audiodg.exe

audiodg.exe hosts the audio engine and the digital signal processing for playback and capture, kept in its own process so that a faulty audio effect crashes the isolation host instead of the shared audio service. It is started by the audio service inside svchost.exe, runs under the LOCAL SERVICE account, and lives at C:\Windows\System32\audiodg.exe.

Legitimately, audiodg runs whenever audio is active, and CPU spikes during playback with enhancements enabled are normal. It processes audio rather than launching programs, so it does not start other processes or reach the network.

audiodg.exe is a baseline process. Because it loads third-party audio effect DLLs, it has a plausible path for loading external code, which makes unusual loaded modules worth a glance, but in practice its main security relevance is impersonation (T1036.005): a process named audiodg.exe outside System32, under the wrong account, or with no audio service parent is the deviation to notice.

As a persistent service-context process it could also be injected into (T1055). audiodg making network connections or spawning programs is outside its normal behavior.