CmdID

CmdID / Files

audiodg.exe

Windows Audio Device Graph Isolation file version info

Program on Windows 13 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real audiodg.exe?

file version info and known copies
Original nameaudioadg.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Audio Device Graph Isolation

13 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\audiodg.exe · signed by Microsoft Windows

44a2b3af560873f8ec05935fc95f20a1da08189c4a2f2cefeea0b87bf9e3b3bc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

1add3048519cd7fc7ad7c1d2f6f41dade1d87bbb0c26c5a25c20a955c20f8abd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

55b144d3bdd0c14ff810fa295ca79e08a1e418ee3bb46eab78982eeb0bb7816f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

616a67dda10aa1f949a4b2fd4bfdc1ad251c839ca0a004eebdebe4a5d05398c8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

93666b4c63239e5c8128d1cc6cdf0765fb8e1e3893e7d6b8285d65d005fb296b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

97c8aaedba3a89174bc6ddd8b5b40504a81e7adae8df6b11230eb34b150ffc3b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

fea9c450c817f121e112f551a3e1b628cf71a6a61e36f697d337ca60b7486189

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\audiodg.exe · signed by Microsoft Windows

f4dac9e23d58879a2f5dd909f417c1f7b2b7e6c836f9ffb88fed78d5ec0cb70c

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\audiodg.exe · signed by Microsoft Windows

18d496289e7992aa65d733715146597421ebac179beb593905ab42963043a0e1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

6dfd3ff11824e58d4abe0946d4bb0ddc06c7c5275ba743738b2b03e11ff6e55f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

bdbfe066f1981fe67cfb883c592dac491efc58b61e17042e31d3bace8731c41f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\audiodg.exe · signed by Microsoft Windows

cc23ec7f03af7c2b27113c71beb978bbb3c833cc1074478d57852db21a769af9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\audiodg.exe · signed by Microsoft Windows

a6da29989cc114b31cde0f429d7da73b5f2f2a422614610e94555520a06b2b1b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name audiodg.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names audiodg.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.