mimic | e231cc1fb99fcca6bae8df59470f82136cb97b9f9c96a75d8cf7ab2ad4e222a0

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Amigodainapasik.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
3752	bcdedit.exe
3172	bcdedit.exe

Renames multiple (2790) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
3740	wbadmin.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
3092	wbadmin.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	Amigodainapasik.exe

Executes dropped EXE 13 IoCs

pid	Process
2924	Amigodainapasik.exe
1604	Amigodainapasik.exe
3684	Amigodainapasik.exe
4308	Amigodainapasik.exe
2164	Everything.exe
3884	Everything.exe
5884	sdel64.exe
5892	sdel64.exe
5900	sdel64.exe
5384	icqsetup.exe
4492	icqsetup.exe
5476	icq.exe
3036	icq.exe

Loads dropped DLL 42 IoCs

pid	Process
2924	Amigodainapasik.exe
1604	Amigodainapasik.exe
3684	Amigodainapasik.exe
4308	Amigodainapasik.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
5476	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amigodainapasik = "\"C:\\Users\\Admin\\AppData\\Local\\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\\Amigodainapasik.exe\" "	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amigodainapasik.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Amigodainapasik_Decryption.txt\""	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\icq.desktop = "\"C:\\Users\\Admin\\AppData\\Roaming\\ICQ\\bin\\icq.exe\" /startup"	icqsetup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\E:	Amigodainapasik.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\J:	Amigodainapasik.exe
File opened (read-only)	\??\V:	Amigodainapasik.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\R:	Amigodainapasik.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\H:	Amigodainapasik.exe
File opened (read-only)	\??\K:	Amigodainapasik.exe
File opened (read-only)	\??\O:	Amigodainapasik.exe
File opened (read-only)	\??\T:	Amigodainapasik.exe
File opened (read-only)	\??\W:	Amigodainapasik.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\X:	Amigodainapasik.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\Q:	Amigodainapasik.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\Y:	Amigodainapasik.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Z:	Amigodainapasik.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\G:	Amigodainapasik.exe
File opened (read-only)	\??\L:	Amigodainapasik.exe
File opened (read-only)	\??\M:	Amigodainapasik.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\B:	Amigodainapasik.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\N:	Amigodainapasik.exe
File opened (read-only)	\??\P:	Amigodainapasik.exe
File opened (read-only)	\??\S:	Amigodainapasik.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\plugin.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\delete.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\selector.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\it_get.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\main.css.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover_2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-ja_jp.gif.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nl_135x40.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Close.png.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview_selected.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_unselected_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Bold.otf.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\ui-strings.js.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif.an8uxv2w	Amigodainapasik.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-hover_32.svg.an8uxv2w	Amigodainapasik.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133359871798075338"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq\shell\open\command	icqsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent\shell\open	icqsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent\URL Protocol	icqsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\Amigodainapasik_Decryption.txt\""	Amigodainapasik.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 50003100000000000857318610004c6f63616c003c0009000400efbee3562663085731862e0000008fe101000000010000000000000000000000000000002f3821014c006f00630061006c00000014000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "6"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq	icqsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent\DefaultIcon	icqsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.an8uxv2w	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq\shell	icqsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent	icqsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\ICQ\\bin\\icq.exe"	icqsetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq\shell\open	icqsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\ICQ\\bin\\icq.exe\" -urlcommand \"%1\""	icqsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 820074001c00434653461600310000000000e3562663120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbee3562663085729862e0000007ce10100000001000000000000000000000000000000b7e7bf004100700070004400610074006100000042000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq\ = "URL:ICQ Link"	icqsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq\URL Protocol	icqsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell	Amigodainapasik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.an8uxv2w\ = "mimicfile"	Amigodainapasik.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\icq\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\ICQ\\bin\\icq.exe"	icqsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\magent\shell\open\command	icqsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\exefile\shell\open\command	Amigodainapasik.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	notepad.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\icqsetup.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
4928	notepad.exe
5824	notepad.exe
6044	notepad.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4492	icqsetup.exe
3036	icq.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
3684	Amigodainapasik.exe
3684	Amigodainapasik.exe
4308	Amigodainapasik.exe
4308	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
1300	powershell.exe
1320	powershell.exe
3984	powershell.exe
3984	powershell.exe
1300	powershell.exe
1320	powershell.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
3704	msedge.exe
3704	msedge.exe
2924	Amigodainapasik.exe
2924	Amigodainapasik.exe
4472	msedge.exe
4472	msedge.exe
1000	msedge.exe
1000	msedge.exe
1072	identity_helper.exe
1072	identity_helper.exe
1868	chrome.exe
1868	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4492	icqsetup.exe
3036	icq.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1308	Amigodainapasik.exe
Token: SeSecurityPrivilege	1308	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	1308	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	1308	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	1308	Amigodainapasik.exe
Token: SeSystemtimePrivilege	1308	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	1308	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	1308	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	1308	Amigodainapasik.exe
Token: SeBackupPrivilege	1308	Amigodainapasik.exe
Token: SeRestorePrivilege	1308	Amigodainapasik.exe
Token: SeShutdownPrivilege	1308	Amigodainapasik.exe
Token: SeDebugPrivilege	1308	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	1308	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	1308	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	1308	Amigodainapasik.exe
Token: SeUndockPrivilege	1308	Amigodainapasik.exe
Token: SeManageVolumePrivilege	1308	Amigodainapasik.exe
Token: SeImpersonatePrivilege	1308	Amigodainapasik.exe
Token: SeCreateGlobalPrivilege	1308	Amigodainapasik.exe
Token: 33	1308	Amigodainapasik.exe
Token: 34	1308	Amigodainapasik.exe
Token: 35	1308	Amigodainapasik.exe
Token: 36	1308	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	2924	Amigodainapasik.exe
Token: SeSecurityPrivilege	2924	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	2924	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	2924	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	2924	Amigodainapasik.exe
Token: SeSystemtimePrivilege	2924	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	2924	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	2924	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	2924	Amigodainapasik.exe
Token: SeBackupPrivilege	2924	Amigodainapasik.exe
Token: SeRestorePrivilege	2924	Amigodainapasik.exe
Token: SeShutdownPrivilege	2924	Amigodainapasik.exe
Token: SeDebugPrivilege	2924	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	2924	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	2924	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	2924	Amigodainapasik.exe
Token: SeUndockPrivilege	2924	Amigodainapasik.exe
Token: SeManageVolumePrivilege	2924	Amigodainapasik.exe
Token: SeImpersonatePrivilege	2924	Amigodainapasik.exe
Token: SeCreateGlobalPrivilege	2924	Amigodainapasik.exe
Token: 33	2924	Amigodainapasik.exe
Token: 34	2924	Amigodainapasik.exe
Token: 35	2924	Amigodainapasik.exe
Token: 36	2924	Amigodainapasik.exe
Token: SeIncreaseQuotaPrivilege	3684	Amigodainapasik.exe
Token: SeSecurityPrivilege	3684	Amigodainapasik.exe
Token: SeTakeOwnershipPrivilege	3684	Amigodainapasik.exe
Token: SeLoadDriverPrivilege	3684	Amigodainapasik.exe
Token: SeSystemProfilePrivilege	3684	Amigodainapasik.exe
Token: SeSystemtimePrivilege	3684	Amigodainapasik.exe
Token: SeProfSingleProcessPrivilege	3684	Amigodainapasik.exe
Token: SeIncBasePriorityPrivilege	3684	Amigodainapasik.exe
Token: SeCreatePagefilePrivilege	3684	Amigodainapasik.exe
Token: SeBackupPrivilege	3684	Amigodainapasik.exe
Token: SeRestorePrivilege	3684	Amigodainapasik.exe
Token: SeShutdownPrivilege	3684	Amigodainapasik.exe
Token: SeDebugPrivilege	3684	Amigodainapasik.exe
Token: SeSystemEnvironmentPrivilege	3684	Amigodainapasik.exe
Token: SeChangeNotifyPrivilege	3684	Amigodainapasik.exe
Token: SeRemoteShutdownPrivilege	3684	Amigodainapasik.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2252	firefox.exe
2252	firefox.exe
2252	firefox.exe
2252	firefox.exe
5848	firefox.exe
5848	firefox.exe
5848	firefox.exe
5848	firefox.exe
5848	firefox.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
6044	notepad.exe
6044	notepad.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2252	firefox.exe
2252	firefox.exe
2252	firefox.exe
5848	firefox.exe
5848	firefox.exe
5848	firefox.exe
5848	firefox.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe
3036	icq.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2164	Everything.exe
3884	Everything.exe
2252	firefox.exe
5848	firefox.exe
6044	notepad.exe
6044	notepad.exe
6044	notepad.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
2036	firefox.exe
4492	icqsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2924	1308	Amigodainapasik.exe	82
PID 1308 wrote to memory of 2924	1308	Amigodainapasik.exe	82
PID 1308 wrote to memory of 2924	1308	Amigodainapasik.exe	82
PID 2924 wrote to memory of 2688	2924	Amigodainapasik.exe	85
PID 2924 wrote to memory of 2688	2924	Amigodainapasik.exe	85
PID 2924 wrote to memory of 2688	2924	Amigodainapasik.exe	85
PID 2924 wrote to memory of 1604	2924	Amigodainapasik.exe	89
PID 2924 wrote to memory of 1604	2924	Amigodainapasik.exe	89
PID 2924 wrote to memory of 1604	2924	Amigodainapasik.exe	89
PID 2924 wrote to memory of 3684	2924	Amigodainapasik.exe	88
PID 2924 wrote to memory of 3684	2924	Amigodainapasik.exe	88
PID 2924 wrote to memory of 3684	2924	Amigodainapasik.exe	88
PID 2924 wrote to memory of 4308	2924	Amigodainapasik.exe	87
PID 2924 wrote to memory of 4308	2924	Amigodainapasik.exe	87
PID 2924 wrote to memory of 4308	2924	Amigodainapasik.exe	87
PID 2924 wrote to memory of 2164	2924	Amigodainapasik.exe	93
PID 2924 wrote to memory of 2164	2924	Amigodainapasik.exe	93
PID 2924 wrote to memory of 2164	2924	Amigodainapasik.exe	93
PID 2924 wrote to memory of 2544	2924	Amigodainapasik.exe	106
PID 2924 wrote to memory of 2544	2924	Amigodainapasik.exe	106
PID 2924 wrote to memory of 3760	2924	Amigodainapasik.exe	109
PID 2924 wrote to memory of 3760	2924	Amigodainapasik.exe	109
PID 2924 wrote to memory of 3044	2924	Amigodainapasik.exe	108
PID 2924 wrote to memory of 3044	2924	Amigodainapasik.exe	108
PID 2924 wrote to memory of 3096	2924	Amigodainapasik.exe	113
PID 2924 wrote to memory of 3096	2924	Amigodainapasik.exe	113
PID 2924 wrote to memory of 1140	2924	Amigodainapasik.exe	112
PID 2924 wrote to memory of 1140	2924	Amigodainapasik.exe	112
PID 2924 wrote to memory of 3776	2924	Amigodainapasik.exe	111
PID 2924 wrote to memory of 3776	2924	Amigodainapasik.exe	111
PID 2924 wrote to memory of 2536	2924	Amigodainapasik.exe	141
PID 2924 wrote to memory of 2536	2924	Amigodainapasik.exe	141
PID 2924 wrote to memory of 1532	2924	Amigodainapasik.exe	140
PID 2924 wrote to memory of 1532	2924	Amigodainapasik.exe	140
PID 2924 wrote to memory of 1940	2924	Amigodainapasik.exe	138
PID 2924 wrote to memory of 1940	2924	Amigodainapasik.exe	138
PID 2924 wrote to memory of 4312	2924	Amigodainapasik.exe	137
PID 2924 wrote to memory of 4312	2924	Amigodainapasik.exe	137
PID 2924 wrote to memory of 5084	2924	Amigodainapasik.exe	136
PID 2924 wrote to memory of 5084	2924	Amigodainapasik.exe	136
PID 2924 wrote to memory of 4368	2924	Amigodainapasik.exe	135
PID 2924 wrote to memory of 4368	2924	Amigodainapasik.exe	135
PID 2924 wrote to memory of 3892	2924	Amigodainapasik.exe	133
PID 2924 wrote to memory of 3892	2924	Amigodainapasik.exe	133
PID 2924 wrote to memory of 3076	2924	Amigodainapasik.exe	132
PID 2924 wrote to memory of 3076	2924	Amigodainapasik.exe	132
PID 2924 wrote to memory of 2744	2924	Amigodainapasik.exe	114
PID 2924 wrote to memory of 2744	2924	Amigodainapasik.exe	114
PID 2924 wrote to memory of 3984	2924	Amigodainapasik.exe	130
PID 2924 wrote to memory of 3984	2924	Amigodainapasik.exe	130
PID 2924 wrote to memory of 1320	2924	Amigodainapasik.exe	129
PID 2924 wrote to memory of 1320	2924	Amigodainapasik.exe	129
PID 2924 wrote to memory of 1300	2924	Amigodainapasik.exe	126
PID 2924 wrote to memory of 1300	2924	Amigodainapasik.exe	126
PID 2924 wrote to memory of 3752	2924	Amigodainapasik.exe	155
PID 2924 wrote to memory of 3752	2924	Amigodainapasik.exe	155
PID 2924 wrote to memory of 3172	2924	Amigodainapasik.exe	156
PID 2924 wrote to memory of 3172	2924	Amigodainapasik.exe	156
PID 2924 wrote to memory of 3740	2924	Amigodainapasik.exe	158
PID 2924 wrote to memory of 3740	2924	Amigodainapasik.exe	158
PID 2924 wrote to memory of 3092	2924	Amigodainapasik.exe	160
PID 2924 wrote to memory of 3092	2924	Amigodainapasik.exe	160
PID 2924 wrote to memory of 3884	2924	Amigodainapasik.exe	168
PID 2924 wrote to memory of 3884	2924	Amigodainapasik.exe	168

System policy modification 1 TTPs 13 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " "	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Amigodainapasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "\n\n￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾀﾃ￢ﾀﾃ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾀﾃ￢ﾀﾃ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n\n￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾦ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾔ￢ﾕﾐ￢ﾕﾐ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾦ￢ﾕﾝ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾕﾚ￢ﾖﾈ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾑ￢ﾖﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾑ￢ﾖﾈ￢ﾖﾈ￢ﾕﾗ\n￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾖﾑ￢ﾖﾑ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ￢ﾕﾚ￢ﾕﾐ￢ﾕﾝ\n-----------------------------[ Hello, My Dear Friend !!! ]--------------------------\n\nALL YOUR FILES HAVE BEEN ENCRYPTED DUE TO A SECURITY PROBLEM WITH YOUR PC.\n\nIf you want to restore them :\n1) Send your unique id dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28an8uxv2w and max 3 files for test decryption\n\nOUR CONTACTS:\n1.1) TOX messenger (fast and anonymous)\nhttps://tox.chat/download.html\nInstall qtox\nPress sign up\nCreate your own name\nPress plus\nPut there our tox ID:\nE9164A982410EFAEBC451C1D5629A2CBB75DBB6BCDBD6D2BA94F4D0A7B0B616F911496E469FB\nAnd add me/write message\n1.2) ICQ Messenger\nICQ live chat which works 24/7 - @Amigodainapasik\nInstall ICQ software on your PC here https://icq.com/windows/ or on your smartphone search for \"ICQ\" in Appstore / Google market\nWrite to our ICQ @Amigodainapasik https://icq.im/Amigodainapasik\n1.3) Skype \nAmigodainapasik Decryption\n1.4) Mail (write only in critical situations bcs your email may not be delivered or get in spam)\n [email protected]\n\nIn subject line please write your decryption ID: dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\nAfter payment we will send you the decryption tool that will decrypt all your files.\n\nFREE DECRYPTION AS A GUARANTEE!\nBefore paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived),\nand files should not contain valuable information. (databases, backups, large excel sheets, etc.)\n\nHow to obtain Bitcoins:\nhttps://www.alfa.cash/buy-crypto-with-credit-card (the fastest way)\nbuy.coingate.com\nhttps://bitcoin.org/en/buy\nhttps://buy.moonpay.io\nbinance.com\ncoinmama.com\n\nATTENTION!!!\nDo not rename encrypted files!\nDo not try to decrypt your data using third party software, it may cause permanent data loss!\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our)\nor you may become a victim of a scam!"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	Amigodainapasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Amigodainapasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Amigodainapasik.exe

C:\Users\Admin\AppData\Local\Temp\Amigodainapasik.exe
"C:\Users\Admin\AppData\Local\Temp\Amigodainapasik.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
  "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe"
  2⤵
  - UAC bypass
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c DC.exe /D
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e ul2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4308
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e ul1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Amigodainapasik.exe" -e watch -pid 2924 -!
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1604
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:2164
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -H off
    3⤵
    PID:2544
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:3044
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:3760
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:1140
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:3096
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    PID:2744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3984
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    PID:3076
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:3892
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:4368
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:4312
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
    3⤵
    PID:1940
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
    3⤵
    PID:1532
- - C:\Windows\SYSTEM32\powercfg.exe
    powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
    3⤵
    PID:2536
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3752
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3172
- - C:\Windows\SYSTEM32\wbadmin.exe
    wbadmin.exe DELETE SYSTEMSTATEBACKUP
    3⤵
    - Deletes System State backups
    - Drops file in Windows directory
    PID:3740
- - C:\Windows\SYSTEM32\wbadmin.exe
    wbadmin.exe delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3092
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\Everything.exe" -startup
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetWindowsHookEx
    PID:3884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe "C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5824
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sdel64.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sdel64.exe" -accepteula -p 1 -c Z:\
    3⤵
    - Executes dropped EXE
    PID:5900
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sdel64.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sdel64.exe" -accepteula -p 1 -c F:\
    3⤵
    - Executes dropped EXE
    PID:5892
- - C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sdel64.exe
    "C:\Users\Admin\AppData\Local\{D3F1A24A-4570-94FC-C72A-8CAE679319B4}\sdel64.exe" -accepteula -p 1 -c C:\
    3⤵
    - Executes dropped EXE
    PID:5884

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:848

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4804

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2840

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2440

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1472

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3092

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:408

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4596

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1456

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1852

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1972

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:816

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1368

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:764

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1300

C:\Windows\system32\notepad.exe
"notepad.exe" "C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt"
1⤵
- Opens file in notepad (likely ransom note)
PID:4928

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1968

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4280

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultce7df931h78a5h4f2dh9ea8h7edbf742c4eb
1⤵
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb57dd46f8,0x7ffb57dd4708,0x7ffb57dd4718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,12552010886542637254,6135774335705781361,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,12552010886542637254,6135774335705781361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,12552010886542637254,6135774335705781361,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2284
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.0.1126052504\1285028543" -parentBuildID 20221007134813 -prefsHandle 1912 -prefMapHandle 1892 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9fec39d-310c-447e-b430-3f6ba696dcaf} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 1992 1b29c7f8b58 gpu
    3⤵
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.1.1030508016\98475274" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2368 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {455a0be6-17d2-475a-b976-a091df93bdff} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 2392 1b29c338858 socket
    3⤵
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.2.1812252551\1435240929" -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3304 -prefsLen 21012 -prefMapSize 232675 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae0452fd-0675-4ad5-944b-93c930112e3a} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 1696 1b2a09b7658 tab
    3⤵
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.3.487017860\306654593" -childID 2 -isForBrowser -prefsHandle 3016 -prefMapHandle 1684 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5e46e14-9227-410c-9232-3c3c52831cc2} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 3576 1b29fe7ae58 tab
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.4.524191795\1277879333" -childID 3 -isForBrowser -prefsHandle 4140 -prefMapHandle 4180 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20bc996d-2274-4f70-b9b5-56a537e2963f} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 4268 1b2a16cf158 tab
    3⤵
    PID:4708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.6.2003514712\1820165939" -childID 5 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 26552 -prefMapSize 232675 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ef3d7bf-155d-419c-925d-28c37ca447be} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 5364 1b2a2c8f158 tab
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.5.1865021386\1265670755" -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5192 -prefsLen 26552 -prefMapSize 232675 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30e8d0f7-05db-45be-880f-a415ac1edc1c} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 5236 1b28fe5cd58 tab
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2252.7.1516145712\526729137" -childID 6 -isForBrowser -prefsHandle 5648 -prefMapHandle 5644 -prefsLen 26552 -prefMapSize 232675 -jsInitHandle 1360 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36bd72a7-f3cc-4fc5-aff8-da8aa24eb908} 2252 "\\.\pipe\gecko-crash-server-pipe.2252" 5656 1b2a2c90658 tab
    3⤵
    PID:5488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.0.252528301\782046114" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 20913 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76c6e5a1-d1b9-447b-a4b6-e6271a115287} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 1836 13afecfc358 gpu
    3⤵
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.1.1433677601\681534355" -parentBuildID 20221007134813 -prefsHandle 2188 -prefMapHandle 2176 -prefsLen 20913 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29385b16-d8a9-4ecf-857f-9195cee78557} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 2200 13afe936a58 socket
    3⤵
    PID:2080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.2.2114534174\315862753" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 2880 -prefsLen 21309 -prefMapSize 232711 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {809ae36f-6b22-4a74-8fc8-faf67522a110} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 3220 13a870a9258 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.3.1483297757\1615772257" -childID 2 -isForBrowser -prefsHandle 1316 -prefMapHandle 3596 -prefsLen 26734 -prefMapSize 232711 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5795bc6-fb6b-4f9e-a89a-136cd88f17e7} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 3604 13a8837c458 tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.4.29206445\620895891" -childID 3 -isForBrowser -prefsHandle 4236 -prefMapHandle 4240 -prefsLen 26793 -prefMapSize 232711 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d8b173c-1f58-4903-90ec-d8d9b3d1551d} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 4284 13a885b8e58 tab
    3⤵
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.5.47449897\2033899474" -childID 4 -isForBrowser -prefsHandle 5100 -prefMapHandle 5116 -prefsLen 26793 -prefMapSize 232711 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {186770a9-4473-49c2-a3f9-1ab4f49d7c79} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 5088 13a8a008458 tab
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.6.2057702087\630284660" -childID 5 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26793 -prefMapSize 232711 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0d4e96f-829a-46a5-9692-f455bac0425c} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 5224 13a8a007558 tab
    3⤵
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5848.7.2127517046\2011246666" -childID 6 -isForBrowser -prefsHandle 5504 -prefMapHandle 5500 -prefsLen 26793 -prefMapSize 232711 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73449525-5816-48c7-acd4-a95be418ebbe} 5848 "\\.\pipe\gecko-crash-server-pipe.5848" 5420 13a8a008158 tab
    3⤵
    PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb57dd46f8,0x7ffb57dd4708,0x7ffb57dd4718
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5449008705106503021,6701430864348114024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\system32\notepad.exe
"notepad.exe" "C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt"
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb62e99758,0x7ffb62e99768,0x7ffb62e99778
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:2
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4736 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3824 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5688 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5492 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1876,i,11874278152210875036,9580666380555373435,131072 /prefetch:8
  2⤵
  PID:4928

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1208
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.0.1072547207\201641826" -parentBuildID 20221007134813 -prefsHandle 1708 -prefMapHandle 1700 -prefsLen 20913 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66580f8d-7a7c-439c-943f-a77a4c1a5606} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 1820 1bfbd1e5058 gpu
    3⤵
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.1.1590861324\47757669" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 20913 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a49612f0-f31e-4bf4-aa4e-48562c4b4b6c} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 2212 1bfbce3ab58 socket
    3⤵
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.2.2101804083\181837107" -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 2984 -prefsLen 21374 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2409a8c-57e1-400d-9d5a-fe25b3148f88} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 3128 1bfc0c0a058 tab
    3⤵
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.3.1067133659\31313326" -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3604 -prefsLen 25954 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d18ba78-c0b2-45c9-98bb-074d0b8a0990} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 3624 1bfc1e59e58 tab
    3⤵
    PID:268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.4.1834730681\1933733978" -childID 3 -isForBrowser -prefsHandle 4596 -prefMapHandle 4604 -prefsLen 26793 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16ae5946-400a-4d36-807b-60ce3b0aeb78} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 4692 1bfc3229858 tab
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.6.2040712756\1731472040" -childID 5 -isForBrowser -prefsHandle 2524 -prefMapHandle 2520 -prefsLen 26872 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a84664e-0162-43ef-99e6-20c5f83d9445} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 5328 1bfc38a2058 tab
    3⤵
    PID:404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.5.1765229291\1155355923" -childID 4 -isForBrowser -prefsHandle 2352 -prefMapHandle 2832 -prefsLen 26872 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {533cf25d-1c37-47ba-8aae-3ca061c2dcd0} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 4100 1bfbe387558 tab
    3⤵
    PID:2664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.7.896175268\1069429481" -childID 6 -isForBrowser -prefsHandle 5276 -prefMapHandle 5176 -prefsLen 26872 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f341eac-9445-4f61-8fc0-36c79fc4bc24} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 2564 1bfb0960a58 tab
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.8.1587241972\1263230663" -childID 7 -isForBrowser -prefsHandle 4696 -prefMapHandle 4252 -prefsLen 26872 -prefMapSize 232711 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f44af174-97e1-4719-a903-3ee7b60f2927} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 4788 1bfb0966b58 tab
    3⤵
    PID:1464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2036.9.4613988\1827053433" -parentBuildID 20221007134813 -prefsHandle 5604 -prefMapHandle 5664 -prefsLen 26872 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51f02c87-0c06-4c37-bfed-947111f1151c} 2036 "\\.\pipe\gecko-crash-server-pipe.2036" 6012 1bfc3662d58 rdd
    3⤵
    PID:5680
- - C:\Users\Admin\Downloads\icqsetup.exe
    "C:\Users\Admin\Downloads\icqsetup.exe"
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\icq.4773427830291.tmp\icqsetup.exe
      C:\Users\Admin\AppData\Local\Temp\\icq.4773427830291.tmp\icqsetup.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:4492
    - - C:\Users\Admin\AppData\Roaming\ICQ\bin\icq.exe
        
        "C:\Users\Admin\AppData\Roaming\ICQ\bin\icq.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5476

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:5176

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1228

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5536

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3324

C:\Users\Admin\AppData\Roaming\ICQ\bin\icq.exe
"C:\Users\Admin\AppData\Roaming\ICQ\bin\icq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:3036

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:4188

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery