106⤵PID:2336
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"107⤵PID:5432
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"107⤵PID:5468
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"108⤵PID:4232
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"108⤵PID:4104
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"109⤵PID:5616
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"109⤵PID:5664
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"110⤵PID:5704
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"110⤵PID:5724
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"111⤵PID:5748
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"111⤵PID:5828
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"112⤵PID:4108
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"112⤵PID:5804
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"113⤵PID:5892
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"113⤵PID:5936
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"114⤵PID:5984
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"114⤵PID:5992
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"115⤵PID:6004
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"115⤵PID:6032
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"116⤵PID:1152
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"116⤵PID:2248
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"117⤵PID:6064
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"117⤵PID:6136
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"118⤵PID:768
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"118⤵PID:1240
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"119⤵PID:4492
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"119⤵PID:1672
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"120⤵PID:3788
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"120⤵PID:5316
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"121⤵PID:4824
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"121⤵PID:2352
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"122⤵PID:5376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-