Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 22:22
Behavioral task
behavioral1
Sample
2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
General
- Target 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
- Size 752KB
- Sample261027-2amn6axset
- SHA256 e22b45918339f65cce17b0b6cf9aaece8d15d4fa8e1164d29fbeb77140180b16
- MD5 f059441bbec52e3282162ebc27313323
- SHA1 b5087cdca57eb16dc67aad7d644c5a4d750c9475
- SHA512 8bd6a72688bee08a9dfedafe657a45eed49d0f50e8aa6ab86036406cc8c58413cbc383377f37472d7ae9246005d8cf9041de44331b3b27adc874826c011fa04e
- SSDEEP 12288:pYyDi5YNiQ7uysMFZzN/E/msu+GlsRYyDi5YNiQ7uysMFZzN/E/msu+GlsU:6hvgsGVhvgsGf
- TLSH T1B9F48C16F75408FDD59BC57489924646DA3ABC8F0B72EADF17C8422A2F237E08E39750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Fxzr3jeT
Signatures
- Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/files/0x0009000000024327-3.dat family_xworm behavioral1/files/0x00070000000243a6-11.dat family_xworm behavioral1/files/0x0012000000024334-12.dat family_xworm behavioral1/memory/2112-21-0x0000000000310000-0x0000000000326000-memory.dmp family_xworm behavioral1/files/0x000b000000024328-18.dat family_xworm - Detects Windows executables referencing non-Windows User-Agents 5 IoCs
resource yara_rule behavioral1/files/0x0009000000024327-3.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x00070000000243a6-11.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x0012000000024334-12.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2112-21-0x0000000000310000-0x0000000000326000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x000b000000024328-18.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Executes a file named after a Windows system binary 1 TTPs 24 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
description ioc Process File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe File opened (read-only) C:\Users\Admin\Documents\diagnostics\audiodg.exe audiodg.exe - Executes dropped EXE 50 IoCs
pid Process 2112 audiodg.exe 548 shost.exe 4772 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe 3064 audiodg.exe 1700 audiodg.exe 1880 shost.exe 4204 shost.exe 5036 audiodg.exe 4988 audiodg.exe 4100 shost.exe 1768 audiodg.exe 3744 shost.exe 3960 audiodg.exe 2396 shost.exe 5072 audiodg.exe 4220 shost.exe 1676 shost.exe 3724 audiodg.exe 4736 audiodg.exe 904 shost.exe 4044 shost.exe 2324 audiodg.exe 1680 audiodg.exe 4156 shost.exe 204 audiodg.exe 2672 shost.exe 1360 audiodg.exe 4820 shost.exe 2104 shost.exe 2016 audiodg.exe 2380 audiodg.exe 3920 shost.exe 4432 shost.exe 4444 audiodg.exe 4784 shost.exe 2996 audiodg.exe 1448 shost.exe 4568 audiodg.exe 864 audiodg.exe 1764 shost.exe 4656 shost.exe 4548 audiodg.exe 4516 audiodg.exe 2228 shost.exe 4720 shost.exe 2616 audiodg.exe 4480 audiodg.exe 312 shost.exe 1604 shost.exe 2188 audiodg.exe - Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*" shost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command shost.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 5112 wrote to memory of 2112 5112 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe 83 PID 5112 wrote to memory of 548 5112 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe 84 PID 5112 wrote to memory of 4772 5112 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe 85 PID 548 wrote to memory of 3064 548 shost.exe 86 PID 4772 wrote to memory of 1700 4772 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe 336 PID 548 wrote to memory of 1880 548 shost.exe 88 PID 4772 wrote to memory of 4204 4772 2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe 89 PID 1880 wrote to memory of 5036 1880 shost.exe 824 PID 4204 wrote to memory of 4988 4204 shost.exe 91 PID 1880 wrote to memory of 4100 1880 shost.exe 93 PID 4100 wrote to memory of 1768 4100 shost.exe 917 PID 4204 wrote to memory of 3744 4204 shost.exe 96 PID 3744 wrote to memory of 3960 3744 shost.exe 754 PID 4100 wrote to memory of 2396 4100 shost.exe 100 PID 2396 wrote to memory of 5072 2396 shost.exe 492 PID 2396 wrote to memory of 4220 2396 shost.exe 110 PID 3744 wrote to memory of 1676 3744 shost.exe 109 PID 1676 wrote to memory of 3724 1676 shost.exe 3227 PID 4220 wrote to memory of 4736 4220 shost.exe 2964 PID 1676 wrote to memory of 904 1676 shost.exe 115 PID 4220 wrote to memory of 4044 4220 shost.exe 116 PID 904 wrote to memory of 2324 904 shost.exe 2126 PID 4044 wrote to memory of 1680 4044 shost.exe 1288 PID 904 wrote to memory of 4156 904 shost.exe 121 PID 4156 wrote to memory of 204 4156 shost.exe 855 PID 4044 wrote to memory of 2672 4044 shost.exe 123 PID 2672 wrote to memory of 1360 2672 shost.exe 875 PID 4156 wrote to memory of 4820 4156 shost.exe 125 PID 2672 wrote to memory of 2104 2672 shost.exe 128 PID 4820 wrote to memory of 2016 4820 shost.exe 1756 PID 2104 wrote to memory of 2380 2104 shost.exe 385 PID 4820 wrote to memory of 3920 4820 shost.exe 133 PID 2104 wrote to memory of 4432 2104 shost.exe 136 PID 3920 wrote to memory of 4444 3920 shost.exe 1150 PID 3920 wrote to memory of 4784 3920 shost.exe 142 PID 4432 wrote to memory of 2996 4432 shost.exe 1672 PID 4432 wrote to memory of 1448 4432 shost.exe 145 PID 4784 wrote to memory of 4568 4784 shost.exe 347 PID 1448 wrote to memory of 864 1448 shost.exe 1085 PID 1448 wrote to memory of 4656 1448 shost.exe 149 PID 4784 wrote to memory of 1764 4784 shost.exe 148 PID 1764 wrote to memory of 4548 1764 shost.exe 266 PID 4656 wrote to memory of 4516 4656 shost.exe 666 PID 1764 wrote to memory of 2228 1764 shost.exe 155 PID 4656 wrote to memory of 4720 4656 shost.exe 157 PID 2228 wrote to memory of 2616 2228 shost.exe 1224 PID 4720 wrote to memory of 4480 4720 shost.exe 1306 PID 2228 wrote to memory of 312 2228 shost.exe 161 PID 4720 wrote to memory of 1604 4720 shost.exe 162 PID 1604 wrote to memory of 2188 1604 shost.exe 515
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_f059441bbec52e3282162ebc27313323_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:2112
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"3⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:3064
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"4⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:5036
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"4⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"5⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:1768
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"5⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"6⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:5072
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"6⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"7⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:4736
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"7⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"8⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:1680
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"8⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"9⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:1360
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"9⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"10⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:2380
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"10⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"11⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:2996
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"11⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"12⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:864
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"12⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"13⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:4516
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"13⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"14⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:4480
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"15⤵
- Executes dropped EXE
PID:2188
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"15⤵PID:4880
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"16⤵PID:2084
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"16⤵PID:3120
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"17⤵PID:4512
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"17⤵PID:2088
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"18⤵PID:1608
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"18⤵PID:3740
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"19⤵PID:2984
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"19⤵PID:5032
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"20⤵PID:1968
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"20⤵PID:3108
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"21⤵PID:3232
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"21⤵PID:2488
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"22⤵PID:4476
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"22⤵PID:4776
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"23⤵PID:4372
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"23⤵PID:2648
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"24⤵PID:2728
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"24⤵PID:3344
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"25⤵PID:4992
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"25⤵PID:2236
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"26⤵PID:4112
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"26⤵PID:2940
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"27⤵PID:4516
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"27⤵PID:2220
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"28⤵PID:4688
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"28⤵PID:5020
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"29⤵PID:2188
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"29⤵PID:2868
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"30⤵PID:516
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"30⤵PID:4548
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"31⤵PID:1956
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"31⤵PID:1928
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"32⤵PID:2080
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"32⤵PID:1592
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"33⤵PID:3892
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"33⤵PID:376
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"34⤵PID:1944
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"34⤵PID:400
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"35⤵PID:1776
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"35⤵PID:1888
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"36⤵PID:5044
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"36⤵PID:3244
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"37⤵PID:544
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"37⤵PID:4992
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"38⤵PID:4716
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"38⤵PID:2832
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"39⤵PID:3380
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"39⤵PID:3060
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"40⤵PID:4756
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"40⤵PID:3084
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"41⤵PID:3316
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"41⤵PID:4568
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"42⤵PID:1432
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"42⤵PID:5012
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"43⤵PID:3944
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"43⤵PID:392
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"44⤵PID:4688
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"44⤵PID:432
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"45⤵PID:2652
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"45⤵PID:4812
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"46⤵PID:3312
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"46⤵PID:2768
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"47⤵PID:1760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"47⤵PID:5028
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"48⤵PID:2252
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"48⤵PID:3764
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"49⤵PID:3476
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"49⤵PID:1544
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"50⤵PID:4308
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"50⤵PID:4564
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"51⤵PID:3236
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"51⤵PID:4504
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"52⤵PID:628
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"52⤵PID:4188
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"53⤵PID:1164
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"53⤵PID:372
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"54⤵PID:4852
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"54⤵PID:2556
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"55⤵PID:2796
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"55⤵PID:2148
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"56⤵PID:1652
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"56⤵PID:1424
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"57⤵PID:3048
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"57⤵PID:692
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"58⤵PID:916
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"58⤵PID:2364
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"59⤵PID:32
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"59⤵PID:4144
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"60⤵PID:116
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"60⤵PID:3840
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"61⤵PID:3616
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"61⤵PID:456
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"62⤵PID:4616
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"62⤵PID:4632
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"63⤵PID:2112
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"63⤵PID:3336
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"64⤵PID:4532
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"64⤵PID:2764
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"65⤵PID:2840
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"65⤵PID:880
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"66⤵PID:3932
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"66⤵PID:2188
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"67⤵PID:2040
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"67⤵PID:3844
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"68⤵PID:620
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"68⤵PID:2812
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"69⤵PID:3804
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"69⤵PID:3944
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"70⤵PID:1780
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"70⤵PID:1708
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"71⤵PID:3240
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"71⤵PID:1964
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"72⤵PID:1580
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"72⤵PID:3236
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"73⤵PID:4732
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"73⤵PID:3624
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"74⤵PID:2884
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"74⤵PID:2172
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"75⤵PID:2140
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"75⤵PID:4312
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"76⤵PID:2388
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"76⤵PID:2164
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"77⤵PID:2240
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"77⤵PID:4052
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"78⤵PID:4904
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"78⤵PID:620
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"79⤵PID:1036
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"79⤵PID:3372
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"80⤵PID:4816
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"80⤵PID:4984
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"81⤵PID:4140
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"81⤵PID:4440
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"82⤵PID:1068
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"82⤵PID:4240
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"83⤵PID:996
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"83⤵PID:636
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"84⤵PID:4248
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"84⤵PID:868
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"85⤵PID:1360
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"85⤵PID:2524
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"86⤵PID:864
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"86⤵PID:3116
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"87⤵PID:2776
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"87⤵PID:1248
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"88⤵PID:4584
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"88⤵PID:4516
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"89⤵PID:3256
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"89⤵PID:3180
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"90⤵PID:3300
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"90⤵PID:3392
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"91⤵PID:1612
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"91⤵PID:1940
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"92⤵PID:2044
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"92⤵PID:4492
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"93⤵PID:1860
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"93⤵PID:2108
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"94⤵PID:2992
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"94⤵PID:848
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"95⤵PID:1668
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"95⤵PID:4744
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"96⤵PID:5092
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"96⤵PID:4124
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"97⤵PID:1268
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"97⤵PID:3248
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"98⤵PID:5076
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"98⤵PID:2880
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"99⤵PID:4760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"99⤵PID:1644
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"100⤵PID:4540
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"100⤵PID:3932
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"101⤵PID:4628
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"101⤵PID:4788
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"102⤵PID:3848
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"102⤵PID:4456
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"103⤵PID:4748
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"103⤵PID:3804
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"104⤵PID:1760
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"104⤵PID:3952
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"105⤵PID:3608
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"105⤵PID:1596
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"106⤵PID:2072
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"106⤵PID:1268
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"107⤵PID:4140
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"107⤵PID:2004
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"108⤵PID:1864
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"108⤵PID:3128
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"109⤵PID:4836
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"109⤵PID:3496
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"110⤵PID:536
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"110⤵PID:3544
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"111⤵PID:2948
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"111⤵PID:2796
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"112⤵PID:1520
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"112⤵PID:2840
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"113⤵PID:1572
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"113⤵PID:804
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"114⤵PID:468
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"114⤵PID:3300
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"115⤵PID:3064
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"115⤵PID:3796
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"116⤵PID:2044
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"116⤵PID:408
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"117⤵PID:4584
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"117⤵PID:4184
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"118⤵PID:3616
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"118⤵PID:4032
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"119⤵PID:1680
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"119⤵PID:1360
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"120⤵PID:1956
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"120⤵PID:452
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"121⤵PID:3988
-
-
C:\Users\Admin\Documents\diagnostics\shost.exe"C:\Users\Admin\Documents\diagnostics\shost.exe"121⤵PID:4372
-
C:\Users\Admin\Documents\diagnostics\audiodg.exe"C:\Users\Admin\Documents\diagnostics\audiodg.exe"122⤵PID:4816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-