MD5: 85c78de69c81c91115ce313a4e272eae
SHA1: 600ff9543754766502a1fce65d02f0e4119ebfbc
SHA256: d373bc53fbb4b8f1c37b4ed2735fe01bb52816ff1290e5a6857b000da14f26c8
SSDeep: 98304:qaM7HvUMvCfZe3dqzUWRxksVoCFUWTdeOG3Ey7ciN1Oz4sEl:qaqHvUFZenWdjFUEg9eK
Size: 3592192 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-01-22 09:34:10
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1700
%original file name%.exe:856
setup.exe:900
AmigoDistrib.exe:1088
amigo.exe:884
MailRuUpdater.exe:1984
MailRuUpdater.exe:800
MailRuUpdater.exe:816

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{1129396A-B78B-42ED-8FCB-2D2A9B7C6BE2}\AmigoDistrib.exe (380715 bytes)

The process setup.exe:900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lt.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\delegate_execute.exe (9606 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-US.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ca.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ms.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bg.pak (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-PT.pak (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\mr.pak (1748 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ko.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pl.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\gcswf32.dll (108196 bytes)
%Documents and Settings%\%current user%\Desktop\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\gu.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\el.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fr.pak (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\et.pak (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ro.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\it.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nl.dll (8 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hr.pak (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fa.pak (1611 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\te.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\tr.dll (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nb.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es-419.pak (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\resources.pak (172310 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\de.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\master_preferences (982 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hu.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fi.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sv.pak (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\de.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ja.pak (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\VisualElements\splash-620x300.png (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\he.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sw.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fi.pak (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\vk.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hi.pak (1754 bytes)
%Documents and Settings%\%current user%\Desktop\Вконтакте.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\uk.pak (1648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sv.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\te.pak (1805 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Amigo.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-TW.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\VisualElements\smalllogo.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\chrome_installer.log (972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ru.pak (1642 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sl.pak (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\nacl64.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_touch_100_percent.pak (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\tr.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es.pak (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ta.pak (1829 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bn.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\metro_driver.dll (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ko.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\icudt.dll (72365 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome.dll (283704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lv.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\et.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_100_percent.pak (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ar.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-BR.pak (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-CN.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\extensions\kgkggmpkealihpbjpdmcblcplljamohl.json (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\cs.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nb.pak (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\kn.pak (1815 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\id.pak (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-BR.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ml.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ms.pak (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\extensions\external_extensions.json (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fil.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\xinput1_3.dll (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\chrome.7z (1341364 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\ok.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\d3dcompiler_43.dll (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pl.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hi.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\id.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es-419.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\he.pak (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-PT.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\mr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\master_preferences (982 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\amigo.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\kn.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\d3dcompiler_46.dll (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ta.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\el.pak (1699 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\vi.pak (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\agentloader.exe (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sk.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_frame_helper.exe (82 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_frame_helper.dll (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\vi.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\ffmpegsumo.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\libegl.dll (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\da.pak (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\mailruupdater.exe (45823 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bn.pak (1769 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\th.pak (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nl.pak (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\da.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\nacl_irt_x86_32.nexe (42362 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ml.pak (3679 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\vk.exe (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ru.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\cs.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\ok.exe (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ca.pak (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hu.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ar.pak (314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-TW.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lv.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe (7971 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fa.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\uk.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\secondarytile.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ja.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lt.dll (8 bytes)
%Documents and Settings%\%current user%\Desktop\Одноклассники.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sw.pak (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fil.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-US.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-GB.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\gu.pak (1745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sl.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\extensions\mailru_checker_1.2.3.crx (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sk.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\VisualElementsManifest.xml (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\it.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_launcher.exe (178 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\VisualElements\logo.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bg.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\th.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_child.dll (286042 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-GB.pak (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fr.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MailRu\MailRuUpdater.exe (46100 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\npchrome_frame.dll (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\wow_helper.exe (71 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ro.pak (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sr.pak (1636 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\nacl_irt_x86_64.nexe (28502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\libglesv2.dll (6347 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\am.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-CN.pak (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\am.pak (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\ppgooglenaclpluginchrome.dll (1745 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\wow_helper.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\vk.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\amigo.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\master_preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\mailruupdater.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\agentloader.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\ok.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin (0 bytes)

The process AmigoDistrib.exe:1088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\SETUP.EX_ (1697 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\setup.exe (18208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\CHROME.PACKED.7Z (375522 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\SETUP.EX_ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\CHROME.PACKED.7Z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp (0 bytes)

The process amigo.exe:884 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\debug.log (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\2.tmp (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\Local State~RF8ac75.TMP (0 bytes)

The process MailRuUpdater.exe:1984 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MailRuUpdater.exe (913079 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (53570 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7361567C36F04C74AAF8828A9D22EE29.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe.old (0 bytes)

The process MailRuUpdater.exe:800 makes changes in the file system.
The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\34F06F57F0B64F6EBF77A538022F69AA.html (0 bytes)

The process MailRuUpdater.exe:816 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (46100 bytes)

Registry activity

The process %original file name%.exe:1700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 98 59 12 B7 44 EC A2 D2 E3 08 18 8C E2 69 C2"

The process %original file name%.exe:856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\IM]
"330" = "15-02-02 19:38:46"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\{1129396A-B78B-42ED-8FCB-2D2A9B7C6BE2}]
"AmigoDistrib.exe" = "Amigo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 66 BE 4A E0 EC 3E D6 85 3C 67 34 D2 36 36 87"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\85c78de69c81c91115ce313a4e272eae\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\85c78de69c81c91115ce313a4e272eae\DEBUG]
"Trace Level"

The process setup.exe:900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Amigo]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".webp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\Startmenu]
"StartMenuInternet" = "Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCR\.shtml\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Amigo\Commands\on-os-upgrade]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe --on-os-upgrade --verbose-logging"

[HKCR\.webp\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Amigo]
"ap" = "-stage:refreshing_policy"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"tel" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"AgentInstall" = "0"

"ua" = "CHANNEL_openpart"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}]
"(Default)" = "CommandExecuteImpl Class"

[HKCU\Software\Amigo]
"pv" = "32.0.1709.113"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Amigo]
"Name" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xhtml" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCR\.html\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\.htm\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\amigo.exe]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".html" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo]
"UninstallArguments" = " --uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"FirstInstall" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"http" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"InstallResult" = "install"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "HTML Document"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayVersion" = "32.0.1709.113"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCR\.xht\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mms" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationName" = "Amigo"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".shtml" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"VersionMajor" = "1709"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ReinstallCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --make-default-browser"

[HKCU\Software\Amigo]
"InstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationDescription" = "Amigo is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Amigo."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"smsto" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Amigo\Commands\install-extension]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --limited-install-from-webstore=%1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"HideIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --hide-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"news" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".htm" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe --uninstall"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"IconsVisible" = "1"

[HKCU\Software\Amigo]
"InstallerError" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 4C F8 50 93 15 C5 F9 4C F3 A5 0A 18 E3 C3 BF"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"InstallDate" = "20150202"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Amigo"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"https" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCR\AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"Guid" = "{4462796E-E605-40B7-B0C6-5AF8B44B9AB3}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"urn" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}\LocalServer32]
"ServerExecutable" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Amigo]
"oopcrashes" = "1"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"stage" = "1"

[HKCR\.xhtml\OpenWithProgids]
"AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Amigo\Commands\install-extension]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mailto" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"irc" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"nntp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"Publisher" = "Mail.Ru"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Amigo]
"InstallerExtraCode1" = "9"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\Default User\Application Data"

[HKCU\Software\Amigo\Commands\install-extension]
"RunAsUser" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\amigo.exe]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"NoModify" = "1"

[HKCU\Software\Amigo]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xht" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29161}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"DisplayName" = "Amigo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"NoRepair" = "1"
"Version" = "32.0.1709.113"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"webcal" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"ftp" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Amigo]
"lang" = "en"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ShowIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --show-icons"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amigo]
"VersionMinor" = "113"

[HKCU\Software\Amigo\Commands\install-extension]
"SendsPings" = "1"

[HKLM\SOFTWARE\RegisteredApplications]
"Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = "Software\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"sms" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"amigo" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Amigo]
"ap"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"InstallResult"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Amigo]
"InstallerExtraCode1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process AmigoDistrib.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B 53 D7 C4 39 0B 5D A6 13 EE 47 59 7E 9F B7 5A"

[HKCU\Software\Mail.Ru\AmigoInstaller]
"RFR" = "openpart"

The process amigo.exe:884 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\.html]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Classes\https\shell]
"(Default)" = "open"

[HKCU\Software\Classes\.shtml]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Classes\http\shell]
"(Default)" = "open"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Classes\http]
"URL Protocol" = ""

[HKCU\Software\Classes\https]
"URL Protocol" = ""

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\.xhtml]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.xht]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.htm]
"(Default)" = "AmigoHTML.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 1D 9F 75 FE A2 FB 7A 0A 27 87 18 B5 B7 E3 A0"

[HKCU\Software\Amigo]
"usagestats" = "0"

[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Classes\ftp]
"URL Protocol" = ""

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe,0"

[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "Amigo.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe -- %1"

The process MailRuUpdater.exe:1984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 F4 F5 BC E9 CD 70 7E CE 81 5C 15 5C DF EC 89"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\3F6E7703242F44229E83F23D32F0B59C,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{81474A52-AF24-448D-BAF4-05EFAE62B260}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Mail.Ru\Updater]
"IconsConvertation" = "1"

[HKCU\Software\Mail.Ru\Tech\ptls\{A12C4AB1-F4D0-4771-8C21-613E9D12491F}\ch]
"gdup" = "LlyYT03/qx vUgo0O6evFTcBnV5X6pcJog1NZ2f/v11XfPY/b8ecM5s5dVIbkY9lVX//IFTdimfdciAXEIGOcC8Ngl9O6upf8F8GMz2Ur0VaSNgCH4fpX/lPPzQ8tf8dU3/2LifEmm7SfzxUQ8nPOwd56z4NiMl zmhiXB2JiGKo9A=="

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process MailRuUpdater.exe:800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"ShowSearchSuggestions" = "1"

[HKCU\Software\Mail.Ru\Tech\ptls\{4519D3B5-465C-4AE2-A905-960CA7D5385C}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCEQPPctMIjJY8djJwwNn497RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKCU\Software\Mail.Ru\Tech\ptls\{0ED2394C-62B6-4A80-A342-C2CA0B2A4E82}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Mail.Ru\Tech\ptls\{8DC7BF6A-58F3-4740-B600-34E37FFADC21}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ie" = "1"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"SuggestionsURL" = "http://suggests.go.mail.ru/ie8?q={SearchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Tech\ptls\{603A8599-628C-4F00-A940-A09F1583A23E}]
"RUNID" = "10"

[HKCU\Software\Mail.Ru\Tech\ptls\{C74622AC-AC0B-44E5-BDC2-EE39A5FD9EC9}]
"RUNID" = "10"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"URL" = "http://go.mail.ru/search?q={SearchTerms}&fr=ntg"

[HKCU\Software\Mail.Ru\Tech\ptls\{4C1D0C36-25B2-4774-80E8-DAE1E7898A1A}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCEQPPctMIjJY8djJwwNn497RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{81474A52-AF24-448D-BAF4-05EFAE62B260}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{FFEBBF0A-C22C-4172-89FF-45215A135AC7}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Mail.Ru\Tech\ptls\{4C1D0C36-25B2-4774-80E8-DAE1E7898A1A}]
"RUNID" = "10"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"FaviconURLFallback" = "http://go.mail.ru/favicon.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"CH" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 7E 9D E4 10 9D E5 EA 75 BD 7E B3 51 00 9A 13"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Mail.Ru\Tech\ptls\{E60E6A0E-4092-4965-85BB-AA1ED8EBBC8E}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCEQPPctMIjJY8djJwwNn497RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ff" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"DisplayName" = "Поиск@Mail.Ru"

[HKCU\Software\Mail.Ru\Tech\ptls\{4519D3B5-465C-4AE2-A905-960CA7D5385C}]
"RUNID" = "10"

[HKCU\Software\Mail.Ru\Tech\ptls\{B63A6D16-4F50-47C2-9BF7-A5D6E79C9EFD}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCEQPPctMIjJY8djJwwNn497RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ie"

[HKCU\Software\Mail.Ru\Tech\ptls\{E60E6A0E-4092-4965-85BB-AA1ED8EBBC8E}\ch]
"gdup"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"Deleted"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ff"
"ch"

[HKCU\Software\Mail.Ru\Tech\ptls\{B63A6D16-4F50-47C2-9BF7-A5D6E79C9EFD}\ch]
"gdup"

The process MailRuUpdater.exe:816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"Publisher" = "Mail.Ru"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"DisplayName" = "Служба автоматического обновления программ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMinor" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMajor" = "1"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru]
"MailRuUpdater.exe" = "Mail.Ru updater"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 8E 61 AF 28 18 D6 3B 12 57 BB 72 62 87 BD 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]

The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
a78c7f8b1b8ab73ea2352ee532e1e304
24135436763ff57cb8e37963cc6f4c25
6f2586d491b36778eff9d9d74cfaa644
be467e901c3c20cbc49e61abf87b65c1
3c6e30aedf6a105a0dbda8c388eea0c0
02f693c7cff9bfd6acdda37488b523f8
ba46066887ade1d23e6dce17ff680162
d6e606dc2a6acf08130e9199edb742d3

URLs

URL	IP
hxxp://7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai/api
hxxp://moscow.cdnmail.ru/AmigoDistrib.exe
hxxp://mrb.mail.ru/update/2/version.txt?ver=32.0.1709.113&v_extsnion=0.14.85&kind=amigo&ds=m&BID={4462796E-E605-40B7-B0C6-5AF8B44B9AB3}&rfr=openpart&type=install	94.100.180.127
hxxp://horses.alllinkers.ru/v_install?sid=13290&guid={4462796E-E605-40B7-B0C6-5AF8B44B9AB3}&sig=dd88cc99332266cc999933bbcc222211bb881155aa44bbff882277bb5522bbcc&ovr=0&amigo=1&aux=6262	94.242.246.242
hxxp://amigobin.cdnmail.ru/AmigoDistrib.exe	94.100.180.110

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 158

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.-....1D...>d.6....i...\

"..Y.)'.0G"[email protected]...%..YH...... <.......;\.....9......0Y.(]aL.jm..Z.Xl/...

7...dA...C..........z.qI-.)...q.....mb.......|4.
HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Mon, 02 Feb 2015 17:36:52 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17
7...x......0...^.... .$|..pu..]9.0..K.:3uDj..XQ.:.*...Rv?MF...1....

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 853

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}TYo.8.. ..R..H.....
.G.F.M..EAI..
%jIZ.Q......(.......

.)../S!eU..(.\...X.....B.L...G4E..E.H..#.....G.)..jQ..<..V#..d.4..68/..K.8._....c)..`.HYQ.<............X....Y...[..S<.4....>......"....%_D._dn.8Q...H.f.-..".rx9b.!D.f.....y.C..Z..Z/.h.%.......o."...Fk.p.\P~Y....I.....)....)YSa.Y.)K..^p.....L...j..L9..L...Z.w9.....fV.~........=......7..99....s.9.&=)D|f......n:sS.1...).P)...u.NX(.....!.9..{...V.f.N
..\..z5.......x?n..>.%.I...j}..q....g...{.X.L........A|R.4Z...N.......y0...5...#.......$M(Y

EV.y%.=k. ...}W...HN..[..... ..j.v....6..ukj . [\.*I..S.'..R......w..89..z.........h...W.`" .n..`.V.\.<..&l.a9...$..".[o.......nCVZ..-c...3...;c.g5..x.
r..MY."g........{.7._=@o& ....T6.....#...;....HhRUI.Q.|.'.`........B.h.mxa4.....Jh... [email protected]...{^...9^.u..,.,f..<-r......e..)ey!..IJ.0..p.6mp......-....$..K9.% ..fu#.20....m.@A.}.C!.M.,...../
..y
HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Mon, 02 Feb 2015 17:35:51 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17
....x.mS]o.0.. [email protected]...}9\.{..5>.BL|.
..."NVXDE..h....$a1.E.s.......Fk......V.c,H$ )"........x.....F%....v..
..=7`..n;VU.M./Y..6 .....e... ..]......NnT..9/....\.tqi.......p.C.....
..gU.9dm...j:.j3.`U.f........f..g......n...'.R....osu......{.......U.@
.f....e.....y..C.X..Cb1.......O...;r0....:. v......M|T..V...o.#.Gz....
[email protected]...:U.....{...........\..c..tV.!3.J..*
.n...'V....:W.....he.......X>..e7Ow..Vnl.xw3Q{m....M.CS<a.1.HD(B
..p.h..l}..-<#{..4...WO.>*....J.kM.9dxn..Y..q.N..(.Z.2.....w ...

GET /AmigoDistrib.exe HTTP/1.1

Host: amigobin.cdnmail.ru

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 02 Feb 2015 17:36:20 GMT

Content-Type: application/octet-stream

Content-Length: 50381352

Connection: keep-alive

Last-Modified: Fri, 26 Dec 2014 10:41:04 GMT

ETag: "549d3b40-300c228"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Vv..........
........*....`................0.......=.......7.....Rich..............
..............PE..L...I.>T.................6...v......p8.......P...
.@....................................................................
.....`?..x....p...t..............(....................................
........................................................text....4.....
..6.................. ..`.data... [email protected]
....t...p...v...:..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................DD..6D..$D...D..TD.....
.&A..6A..BA..TA..`[email protected]
B..xB...B...A...B...B...B...B...B...B...C...C..0C..>C..TC..dC..xC..
.C...C...C...C...C...C...A...@...@[email protected][email protected]
.......D......................I.>T........[...,...,.......{.8.A.6.9
.D.3.4.5.-.D.5.6.4.-.4.6.3.c.-.A.F.F.1.-.A.6.9.D.9.E.5.3.0.F.9.6.}....
.{.F.D.A.7.1.E.6.F.-.A.C.4.C.-.4.a.0.0.-.8.B.7.0.-.9.9.5.8.A.6.8.9.0.6
.B.F.}.....{.8.B.A.9.8.6.D.A.-.5.1.0.0.-.4.0.5.E.-.A.A.3.5.-.8.6.F
<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 849

Host: 7d8elkqrpz9cesw.xn--n1aaaglu5c.xn--p1ai

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8...BO)j.$%Q.........{..EQ..8fC.Z..............<3.3<sc^0N).|...U.....Re^.2.9mUQ...W............B..........R..Mp..w....d.
..... ..G.4......Gb}.....=B.,^..i..qAit..'.Q$..4.fIx. ..Y....wH....%..m2.o.....H...........t.1.f....T..KB)..M}]..U.u..Z....._.G.dq2~EX]..nA4.f.a.

r...x.AB..@7i.'Iu.Y...In..k...(.....t...X.nR..sF.//......y..k{...s.Lz....v....5~<k..Z.&..l...J.2YG,T..........=......a.{c./......Oe..nC........d....s...uA.B....0..d..9..^ g.....{p..q..5......3...iqaHV.5..A..>.......{!yF..T7............n^..?.A..Z..... ..5:n
.s......].y..

5Y..?.x.~'
.....N......^.B.'..C-.G..V.

VD..*........'7q....._.rJ.\....r..wF.-Y...l.#.{..|..c........A...........l......#...:;.A..R.......)0%v.......i2!..t.'.`......L.B...m.a.=..O..h..]/...l......`.....,S..)g).....`e..A.Z7"Z).UQ.(R..a..Gn.F0...%ooq]M.....b...m..L."/.M

Z.*.,ZX...X..DRVR..z..K...
HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Mon, 02 Feb 2015 17:35:50 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17
}...x...1..1.......w.v....XB.H.(...,..oJ.0.......n9.gt.*l...o.Ck...At.
....G.)....k?xN.......>......X...Z.....D ...

GET /update/2/version.txt?ver=32.0.1709.113&v_extsnion=0.14.85&kind=amigo&ds=m&BID={4462796E-E605-40B7-B0C6-5AF8B44B9AB3}&rfr=openpart&type=install HTTP/1.1

User-Agent: Amigo Setup

Host: mrb.mail.ru

Cache-Control: no-cache

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx/1.7.5

Date: Mon, 02 Feb 2015 17:37:08 GMT

Content-Type: text/html

Content-Length: 212

Connection: close
<html>..<head><title>503 Service Temporarily Unavail
able</title></head>..<body bgcolor="white">..<cen
ter><h1>503 Service Temporarily Unavailable</h1></ce
nter>..<hr><center>nginx/1.7.5</center>..</bod
y>..</html>....

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by <[email protected]>

SHA1 block transform for x86, CRYPTOGAMS by <[email protected]>

.EKSWU

DlSHA512 block transform for x86, CRYPTOGAMS by <[email protected]>

Montgomery Multiplication for x86, CRYPTOGAMS by <[email protected]>

FtPS

6-9'6-9'

$6.:$6.:

*?#1*?#1

>8$4,8$4,

AES for x86, CRYPTOGAMS by <[email protected]>

<0|1<:}-

<0|9<:}5

8%u(j

 FTPj

F\ FTP

><%uB

t.Jx 

w%s( 

j.Yf;

_tcPVj@

.PjRW

f;F.se

?sqliu

 2 34 567

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

KERNEL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

ntdll.dll

kernel32.dll

C:\trunk\SputnikLib/process_enumerate.hpp

boost::iequals( pEntry.szExeFile, process_name ) == true

path_name before converting %s

path_name after converting %s

C:\trunk\CommonFiles/file_util.h

C:\trunk\CommonFiles/Install_stat.h

C:\trunk\CommonFiles/sql_lite_bind.hpp

mailru::sqlite_bind::column_string

mailru::sqlite_bind::column_blob

mailru::sqlite_bind::column_byte_length

mailru::sqlite_bind::column_blob_as_string

startup_urls

..\CommonFiles\chromium_settings.cpp

hXXp://mail.ru

hXXp://VVV.mail.ru

browser.show_home_button

session.restore_on_startup

yandex\.ru. clid

mailru::chromium::settings::search_url

chrome_settings_overrides

search_url

template_url_data

mailru::chromium::settings::search_url_without_extensions

@MAIL.RU

suggestions_url

suggestions_url_post_params

windows-1251

keyword

mail.ru

D15371FE-C188-4E99-9841-A91F3BCBCCC3

search_terms_replacement_key

search_url_post_params

favicon_url

hXXp://go.mail.ru/favicon.ico

image_url

image_url_post_params

instant_url

instant_url_post_params

originating_url

alternate_urls

default_search_provider_data.template_url_data

suggest_url

default_search_provider.name

default_search_provider.search_url

go.mail.ru

keystore_encryption_bootstrap_token

.*yandex\.ru. clid.*

chrome_url_overrides

chrome-extension://

hXXp://mail.ru/cnt/9824

mail.ru

extensions.settings.

mailru::chromium::settings::url_from_ext_id

extensions.known_disabled

error %s

hXXp://xml.binupdate.mail.ru/guard/mrids.mrdj?

update_url

.enabled

hXXp://mailruupdater.cdnmail.ru/check_policy.amg?

check_policy.amg not loaded

check_policy.amg NOT decoded

check_policy.amg NOT parsed

C:\trunk\SputnikLib/reg_key.hpp

hXXp://VVV.mail.ru/cnt/7861

hXXp://agent.mail.ru/ru/download/agent_windows/download.html?sputnik=1

hXXp://img.imgsmail.ru/r/agent/favicon.ico

hXXp://mail.ru/cnt/10445

hXXp://VVV.mail.ru/

hXXp://go.mail.ru/search?fr=ntg&q={SearchTerms}

hXXp://go.mail.ru/search?fr=ntg&q=

hXXp://m.mail.ru/cgi-bin/splash?opera=1

hXXp://VVV.mail.ru/cnt/5090

hXXp://go.mail.ru/search?q=%s&fr=ntg

@mail.ru

hXXp://suggests.go.mail.ru/ff3?q={SearchTerm}

hXXp://go.mail.ru/search_images?utf8in=1&q=%s&fr=oprtb

hXXp://go.mail.ru/favicon_images.ico

hXXp://go.mail.ru/search_video?utf8in=1&q=%s&fr=oprtb

hXXp://go.mail.ru/favicon_video.ico

hXXp://VVV.mail.ru/cnt/5091

hXXp://redir.opera.com/speeddials/mail.ru

hXXp://redir.opera.com/bookmarks/mail.ru

hXXp://go.mail.ru/search?q=%s&fr=opr11

hXXp://go.mail.ru/search?q={SearchTerms}&fr=ntg

hXXp://suggests.go.mail.ru/ff3?q={searchTerms}

hXXp://mail.ru/cnt/10226

hXXp://go.mail.ru/?pin=1

mailru::default_browser::find_executable

..\CommonFiles\default_browser.cpp

SHORTCUTS PROSEED ERROR: std exception = %s

C:\trunk\3party\ticpp/ticpp.h

..\CommonFiles\firefox_settings.cpp

mailru::firefox::settings::~settings

browser.startup.homepage

Profile%d

hXXp://go.mail.ru

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.defaulturl

keyword.URL

extensions.enabledAddons

mailru::firefox::settings::remove_media_viewer

browser.search.suggest.enabled

browser.search.useDBForOrder

yasearch.native_comps.hXXp://bar-widgets.yandex.ru/packages/approved/176/manifest.xml#smartbox.all.settings.searchName

Firefox

..\CommonFiles\Firefox_visual_bookmarks.cpp

mailru::firefox::visual_bookmarks::install

mailru::firefox::visual_bookmarks::download

urn:mozilla:item:

mailru::firefox::visual_bookmarks::localstore_rdf

chrome://browser/content/browser.xul#mailru_main_toolbar

(\s*app-profile\s \{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7\}\s rel%\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7\}\s \d )\s*.*

partner_new_url

partner_online_url

hXXps://xtnmailru.cdnmail.ru/go_ffvbm1_update.rdf

chrome://vbmail.ru/skin/vb-logo.png

extensions.autoDisableScopes

extensions.shownSelectionUI

mailru::firefox::enable_visual_bookmarks::PatchExtensionSqlite

mailru::firefox::enable_visual_bookmarks::PatchExtensionIni

mailru::firefox::enable_visual_bookmarks::PatchExtensionJson

updateURL

updateKey

optionsURL

aboutURL

iconURL

icon64URL

Mail.Ru

homepageURL

hXXp://sputnik.mail.ru/

{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

mailru::firefox::enable_visual_bookmarks::is_enabled

mailru::firefox::enable_visual_bookmarks::PatchFileTime

c:\trunk\sputniklib\auto_handle.hpp

..\CommonFiles\ie_settings.cpp

urls_to_restore_on_startup

c:/logging/state.log

web_data_ver

state_item::load_from_chromium_settings error = %s

save_google_state_task::do_task error : item_in_storage.file_serialize

SHORTCUT ParseArgumentsSendStatistics arg is switch = %s

SHORTCUT ParseArgumentsSendStatistics arg not reg ex match as url domain

SHORTCUT PATCH STATISTIC SENDED: br = %s, one_to_send = %s

chrome

firefox

opera

run_chrome

SHORTCUT WAS PATCHED: enemy_shortcut = %s, br = %s

SHORTCUT ERROR: e = %s

SECURE PATCH SHORTCUT ERROR: e = %d

NEXT TRY TO SAVE AFTER PATCH SHORTCUT ERROR: e = %s

LAST CHANCE TRY TO SAVE AFTER PATCH SHORTCUT ERROR: e = %s

URL SHORTCUT GetArgumentsFromCommandLine ERROR parse

SHORTCUT ERROR: shortcut_check_url::do_patch -> path_name.empty() !!!

SHORTCUT WAS PATCHED: enemy_url_shortcut = %s, br = %s

c:/logging/remote_task.log

, Remote tasks execution is started

RemoteTasksExecuter::init_tasks() leave

error occured during performing task = %s, error = %s

RemoteTasksExecuter::fetch_tasks !

URL = %s

Tasks decoded = %s

google chrome sync_enabled

ERROR google_blocked_mailru_extensions_base::ProceedExtensions std::exception %s !!!

..\CommonFiles\Tasks\TaskGoogleBlockedMailruSettings.cpp

ChromeVbmId

ChromeVbmArchive

Chrome

invalid map<K, T> key

ERROR: chrome_value is empty

..\CommonFiles\Tasks\TaskRestoreFFDse.cpp

hXXp://xml.binupdate.mail.ru/tasks/sg_settings.mrdj

black_list json is EMPTY for browesr = %s!

ProceedGoogleChrome patch prepared

ProceedGoogleChrome start patching

google_chrome constructed

state is %s

domen %s

matched %s

TaskStartGroupBlackList::ProceedGoogleChrome failed

ProceedGoogleChrome patch_util.set_was_patch(true);

ProceedGoogleChrome patched

ProceedFirefox is running

hXXp://go.mail.ru/?ffverfix=1&fr=ffverfix_sg

hXXp://go.mail.ru/?ieverfix=1&fr=ieverfix_sg

ConverterIconsFromInternetToAmigo.cpp

C:\trunk\SputnikLib/one_instance.h

mailru::reg_keyT<0>::check

mailru::reg_keyT<0>::throw_on_error

InternetProtection.cpp

mail.ru/cnt

cln10322/odnoklassniki.ru

hXXp://r.mail.ru/cln10322/odnoklassniki.ru

@Mail.Ru

hXXp://download.yandex.ru/bar/chrome/updates-vb.xml

hXXp://download.yandex.ru/bar/chrome/updates.xml

hXXp://download.yandex.ru/bar/chrome/updates-translate.xml

chrome-extension://deejpmlbpbmjecdbfhafkcjeknpnpngh/visual-bookmarks.html

C:\logging\MailRuUpdater_1.0.10.log

main.cpp

Started with cmd line

c:\trunk\mailruupdater\concrete_update_task.hpp

mailru::sqlite_bind::column_int64

SendBrowsersStatistic.cpp

updater::SendBrowsersStastic::send_urls_stat

c:\trunk\mailruupdater\SendBrowsersStatistic.h

updater::SendBrowsersStastic::BrowserData<class mailru::chromium::settings_amigo>::getDSEurl

updater::SendBrowsersStastic::BrowserData<class mailru::chromium::settings_mail>::getDSEurl

updater::SendBrowsersStastic::BrowserData<class mailru::chromium::settings_google>::getDSEurl

asio.misc

asio.misc error

C:\trunk\3party\boost_1_56_0\boost/exception/detail/exception_ptr.hpp

update_info.cpp

fetch_url

Program fetch url

md5 fetch url

cmd_line

util.cpp

YandexRemover.cpp

SHA-256 part of OpenSSL 1.0.0g 18 Jan 2012

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

SHA1 part of OpenSSL 1.0.0g 18 Jan 2012

SHA-512 part of OpenSSL 1.0.0g 18 Jan 2012

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

RSA part of OpenSSL 1.0.0g 18 Jan 2012

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

passed a null parameter

DSO support routines

x509 certificate routines

Stack part of OpenSSL 1.0.0g 18 Jan 2012

Big Number part of OpenSSL 1.0.0g 18 Jan 2012

lhash part of OpenSSL 1.0.0g 18 Jan 2012

ASN.1 part of OpenSSL 1.0.0g 18 Jan 2012

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

RAND part of OpenSSL 1.0.0g 18 Jan 2012

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

keylen <= sizeof key

EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)

%d.%d.%d.%d

EC part of OpenSSL 1.0.0g 18 Jan 2012

ECDSA part of OpenSSL 1.0.0g 18 Jan 2012

.\crypto\ec\ec_key.c

DSA part of OpenSSL 1.0.0g 18 Jan 2012

Diffie-Hellman part of OpenSSL 1.0.0g 18 Jan 2012

.\crypto\dh\dh_key.c

value.single

value.set

USER32.DLL

NETAPI32.DLL

ADVAPI32.DLL

keylength

keyfunc

EVP part of OpenSSL 1.0.0g 18 Jan 2012

.\crypto\pkcs12\p12_key.c

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

ECDH part of OpenSSL 1.0.0g 18 Jan 2012

priv_key

pub_key

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

<unsupported>

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:<unsupported>

X400Name:<unsupported>

othername:<unsupported>

CONF part of OpenSSL 1.0.0g 18 Jan 2012

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*s%s:

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

%d.%d.%d.%d/%d.%d.%d.%d

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

keyid

.\crypto\x509v3\v3_akey.c

d.usernotice

d.cpsuri

d.other

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

pubkey

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

x%s

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

cert_info

\X

'() ,-./:=?

CONF_def part of OpenSSL 1.0.0g 18 Jan 2012

[[%s]]

[%s] %s=%s

MD5 part of OpenSSL 1.0.0g 18 Jan 2012

PROXY_CERT_INFO_EXTENSION

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

certs

%s - d:d:d%.*s %d%s

AUTHORITY_KEYID

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

X.509 part of OpenSSL 1.0.0g 18 Jan 2012

X509_CERT_PAIR

X509_CERT_AUX

%s.dll

ddddddZ

ddddddZ

PEM part of OpenSSL 1.0.0g 18 Jan 2012

?456789:;<=

!"#$%&'()* ,-./0123

Verifying - %s

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

The repeat operator "*" cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator " " cannot start a regular expression.

Found a closing repetition operator } with no corresponding {.

Can't terminate a sub-expression with an alternation operator |.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

A regular expression can start with the alternation operator |.

Invalid alternation operators within (?...) block.

More than one alternation operator | was encountered inside a conditional expression.

Alternation operators are not allowed inside a DEFINE block.

A repetition operator cannot be applied to a zero-width assertion.

left-curly-bracket

right-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

boost::filesystem::directory_iterator::operator  

boost thread: trying joining itself

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Resource.cpp

<>"#%{}|\^~[] ?&@=:,

hXXp://

hXXps://

Path.cpp

version_info.cpp

logger.cpp

mailru::logging::execution_time_logger::~execution_time_logger

process_util.cpp

unzip.cpp

mailru::sqlite::database::database

sqlite.cpp

[%d][%d][d.d d:d:d]

thread.entry_event

thread.exit_event

mailru::http::request_headers::get_header

c:\trunk\sputniklib\http_downloader.h

HTTP/1.1

^HTTP/1.1 (\d ) (. )

mailru::http::response_headers::response_headers

mailru::http::response_headers::get_file_time

http_downloader.cpp

mailru::http::downloader_impl::connection_data_file::~connection_data_file

mailru::http::downloader_impl::handle_read_headers

mailru::http::downloader::fetch_file_attributes

HTTP error %2%: %3%

mailru::http::fetch_wstring_via_tempfile

is_admin.cpp

mailru::firefox_js_core::load_prefs_js

firefox_js.cpp

!"#$%&'(

)* ,-./0123

mailru::url_parser::init

url_parser.cpp

shortcut.cpp

Visual C   CRT: Not enough memory to complete call to strerror.

Operation not permitted

Inappropriate I/O control operation

Broken pipe

operator

GetProcessWindowStation

Line %d, Column %d

foreign_keys

SQLite format 3

3.7.11

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

sqlite_stat1

SQL logic error or missing database

unknown operation

large file support is disabled

RowKey

sqlite_detach

sqlite_attach

sqlite_version

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid<?)

%s (rowid>?)

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

c:\trunk\3party\ticpp\ticpp.h

ticpp.cpp

Type is unsupported

&#xX;

</%s>

%s="%s"

%s='%s'

<!--%s-->

<![CDATA[%s]]>

version="%s"

encoding="%s"

standalone="%s"

type="%s"

href="%s"

GetProcessHeap

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegCreateKeyExW

RegDeleteKeyW

RegEnumKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

ReportEventA

ADVAPI32.dll

FindExecutableW

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

WS2_32.dll

PSAPI.DLL

USERENV.dll

WTSAPI32.dll

VERSION.dll

CreateIoCompletionPort

GetCPInfo

ShellExecuteExW

CoInternetParseUrl

urlmon.dll

zcÁ

.?AVsettings@firefox@mailru@@

.?AVvisual_bookmarks@firefox@mailru@@

.?AV?$thread_data@V?$bind_t@XV?$mf0@XVRemoteTasksExecuter@mailru@@@_mfi@boost@@V?$list1@V?$value@PAVRemoteTasksExecuter@mailru@@@_bi@boost@@@_bi@3@@_bi@boost@@@detail@boost@@

.?AV?$thread_data@V?$bind_t@XV?$mf1@XVRemoteTasksExecuter@mailru@@ABV?$shared_ptr@VTaskInterface@mailru@@@std@@@_mfi@boost@@V?$list2@V?$value@PAVRemoteTasksExecuter@mailru@@@_bi@boost@@V?$value@V?$shared_ptr@VTaskInterface@mailru@@@std@@@23@@_bi@3@@_bi@boost@@@detail@boost@@

.?AVTaskOneTimeWithChromeAutorunPatch@mailru@@

.?AV?$_Ref_count@VRemoteTasksExecuter@mailru@@@std@@

.?AVwindows_file_codecvt@@

.?AVexception@sqlite@mailru@@

.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@

.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@

.?AV?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@

.?AV?$service_base@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@

.?AV?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@

.?AV?$service_base@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@

.?AVconnection_data@downloader_impl@http@mailru@@

.?AVconnection_data_file@downloader_impl@http@mailru@@

.?AVconnection_data_string@downloader_impl@http@mailru@@

.?AV?$_Ref_count@V?$vector@V?$basic_resolver_entry@Vtcp@ip@asio@boost@@@ip@asio@boost@@V?$allocator@V?$basic_resolver_entry@Vtcp@ip@asio@boost@@@ip@asio@boost@@@std@@@std@@@std@@

.?AV?$sp_counted_impl_p@Vdownload_limitation@downloader_impl@http@mailru@@@detail@boost@@

.?AV?$sp_counted_impl_p@Vconnection_data_file@downloader_impl@http@mailru@@@detail@boost@@

.?AV?$sp_counted_impl_p@Vconnection_data_string@downloader_impl@http@mailru@@@detail@boost@@

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

2(2.272>2`2

>=<6332-

?:97410"

;85&%$#!

/* 231'9:;

D.jn#k

üc5tFV

LLC Mail.Ru1

LLC Mail.Ru0

*hXXp://cs-g2-crl.thawte.com/ThawteCSG2.crl0

hXXp://ocsp.thawte.com0

Certification Services Division1806

#hXXp://crl.thawte.com/ThawtePCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

Thawte Certification1

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

.OA/;ZeF

Dr%X/

~.fj"

p>.kK

mÚ.E

-1g}I

uC?]t%Uh

% g .gT*_

%s,i4

j~%cX

.zTYo*

h?.wk

uecmdf

ir%Xd

ug.um

aLn%F.

ov~.SJ

Nhn,.XW[0

%2S$%G

.Tt6@

w;-cR}

\|.Jk

.pM**

.cSKK

.TN&L*y;

@`<.tN

ObÓ> 

%fgR}2

.Atf6

.GYC" 

RKI%x[

S=%D^r

>.ym^

.cbO9ld

C.iXy\$

".WSs

]f%s<q

.uhV)

$,.NN

h.krO

.Ig/'

Ag.gi

O:\"J

msgT'

N9.fN

c29.zi.

9L.HE

\R .wDuR

{Nù{*

Wq.vYZ

[email protected]

s(z%C

.wG;t

y%U?y

mL.JO

.Adtu

7.RTY

.IJsP

p\>7.CR

.PMs'.

qb=c..lX

=n X%XM*]

f.sM#

.ZT/X

kkT?%d

2D.uQ

{|.By

.ZWxs

.yaNg

.FbJP

'U.zjf8U?

.SsKJ

#.SC8K

.BCeZ

kX.EZ"

%x|N,f

A2=.cr3

L4#z`%UYL

NKd%2s)$E

/t8%f

.Ks#2

.pk"Q

Y.aJn

;D.PmTl

7sÔ

l|.iV

r0.CG

*.OW_I

.jpSSQ

B.QsA

%Sm1Z$_

e-.SQ

.NBU&

*(.wna

.JrOy

P.Cm|4!

d};s{v.bS4

Ql.vJ0

.MC _

:~.fK

y.Nzp[

R.Si^

Ó='

.ie6F

.g.bj

.Mw2%e/

rTj%F

O31%Xb

v~.UB

q.qoj

.gCiU

!P6:%u

.mH7L%

X0.bJn

EVc.uk

.uQbpc,

.PGs*GW

<%uP}

&%FNl8

z.PpTq

p%s&P

wìFf%S

,E%C 

.OLrCM^

hX.Ri

.hZOYQY$

%d?aY

]}yZ%c

S÷O

.PtYA

B.IDL-

:RM!U}%F

g.uGV

.FhJ?a

(G%X`

9.wK 1

,.pXa

/.LTM

L.YG.q3b

l.nBrb

P.Lku

gÿ<v

1=Bb/*>t

"fuDp

eZE.us

*".Wg

_.LW=

@\%0U

.SFi"

Cm.PT

A.QRL^

>..ci

`.ZtKt

Q.lET

Jy%XsA-

~.cVh

nB|exE:

MN1).xx

@.NN*

.WKKY

u.Wmf

YzC.Ri

JMk.Wt

=[hR%uD

K:\ A`D

.lGBt

J(B%C

P.in@

n?.EU

.yf"76

ûL)0%

I.phM,1P

_.BtO

2h%d"9<_

*F%s<IL

1n.Ab

e%Cwj%

x.MEIR

%DUo<

>d;.iY

D99.vI|/

.qTB_

'zB&%F

D2'.Ks

%cUA3

Lq.jb

%S!pnw

L %C<

>THo0"%d(

%fNC}=

-K}B;-0

5%xSSg

'<T.Ck

.beOV

|8dq%f

SqLM'

.Vw~%8

: L%uz|Y

0On%CZ

V.WGt

}uIg%S&

JoX.kQ

^.lA=

%sw|3}da@o`

0%UDd}

.Ig#|

QV7.Cs

?s!%X

d"">%F 

Y?.Es

.dLJ]

.aO_l

%D^w?

.lL"U

w.ayJ

9JtCP

b.hVP

E$/")%c

~2.xmc

]$[.ii

e".EI

D%xgT

.Jr9Q

@m.wG

 Zn.LZN

%FKDhM

k3:%s

h>.Oa:

.EM3_

!.Wq%

gN4.fy

D\%X:

.licB

#RsSHIz-

%U$$F

Ni.AI

1G.Dn

.XMeD

.lW@>A

Vq.Zy*F

=/355>*0

.Rd?9

s:\h:

^m.hL

.Cki'

of%s<

%s.SE

õ>lH

e(`ú

.MJ>:

%uV[n*

j%CPT

Ld5%cvE

LY6.FT

5.Wj?

.Ul\tq

.TH/Xf

.vy-J

MO).Gx.L,

.kv]b_

qU.fU

.CU.s

v.Wpd

.fog^GqFR

.}X.pI

uMSg

%s{5G

9x.cF>

3t.ltX

.eS]K

gb.BK

.YP&dS

A%%C 9

m.CGK

1.xZH-

b}D%x^-

@&im'Y%sG

z#.dJ

.rb(J)

-DpP}0

%x~z[N

d`X` Aù

B.wkciR

&j.dJO

O%x$=

%X*;V

.hfx6

K.Uwa9

r.iEBd:*g

U#;.bAU\

V.jRk/

sum[.Unj

0%XZ^2$_

.wM!"d

yN-S}~

uRl;n6n

,%C'^m

0q.qE^

.xq7:

õ%t

D-..PqT

6O%H.vK

>.vL|

1B.dc

.sHl\(?#

h'\.Ye

.rydp

k.Ch1

s}C7#%x!

).Tv8

.IL`B

V%d?@

.DR[<

g2wOq.xb

(.JeH

W%S[t

6t%f[

/R.ph

ntc.qt

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

6 6$6(6,6064686<6~7

2%3u3s5

3L4

9 9$9(9,9

4L4

77[9k:

?$?(?,?0?4?8?

4O4

8"8(848;8@8^8

8'9,91969

3 4%4*4/4

2&555&;8;

=1>6>;>@>

0'1,11161

?)?.?4?9?

00f0

=$=&>5>{>

3 3$3(3,3

8Ÿ9R9Y9^9w9

4]5

3O8W8

2 2f2x2

6r7F7i7~7

8%8s9

5 61676`6

;!;';1;7;

?%? ?>?{?

6%6x6

: :$:(:,:

; ;$;(;,;0;4;8;

8$8,848<8|8

3<3T3b3t3

4(4,4044484<4

: :(:[:{:

1/3

0,0004080

2/2

<4=8=<=@=

= =$=(=,=

7 7$7(7,7074787

; ;$;0;@;

> >$>(>,>0>4>8><>

4 4$4(4,4044484<4@4

5 5$5(5,505

=(=0=<=`=

1,181@1`1

7(747<7\7

<$<,<8<\<

6 6@6\6`6

< <4<<<\<

:$:,:8:\:

manifest.json

URLS

Advapi32.dll

common_process.exe

praetorian.exe

qipguard.exe

BrowserManager.exe

BrowserManagerGUI.exe

%1%version.txt?type=%2%&GUID=%3%&rfr=%4%

&%1$=%2%

sqlite3_reset

sqlite3_exec

Web Data

chrome.exe

select k.url from meta m, keywords k where m.key='Default Search Provider ID' and m.value=k.id

select id, short_name from keywords where url like '%go.mail.ru%' COLLATE NOCASE

No go.mail.ru in chromium

WHERE key='Default Search Provider ID'

sSELECT id FROM keywords WHERE keyword = 'mail.ru' COLLATE NOCASE

DELETE FROM keywords WHERE short_name = '@MAIL.RU'

SELECT * FROM keywords

ALTER TABLE keywords ADD COLUMN alternate_urls VARCHAR DEFAULT ''

ALTER TABLE keywords ADD COLUMN search_terms_replacement_key VARCHAR DEFAULT ''

INSERT INTO keywords

id, short_name, keyword, favicon_url, url, show_in_default_list, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid

@Mail.Ru','go.mail.ru','hXXp://go.mail.ru/favicon.ico','hXXp://go.mail.ru/search?q={searchTerms}&fr=ntg',1,1,'',1333701777,0,'windows-1251','hXXp://suggests.go.mail.ru/ff3?q={searchTerms}',%PREPOPULATE_ID%,0,'',0,'03095DE3-A6E7-4793-A20C-399A0F4A92E1'

UPDATE keywords SET short_name = '

@Mail.Ru', keyword = 'go.mail.ru', favicon_url = 'hXXp://go.mail.ru/favicon.ico', url = 'hXXp://go.mail.ru/search?q={searchTerms}&fr=ntg%RFR%',show_in_default_list = '1' WHERE id = '%ID%'

SELECT id , prepopulate_id FROM keywords WHERE keyword = 'go.mail.ru' COLLATE NOCASE

SELECT id , prepopulate_id FROM keywords WHERE keyword = 'mail.ru' COLLATE NOCASE

SELECT id, prepopulate_id FROM keywords

' WHERE key = 'Default Search Provider ID'

' WHERE key = 'Default Search Provider ID Backup'

SELECT value FROM meta WHERE key = 'version'

select * from keywords

UPDATE keywords SET suggest_url = '%SUGGEST_URL%' WHERE keyword like '%mail.ru%'

%SUGGEST_URL%

4Google Chrome

Google/Chrome/User Data/Default

Google/Chrome/Application/chrome.exe

Software/Google/Chrome/BLBeacon

s^(chrome-extension://)?(\w{32})?/?

Software/Google/Chrome/Extensions

update.exe

Software/Microsoft/Windows/CurrentVersion/Run

Sync Data Backup/SyncData.sqlite3

hXXps://clients2.google.com/service/update2/crx

zMail.Ru\Tmp

{A12C4AB1-F4D0-4771-8C21-613E9D12491F}

{1079004F-E4EF-4A44-9D1F-7C9CE09CE258}

{901B414B-72A2-48C6-8DCD-29388B8B3E40}

{0ED2394C-62B6-4A80-A342-C2CA0B2A4E82}

{E60E6A0E-4092-4965-85BB-AA1ED8EBBC8E}

{ADAC3638-040C-498C-845A-F89B99705444}

{4519D3B5-465C-4AE2-A905-960CA7D5385C}

{F581DE96-9AA1-45C8-8335-B7445525371A}

{DCEF19BB-AB61-48F4-A7CB-6D677D90D1C2}

{B63A6D16-4F50-47C2-9BF7-A5D6E79C9EFD}

{11A1974E-9BEF-4B50-8E2F-9F25FC775BD1}

{603A8599-628C-4F00-A940-A09F1583A23E}

{C74622AC-AC0B-44E5-BDC2-EE39A5FD9EC9}

{ABCAA0D8-A892-481F-9492-ACC63768F659}

{8DC7BF6A-58F3-4740-B600-34E37FFADC21}

{4C1D0C36-25B2-4774-80E8-DAE1E7898A1A}

{96AF929E-B8EB-499E-99A8-095E4262BE26}

{027940D4-10B8-43B6-9707-A4EE47618E1D}

chrome-extension://clpdgmdkdnijjbgmnajolnbnjejoeogm/visual-bookmarks.html

chrome-extension://hcncjpganfocbfoenaemagjjopkkindp/visual-bookmarks.html

chrome-extension://jaocgokledfmfebefgbeokdodbbdjhdd/visual-bookmarks.html

chrome-extension://dhngkpgdbpbkopndlpkicfaiffphdkbo/visual-bookmarks.html

)Software/AppDataLow/Software/Mail.Ru/IE_Bar

Software/Mail.Ru/IE_Bar

Software/Mail.Ru/Updater

Software\Mail.Ru\Flags

SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall

SOFTWARE/Microsoft/Windows/CurrentVersion/Run

SOFTWARE/Mail.Ru

{09900DE8-1DCA-443F-9243-26FF581438AF}

{58810E75-E249-44C6-B989-11D227263E24}

{91397D20-1446-11D4-8AF4-0040CA1127B6}

{95289393-33EA-4F8D-B952-483415B9C955}

hXXp://mrds.mail.ru/update/2/

hXXp://suggests.go.mail.ru/ie8?q={SearchTerms}

{FFEBBF0A-C22C-4172-89FF-45215A135AC7}

Mail.Ru

iexplore.exe

{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}

{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}

firefox.exe

opera.exe

SOFTWARE/Google/Chrome/Extensions

amigo.exe

nichrome.exe

browser.exe

Software/Mail.Ru/ChromeInstaller

hXXp://xml.binupdate.mail.ru/guard/update/version.xml

F777C640-57F8-4ECE-A40B-F571D25C2EFE

.html

launcher.exe

SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/Google Chrome

SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/Bromium

Software/Microsoft/Windows/CurrentVersion/Uninstall/Xpom

Software/Microsoft/Windows/CurrentVersion/Uninstall/{1B89BC31-F539-4EBD-B94F-C24705C73433}

Software/Microsoft/Windows/CurrentVersion/Uninstall/YandexBrowser

xpom.exe

Software/Microsoft/Windows/CurrentVersion/Uninstall/xpom

Software/Microsoft/Windows/CurrentVersion/Uninstall/Amigo

google chrome

Microsoft/Windows/Start Menu

Microsoft/Windows/

url_argument

key_arg

search-metadata.json

prefs.js

sessionstore.js

Mozilla/Firefox/profiles.ini

Mozilla/Firefox

Lsearch.json

Mozilla Firefox

mailru.xml

<SearchPlugin xmlns="hXXp://VVV.mozilla.org/2006/browser/search/" xmlns:os="hXXp://a9.com/-/spec/opensearch/1.1/">

@Mail.Ru</os:ShortName>

@Mail.Ru</os:Description>

<SearchForm>hXXp://VVV.mail.ru/</SearchForm>

<os:Url type="application/x-suggestions json" method="GET" template="hXXp://suggests.go.mail.ru/ff3?q={searchTerms}"></os:Url>

<os:Url type="text/html" method="GET" template="hXXp://go.mail.ru/search"><os:Param name="q" value="{searchTerms}"/>%PARAMS%%RFR%</os:Url>

extensions.ini

ini keys failed

extensions.json

extensions.json not parsed!

localstore.rdf

extensions.sqlite

Mail.Ru\Tmp\ffvisualbookmarks.7z

install.rdf

d.autoreg

extensions.rdf

extensions.cache

install_options.xml

@Mail.Ru

Mail.ru

Firefox

File: %s

pgo.mail.ru

FaviconURLFallback

SuggestionsURL

ie.reg

[-HKEY_USERS\

import

reg.exe

*.dll

Software/Mail.ru/Tech/ptls

Software/Mail.Ru/Guard

L.delay

WGoogle/Chrome/User Data

Google/Chrome/Application

Mail.Ru/mrst

Mozilla Firefox/firefox.exe

Internet Explorer/iexplore.exe

Opera/Opera.exe

Opera/Launcher.exe

Xpom/Application/chrome.exe

Amigo/Application/amigo.exe

Amigo/Application/ok.exe

ok.exe

Amigo/Application/vk.exe

vk.exe

Amigo/Application/run_chrome.exe

run_chrome.exe

go_internet.exe

odnoklassniki.ru

ok.ru

vk.com

hXXp://xml.binupdate.mail.ru/tasks/shortcuts.mrdj

hXXp://go.mail.ru/?sct=1

hXXp://r.mail.ru/n137257727

hXXp://r.mail.ru/n137257923

hXXp://r.mail.ru/cln10362/odnoklassniki.ru

enemy_url_shortcut

^(http[s]?:\/\/)?(www\.)?([\w\.-] )([:\/].*)?$

hXXp://xml.binupdate.mail.ru/tasks.mrdj?

Myahoo.com

webalta.ru

yambler.net

yafinder.com

XSoftware/Mail.Ru

hXXp://xml.binupdate.mail.ru/tasks/ext_settings.mrdj?

hXXp://xml.binupdate.mail.ru/sputnik/spmrids.mrdj?

n\bmail\.ru\b

WVVV.mail.ru

VVV.go.mail.ru

{61EB20A4-D4D5-4276-A2C9-DCCE8CE9F633}

{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}

qip.ru

MSoftware/Mail.ru/Tech/ptls

hXXp://go.mail.ru/?chverfix=1&fr=chverfix_sg

hXXp://go.mail.ru/search?q={SearchTerms}&ieverfix=1&fr=ieverfix_dse

MailRuUpdater.exe

Mail.Ru/MailRuUpdater.exe

rsqlite3_bind_text16

Software\Mail.Ru\ChromeInstaller

hXXp://go.mail.ru/search?q={searchTerms}&fr=mrch&fr3=

go.mail.ru/search

suggests.go.mail.ru

UPDATE keywords SET show_in_default_list = '1' WHERE keyword like '%mail.ru%'

delete from keywords

keywords

Local Storage/chrome-extension_jaocgokledfmfebefgbeokdodbbdjhdd_0.localstorage

SELECT * FROM ItemTable where key like '%url%'

(.*yandex\.ru. clid.*|.*soft.yandex.*)

UPDATE ItemTable SET value = ? WHERE key = ?

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Wamigo_tmp.exe

hXXp://binupdate.mail.ru/amigo/version2.xml

internetinstaller_tmp.exe

hXXp://binupdate.mail.ru/chrome/version3.xml

internetupdater_tmp.exe

hXXp://binupdate.mail.ru/chrome/version2.xml

0.0.0.0

inttoam_tmp.exe

hXXp://binupdate.mail.ru/chrome/internet_to_amigo.xml

28.0.1501.430

hXXp://binupdate.mail.ru/updater/version.xml

mailruupdater_tmp.exe

gC:\logging\MailRuUpdater_1.0.10.var2.log

SELECT last_visit_time FROM urls order by last_visit_time DESC LIMIT 1

URL :

amsg

last_chrome

ovr_chrome

STEP 1 : URL

STEP 3 : URL :

STEP 5 : URL

STEP 6 : IS GOOGLE CHROME INSTALLED

STEP 6.1 : IS GOOGLE CHROME HAS AN ERROR :

STEP 7 : URL

Google/Chrome/User Data/Default/History

%1% (%2%)

\StringFileInfo\xx

notepad.exe

0123456789 ,.

Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders

sAbsolutePath: <%s>

sqlite3_prepare16_v2

sqlite3_step

sqlite3

SQLite error %1% returned by %2%

SQLite error code %1%, file %2%

HTTP code %1%

SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/System

Incorrect firefox js file

stub.exe

Invalid url

mmscoree.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

portuguese-brazilian

888816666554443

6666554443

!6666554443

%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe

IDR_CHROME_MAILTABS

Mail.Ru updater

1.0.12.38

\Amigo\Application\amigo.exe

mscoree.dll

WUSER32.DLL

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1700
   %original file name%.exe:856
   setup.exe:900
   AmigoDistrib.exe:1088
   amigo.exe:884
   MailRuUpdater.exe:1984
   MailRuUpdater.exe:800
   MailRuUpdater.exe:816

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\{1129396A-B78B-42ED-8FCB-2D2A9B7C6BE2}\AmigoDistrib.exe (380715 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lt.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\delegate_execute.exe (9606 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-US.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ca.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ms.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bg.pak (1668 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-PT.pak (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\mr.pak (1748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ko.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pl.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\gcswf32.dll (108196 bytes)
   %Documents and Settings%\%current user%\Desktop\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\gu.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\el.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fr.pak (251 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe (7433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\et.pak (207 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ro.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\it.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nl.dll (8 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hr.pak (222 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fa.pak (1611 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\te.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\tr.dll (8 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nb.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es-419.pak (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\resources.pak (172310 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\de.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\master_preferences (982 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hu.pak (246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fi.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sv.pak (214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\de.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ja.pak (282 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\VisualElements\splash-620x300.png (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\he.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sw.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fi.pak (220 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\vk.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hi.pak (1754 bytes)
   %Documents and Settings%\%current user%\Desktop\Вконтакте.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\uk.pak (1648 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sv.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\te.pak (1805 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Amigo.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-TW.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\VisualElements\smalllogo.png (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\chrome_installer.log (972 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ru.pak (1642 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sl.pak (218 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\nacl64.exe (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_touch_100_percent.pak (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\tr.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es.pak (242 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ta.pak (1829 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bn.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\metro_driver.dll (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ko.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\icudt.dll (72365 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome.dll (283704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lv.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\et.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_100_percent.pak (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ar.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-BR.pak (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-CN.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\extensions\kgkggmpkealihpbjpdmcblcplljamohl.json (88 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\cs.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nb.pak (213 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\kn.pak (1815 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\id.pak (209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-BR.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ml.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ms.pak (214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\extensions\external_extensions.json (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fil.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\xinput1_3.dll (81 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\chrome.7z (1341364 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\ok.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\d3dcompiler_43.dll (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pl.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hi.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\id.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es-419.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\he.pak (266 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\pt-PT.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\mr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\master_preferences (982 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\amigo.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\kn.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\d3dcompiler_46.dll (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ta.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\el.pak (1699 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\vi.pak (263 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\agentloader.exe (115 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sk.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_frame_helper.exe (82 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_frame_helper.dll (55 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\vi.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\ffmpegsumo.dll (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\libegl.dll (107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\da.pak (213 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\mailruupdater.exe (45823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bn.pak (1769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\th.pak (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\nl.pak (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\da.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\nacl_irt_x86_32.nexe (42362 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ml.pak (3679 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\vk.exe (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ru.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\cs.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\ok.exe (140 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ca.pak (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hu.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ar.pak (314 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-TW.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\es.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lv.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\32.0.1709.113\Installer\setup.exe (7971 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fa.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\uk.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\secondarytile.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ja.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\lt.dll (8 bytes)
   %Documents and Settings%\%current user%\Desktop\Одноклассники.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sw.pak (215 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fil.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-US.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-GB.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\gu.pak (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sl.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\extensions\mailru_checker_1.2.3.crx (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sk.pak (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\VisualElementsManifest.xml (391 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\it.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_launcher.exe (178 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\VisualElements\logo.png (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\bg.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\hr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\th.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\chrome_child.dll (286042 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\en-GB.pak (195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\fr.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\MailRu\MailRuUpdater.exe (46100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\npchrome_frame.dll (15801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\wow_helper.exe (71 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\ro.pak (242 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\sr.pak (1636 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\nacl_irt_x86_64.nexe (28502 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\libglesv2.dll (6347 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\am.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\zh-CN.pak (192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\Locales\am.pak (323 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Temp\source900_16961\Chrome-bin\32.0.1709.113\ppgooglenaclpluginchrome.dll (1745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\SETUP.EX_ (1697 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\setup.exe (18208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_B1350.tmp\CHROME.PACKED.7Z (375522 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\debug.log (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\1.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\User Data\2.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MailRuUpdater.exe (913079 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (53570 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "amigo" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.