dcrat | b799e2bd2a5cd1ca75348220126e0f4dfc746f230ff7edbcfe25057b7668abc2

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default\\Favorites\\Registry.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\HyperagentCommon.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default\\Favorites\\Registry.exe\", \"C:\\odt\\SppExtComObj.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default\\Favorites\\Registry.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default\\Favorites\\Registry.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\HyperagentCommon.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default\\Favorites\\Registry.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\HyperagentCommon.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\System.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\", \"C:\\Windows\\en-US\\chrome.exe\", \"C:\\Program Files\\Windows Mail\\chrome.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default\\Favorites\\Registry.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\HyperagentCommon.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\System.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\System.exe\", \"C:\\Windows\\de-DE\\chrome.exe\", \"C:\\odt\\smss.exe\", \"C:\\odt\\Taskmgr.exe\""	HyperagentCommon.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5920	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5980	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6704	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6812	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6768	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5268	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5416	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6252	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6752	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5516	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7096	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6636	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7120	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5468	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5492	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5808	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6780	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5560	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6992	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6404	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	4900	schtasks.exe	203
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6720	4900	schtasks.exe	203

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3812-4078-0x00000000005E0000-0x000000000072C000-memory.dmp	dcrat
behavioral1/files/0x00060000000236cc-4087.dat	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperagentCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperagentCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperagentCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperagentCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperagentCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	HyperagentCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Akebi CG Global.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 64 IoCs

pid	Process
4648	ProSoftCrack10.02.080.exe
6848	Akebi CG Global.exe
3812	HyperagentCommon.exe
4896	chrome.exe
5652	Akebi CG Global.exe
6680	HyperagentCommon.exe
4920	Akebi CG Global.exe
5860	HyperagentCommon.exe
7028	Akebi CG Global.exe
6848	HyperagentCommon.exe
4288	Akebi CG Global.exe
6268	Akebi CG Global.exe
1164	Akebi CG Global.exe
3524	HyperagentCommon.exe
2584	Akebi CG Global.exe
5992	HyperagentCommon.exe
1488	Akebi CG Global.exe
1388	Akebi CG Global.exe
1144	Akebi CG Global.exe
2836	Akebi CG Global.exe
460	WScript.exe
6764	Akebi CG Global.exe
6016	Akebi CG Global.exe
2192	HyperagentCommon.exe
4720	Akebi CG Global.exe
2212	Akebi CG Global.exe
644	Akebi CG Global.exe
5192	Akebi CG Global.exe
5724	Akebi CG Global.exe
7080	Akebi CG Global.exe
1556	Akebi CG Global.exe
7112	HyperagentCommon.exe
2472	Akebi CG Global.exe
2872	WScript.exe
5304	WScript.exe
5676	WScript.exe
768	reg.exe
5328	Akebi CG Global.exe
2028	Akebi CG Global.exe
4900	Akebi CG Global.exe
5220	WScript.exe
1588	Akebi CG Global.exe
4604	Conhost.exe
1692	HyperagentCommon.exe
5584	WScript.exe
6080	HyperagentCommon.exe
3696	cmd.exe
5844	reg.exe
6796	HyperagentCommon.exe
2340	Akebi CG Global.exe
3424	HyperagentCommon.exe
452	Akebi CG Global.exe
828	Akebi CG Global.exe
1328	cmd.exe
4612	WScript.exe
5840	HyperagentCommon.exe
4104	HyperagentCommon.exe
7112	HyperagentCommon.exe
2244	Akebi CG Global.exe
3752	HyperagentCommon.exe
2324	cmd.exe
5956	HyperagentCommon.exe
7000	WerFault.exe
6816	HyperagentCommon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\odt\\cmd.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskmgr = "\"C:\\odt\\Taskmgr.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Windows\\en-US\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperagentCommon = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default\\Favorites\\Registry.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\System.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Windows\\de-DE\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\System.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Windows\\en-US\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Program Files\\Windows Mail\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperagentCommon = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\HyperagentCommon.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\PrintDialog\\Assets\\RuntimeBroker.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default\\Favorites\\Registry.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\odt\\SppExtComObj.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperagentCommon = "\"C:\\odt\\HyperagentCommon.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\odt\\conhost.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Windows\\de-DE\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskmgr = "\"C:\\odt\\Taskmgr.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperagentCommon = "\"C:\\odt\\HyperagentCommon.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Program Files\\Windows Mail\\chrome.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\odt\\SppExtComObj.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\odt\\conhost.exe\""	HyperagentCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\odt\\cmd.exe\""	HyperagentCommon.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4648	ProSoftCrack10.02.080.exe
4648	ProSoftCrack10.02.080.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\chrome.exe	HyperagentCommon.exe
File created	C:\Program Files\Windows Mail\chrome.exe	HyperagentCommon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\HyperagentCommon.exe	HyperagentCommon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\27d1bcfc3c54e0	HyperagentCommon.exe
File created	C:\Program Files\Windows Mail\7a73b78f679a6f	HyperagentCommon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e551688caeea0d	HyperagentCommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\chrome.exe	HyperagentCommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\7a73b78f679a6f	HyperagentCommon.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\System.exe	HyperagentCommon.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\LanguageOverlayCache\winlogon.exe	HyperagentCommon.exe
File created	C:\Windows\de-DE\chrome.exe	HyperagentCommon.exe
File created	C:\Windows\de-DE\7a73b78f679a6f	HyperagentCommon.exe
File created	C:\Windows\PrintDialog\Assets\RuntimeBroker.exe	HyperagentCommon.exe
File created	C:\Windows\PrintDialog\Assets\9e8d7a4ca61bd9	HyperagentCommon.exe
File created	C:\Windows\en-US\chrome.exe	HyperagentCommon.exe
File created	C:\Windows\en-US\7a73b78f679a6f	HyperagentCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4352	6816	WerFault.exe	797
7472	3452	WerFault.exe	794
6880	2128	WerFault.exe	820
7868	7724	WerFault.exe	825
5148	7868	WerFault.exe	829
4280	1016	WerFault.exe	55
5612	7556	WerFault.exe	713
1316	6588	WerFault.exe	741
5616	2000	WerFault.exe	840

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5980	schtasks.exe
4888	schtasks.exe
2584	schtasks.exe
4844	schtasks.exe
7120	schtasks.exe
6812	schtasks.exe
312	schtasks.exe
5516	schtasks.exe
2700	schtasks.exe
6704	schtasks.exe
5060	schtasks.exe
3756	schtasks.exe
3632	schtasks.exe
5560	schtasks.exe
956	schtasks.exe
2772	schtasks.exe
5808	schtasks.exe
4248	schtasks.exe
1876	schtasks.exe
4608	schtasks.exe
1608	schtasks.exe
832	schtasks.exe
3600	schtasks.exe
6780	schtasks.exe
6720	schtasks.exe
3864	schtasks.exe
4412	schtasks.exe
7096	schtasks.exe
1908	schtasks.exe
4876	schtasks.exe
5492	schtasks.exe
5920	schtasks.exe
3576	schtasks.exe
3752	schtasks.exe
6992	schtasks.exe
6404	schtasks.exe
2520	schtasks.exe
2668	schtasks.exe
5268	schtasks.exe
2832	schtasks.exe
2888	schtasks.exe
2836	schtasks.exe
5468	schtasks.exe
6768	schtasks.exe
5416	schtasks.exe
6252	schtasks.exe
6752	schtasks.exe
3880	schtasks.exe
6636	schtasks.exe
4084	schtasks.exe
1376	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133221987588793074"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\ᎀ㛩ȏ\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\rar_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\rar_auto_file\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	WerFault.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.rar\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	HyperagentCommon.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\鹟き紀蠁\ = "rar_auto_file"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\ᎀ㛩ȏ	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\㛩ȏ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.rar	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\鹝く簀老"%1"\ = "rar_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\m.Size\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\m.Size	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	Akebi CG Global.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\rar_auto_file\shell\open\command	OpenWith.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

pid	Process
432	reg.exe
7872	reg.exe
5576	reg.exe
5412	reg.exe
2248	reg.exe
6052	reg.exe
7660	reg.exe
1552	reg.exe
5440	reg.exe
5472	reg.exe
6140	reg.exe
6108	reg.exe
2628	reg.exe
7260	reg.exe
3944	reg.exe
3456	reg.exe
7816	reg.exe
936	reg.exe
7204	reg.exe
5600	reg.exe
4940	reg.exe
464	reg.exe
6840	reg.exe
768	reg.exe
6048	reg.exe
3764	reg.exe
464	reg.exe
3668	reg.exe
4832	reg.exe
7752	reg.exe
5004	reg.exe
4832	reg.exe
508	reg.exe
7136	reg.exe
6936	reg.exe
6740	reg.exe
7240	reg.exe
7296	reg.exe
2676	reg.exe
8020	reg.exe
1996	reg.exe
7416	reg.exe
4300	reg.exe
3580	reg.exe
1528	reg.exe
4444	reg.exe
4528	reg.exe
3316	reg.exe
6076	reg.exe
6324	reg.exe
5568	reg.exe
3220	reg.exe
5940	reg.exe
7192	reg.exe
4908	reg.exe
2976	reg.exe
7356	reg.exe
6440	reg.exe
3608	reg.exe
6428	reg.exe
7200	reg.exe
7920	reg.exe
6744	reg.exe
7432	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
5660	msedge.exe
5660	msedge.exe
3596	chrome.exe
3596	chrome.exe
4648	ProSoftCrack10.02.080.exe
4648	ProSoftCrack10.02.080.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
3812	HyperagentCommon.exe
3812	HyperagentCommon.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
3812	HyperagentCommon.exe
3812	HyperagentCommon.exe
3812	HyperagentCommon.exe
3812	HyperagentCommon.exe
7032	taskmgr.exe
3812	HyperagentCommon.exe
3812	HyperagentCommon.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
4896	chrome.exe
4896	chrome.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe
7032	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
6432	OpenWith.exe
3820	7zFM.exe
7032	taskmgr.exe
6132	perfmon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe
Token: SeShutdownPrivilege	2788	chrome.exe
Token: SeCreatePagefilePrivilege	2788	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
5308	msedge.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
6540	7zFM.exe
3820	7zFM.exe
3820	7zFM.exe
3820	7zFM.exe
3820	7zFM.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2788	chrome.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe
2636	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6432	OpenWith.exe
6848	Akebi CG Global.exe
5652	Akebi CG Global.exe
4920	Akebi CG Global.exe
7028	Akebi CG Global.exe
4288	Akebi CG Global.exe
6268	Akebi CG Global.exe
1164	Akebi CG Global.exe
2584	Akebi CG Global.exe
1488	Akebi CG Global.exe
1388	Akebi CG Global.exe
1144	Akebi CG Global.exe
2836	Akebi CG Global.exe
460	WScript.exe
6764	Akebi CG Global.exe
6016	Akebi CG Global.exe
4720	Akebi CG Global.exe
2212	Akebi CG Global.exe
644	Akebi CG Global.exe
5192	Akebi CG Global.exe
5724	Akebi CG Global.exe
7080	Akebi CG Global.exe
1556	Akebi CG Global.exe
7112	HyperagentCommon.exe
2472	Akebi CG Global.exe
5304	WScript.exe
5676	WScript.exe
768	reg.exe
5328	Akebi CG Global.exe
2028	Akebi CG Global.exe
4900	Akebi CG Global.exe
5220	WScript.exe
1588	Akebi CG Global.exe
6080	HyperagentCommon.exe
2340	Akebi CG Global.exe
452	Akebi CG Global.exe
828	Akebi CG Global.exe
2244	Akebi CG Global.exe
2324	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 444	2788	chrome.exe	86
PID 2788 wrote to memory of 444	2788	chrome.exe	86
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 1240	2788	chrome.exe	87
PID 2788 wrote to memory of 628	2788	chrome.exe	88
PID 2788 wrote to memory of 628	2788	chrome.exe	88
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89
PID 2788 wrote to memory of 4236	2788	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\nqGJGi5zy.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x110,0x114,0x118,0xe0,0xe4,0x7ff954289758,0x7ff954289768,0x7ff954289778
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4968 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3500 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5844 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5940 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5564 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5376 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3780 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3180 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3392 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:6796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6380 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6468 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6396 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6432 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6748 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5708 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6976 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6832 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5344 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7096 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:6556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=7664 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7864 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7800 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7568 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6580 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7500 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5212 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5692 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=3568 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=4536 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=7180 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5248 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=7700 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=7792 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=8228 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=7416 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=7768 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=7744 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=7828 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=6660 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=4832 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:6392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=7324 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=5020 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6636 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:6824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7336 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Akebi CG Global crack.rar"
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 --field-trial-handle=1828,i,15280876092316790333,4799123007264625241,131072 /prefetch:8
  2⤵
  PID:6652

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3404382fh1d76h4f37haed0h60b08418cbbe
1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff94e9446f8,0x7ff94e944708,0x7ff94e944718
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,18157034683627670271,1796302693993195262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,18157034683627670271,1796302693993195262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,18157034683627670271,1796302693993195262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault29907d1ah4234h4f66h8577hb405f7be74f2
1⤵
PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff94e9446f8,0x7ff94e944708,0x7ff94e944718
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,5501270791779154242,15139748895514839697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,5501270791779154242,15139748895514839697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,5501270791779154242,15139748895514839697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  PID:2248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3a0 0x304
1⤵
PID:5256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6432
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ProSoftCrack 10.02.080+.rar"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:6540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4644

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ProSoftCrack 10.02.080+.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3820

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ProSoftCrack 10.02.080+\" -spe -an -ai#7zMap27328:108:7zEvent17097
1⤵
PID:4296

C:\Users\Admin\Downloads\ProSoftCrack 10.02.080+\ProSoftCrack10.02.080.exe
"C:\Users\Admin\Downloads\ProSoftCrack 10.02.080+\ProSoftCrack10.02.080.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2636

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Akebi CG Global crack\" -spe -an -ai#7zMap11767:104:7zEvent30853
1⤵
PID:3192

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6848
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2044
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      PID:3812
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rPoFSw9oYD.bat"
        5⤵
        
        PID:2200
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:6244
      - C:\Program Files\Windows Mail\chrome.exe
        
        "C:\Program Files\Windows Mail\chrome.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4896
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4832

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:7032
- C:\Windows\system32\resmon.exe
  "C:\Windows\system32\resmon.exe"
  2⤵
  PID:2228
- - C:\Windows\System32\perfmon.exe
    "C:\Windows\System32\perfmon.exe" /res
    3⤵
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:6132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Windows\de-DE\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 14 /tr "'C:\odt\Taskmgr.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Taskmgr" /sc ONLOGON /tr "'C:\odt\Taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 8 /tr "'C:\odt\Taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\PrintDialog\Assets\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\PrintDialog\Assets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Windows\en-US\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperagentCommonH" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\HyperagentCommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperagentCommon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\HyperagentCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperagentCommonH" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\HyperagentCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Favorites\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperagentCommonH" /sc MINUTE /mo 12 /tr "'C:\odt\HyperagentCommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperagentCommon" /sc ONLOGON /tr "'C:\odt\HyperagentCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperagentCommonH" /sc MINUTE /mo 8 /tr "'C:\odt\HyperagentCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6720

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5652
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5000
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:6680
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:6856

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4920
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3016
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:5860
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1996

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:4804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6216
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:6848
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6740

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:5896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1148
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:3524
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6172

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3576
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:5992
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6652

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1164
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3800
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:2192
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6428

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2584
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5244
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2872
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4444

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:2084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:400
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:1692
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7200

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6936
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5584
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7240

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1144
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1324
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4604
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7232

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2836
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4776
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:6796
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7832

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:460
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:5324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6656
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3696
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7752

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6764
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2480
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7816

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6016
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6276
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:3424
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7872

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4720
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1376
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:4104
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5576

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2212
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6896
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:1328
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:464

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:3912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6376
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4612
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:936

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5192
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:672
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:5840
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7192

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4620
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:7112
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7204

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6632
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:3752
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4528

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3504
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2676

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7112
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7072
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Executes dropped EXE
      PID:5956
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7416

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2472
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:7116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7084
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3832
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7920

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5304
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:7056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6324
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:6120
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3316

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7096
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4568
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:8020

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:768
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5180
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5060
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5004

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5328
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6548
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7048
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4908

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5684
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Checks computer location settings
      PID:324
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7216

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4900
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5604
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5776
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2976

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5220
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4936
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5264

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5632
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:704
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7356

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:548
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4976
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6348

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2340
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7060
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2616
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Executes dropped EXE
      Modifies registry class
      Modifies registry key
      Suspicious use of SetWindowsHookEx
      PID:768

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6080
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6840

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:828
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2772
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4444
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat"
        5⤵
        
        PID:7264
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:7336
      - C:\WinsavesRuntime\HyperagentCommon.exe
        
        "C:\WinsavesRuntime\HyperagentCommon.exe"
        6⤵
        
        PID:5572
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7296

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2244
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3336

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7384
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7492
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4832

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7448
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7540
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:2904

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7532
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7652
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6744

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6732
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7684
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7760
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6440

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
PID:6912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7908
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7960
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5568

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2780
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7976
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:8072
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1552

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:3948
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:8096
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:8168
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7052

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2376
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7432

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4976
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3148
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Executes dropped EXE
      PID:4604
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7256
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5600

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:6732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1964
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3796
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5824

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4148
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1460
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4084
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:3812

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6568
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3528
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5896
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6076

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:3768
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7648
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3908
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7100

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:3656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2216
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:6904
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5440

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Executes dropped EXE
  PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6388
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3524
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7768

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5812
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4428
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5260
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5472

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4716
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7888
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Checks computer location settings
      PID:312
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6324

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3016
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5756

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4284
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1940
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:6620
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6048

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5468
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:6832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4592
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:708
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3764

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2908
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7132
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3608

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5768
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3816
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:1388

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:3796
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6676
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6836

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2408
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7984
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7160
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:508

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5316
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7484
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5932
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3580

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5888
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:8120
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3596
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2248

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5244
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6836
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7620

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2624
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3112
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7420

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:1880
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6160
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6216

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    - Executes dropped EXE
    PID:3696
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5224
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6140

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6824
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6864
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5248
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5412

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4880
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6640
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:4988

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:1716
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6756
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2996
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6108

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7364
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:2144
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4588
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:464

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6056
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    - Executes dropped EXE
    PID:1328
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3992
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:544

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6548
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6684
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:8032
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3220

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7216
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6248
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:6812
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3668

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:1540
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1812
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:432

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6560
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6696
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6052

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:1308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7636
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:6628
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4940

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6100
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4460
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5660
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7260

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5900
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:5924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7084
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5940

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6680
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7892
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1528

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6348
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4388
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:6196
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3944

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
- Checks computer location settings
PID:1816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7660

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:3576
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6892
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Executes dropped EXE
      PID:5844

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7480
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:3452
    - - C:\WinsavesRuntime\HyperagentCommon.exe
        
        "C:\WinsavesRuntime\HyperagentCommon.exe"
        5⤵
        
        PID:7560
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3452 -s 1140
        5⤵
        Program crash
        
        PID:7472
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:728

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7284
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3480
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6816
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6816 -s 856
        5⤵
        Program crash
        
        PID:4352
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7220

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2904
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:732
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2160

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7424
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5640

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6064
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4568

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7052

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:8032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4808

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:8096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3668

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4516
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3576
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6080
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3456

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3560

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5468
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7568

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5472
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6096

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:4720
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7592

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4572
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Executes dropped EXE
  PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7172
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2128
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2128 -s 116
        5⤵
        Program crash
        
        PID:6880
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2628

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:1940
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6376
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7724
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7724 -s 708
        5⤵
        Program crash
        
        PID:7868
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7868 -s 644
        6⤵
        Program crash
        
        PID:5148

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4736
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:6872

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6344
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6656

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5076
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3052

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:8020
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  - Checks computer location settings
  PID:3520

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7204
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:3292

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:6056
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7488

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7808
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:8044

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:5884
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1080
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7748

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:3576
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:7916
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:5148
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6148

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:4936
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:7772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1544
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2000
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2000 -s 904
        5⤵
        Program crash
        
        PID:5616
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4300

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:7536
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:6520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:1972
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:7740
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:7136

C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe
"C:\Users\Admin\Downloads\Akebi CG Global crack\Akebi CG Global\Akebi CG Global.exe"
1⤵
PID:2180
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WinsavesRuntime\WyD4lcMdkr.vbe"
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WinsavesRuntime\qVDPS.bat" "
    3⤵
    PID:5880
  - - C:\WinsavesRuntime\HyperagentCommon.exe
      "C:\WinsavesRuntime\HyperagentCommon.exe"
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 3452 -ip 3452
1⤵
PID:2108

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 192 -p 6816 -ip 6816
1⤵
PID:7504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 7724 -ip 7724
1⤵
PID:7532

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 7868 -ip 7868
1⤵
PID:6824

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 2000 -ip 2000
1⤵
PID:6456

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 6588 -ip 6588
1⤵
PID:2348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1016 -s 4184
1⤵
- Program crash
PID:4280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 7556 -ip 7556
1⤵
PID:7500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 716 -p 6984 -ip 6984
1⤵
PID:7808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 664 -p 8140 -ip 8140
1⤵
PID:384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7556 -s 500
1⤵
- Program crash
PID:5612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6588 -s 504
1⤵
- Program crash
PID:1316

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 720 -p 6508 -ip 6508
1⤵
PID:6804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 5556 -ip 5556
1⤵
PID:4084

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 848 -p 5980 -ip 5980
1⤵
PID:6368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 176 -p 2200 -ip 2200
1⤵
PID:4592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 668 -p 7520 -ip 7520
1⤵
PID:7404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 880 -p 4716 -ip 4716
1⤵
PID:7476

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 796 -p 7572 -ip 7572
1⤵
PID:6224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 784 -p 1308 -ip 1308
1⤵
PID:5916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 5668 -ip 5668
1⤵
PID:3908

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 5920 -ip 5920
1⤵
PID:6272

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 752 -p 6040 -ip 6040
1⤵
PID:3988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 668 -p 5500 -ip 5500
1⤵
PID:4632

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 824 -p 7704 -ip 7704
1⤵
PID:3460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 792 -p 5724 -ip 5724
1⤵
PID:6016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 788 -p 8004 -ip 8004
1⤵
- Executes dropped EXE
- Modifies registry class
PID:7000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 748 -p 5068 -ip 5068
1⤵
PID:5540

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery