028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e

Analysis

max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Size

2.0MB
MD5

2c3bd477eefc6e52974a4fe8659660da
SHA1

4d77b1ca10a254109e71443ca72a320efb6bd13d
SHA256

028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e
SHA512

b4e1e44570f27dad612849e2cba04ff8fae75e6987a1c7a99efc2a34740671ebe8434fc0b8668ff6de2470302940a6ed01cf0066f1367f803123bc7213ca66df
SSDEEP

49152:RSnWm37PrFEAPTHnhg1j2DeED3WePTHnhg1j2DeED3gCQ5:RyWm37zT9oK/9oKBQ5

Score

8^/10

adware discovery evasion persistence phishing spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	mailruhomesearch.exe

Executes dropped EXE 23 IoCs

pid	Process
2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
3256	AmigoDistrib.exe
3156	AmigoDistrib.exe
4572	mailruhomesearch.exe
640	na_runner.exe
5200	MailRuUpdater.exe
5268	MailRuUpdater.exe
5260	AmigoDistrib.exe
5512	setup.exe
5556	setup.exe
5628	3c75-9e98-8812-be73
5708	mrupdsrv.exe
5696	MailRuUpdater.exe
5852	MailRuUpdater.exe
6008	MailRuUpdater.exe
6116	MailRuUpdater.exe
6096	MailRuUpdater.exe
5628	amigo.exe
5832	amigo.exe
5340	amigo.exe
2844	updater.exe
5304	MailRuUpdater.exe
5848	MailRuUpdater.exe

Loads dropped DLL 5 IoCs

pid	Process
5496	regsvr32.exe
5628	amigo.exe
5832	amigo.exe
5340	amigo.exe
5628	amigo.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater = "C:\\Users\\Admin\\AppData\\Local\\Mail.Ru\\MailRuUpdater.exe"	MailRuUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amigo = "C:\\Users\\Admin\\AppData\\Local\\Amigo\\Application\\amigo.exe --no-startup-window"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater = "C:\\Users\\Admin\\AppData\\Local\\Mail.Ru\\MailRuUpdater.exe"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mailruhomesearch = "\"C:\\Users\\Admin\\AppData\\Local\\Mail.Ru\\Sputnik\\ptls\\mailruhomesearch.exe\" --pr_deferred"	mailruhomesearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MailRuUpdater = "C:\\Users\\Admin\\AppData\\Local\\Mail.Ru\\MailRuUpdater.exe"	na_runner.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 13 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mailruhomesearch.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	na_runner.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mrupdsrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MailRuUpdater.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E8F97CD-60B5-456F-A201-73065652D099}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E8F97CD-60B5-456F-A201-73065652D099}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E8F97CD-60B5-456F-A201-73065652D099}\ = "MRSearchPlugin"	regsvr32.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\Update Service\us\d9bf774acb	mrupdsrv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85	MailRuUpdater.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	mailruhomesearch.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	mailruhomesearch.exe
File opened for modification	C:\Windows\System32\GroupPolicy\User\Registry.pol	mailruhomesearch.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85	MailRuUpdater.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85	MailRuUpdater.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85	MailRuUpdater.exe
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	mailruhomesearch.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	mailruhomesearch.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	mailruhomesearch.exe
File opened for modification	C:\Windows\System32\GroupPolicy	mailruhomesearch.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe	updater.exe
File created	C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe	na_runner.exe
File created	C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe	3c75-9e98-8812-be73
File opened for modification	C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe	3c75-9e98-8812-be73
File opened for modification	C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe	MailRuUpdater.exe
File opened for modification	C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe	MailRuUpdater.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amigo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amigo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c75-9e98-8812-be73
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrupdsrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmigoDistrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmigoDistrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mailruhomesearch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmigoDistrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amigo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	na_runner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MailRuUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}\FaviconURLFallback = "https://go.mail.ru/favicon.ico"	mailruhomesearch.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences	mailruhomesearch.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	mailruhomesearch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Mail.Ru"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}\Policy = "3"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Approved Extensions	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}\DisplayName = "Поиск@Mail.Ru"	mailruhomesearch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}\AppName = "mrkeeper.exe"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Approved Extensions	mailruhomesearch.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}	mailruhomesearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}\SuggestionsURL = "https://suggests.go.mail.ru/ie8?q={searchTerms}"	mailruhomesearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{FFEBBF0A-C22C-4172-89FF-45215A135AC7}"	mailruhomesearch.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	MailRuUpdater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{8E8F97CD-60B5-456F-A201-73065652D099} = 51667a6c4c1d3b1bdd88949382330308ba03384654109082	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{8E8F97CD-60B5-456F-A201-73065652D099} = 51667a6c4c1d3b1bdd8d9d9f8b350308b80f334657149c83	mailruhomesearch.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\SearchScopes	mailruhomesearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}\URL = "https://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7B512CCEB1-4975-404E-B3AC-8E6A4B0DC498%7D&gp="	mailruhomesearch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}\ShowSearchSuggestions = "1"	mailruhomesearch.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://mail.ru/cnt/10445?gp="	mailruhomesearch.exe

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO.1\CLSID\ = "{8E8F97CD-60B5-456F-A201-73065652D099}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Amigo\\Application\\amigo.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.svg	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.xht	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Name\ = "[email protected]"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.svg\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.xht\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Name	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO.1\ = "[email protected]"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\Application\ApplicationDescription = "Browse the web"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.webp\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.html\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\ = "[email protected]"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\shell\open	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.xhtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.shtml	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\Application\AppUserModelId = "Amigo.RC2CSCYBZBGJJIWPXAM6S2CBS4"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.html	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.xhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.htm\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.pdf	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\Application\ApplicationCompany = "Mail.Ru"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.html\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\Application	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO\ = "[email protected]"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.htm	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.shtml\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Amigo\\Application\\amigo.exe\" -- \"%1\""	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\AppUserModelId = "Amigo.RC2CSCYBZBGJJIWPXAM6S2CBS4"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.xht\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\ = "Amigo HTML Document"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.svg\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.pdf\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.webp\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.webp	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Mail.Ru\\Sputnik\\ie_addon_dll.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO\CurVer\ = "IESearchPlugin.MailRuBHO.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO.1	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.xhtml\OpenWithProgids\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\ProgID\ = "IESearchPlugin.MailRuBHO.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IESearchPlugin.MailRuBHO\CLSID\ = "{8E8F97CD-60B5-456F-A201-73065652D099}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Amigo\\Application\\amigo.exe,0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\AmigoHTML.RC2CSCYBZBGJJIWPXAM6S2CBS4\Application\ApplicationName = "Amigo"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.htm\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\.pdf\OpenWithProgids	setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
2620	msedge.exe
2620	msedge.exe
1284	msedge.exe
1284	msedge.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
1948	identity_helper.exe
1948	identity_helper.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
4572	mailruhomesearch.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
5268	MailRuUpdater.exe
5268	MailRuUpdater.exe
5268	MailRuUpdater.exe
5268	MailRuUpdater.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe
640	na_runner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSecurityPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeTakeOwnershipPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeLoadDriverPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSystemProfilePrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSystemtimePrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeProfSingleProcessPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeIncBasePriorityPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeCreatePagefilePrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeBackupPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeRestorePrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeShutdownPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeDebugPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSystemEnvironmentPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeChangeNotifyPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeRemoteShutdownPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeUndockPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeManageVolumePrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeImpersonatePrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeCreateGlobalPrivilege	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 33	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 34	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 35	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 36	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeIncreaseQuotaPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSecurityPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeTakeOwnershipPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeLoadDriverPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSystemProfilePrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSystemtimePrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeProfSingleProcessPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeIncBasePriorityPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeCreatePagefilePrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeBackupPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeRestorePrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeShutdownPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeDebugPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeSystemEnvironmentPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeChangeNotifyPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeRemoteShutdownPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeUndockPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeManageVolumePrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeImpersonatePrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: SeCreateGlobalPrivilege	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 33	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 34	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 35	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 36	2472	_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
Token: 33	5260	AmigoDistrib.exe
Token: SeIncBasePriorityPrivilege	5260	AmigoDistrib.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2472	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe	94
PID 4816 wrote to memory of 2472	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe	94
PID 4816 wrote to memory of 2472	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe	94
PID 4816 wrote to memory of 1284	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe	96
PID 4816 wrote to memory of 1284	4816	028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe	96
PID 1284 wrote to memory of 1128	1284	msedge.exe	97
PID 1284 wrote to memory of 1128	1284	msedge.exe	97
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 4196	1284	msedge.exe	98
PID 1284 wrote to memory of 2620	1284	msedge.exe	99
PID 1284 wrote to memory of 2620	1284	msedge.exe	99
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100
PID 1284 wrote to memory of 4924	1284	msedge.exe	100

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	mrupdsrv.exe

C:\Users\Admin\AppData\Local\Temp\028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
"C:\Users\Admin\AppData\Local\Temp\028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe"
1⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Roaming\Installer\_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe
  "C:\Users\Admin\AppData\Roaming\Installer\_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe" 655454
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://special.kaspersky-labs.com/AIF0KEZ7VLBUR6KBTBYC/kav14.0.0.4651abRU_5173.exe
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff179346f8,0x7fff17934708,0x7fff17934718
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13191410623039332571,16061458267680487010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:4088
- C:\Users\Admin\AppData\Roaming\Installer\AmigoDistrib.exe
  "C:\Users\Admin\AppData\Roaming\Installer\AmigoDistrib.exe" --silent --rfr=ticno2 --ua_rfr=CHANNEL_ticno2 --make_default=1 /partner_new_url=&ovr=$__OVR
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\loader_ldir_3256_27468\AmigoDistrib.exe
    C:\Users\Admin\AppData\Local\Temp\loader_ldir_3256_27468\AmigoDistrib.exe --silent --rfr=ticno2 --ua_rfr=CHANNEL_ticno2 /partner_new_url=&ovr=$__OVR --cp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1731383744\AmigoDistrib.exe
      "C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1731383744\AmigoDistrib.exe" --silent --rfr=ticno2 --ua_rfr=CHANNEL_ticno2 --partner_new_url=&ovr=$__OVR --ext_params=masterid={F0787064-8009-4922-8EE9-1DEBF3AEEE4A}&tcvsts=-2 --ils=12
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\CR_577DD.tmp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CR_577DD.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_577DD.tmp\CHROME.PACKED.7Z" --silent --rfr=ticno2 --ua_rfr=CHANNEL_ticno2 --partner_new_url=&ovr=$__OVR --ext_params=masterid={F0787064-8009-4922-8EE9-1DEBF3AEEE4A}&tcvsts=-2 --ils=12
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\CR_577DD.tmp\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\CR_577DD.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Amigo\User Data\Crashpad" --url=https://webrowser.amigo.mail.ru/amcr --annotation=ProductName=Amigo --annotation=Version=61.0.3163.114 --annotation=bid={A0D81640-B279-45C2-82E6-6C64DBF7284A} --annotation=plat=Win32 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2c8,0x2dc,0x28dde0,0x28ddf0,0x28de00
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe
        
        "C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe" --make-default-browser
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe
        
        C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe --type=crashpad-handler /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Amigo\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Amigo\User Data" --url=https://webrowser.amigo.mail.ru/amcr --annotation=ProductName=Amigo --annotation=Version=61.0.3163.114 --annotation=bid={A0D81640-B279-45C2-82E6-6C64DBF7284A} --annotation=plat=Win32 --initial-client-data=0x174,0x178,0x17c,0x16c,0x180,0x730672bc,0x730672cc,0x730672dc
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe
        
        C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe --type=crashpad-handler /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Amigo\User Data\Crashpad" --url=https://webrowser.amigo.mail.ru/amcr --annotation=ProductName=Amigo --annotation=Version=61.0.3163.114 --annotation=bid={A0D81640-B279-45C2-82E6-6C64DBF7284A} --annotation=plat=Win32 --initial-client-data=0x1f8,0x1fc,0x200,0x1f0,0x204,0xd5db34,0xd5db44,0xd5db54
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1731383744\updater.exe
      "C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1731383744\updater.exe" --install
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:2844
    - - C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater.exe
        
        "C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater.exe"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        
        PID:5304
- C:\Users\Admin\AppData\Roaming\Installer\mailruhomesearch.exe
  "C:\Users\Admin\AppData\Roaming\Installer\mailruhomesearch.exe" /silent /rfr=ticno2 /partner_new_url=
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\62c2-bc7c-9b3f-1da3\na_runner.exe
    "C:\Users\Admin\AppData\Local\Temp\62c2-bc7c-9b3f-1da3\na_runner.exe" --install
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:640
  - - C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater.exe
      "C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:5200
    - - C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004_d\MailRuUpdater.exe
        
        "C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004_d\MailRuUpdater.exe" --update-installation
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater.exe
        
        "C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater.exe"
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        
        PID:6116
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:5496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe
"C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5268
- C:\Windows\TEMP\3c75-9e98-8812-be73
  "C:\Windows\TEMP\3c75-9e98-8812-be73" --install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5628
- C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85_d\MailRuUpdater.exe
  "C:\Windows\system32\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85_d\MailRuUpdater.exe" --us
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5696

C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe
"C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:5708

C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe
"C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5852

C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe
"C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6096

C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe
"C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe" --s
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mail.Ru\Id

Filesize
38B

MD5
e687ef0f4efe4998cd6ad8dcaaaeb330

SHA1
2dd8bbfa1450b1f9b5044f74f155e241708a270f

SHA256
b17d6c795f38c81d1814b3ce601cfbbd635040df3234a93feefe769e31d8a03b

SHA512
0ddc85224516efb0e277dbce3aae84de5ba335251b6e8224fa0c38074ba83eb009842c91c0e5cf30e917e5311d19d1bc3fd0eb8fd43c0862c18c1be3e9d3e971

Download Submit
C:\ProgramData\Mail.ru\ifrm

Filesize
26KB

MD5
fde01a213d0494cd2944126265f22ab5

SHA1
55f60ce629a80321284c53643d0ce4623ca31f8d

SHA256
af05c5a6c4f6413e6db1e92189e1768a6e8a3f79ea04d69b87091c34af1a526d

SHA512
61d4f8da418a0ae09ad9cb3c5ba599900b62221bc3b5052d321caa8990e1247f1eb4b15d7d54f64b51c705973fbe16a39a8d5329e1006ede196fc0637e2a2d94

Download Submit
C:\Users\Admin\AppData\Local\Amigo\Application\61.0.3163.114\chrome.dll

Filesize
35.3MB

MD5
8ee2d07283acf5be92ebf81e7622f743

SHA1
cd79b5c1244abb7a4da86ef17a8d4b2429ccc15a

SHA256
7bccad759e4e96af2bbd2ea3578f74103e9f4f3cfefcfa04cbd0dde8f31f2b01

SHA512
dc7fc02974a200798738283af745c95b422970ee849df3754d3b817bc2b233541df05c5de60f2ede678e56c166370d9f59584242e7ee084ff0f7e037e02021dc

Download Submit
C:\Users\Admin\AppData\Local\Amigo\Application\61.0.3163.114\chrome_elf.dll

Filesize
426KB

MD5
a1bb3486b51eb004949cb8fc026f36e7

SHA1
786d4add44c182e5c2a983ee3ecf8b130a932b22

SHA256
98c67a1effc01984cdfbc89092929d45724e88e75efda69a322a83f7ac46042d

SHA512
090f3483afb127dac1e63e620ccf8465bd1a77fbf023d103c35caa6e9ca400f70d105dffb49a7c39ed38e35f774be75fbfb69c3f033634133dfb87849d6e96c7

Download Submit
C:\Users\Admin\AppData\Local\Amigo\Application\61.0.3163.114\icudtl.dat

Filesize
9.7MB

MD5
d1fb52ed611b2fb214482d877921bfef

SHA1
b0a3c6c9ab60e2eb2bd68c10de5490978fed8321

SHA256
f4b7a46a026455785937c2aef596f92a02136129f7615200f7efc983ac2fadb2

SHA512
fba3b692088ba0bfcca1623d0e1490eeab7a097b99e9d0395d3744067b059b663228c4afa4604f54d14671d529a3c4aefd3b558fa2662e5849ddad9d80095efc

Download Submit
C:\Users\Admin\AppData\Local\Amigo\Temp\source5512_21182\Chrome-bin\amigo.exe

Filesize
1.1MB

MD5
12f74a11190a321695764da85c0b177a

SHA1
fbde96e731468a5309f2446b3f6d82d2522b2394

SHA256
b591dc2642c069cbaaeebeec23ae476aaefbbc178b47f255f6eaadf10d59f9f1

SHA512
a9ef056acbb6d5b4fe7bcacbdbf226900873ab6ad8cdb1539c7b3afd39ae19b1bedfeb87dfb5dcfc9abcd5029a4dc443f33602b59599619423090b21a9d2d77a

Download Submit
C:\Users\Admin\AppData\Local\Amigo\User Data\Crashpad\settings.dat

Filesize
40B

MD5
2ed0b091677dc1136b82c19e5a8b852c

SHA1
25f80d3c6b48eb830a77fbcd18ba098217c98c17

SHA256
8b7955dd2ee995f6950a991b1894ebd2e76e3290e2d99f48ce2c8943b876cc47

SHA512
dca5c169144290967f875c4467e5971bfcadcf0104b4694a52495379acf53c77d6b866364731f17090ebf5804fd150b77f07066505fdbfc227d06b3cc39edb97

Download Submit
C:\Users\Admin\AppData\Local\Amigo\User Data\Local State

Filesize
1KB

MD5
876eed5e58872969e1dde488e582584b

SHA1
8948141d0e6ebc171120a16a8cd6b52f8c1117fd

SHA256
0b1257752461944ed1ad86e84fd99982097d335ff76524f7e452705698b41b8a

SHA512
5fd8c2462d530de1f995f8c4caaf2669e2daaa0b2259a81ada71ee80c81621b5bd04fc6c400e088bc3d8540f18c5806e0596b7f2820804e4dc8e431e28893375

Download Submit
C:\Users\Admin\AppData\Local\Mail.Ru\GoChromiumNativeHost\native_host_app.exe

Filesize
906KB

MD5
2fd24b550e262ef2b91162f4728729d2

SHA1
c23b96e45c0b1df122e1c8f0b93d7afdb1ebc5b7

SHA256
3891ff2d5620b4ee5326dcfdd50e1a34def8397579c7dbec45b296dd5727d25f

SHA512
699929912292d98796e71bcf9bcc4c7f6eef01cdde55ebcd588ffa426f3e9351c94f7a22dcd30ff1d11b8b7e31abad14caf10350ddbf8583adc55d175804bdd2

Download Submit
C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater\prodmon

Filesize
119KB

MD5
3eca8bc0357843474576d5cb5e397a13

SHA1
e19caa534af30459beee3fddd9891e49837cc0cf

SHA256
f3778cb6a9a5a791b77a1eb728315e52aeb709df1457bb38d21af47bb6733294

SHA512
6d7e4fa96c9279f0f6c3de21b29a4012d43cc18e931cdecbfb7e5654c6b87d0778acede76c05181d72802b5a800d791394b844d869e9d9a1a13574e2fbb8edbb

Download Submit
C:\Users\Admin\AppData\Local\Mail.Ru\MailRuUpdater\us\2d0cd78004

Filesize
64B

MD5
c5c018db3072c42e7675eaf21071f665

SHA1
82b96973d662827cd9487e450afc8fdbb9f26541

SHA256
aef3b405d2e441bdec2a7f3b20b5397082f02da248fec358c1ab535d059228b3

SHA512
ac5f4d789664074d43e1b373d0ac5c17239c1b6799a5353920c1902cfc1176bdc3b6be7fe2cfa3bbdeadfe7a0e3013a32edae3bc4b8ff7a227426ae591f02fbd

Download Submit
C:\Users\Admin\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll

Filesize
1.5MB

MD5
8c1c71d39137c7a7b2b9bdfe6eefe73c

SHA1
8845700f12df281d7bed6b456a340ec1f115bdaf

SHA256
1d297d91948c568edf3214eff94460c7dcf5c32a96bbee1f5adf47c3754ced63

SHA512
9ed389072316f8cc066ecab71fc7fdea9268f7d8665960ed7a0f52d98a665fb343dbdd6756db7636e5e178b6706f7978546c85a72b667c9dee2c4eef9c8d0e3c

Download Submit
C:\Users\Admin\AppData\Local\Mail.Ru\Sputnik\ptls\mailruhomesearch.exe

Filesize
128KB

MD5
4a8a7eae2a28831d101e754b125ce042

SHA1
a9a4cbe2e7a3ea02d952506954c472517f58d383

SHA256
5a864f47af1cded89dd57fd6dad3b46c8fa4769363ab1fa560092b557df449b9

SHA512
5a35816b40c4659150023d0413f2440619b0202aca2772151c7b6d34d8007d65745b769cbc2ce85d8c30c9a0a9056e440b47ba930859904bd4829b69e05e9ada

Download Submit
C:\Users\Admin\AppData\Local\Mail.Ru\Tmp\DeferredTasks\{9BB079BC-125F-4FE7-9ADF-196361066695}_c

Filesize
8KB

MD5
2420ae34e2d3b4954174092fbad5d336

SHA1
76f3e39d23b1f256b2433e815bb62264e9b01256

SHA256
2003fb265d76e28d6ac5aa809e35a2bee203d7d7c75f707ee855d6487801ca62

SHA512
36b89c9ec2f62adb7733c4ecfad8f388625a5b87718106743114c5f53678a9c3213b82892ede2e866d4fdfdaa3e40e5ef9588a662d106934295bb675667a75a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62ec9a5f5a7a972af632c7ee7a5ea565

SHA1
cfe279fbb1af251706da45e62a5b064b24650b4f

SHA256
e54560306b16b1e92b67ff260de8207f6174a86db132233b4a74e62147b49ef0

SHA512
169defcf46de6cf8df019f5afe59b221381c23811eda50e13aa0a0c8500812b45449c8b024c237cafefdc3f07c72a8ddd0e8fca9cbfff3a976ff71840ed2e365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b50b3921d696e408c8785a1166dc549

SHA1
e6f434bd8406bbcd0f09e531f987a1b9e2e7bbc0

SHA256
6ec97feeccffb71d28ea050f9f2861d61c484f1bb5a53dfde3d3d6a85e4eb126

SHA512
4ffe032efb60e220d854a44c18228ccb153464141a353f3df18ed795e3f3df52b03c88507fef40280fefd2764a8d509e1c4ff91999f3a75cd4287bf582344c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eed9dbbffb908447e62ea8bb65ceab0c

SHA1
e48121d132802512064b476510040a71b7614cee

SHA256
4c0db23b1fceac5f576c60d27dfcb67db204b4b35fce687bbac5be960f5ae84b

SHA512
0acc2c01da4af0b0fc679adc2ff6f38bae6efa89ed96e0f22843ba5d4bd125ca8d722f84cc5172c6ba6a238addb49121b55c7f898949d06eb9634b9c081e6d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
535b49407a6c8b850e583176d6d8ad6a

SHA1
0afd7ed96753bf42d7c0f5691da58f92afad4888

SHA256
a0d41c6c2595caf4f34f59f4fb499d43c19ac39779dc8e3842bcc8d8bf730d4d

SHA512
2a922ebb799844a95d6ccfd08f5b94af63bdf43fb1015c67885c6616f71526c0298e42d727d371eaae01da318284c71a20d8529e2757ce11a906ffc878aed506

Download Submit
C:\Users\Admin\AppData\Local\Temp\62c2-bc7c-9b3f-1da3\na_runner.exe

Filesize
3.5MB

MD5
feb798265c24beb577cb5bcd43cbd158

SHA1
0b13b0b60367a77cdc55a8db5c31dd7c1f1f7162

SHA256
d9be17d76dfb9d90246512ce89dd7aab7cf1cf94d6145429a84094614aba65e4

SHA512
157024ad7e3b1ea71c6e398105506d7a3df9c8758b092fae014fa4757ff16e0b69168b2a798e92a372dbe46a3a9a4f0a4276c7e9deec9221d5ffb7dfbeeea35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_577DD.tmp\setup.exe

Filesize
1.3MB

MD5
8947cdcbfb2f5a63052218d9a73768d8

SHA1
8b5b653c6985bdf3c9ef6aaf8b6dd2773c61d99e

SHA256
65532f8a9ac33b6f146c86497710acbe18516c14498919e7b610c21f296c9d6a

SHA512
14c1f5c8cd6f4c7f620a2b8e30da49a462b15abefa3171a828087a8ba035b1af72156a556272c6d3609cc4141ccaa0ed4641cafe5d73a44a2efcb7fb46a210ae

Download Submit
C:\Users\Admin\AppData\Roaming\Installer\AmigoDistrib.exe

Filesize
554KB

MD5
b2b97b5f2ffe8603788a49b7105baa82

SHA1
98b854520f4fe748a9ae54c8abe710f99da6acbc

SHA256
fe03edbc99e3728745e19e800195fbd795476cd503903eef3714eee5e675f760

SHA512
207608bd5529aaeab90b800beacdea9e2700c7a22117e2866c8809f3018d1f42694c50fe379e6d355db49dc93206f340b998d4b9ae2d30cab95fdebdfe549c56

Download Submit
C:\Users\Admin\AppData\Roaming\Installer\_028969f62470620aae3bc83f5cde670ccf00932272b5eb1a4d93107301e8823e.exe

Filesize
512KB

MD5
c2681c8a61954ed115834a530db9be33

SHA1
a669efa63b22eaab146b169be21fe9968912e2ab

SHA256
cf5c6ad54a838e8fc6c5965e3cab6414ebbff790e333dcb12d32768134ab6b99

SHA512
0a7512be2be45b4b76edabe465a1dcb84ddf36a5f7aaeef2a5d28204478090ca315622beec7066091c5a182deab850d250a2c1c4e1e59e3a25a249237a7776fd

Download Submit
C:\Users\Admin\AppData\Roaming\Installer\mailruhomesearch.exe

Filesize
2.0MB

MD5
a29c9f523b47027fb97190b908c18979

SHA1
203ca880efa5e1c883f37ad56a4b0e832b813a15

SHA256
25ceeaed228c2d7c08bad41362ad6619c243324ad8a0e05c75d3672e96373bed

SHA512
2d5383fd32060064843ff66be6f0477d36bb8eb0d348305700563fbb737ceddc14e0589ec78f922e9baa96e00c1487512f32fe92951229d5277db3701936d8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kkr0into.Admin\extension-settings.json

Filesize
1KB

MD5
b8dc24ca96b99d8b2e7af36b11fb1dff

SHA1
30b0016b790c1145e30e9db410aae4f9aecea3ea

SHA256
b90d20b2631ffb42df13098aa387d4de91c4c1277720055b34616b662371bde6

SHA512
f26d825d09e66d3c831f1c5d1718ccb316ff1d352e4a58e4739b79f3427d23d4f3da409b17446fe8cc55325beac848457fc93e96703fa773ab7cabce9a01e00e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kkr0into.Admin\extensions\c4ed-3a20-8997-235b\background.bundle.css

Filesize
17KB

MD5
8809ed6a0bf3b15223eb2b3ed6a6a313

SHA1
579f9a84440b38ef995a2c5555305e8a237f3db6

SHA256
00fbde9b0e8b6fd6977ce03785b8fc4e1c796ba30380368a4aea0b99d8fa7854

SHA512
73fd89537cb588b6067e49c0a879b27847ee167eb7447b7cd24c65ecdfc354936969e1b1c40a4145ccfb113b777cb72b2d08ff80ed9efad3deedb2f0d7b41e6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kkr0into.Admin\extensions\[email protected]

Filesize
63KB

MD5
c896d3af89568bcab52d8898d7416bcf

SHA1
bc74c6b0f1e5f02a9888b752ee8ac02786f541bf

SHA256
c1014c30985edbe0398df7c6c613a602e3992df0e13e38bda0455057daba7dbf

SHA512
39b42ef9c0de779c7d8041023f3615b379f0ddc113efdf7e49c1143c698e067333e2762513f3b9ca6c8aeda6af4317aaccf0785867f696098c0573f14f3cf028

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kkr0into.Admin\extensions\[email protected]

Filesize
67KB

MD5
f429584f87e9396c1793559de5950621

SHA1
8220a45001de43323cc02d7cdf6e13a8598dc142

SHA256
0c003b12a06e2a2c54309a4a96a0d45f2c0a0ee8e024c454a34c76d3b6d9cc13

SHA512
ed18256115bb50c66ca6cffe70fc3511381fedaaeb3f9c74a5b4834c39cd5cbf3cc1957bf89fcd995066b491fbc085b246200198d05b499a2528e0381dcf40f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kkr0into.Admin\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}.xpi

Filesize
994KB

MD5
2be6e44753d9f84f727bc4fe5bdd838c

SHA1
2919816c4ba6b87a5cf1455a77b51253de3b03ab

SHA256
a34279d47ed388f2e75527b98a6d9242f25b85741d9abac41a9499e4aec74931

SHA512
b0c8c3fbfafd8502a58fc3c4e42efa2be80a71b3b5f1ce28c328f1edabc45e3075e850e782695f5caf514439be80a6ca88cd2b96df3eba9b5647c259fc7c139f

Download Submit
C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Filesize
11B

MD5
ec3584f3db838942ec3669db02dc908e

SHA1
8dceb96874d5c6425ebb81bfee587244c89416da

SHA256
77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

SHA512
35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85

Filesize
64B

MD5
bddd8a0a8cc08cdc55a3d66abdc96ddd

SHA1
17eea0b877b56150d7600aabd7c0e4794a40c812

SHA256
04860682c52df3ba18f74f8d62f543b869b3cbda44cca2eeda89cab7683b1470

SHA512
724e9a8d41b17a1ee6e1df2557e1bb3521e2d140364ac1ab59049103227371f20331f7d66eec4a0905cfe3b47138ab3856342174c4e957b4a3ae87896ac8de7f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85

Filesize
64B

MD5
d17c3583135d0f24b7020c58d73108bb

SHA1
ba8f425888401b3096bf1e64d70e14f85d5aaa1c

SHA256
be3e42be905c7acf146cde2a561f0bc4f9773c002c0ab3c2d06373dbbd4d1319

SHA512
3be523c18e6d33b39687d3f09f9ae75f6f8653f02b2b1f6e86844dca28a9f92c3457654a58b9244f38a1cc03bd8a84f592cb2759eaf1990bb7a39d7122be0a91

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru\MailRuUpdater\us\336327ca85_d\MailRuUpdater.exe

Filesize
3.1MB

MD5
fdb8415567c0748a3bd4ffb9ac783cb7

SHA1
dbc51b3b102a1fd0fffa2dd5d2809c6e385d6a82

SHA256
92025c595d1a8e503aed2725ef9e64ef4ea919307c2694ffd564993ee4b64d43

SHA512
4335ed11f768209edff90f4611b7ea9ec3ca40daa39eea98cd6cf62bf4a51e1d94d2aa3b3d42b51abb834d2954aaccf84006c6d2af3065b8f35f3b505f3674c2

Download Submit
C:\Windows\System32\GroupPolicy\User\Registry.pol

Filesize
8B

MD5
8e1b08222f20e45a3e8db04c569f9cb7

SHA1
a6ac68fbadf96faba3af7000a7514790157f930f

SHA256
5bb1f21f806938a043563024b13b33d74a2b95b767c5f81bde8456e9d0413a89

SHA512
414d30dec0fce6b4e3ab52c50f064262e0df00cf9dbbeacca271a0991555371a37cfffdd0486c07a9096838942a69cdbefea4a4399ef2848139678daff589c31

Download Submit
C:\Windows\Temp\3c75-9e98-8812-be73

Filesize
1.3MB

MD5
602cd1f0dd54e83de1413705aa378803

SHA1
5015b921285a070a586be12c8663680a9e84dd2b

SHA256
8eeef659d4d3e827474b4c769436807eafedf58dc923054338cb5385dc8d3998

SHA512
5ba07ae618103ba84d7b4e10b15aa7f72fd42e80a5598f2ca361b4afe3ddce5c83dc44b64ba076020838f758a95dc2b148a9374155ff6c92d7d065355f657477

Download Submit
memory/2472-69-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2472-10-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2472-9-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2472-7-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/3156-1159-0x0000000000110000-0x000000000019E000-memory.dmp

Filesize
568KB

Download
memory/4816-0-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4816-70-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/4816-68-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/4816-8-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/4816-1-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/4816-2-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/5696-270-0x0000000000A50000-0x0000000000D6F000-memory.dmp

Filesize
3.1MB

Download