Gen.Variant.Zusy.122267_2492a37d59

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1336
%original file name%.exe:136
setup.exe:936
AmigoDistrib.exe:344
amigo.exe:1888
MailRuUpdater.exe:1340
MailRuUpdater.exe:956

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{0A34B065-A460-4104-B2F7-0859F7920B15}\AmigoDistrib.exe (380715 bytes)

The process setup.exe:936 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-TW.dll (8 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-CN.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nb.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\delegate_execute.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\id.pak (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lv.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\libglesv2.dll (6347 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\VisualElements\splash-620x300.png (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-GB.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\icudt.dll (72365 bytes)
%Documents and Settings%\%current user%\Desktop\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fr.pak (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJJZP76X\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ar.pak (314 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\cs.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_frame_helper.exe (82 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\cs.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\da.dll (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\extensions\external_extensions.json (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\el.pak (1699 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MailRu\MailRuUpdater.exe (46100 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\vi.pak (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sw.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sl.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hu.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\am.pak (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\mr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lv.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-US.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\secondarytile.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\vk.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\chrome.7z (1341364 bytes)
%Documents and Settings%\%current user%\Desktop\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es.pak (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\he.pak (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ca.pak (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-TW.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ms.pak (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\chrome_installer.log (972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\extensions\mailru_checker_1.2.3.crx (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\npchrome_frame.dll (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\it.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\ok.exe (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pl.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\gu.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fi.pak (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fil.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\da.pak (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pl.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\nacl_irt_x86_64.nexe (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lt.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fa.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fa.pak (1611 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\et.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ru.pak (1642 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sk.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\d3dcompiler_43.dll (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sk.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hu.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\am.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sl.pak (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\de.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ml.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ta.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\kn.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-CN.pak (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\ok.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_frame_helper.dll (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\extensions\kgkggmpkealihpbjpdmcblcplljamohl.json (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\master_preferences (982 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sv.pak (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\ffmpegsumo.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ja.pak (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\te.pak (1805 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\uk.pak (1648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\agentloader.exe (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\wow_helper.exe (71 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-PT.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\mailruupdater.exe (45823 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bn.pak (1769 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-BR.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ta.pak (1829 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\nacl64.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-PT.pak (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ro.pak (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\gcswf32.dll (108196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ro.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41AF8HMJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hi.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\kn.pak (1815 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-BR.pak (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\12POLYR3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fil.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\vi.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nl.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\metro_driver.dll (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ml.pak (3679 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe (7971 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hi.pak (1754 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\d3dcompiler_46.dll (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\VisualElements\logo.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\ppgooglenaclpluginchrome.dll (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ko.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_touch_100_percent.pak (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\th.pak (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\de.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es-419.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\amigo.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sv.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ko.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\mr.pak (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\libegl.dll (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome.dll (283704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fi.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es-419.pak (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-US.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\he.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\master_preferences (982 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin (4 bytes)
%Documents and Settings%\%current user%\Desktop\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\it.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\gu.pak (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sr.pak (1636 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bn.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ru.dll (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\et.pak (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\VisualElementsManifest.xml (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\xinput1_3.dll (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ms.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ja.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ca.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\nacl_irt_x86_32.nexe (42362 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\te.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\uk.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KPINOLEV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hr.pak (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_launcher.exe (178 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\tr.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\vk.exe (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nl.pak (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lt.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ar.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_100_percent.pak (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\tr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_child.dll (286042 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\th.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\id.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-GB.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bg.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\VisualElements\smalllogo.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\el.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bg.pak (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nb.pak (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\resources.pak (172310 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sw.pak (215 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\agentloader.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\wow_helper.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\ok.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\vk.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\amigo.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\master_preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\MailRuUpdater.exe (0 bytes)

The process AmigoDistrib.exe:344 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\setup.exe (18208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\SETUP.EX_ (1697 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\CHROME.PACKED.7Z (375522 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\SETUP.EX_ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\CHROME.PACKED.7Z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp (0 bytes)

The process amigo.exe:1888 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\debug.log (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\2.tmp (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\Local State~RF87cda.TMP (0 bytes)

The process MailRuUpdater.exe:1340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (46100 bytes)

The process MailRuUpdater.exe:956 makes changes in the file system.

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\85E1852F828C4A1B8F1E5B6C88FD2291.html (0 bytes)

Registry activity

The process %original file name%.exe:1336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\{0A34B065-A460-4104-B2F7-0859F7920B15}]
"AmigoDistrib.exe" = "Amigo"

[HKCU\Software\IM]
"330" = "15-02-01 0:46:34"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\2492a37d59d1eb1f631a53bfa18866bd\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 45 19 A0 2C FB C8 C6 B1 31 03 45 56 67 CC A6"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\2492a37d59d1eb1f631a53bfa18866bd\DEBUG]
"Trace Level"

The process %original file name%.exe:136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 1B D3 A7 B1 15 8B 9B AE 2D 06 AD 40 E8 0E 7E"

The process setup.exe:936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Amigo]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".webp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\Startmenu]
"StartMenuInternet" = "Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCR\.shtml\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Amigo\Commands\on-os-upgrade]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe --on-os-upgrade --verbose-logging"

[HKCR\.webp\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Amigo]
"ap" = "-stage:refreshing_policy"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"tel" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"AgentInstall" = "0"

"ua" = "CHANNEL_newcustom1"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}]
"(Default)" = "CommandExecuteImpl Class"

[HKCU\Software\Amigo]
"pv" = "32.0.1709.113"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Amigo]
"Name" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xhtml" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCR\.html\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\.htm\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\amigo.exe]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".html" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo]
"UninstallArguments" = " --uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"FirstInstall" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"http" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"InstallResult" = "install"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "HTML Document"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayVersion" = "32.0.1709.113"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCR\.xht\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mms" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationName" = "Amigo"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".shtml" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"VersionMajor" = "1709"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ReinstallCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --make-default-browser"

[HKCU\Software\Amigo]
"InstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationDescription" = "Amigo is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Amigo."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"smsto" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo\Commands\install-extension]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --limited-install-from-webstore=%1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"HideIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --hide-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"news" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".htm" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe --uninstall"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"IconsVisible" = "1"

[HKCU\Software\Amigo]
"InstallerError" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 AE 46 60 F3 48 19 93 A3 07 0A 9A 98 2E 98 FB"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"InstallDate" = "20150201"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Amigo"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"https" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"Guid" = "{29ACF10A-9EB0-4D2A-B49B-C9E2C54E56E1}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"urn" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}\LocalServer32]
"ServerExecutable" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Amigo]
"oopcrashes" = "1"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"stage" = "1"

[HKCR\.xhtml\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Amigo\Commands\install-extension]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mailto" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"irc" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"nntp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"Publisher" = "Mail.Ru"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Amigo]
"InstallerExtraCode1" = "9"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\Default User\Application Data"

[HKCU\Software\Amigo\Commands\install-extension]
"RunAsUser" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\amigo.exe]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"NoModify" = "1"

[HKCU\Software\Amigo]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xht" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayName" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"NoRepair" = "1"
"Version" = "32.0.1709.113"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"webcal" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"ftp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Amigo]
"lang" = "en"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ShowIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --show-icons"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"VersionMinor" = "113"

[HKCU\Software\Amigo\Commands\install-extension]
"SendsPings" = "1"

[HKLM\SOFTWARE\RegisteredApplications]
"Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = "Software\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"sms" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"amigo" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Amigo]
"ap"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"InstallResult"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Amigo]
"InstallerExtraCode1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process AmigoDistrib.exe:344 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 CE 0C F6 50 D0 55 DC FC 6B BB 3E 7F 45 FA 26"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"RFR" = "newcustom1"

The process amigo.exe:1888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\.html]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Classes\https\shell]
"(Default)" = "open"

[HKCU\Software\Classes\.shtml]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Classes\http\shell]
"(Default)" = "open"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Classes\http]
"URL Protocol" = ""

[HKCU\Software\Classes\https]
"URL Protocol" = ""

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\.xhtml]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.xht]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.htm]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 80 39 5B 76 DC EA 5B D7 50 6C DA 8D 72 48 E3"

[HKCU\Software\Amigo]
"usagestats" = "0"

[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\ftp]
"URL Protocol" = ""

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

The process MailRuUpdater.exe:1340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"Publisher" = "Mail.Ru"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"DisplayName" = "Служба автоматического обновления программ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMinor" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMajor" = "1"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru]
"MailRuUpdater.exe" = "Mail.Ru updater"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F 38 B3 DD 43 73 3D C6 5A 23 72 24 7E 13 CC F0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater"

The process MailRuUpdater.exe:956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 4E 2A 4A 8E 44 E3 0F 69 24 81 EA 9F 6D C6 61"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{81BC9546-89E1-42FE-9F40-BE9710336316}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Updater]
"IconsConvertation" = "1"

[HKCU\Software\Mail.Ru\Tech\ptls\{A12C4AB1-F4D0-4771-8C21-613E9D12491F}\ch]
"gdup" = "LlyYT03/qx vUgo0O6evFTcBnV5X6pcJog1NZ2f/v11XfPY/b8ecM5s5dVIbkY9lVX//IFTdimfdcSAWGYGJci8Pil9O6upf8F8GMz2Ur0VaSNgCH4fpX/lPPzQ8tf8dU3/2LifEmm7SfzxUQ8nPOwd56z4NiMl zmhiXB2JiGKo9A=="

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1336
   %original file name%.exe:136
   setup.exe:936
   AmigoDistrib.exe:344
   amigo.exe:1888
   MailRuUpdater.exe:1340
   MailRuUpdater.exe:956

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\{0A34B065-A460-4104-B2F7-0859F7920B15}\AmigoDistrib.exe (380715 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-TW.dll (8 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-CN.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nb.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\delegate_execute.exe (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\id.pak (209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lv.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\libglesv2.dll (6347 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\VisualElements\splash-620x300.png (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-GB.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\icudt.dll (72365 bytes)
   %Documents and Settings%\%current user%\Desktop\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fr.pak (251 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe (7433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJJZP76X\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ar.pak (314 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\cs.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_frame_helper.exe (82 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\cs.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\da.dll (8 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\extensions\external_extensions.json (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\el.pak (1699 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\MailRu\MailRuUpdater.exe (46100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\vi.pak (263 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sw.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sl.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hu.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\am.pak (323 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\mr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lv.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-US.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\secondarytile.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\vk.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\chrome.7z (1341364 bytes)
   %Documents and Settings%\%current user%\Desktop\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es.pak (242 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\he.pak (266 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ca.pak (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-TW.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ms.pak (214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\chrome_installer.log (972 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\extensions\mailru_checker_1.2.3.crx (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\npchrome_frame.dll (15801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\it.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\ok.exe (140 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pl.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\gu.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fi.pak (220 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fil.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\da.pak (213 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pl.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\nacl_irt_x86_64.nexe (28502 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lt.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fa.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fa.pak (1611 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\et.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ru.pak (1642 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sk.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\d3dcompiler_43.dll (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sk.pak (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hu.pak (246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\am.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sl.pak (218 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\de.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ml.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ta.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\kn.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\zh-CN.pak (192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\ok.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_frame_helper.dll (55 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\extensions\kgkggmpkealihpbjpdmcblcplljamohl.json (88 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\master_preferences (982 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sv.pak (214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\ffmpegsumo.dll (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ja.pak (282 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\te.pak (1805 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\uk.pak (1648 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\agentloader.exe (115 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\wow_helper.exe (71 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-PT.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\mailruupdater.exe (45823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bn.pak (1769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-BR.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ta.pak (1829 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\nacl64.exe (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-PT.pak (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ro.pak (242 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\gcswf32.dll (108196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ro.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\41AF8HMJ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hi.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\kn.pak (1815 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\pt-BR.pak (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\12POLYR3\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fil.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\vi.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nl.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\metro_driver.dll (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ml.pak (3679 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe (7971 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hi.pak (1754 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\d3dcompiler_46.dll (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\VisualElements\logo.png (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\ppgooglenaclpluginchrome.dll (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ko.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_touch_100_percent.pak (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\th.pak (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\de.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es-419.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\amigo.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sv.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ko.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\mr.pak (1748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\libegl.dll (107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome.dll (283704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\fi.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\es-419.pak (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-US.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\he.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\master_preferences (982 bytes)
   %Documents and Settings%\%current user%\Desktop\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\it.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\gu.pak (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sr.pak (1636 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bn.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ru.dll (8 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\et.pak (207 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\VisualElementsManifest.xml (391 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\xinput1_3.dll (81 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ms.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ja.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ca.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\nacl_irt_x86_32.nexe (42362 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\te.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\uk.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KPINOLEV\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\hr.pak (222 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_launcher.exe (178 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\tr.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\vk.exe (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nl.pak (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\lt.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\ar.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_100_percent.pak (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\tr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\chrome_child.dll (286042 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\th.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\id.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\en-GB.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bg.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\VisualElements\smalllogo.png (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\el.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\bg.pak (1668 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\nb.pak (213 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\resources.pak (172310 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source936_29185\Chrome-bin\32.0.1709.113\Locales\sw.pak (215 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\setup.exe (18208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\SETUP.EX_ (1697 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_87420.tmp\CHROME.PACKED.7Z (375522 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\debug.log (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\1.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\2.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (46100 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "amigo" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

Static Analysis

VersionInfo

Company Name: 0.0.0.0
Product Name: 0.0.0.0
Product Version: 0.0.0.0
Legal Copyright: 0.0.0.0
Legal Trademarks: 0.0.0.0
Original Filename: 0.0.0.0
Internal Name: 0.0.0.0
File Version: 1.2.3.405
File Description: 0.0.0.0
Comments: 0.0.0.0
Language: English (United States)

Company Name: 0.0.0.0Product Name: 0.0.0.0Product Version: 0.0.0.0Legal Copyright: 0.0.0.0Legal Trademarks: 0.0.0.0Original Filename: 0.0.0.0Internal Name: 0.0.0.0File Version: 1.2.3.405File Description: 0.0.0.0Comments: 0.0.0.0Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 156

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.-.

.1D..g.I....M....(.*...F.4o.a&&....H...n.

..}v.....Z^......./...u..mw.....!N.9.3.A.Z.4....}.....G.U......o%Fp.\...VO?.fi

.,..PN=6...@......4.

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 31 Jan 2015 22:44:42 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x......@...^.`.ns..$.....wg..^........dtkm...F......q.........

GET /AmigoDistrib.exe HTTP/1.1

Host: amigobin.cdnmail.ru

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 31 Jan 2015 22:44:10 GMT

Content-Type: application/octet-stream

Content-Length: 50381352

Connection: keep-alive

Last-Modified: Fri, 26 Dec 2014 10:41:04 GMT

ETag: "549d3b40-300c228"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vv..................*....`................0.......=.......7.....Rich............................PE..L...I.>T.................6...v......p8.......P....@.........................................................................`?..x....p...t..............(............................................................................................text....4.......6.................. ..`.data... ....P......................@....rsrc....t...p...v...:..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................DD..6D..$D...D..TD......&A..6A..BA..TA..`A..vA...A...A...A...A...A...A...B...B..$B..@B..LB..bB..xB...B...A...B...B...B...B...B...B...C...C..0C..>C..TC..dC..xC...C...C...C...C...C...C...A...@...@...@...B...@.......D..rD.......D...D.......D......................I.>T........[...,...,.......{.8.A.6.9.D.3.4.5.-.D.5.6.4.-.4.6.3.c.-.A.F.F.1.-.A.6.9.D.9.E.5.3.0.F.9.6.}.....{.F.D.A.7.1.E.6.F.-.A.C.4.C.-.4.a.0.0.-.8.B.7.0.-.9.9.5.8.A.6.8.9.0.6.B.F.}.....{.8.B.A.9.8.6.D.A.-.5.1.0.0.-.4.0.5.E.-.A.A.3.5.-.8.6.F

<<< skipped >>>

GET /update/2/version.txt?type=mruinfo&GUID={81BC9546-89E1-42FE-9F40-BE9710336316}&rfr=&tool=mrupdater&ovr_internet=0&ovr_amigo=1&amigo_conv=0&ver=1.0.8.28&amhp=error&amdse=error&amsg=error&last_amigo=31536000 HTTP/1.1

Host: mrb.mail.ru

Accept: */*

User-Agent: FULLSTUFF

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.7.5

Date: Sat, 31 Jan 2015 22:45:00 GMT

Content-Type: text/html

Content-Length: 212

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.7.5</center>..</body>..</html>....

GET /updater/version.xml?guid={81BC9546-89E1-42FE-9F40-BE9710336316} HTTP/1.1

Host: binupdate.mail.ru

Accept: */*

User-Agent: MailRuUpdater

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 31 Jan 2015 22:45:00 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /ext_settings.json?mrupver= HTTP/1.1

Host: xml.binupdate.mail.ru

Accept: */*

User-Agent: MailRuUpdater

Connection: close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 31 Jan 2015 22:45:02 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 15580

d.?^w{zsHz|gg01*/U..jeaooklcknheV_TRU_^ST__ZU[]_DOFI..#.HMDJJRBM<;29>75:=88:1682')=.'&. ejOf$--(............................ANkB...............................................................................................................................oy~wpwwp}xesz0=.-an`ledmi`nhijgkYXQ[SJIQSY[DX^[ZH..&.ENNMKMBMNEN>40::5?=>70$4:;5!,*&$heBe #,-)&0.........................DInA..................................................................................................................................optz}}rw}r78.0txiocfn`bdakkhg`ccSNR__XZ]VSPYX\..%.F\FL@BMNBKODOG11;, 7264<9148>=--o`Ah#/(%*(**$,......................KDmD.....................................................................................................................................tsryzx{:;.7{|w.qa~bffmjlco`t`rea]NMVZY^S^Q[..8.R@G]EFBOBWGNBDAJH=276>4>9<<=?00!rcDo(% $# "#'("$...................NG`K........................................................................................................................................z{qy96.:zrexy|usblhe`lgdajfcdchpXPUU^^[T..?.[TV[AFLFCMAN@VKIG@EF6=658716<561q~[r#()$'%"8"'- "#1$................MBgN...........................................................................................................................................u<1.9~xyyqydpbzzebfdhheicvunsjfl]WZ]V..2.SR^V\^SAJF@MAFAOVJH@DLG<.;878=49ty^q4!<'*.&&(9.,#/& ,&-.............P]zM..........................................................................................................

<<< skipped >>>

GET /chrome/internet_to_amigo.xml?guid={81BC9546-89E1-42FE-9F40-BE9710336316} HTTP/1.1

Host: binupdate.mail.ru

Accept: */*

User-Agent: MailRuUpdater

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 31 Jan 2015 22:45:00 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 849

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8...BO)j......$h..da..4@Q..4..P...d.E.}...E.E.......\..R.2.7I.p...x...5.J....YZ.\m~.S..X

..b.:.?...t..t...u<..y

A...T.;.[o.