Trojan.Gozi.1020

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\AmigoHTML.64Z5SFRFTF737LDFDXUTS4QQ44\shell\open\command] '' = '"%LOCALAPPDATA%\Amigo\Application\amigo.exe" -- "%1"'
[HKLM\Software\Wow6432Node\Clients\StartMenuInternet\Amigo.64Z5SFRFTF737LDFDXUTS4QQ44\shell\open\command] '' = '"%LOCALAPPDATA%\Amigo\Application\amigo.exe"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'amigo' = '%LOCALAPPDATA%\Amigo\Application\amigo.exe --no-startup-window'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MailRuUpdater' = '%LOCALAPPDATA%\Mail.Ru\MailRuUpdater.exe'

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru] 'ImagePath' = '%ProgramFiles(x86)%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe --s'

Creates the following services

'Updater.Mail.Ru' %ProgramFiles(x86)%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe --s

Malicious functions

Injects code into

the following user processes:

amigo.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\amigo\user data\default\web data
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\amigo\user data\default\cookies
%LOCALAPPDATA%\amigo\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\cr_182c0.tmp\chrome.packed.7z
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\mail-large.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\start.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\mail-medium.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\start_custom.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\mail-small.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\music-large.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\search-form.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\music-medium.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\static.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\add-site.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\status.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\add-tile.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\drag-tile-arrow.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\hint-cross.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\horo-small.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\social-networks.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\share.css
%TEMP%\scoped_dir_1348_14227\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1348_12240\crx_install\css\tabs.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\moimir.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\music-player.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\lastfm\lastfm_grey_small.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\side-menu.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\music.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\sticky-header.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\messages.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\music-small.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\spinner.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\at-sign.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\reset.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\horo-large.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\extensions\horo-medium.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\scrollbars.css
%TEMP%\scoped_dir_1348_14227\crx_install\resources\background.js
%TEMP%\scoped_dir_1348_12240\crx_install\css\publishing.css
%TEMP%\scoped_dir_1348_14227\crx_install\resources\index.js
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\capricorn-dark.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\arrows\add-tile-arrow-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\options\controls.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\aquarius-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\options\icons.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\aquarius.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\options\layout.css
%LOCALAPPDATA%\amigo\user data\default\4fd4.tmp
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\aries-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\options\app.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\icons\error.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\arrows\popup-arrow-light.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\tray\menu.css
%TEMP%\scoped_dir_1348_12240\crx_install\img\cancel.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\cancer-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chrome_128.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\cancer.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chrome_16.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\tray\all.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\aries.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\icons\message.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\options\all.css
%HOMEPATH%\desktop\амиго.музыка.lnk
%TEMP%\scoped_dir_1348_14227\decoded_message_catalogs
%LOCALAPPDATA%\amigo\user data\default\46be.tmp
%WINDIR%\syswow64\grouppolicy\gpt.ini
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\arrows\add-tile-arrow-light.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\user-select.css
%LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\497d.tmp
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\arrows\popup-arrow-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\twitter.css
%TEMP%\scoped_dir_1348_14227\decoded_images
%APPDATA%\microsoft\windows\start menu\programs\amigo apps\амиго.музыка.lnk
%TEMP%\scoped_dir_1348_12240\crx_install\css\inject\login-bar.css
%LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\амиго.музыка.lnk
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\arrows\new-tile-arrow-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\inject\save-auth.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\hints\arrows\new-tile-arrow-light.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\virus.css
%LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\амиго.музыка.ico.md5
%TEMP%\scoped_dir_1348_12240\crx_install\css\tray\app.css
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\амиго.музыка.lnk
%TEMP%\scoped_dir_1348_12240\crx_install\css\loading.css
%TEMP%\scoped_dir_1348_7194\decoded_message_catalogs
%TEMP%\scoped_dir_1348_6334\crx_install\img\icon_options.png
%LOCALAPPDATA%\amigo\user data\default\cursession
%TEMP%\scoped_dir_1348_15469\crx_install\img\currency-arrow.png
%TEMP%\scoped_dir_1348_15778\decoded_images
%TEMP%\scoped_dir_1348_14659\decoded_images
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\close.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\icon_promo.png
%TEMP%\scoped_dir_1348_12240\crx_install\assets\sound\notifications\test.txt
%TEMP%\scoped_dir_1348_15469\crx_install\img\dots.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\maximize.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\logo.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\small-player-bg.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\icon_new_mess2.png
%TEMP%\scoped_dir_1348_15778\decoded_message_catalogs
%TEMP%\scoped_dir_1348_7194\decoded_images
%TEMP%\scoped_dir_1348_12240\crx_install\assets\sound\notifications\audio.txt
%TEMP%\scoped_dir_1348_6334\crx_install\img\icon_new_mess.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\icon_mails.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\arrows.png
%TEMP%\scoped_dir_1348_14659\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1348_12240\crx_install\virus.html
%TEMP%\scoped_dir_1348_15469\crx_install\img\boards-icon.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\maximized.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\placeholder3.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\folder_flag.png
%TEMP%\scoped_dir_1348_14659\decoded_message_catalogs
%TEMP%\scoped_dir_1348_12240\crx_install\assets\fonts\emojisymbols-regular.woff
%TEMP%\scoped_dir_1348_15469\crx_install\img\boards-panel-preview.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\icon_add.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\playlist.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\currency-arrow-light-rotated.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\flag_icon.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\placeholder2.png
%TEMP%\scoped_dir_1348_12240\crx_install\tray.html
%TEMP%\scoped_dir_1348_14227\crx_install\img\placeholder4.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\all.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\dropdown.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\mini.png
%TEMP%\scoped_dir_1348_6334\decoded_images
%TEMP%\scoped_dir_1348_15469\crx_install\img\search-cancel-button.png
%TEMP%\scoped_dir_1348_6334\decoded_message_catalogs
%TEMP%\scoped_dir_1348_12240\crx_install\css\errors.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\play.svg
%TEMP%\scoped_dir_1348_12240\crx_install\css\data-counter.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\collapsible.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\remove-tile-cross.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\search-crosses.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\instagram.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\player-fb.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\layout.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\player-ff.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\search.png
%LOCALAPPDATA%\amigo\user data\34d2.tmp
%TEMP%\scoped_dir_1348_12240\crx_install\css\facebook.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\feed.css
%TEMP%\scoped_dir_1348_12240\crx_install\css\localize.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\resize-full.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\currency-arrow-light.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\mail.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\app.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\drop-arrow-up.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\attachments.css
%TEMP%\scoped_dir_1348_6334\crx_install\img\mail_off.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\navigation-buttons.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\drag-arrows.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\pencil.png
%TEMP%\scoped_dir_1348_12240\crx_install\css\chat.css
%TEMP%\scoped_dir_1348_15469\crx_install\img\green-circle.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\no-int-big-black.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\no-int-big-white.png
%TEMP%\scoped_dir_1348_6334\crx_install\sound\5.ogg
%TEMP%\scoped_dir_1348_15469\crx_install\img\options-spritesheet.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\drop-arrow.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\buttons\minimize.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\status_icon.png
%TEMP%\scoped_dir_1348_771\crx_install\background.html
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\capricorn.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\my.mail.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\ok.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\otvet.mail.ru.png
%LOCALAPPDATA%\amigo\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\amigo\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\amigo\user data\default\extension state\log
%LOCALAPPDATA%\amigo\user data\default\extension state\000003.log
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\kissheart.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\puking.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\sad.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\sys.mail.ru.blog.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\sys.mail.ru.ideas.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\sys.mail.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\tanks.mail.ru_game_unity.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\laugh.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\mail.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\news.mail.ru.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\kitty.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\crying.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\sealed.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\facepalm.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\facebook.com.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\fotostrana.ru.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\grin.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\twitter.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\heart.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\dobro.mail.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\sf.mail.ru.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\hearteyes.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\ill.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\instagram.com.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\innocent.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\jira.mail.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\games.mail.ru.png
%LOCALAPPDATA%\amigo\user data\default\cache\f_000002
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\hugs.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\hr.corp.mail.ru_irj_portal.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chrome_48.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\sleepy.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\10.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\11.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\2.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\3.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\09a.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\10a.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\1.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\11a.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\07a.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\themes\themes__arrow-right.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\13a.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\14a.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\6.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\7.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\8.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\4.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\confluence.mail.ru.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\12a.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\devil.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\smiley.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\themes\themes__arrow-left.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\sun.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\surprised.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\vkontakte.ru.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\wf.mail.ru.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\wait.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\06a.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\wikipedia.org.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\08a.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\vk.com.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\winking.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\01.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\02.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\03a.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\04b.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\youtube.com.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\cool.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\themes\random.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\cloud.mail.ru.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\blushed.gif
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\chat_off.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\scorpio-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\fb.png
%LOCALAPPDATA%\amigo\user data\default\chromedwritefontcache
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\scorpio.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\chat.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\taurus-dark.png
%TEMP%\scoped_dir_1348_15778\crx_install\js\interface.js
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\chat_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\taurus.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\mm.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\mm_off.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\mm_off_press.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\mm_press.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\fb_off.png
%TEMP%\etilqs_zpncfephela45yq
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\fb_off_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\virgo-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\ok.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\sagittarius.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\gemini-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\hand.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\gemini.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\loading.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\leo-dark.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\leo.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\video_play.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\mark.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\sagittarius-dark.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\libra.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\mono_iconset.gif
%LOCALAPPDATA%\amigo\user data\57b2.tmp
%TEMP%\scoped_dir_1348_12240\crx_install\img\playpause.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\pisces.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\published.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\libra-dark.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\default_pic.jpg
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\pisces-dark.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\countersign.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\ok_off.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\ok_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\onboarding-arrow.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\active.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\close-dialog.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\onboarding-done.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\search-arrow.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\vk_off_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\menu-arrow.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\vk_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\search.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\sites.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\user-online.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\start.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\mm\angry.gif
%TEMP%\scoped_dir_1348_15469\crx_install\img\predefined\ask.fm.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\im_smile_cross.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\sites-arrow.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\profile.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\menu.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\horo\virgo.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\chat_off_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\amigo\icon128.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\qu.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\qu_press.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\share.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\tw.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\adding.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\ok_off_press.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\vk_off.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\amigo\icon16.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\tw_off_press.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\chrome\icon128.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\tw_press.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\vk.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\onboarding\adding-arrow.png
%LOCALAPPDATA%\amigo\user data\default\cache\f_000001
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\amigo\icon48.png
%TEMP%\scoped_dir_1348_12240\crx_install\img\buttons\tw_off.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\close_promo.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\placeholder1.png
%TEMP%\scoped_dir_1348_12240\crx_install\start_ok.html
%HOMEPATH%\desktop\вконтакте.lnk
%HOMEPATH%\desktop\одноклассники.lnk
%APPDATA%\microsoft\internet explorer\quick launch\amigo.lnk
%APPDATA%\microsoft\internet explorer\quick launch\вконтакте.lnk
%APPDATA%\microsoft\internet explorer\quick launch\одноклассники.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\одноклассники.lnk
%APPDATA%\microsoft\windows\start menu\programs\amigo.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\amigo.lnk
%APPDATA%\microsoft\windows\start menu\programs\вконтакте.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\вконтакте.lnk
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\вконтакте.lnk
%APPDATA%\microsoft\windows\start menu\programs\одноклассники.lnk
%LOCALAPPDATA%\amigo\application\mg.exe
%LOCALAPPDATA%\amigo\application\mm.exe
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\amigo.lnk
%HOMEPATH%\desktop\amigo.lnk
%LOCALAPPDATA%\amigo\application\vk.exe
%LOCALAPPDATA%\amigo\application\44.0.2403.111\installer\setup.exe
%LOCALAPPDATA%\amigo\application\amigo.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ta.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\te.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\th.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\tr.pak
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\одноклассники.lnk
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\uk.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\zh-cn.pak
%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\mailruupdater.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\zh-tw.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\secondarytile.png
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\visualelements\smalllogo.png
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\visualelements\splash-620x300.png
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\visualelementsmanifest.xml
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\vi.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\sv.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\sr.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\visualelements\logo.png
%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\unitywebplayer.exe
%TEMP%\etilqs_fslflhoevpqmj5p
%TEMP%\nsoa6ea.tmp\userinfo.dll
%LOCALAPPDATA%\amigo\user data\default\web data
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\mbipmajmbfjakbcfnjdldckninlnmhoe.crx
%LOCALAPPDATA%\amigo\user data\default\favicons-journal
%TEMP%\etilqs_grklfmzn6jh96er
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\hlnkhcccfccipjdgeddoifmlognfajdp.crx
%LOCALAPPDATA%\amigo\user data\default\history-journal
%TEMP%\etilqs_zhbdyrouaedrzrc
%LOCALAPPDATA%\amigo\user data\default\history
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\kgkggmpkealihpbjpdmcblcplljamohl.crx
%LOCALAPPDATA%\amigo\user data\first run
%LOCALAPPDATA%\amigo\user data\default\top sites-journal
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\diciddlabejpoaofdnmoamebeohoiobg.crx
%TEMP%\etilqs_15eokc1vnf34ujy
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\hfpahoblpjopcfnlokmndooidiinhiie.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\eeecheimdlkopnpajfcdmacgkjlkcmji.crx
%LOCALAPPDATA%\amigo\user data\default\favicons
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\egohihcbmlmdokfdoecjpdiadnkjgmdd.crx
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\sw.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\sl.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ru.pak
%TEMP%\nsoa6ea.tmp\utilsplugin.dll
%TEMP%\nsoa6ea.tmp\system.dll
%LOCALAPPDATA%low\unity\webplayer\unitybugreporter.exe
%LOCALAPPDATA%low\unity\webplayer\unitywebplayerupdate.exe
%APPDATA%\mailproducts\id
%LOCALAPPDATA%\amigo\user data\default\web data-journal
%TEMP%\nsea60f.tmp
%TEMP%\mrutmp.exe
%LOCALAPPDATA%low\unity\webplayer\loader\unitywebplayernp.map
%LOCALAPPDATA%low\unity\webplayer\loader\npunity3d32.dll
%LOCALAPPDATA%\unity\webplayer\uninstall.exe
%TEMP%\nsoa6ea.tmp\uac.dll
%LOCALAPPDATA%\mail.ru\mailruupdater.exe
%ProgramFiles(x86)%\mail.ru\mailruupdater\mailruupdater.exe
%ALLUSERSPROFILE%\mail.ru\id
%LOCALAPPDATA%low\unity\webplayer\loader\unitywebpluginax.ocx
%LOCALAPPDATA%low\unity\webplayer\loader\info.plist
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\sk.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ro.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\es-419.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\mg.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\mm.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\nacl64.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\ok.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\unitywebplayer.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\amigo_cr.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\chrome_child.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\mailruupdater.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\vk.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\44.0.2403.111.manifest
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\nacl_irt_x86_32.nexe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\nacl_irt_x86_64.nexe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\am.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\amigo_resources.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\wow_helper.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\extensions\external_extensions.json
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\pepperflash\manifest.json
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\nhhefclnfbjmnbbkhjplpnciolbbbdkd.crx
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ar.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\pepperflash\pepflashplayer.dll
%TEMP%\cr_182c0.tmp\setup.exe
%TEMP%\chrome_installer.log
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome.7z
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\natives_blob.bin
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\snapshot_blob.bin
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\icudtl.dat
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\xinput1_3.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\amigo.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\chrome.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\chrome_watcher.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\d3dcompiler_47.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\libegl.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\libexif.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\libglesv2.dll
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\metro_driver.dll
%TEMP%\cr_182c0.tmp\setup.ex_
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\chrome_elf.dll
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\9.png
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\bg.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\chrome_100_percent.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\it.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ja.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\kn.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ko.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\lt.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\lv.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\bn.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\id.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\hu.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\nb.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\nl.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\pl.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\pt-br.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\pt-pt.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\resources.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ml.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ms.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\ca.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\mr.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\delegate_execute.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\chrome_200_percent.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\cs.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\da.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\de.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\el.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\en-gb.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\he.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\hr.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\hi.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\et.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\fa.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\fi.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\fil.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\fr.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\gu.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\en-us.pak
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\44.0.2403.111\locales\es.pak
%TEMP%\scoped_dir_1348_15469\crx_install\img\weather\5.png
%LOCALAPPDATA%\amigo\user data\default\visited links
%LOCALAPPDATA%\amigo\user data\default\cache\index
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\lato-bold.woff
%TEMP%\scoped_dir_1348_12240\crx_install\save_auth.html
%TEMP%\scoped_dir_1348_14659\crx_install\resources\amigo.js
%TEMP%\scoped_dir_1348_14227\crx_install\img\16x16.png
%TEMP%\scoped_dir_1348_6334\crx_install\css\promo.css
%TEMP%\scoped_dir_1348_7194\crx_install\img\history_img.png
%TEMP%\scoped_dir_1348_7194\crx_install\img\main_icon.png
%TEMP%\scoped_dir_1348_12240\crx_install\share.html
%TEMP%\scoped_dir_1348_771\crx_install\resources\hint.js
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\lato-light.woff
%TEMP%\scoped_dir_1348_14659\crx_install\resources\injectsaveauth.js
%TEMP%\scoped_dir_1348_14227\crx_install\img\32x32.png
%TEMP%\scoped_dir_1348_7194\crx_install\img\recent.png
%TEMP%\scoped_dir_1348_6334\crx_install\css\popup_settings.css
%TEMP%\scoped_dir_1348_15778\crx_install\img\mail.png
%TEMP%\scoped_dir_1348_15778\crx_install\img\local_mail.png
%TEMP%\scoped_dir_1348_771\crx_install\images\icon_mail.png
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\lato-black.woff
%TEMP%\scoped_dir_1348_12240\crx_install\require-config.js
%TEMP%\scoped_dir_1348_6334\crx_install\sign.bin
%TEMP%\scoped_dir_1348_7194\crx_install\img\arrows_scroll.png
%TEMP%\scoped_dir_1348_15469\crx_install\css\main.css
%TEMP%\scoped_dir_1348_12240\crx_install\oauth.html
%TEMP%\scoped_dir_1348_15778\crx_install\img\share.png
%TEMP%\scoped_dir_1348_12240\crx_install\manifest.json
%TEMP%\scoped_dir_1348_14227\crx_install\fonts\glyphicons-halflings-regular.woff2
%LOCALAPPDATA%\amigo\application\ok.exe
%TEMP%\scoped_dir_1348_7194\crx_install\img\close.png
%TEMP%\scoped_dir_1348_6334\crx_install\css\popup_preview.css
%TEMP%\scoped_dir_1348_14227\crx_install\img\128x128.png
%TEMP%\scoped_dir_1348_14659\crx_install\oauth\oauth.html
%TEMP%\scoped_dir_1348_771\crx_install\images\icon_delta.png
%TEMP%\scoped_dir_1348_14659\crx_install\img\loading.gif
%TEMP%\scoped_dir_1348_771\crx_install\images\icon_bell.png
%LOCALAPPDATA%\amigo\user data\default\shortcuts-journal
%TEMP%\scoped_dir_1348_12240\crx_install\options.html
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\lato-regular.woff
%TEMP%\scoped_dir_1348_15778\crx_install\img\status.png
%TEMP%\scoped_dir_1348_7194\crx_install\img\recovery_img.png
%TEMP%\scoped_dir_1348_7194\crx_install\js\app.build.js
%TEMP%\scoped_dir_1348_771\decoded_message_catalogs
%TEMP%\scoped_dir_1348_14659\crx_install\resources\oauth_inject.js
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\opensans-regular.woff
%TEMP%\scoped_dir_1348_12240\crx_install\start_mm.html
%TEMP%\scoped_dir_1348_14227\crx_install\img\loading.gif
%LOCALAPPDATA%\amigo\user data\default\network action predictor
%TEMP%\scoped_dir_1348_771\decoded_images
%TEMP%\scoped_dir_1348_14227\crx_install\img\noname.png
%TEMP%\scoped_dir_1348_7194\crx_install\js\background.build.js
%TEMP%\scoped_dir_1348_6334\crx_install\img\arrow.png
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\ptm75f_w.woff
%TEMP%\scoped_dir_1348_14659\crx_install\resources\tw_authworker.js
%LOCALAPPDATA%\amigo\user data\default\login data
%TEMP%\scoped_dir_1348_15778\crx_install\js\background.js
%LOCALAPPDATA%\amigo\user data\default\login data-journal
%TEMP%\etilqs_jkhfgialzvt1gcr
%TEMP%\scoped_dir_1348_771\crx_install\images\icon_128.png
%TEMP%\scoped_dir_1348_15778\crx_install\css\main.css
%LOCALAPPDATA%\amigo\user data\default\shortcuts
%TEMP%\scoped_dir_1348_6334\crx_install\fonts\opensans-bold.woff
%TEMP%\scoped_dir_1348_12240\crx_install\sidebar.html
%TEMP%\scoped_dir_1348_14227\crx_install\img\48x48.png
%TEMP%\scoped_dir_1348_14659\crx_install\resources\injectsynclogin.js
%TEMP%\scoped_dir_1348_15778\crx_install\img\share_on.png
%LOCALAPPDATA%\amigo\user data\default\network action predictor-journal
%TEMP%\scoped_dir_1348_15778\crx_install\img\share_off.png
%TEMP%\scoped_dir_1348_6334\crx_install\fonts\opensans-regular.woff
%TEMP%\scoped_dir_1348_7194\crx_install\img\tm.png
%TEMP%\scoped_dir_1348_15778\crx_install\img\social.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\default_pic.jpg
%TEMP%\scoped_dir_1348_14659\crx_install\resources\master.js
%TEMP%\scoped_dir_1348_12240\crx_install\start.html
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\opensans-light.woff
%TEMP%\scoped_dir_1348_6334\crx_install\fonts\opensans-light.woff
%TEMP%\scoped_dir_1348_15469\crx_install\fonts\opensans-bold.woff
%TEMP%\scoped_dir_1348_12240\crx_install\sign.bin
%TEMP%\scoped_dir_1348_14227\crx_install\fonts\amigo-webfont.woff
%TEMP%\scoped_dir_1348_6334\crx_install\popup.js
%TEMP%\scoped_dir_1348_14659\crx_install\css\save-auth.css
%TEMP%\etilqs_xu4klwomeqrqs76
%LOCALAPPDATA%\amigo\user data\default\cookies
%LOCALAPPDATA%\amigo\user data\db1b.tmp
%LOCALAPPDATA%\amigo\user data\default\df70.tmp
%TEMP%\scoped_dir_1348_7194\nhhefclnfbjmnbbkhjplpnciolbbbdkd.crx
%TEMP%\ce48.tmp
%LOCALAPPDATA%\amigo\user data\default\df80.tmp
%LOCALAPPDATA%\amigo\user data\default\cookies-journal
%LOCALAPPDATA%\amigo\user data\safe browsing cookies
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.new
%LOCALAPPDATA%\amigo\user data\safe browsing cookies-journal
%TEMP%\etilqs_ibcxtou1fiqgq46
%TEMP%\c8ba.tmp
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg.new
%TEMP%\d32d.tmp
%TEMP%\ccd1.tmp
%LOCALAPPDATA%\amigo\user data\default\cache\data_0
%LOCALAPPDATA%\amigo\user data\default\cache\data_1
%LOCALAPPDATA%\amigo\user data\default\cache\data_2
%TEMP%\scoped_dir_1348_14659\eeecheimdlkopnpajfcdmacgkjlkcmji.crx
%TEMP%\scoped_dir_1348_14227\mbipmajmbfjakbcfnjdldckninlnmhoe.crx
%LOCALAPPDATA%\amigo\user data\default\cache\data_3
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.update
%TEMP%\scoped_dir_1348_15469\egohihcbmlmdokfdoecjpdiadnkjgmdd.crx
%TEMP%\scoped_dir_1348_15778\hfpahoblpjopcfnlokmndooidiinhiie.crx
%TEMP%\d1c3.tmp
%TEMP%\scoped_dir_1348_771\hlnkhcccfccipjdgeddoifmlognfajdp.crx
%TEMP%\d1e3.tmp
%TEMP%\scoped_dir_1348_6334\kgkggmpkealihpbjpdmcblcplljamohl.crx
%TEMP%\scoped_dir_1348_12240\diciddlabejpoaofdnmoamebeohoiobg.crx
%TEMP%\d271.tmp
%TEMP%\d0e8.tmp
%LOCALAPPDATA%\amigo\user data\default\top sites
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.update
%TEMP%\scoped_dir_1348_7194\crx_install\background.html
%TEMP%\scoped_dir_1348_15778\crx_install\manifest.json
%TEMP%\scoped_dir_1348_6334\crx_install\manifest.json
%TEMP%\scoped_dir_1348_12240\crx_install\changelog.md
%TEMP%\scoped_dir_1348_7194\crx_install\sign.bin
%TEMP%\scoped_dir_1348_771\crx_install\manifest.json
%LOCALAPPDATA%\mail.ru\mrst\1
%TEMP%\scoped_dir_1348_14227\crx_install\sign.bin
%TEMP%\scoped_dir_1348_771\crx_install\inject_script.js
%TEMP%\scoped_dir_1348_15778\crx_install\sign.bin
%TEMP%\scoped_dir_1348_12240\crx_install\incognito.html
%LOCALAPPDATA%\amigo\application\debug.log
%TEMP%\scoped_dir_1348_6334\crx_install\popup.html
%TEMP%\scoped_dir_1348_15469\crx_install\visual-bookmarks.html
%TEMP%\scoped_dir_1348_771\crx_install\sign.bin
%LOCALAPPDATA%\amigo\user data\default\1437.tmp
%TEMP%\scoped_dir_1348_7194\crx_install\css\index.css
%TEMP%\scoped_dir_1348_14227\crx_install\css\all.css
%LOCALAPPDATA%\amigo\user data\default\history.cp
%TEMP%\scoped_dir_1348_7194\crx_install\popup.html
%TEMP%\scoped_dir_1348_12240\crx_install\blank.html
%TEMP%\scoped_dir_1348_14227\crx_install\index.html
%TEMP%\scoped_dir_1348_6334\crx_install\background.html
%TEMP%\scoped_dir_1348_14659\crx_install\background.html
%TEMP%\scoped_dir_1348_12240\crx_install\background.html
%TEMP%\scoped_dir_1348_15469\crx_install\background.html
%TEMP%\scoped_dir_1348_14659\crx_install\sign.bin
%TEMP%\scoped_dir_1348_15469\crx_install\sign.bin
%TEMP%\scoped_dir_1348_14659\crx_install\css\login-bar.css
%TEMP%\scoped_dir_1348_14659\crx_install\manifest.json
%TEMP%\scoped_dir_1348_15778\crx_install\index.html
%TEMP%\scoped_dir_1348_6334\crx_install\background.js
%TEMP%\scoped_dir_1348_14227\crx_install\manifest.json
%TEMP%\scoped_dir_1348_7194\crx_install\manifest.json
%TEMP%\scoped_dir_1348_771\crx_install\background.js
%TEMP%\scoped_dir_1348_15778\crx_install\background.html
%LOCALAPPDATA%\amigo\user data\default\d3ab.tmp
%TEMP%\scoped_dir_1348_15469\crx_install\manifest.json
%TEMP%\scoped_dir_1348_12240\crx_install\img\chat\smileys\ok\15a.gif

Deletes the following files

%TEMP%\cr_182c0.tmp\setup.ex_
%TEMP%\scoped_dir_1348_6334\decoded_images
%TEMP%\scoped_dir_1348_14659\eeecheimdlkopnpajfcdmacgkjlkcmji.crx
%TEMP%\scoped_dir_1348_14659\decoded_message_catalogs
%TEMP%\scoped_dir_1348_14659\decoded_images
%TEMP%\scoped_dir_1348_6334\crx_install\img\mail_off.png
%TEMP%\scoped_dir_1348_7194\nhhefclnfbjmnbbkhjplpnciolbbbdkd.crx
%TEMP%\scoped_dir_1348_7194\crx_install\img\main_icon.png
%TEMP%\scoped_dir_1348_7194\decoded_message_catalogs
%LOCALAPPDATA%\amigo\user data\local state~rfb3590.tmp
%TEMP%\scoped_dir_1348_15778\hfpahoblpjopcfnlokmndooidiinhiie.crx
%TEMP%\scoped_dir_1348_15778\decoded_message_catalogs
%TEMP%\scoped_dir_1348_15778\decoded_images
%TEMP%\scoped_dir_1348_771\hlnkhcccfccipjdgeddoifmlognfajdp.crx
%TEMP%\scoped_dir_1348_771\decoded_message_catalogs
%TEMP%\scoped_dir_1348_7194\decoded_images
%TEMP%\scoped_dir_1348_771\decoded_images
%TEMP%\scoped_dir_1348_6334\decoded_message_catalogs
%TEMP%\scoped_dir_1348_14227\mbipmajmbfjakbcfnjdldckninlnmhoe.crx
%TEMP%\scoped_dir_1348_15469\egohihcbmlmdokfdoecjpdiadnkjgmdd.crx
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\amigo\icon48.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\amigo\icon16.png
%TEMP%\scoped_dir_1348_15469\crx_install\img\icons\amigo\icon128.png
%LOCALAPPDATA%\amigo\user data\default\secure preferences~rfb7c40.tmp
%LOCALAPPDATA%\amigo\user data\local state~rfb5a01.tmp
%TEMP%\scoped_dir_1348_14227\crx_install\img\128x128.png
%TEMP%\scoped_dir_1348_6334\kgkggmpkealihpbjpdmcblcplljamohl.crx
%TEMP%\scoped_dir_1348_14227\decoded_message_catalogs
%TEMP%\scoped_dir_1348_14227\decoded_images
%LOCALAPPDATA%\amigo\user data\default\extension data~rfb46fe.tmp
%TEMP%\scoped_dir_1348_14227\crx_install\img\48x48.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\32x32.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\16x16.png
%LOCALAPPDATA%\amigo\user data\default\secure preferences~rfb51f6.tmp
%TEMP%\scoped_dir_1348_15778\crx_install\img\share_off.png
%TEMP%\scoped_dir_1348_771\crx_install\images\icon_128.png
%LOCALAPPDATA%\amigo\user data\default\1437.tmp
%TEMP%\nsoa6ea.tmp\userinfo.dll
%TEMP%\nsoa6ea.tmp\uac.dll
%TEMP%\nsoa6ea.tmp\system.dll
%TEMP%\cr_182c0.tmp\setup.exe
%TEMP%\cr_182c0.tmp\chrome.packed.7z
%TEMP%\c8ba.tmp
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\wow_helper.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\unitywebplayer.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\ok.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\mm.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\mg.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\mailruupdater.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\amigo.exe
%LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\vk.exe
%TEMP%\ccd1.tmp
%TEMP%\nsoa6ea.tmp\utilsplugin.dll
%TEMP%\ce48.tmp
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg
%LOCALAPPDATA%\amigo\user data\default\history.cp
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.update
%TEMP%\d0e8.tmp
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.update
%TEMP%\d32d.tmp
%TEMP%\d271.tmp
%TEMP%\mrutmp.exe
%TEMP%\d1e3.tmp
%TEMP%\d1c3.tmp
%LOCALAPPDATA%\amigo\user data\local state~rfbacb2.tmp
%LOCALAPPDATA%\amigo\user data\default\extension data~rfbb885.tmp

Moves the following files

from %LOCALAPPDATA%\amigo\temp\source3040_6347\chrome-bin\visualelementsmanifest.xml to %LOCALAPPDATA%\amigo\application\visualelementsmanifest.xml
from %LOCALAPPDATA%\amigo\user data\default\secure preferences to %LOCALAPPDATA%\amigo\user data\default\secure preferences~rfb7c40.tmp
from %LOCALAPPDATA%\amigo\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\extension state\current
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfb5a01.tmp
from %LOCALAPPDATA%\amigo\user data\57b2.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\default\secure preferences to %LOCALAPPDATA%\amigo\user data\default\secure preferences~rfb51f6.tmp
from %LOCALAPPDATA%\amigo\user data\default\4fd4.tmp to %LOCALAPPDATA%\amigo\user data\default\secure preferences
from %LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\497d.tmp to %LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\амиго.музыка.ico
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfb46fe.tmp
from %LOCALAPPDATA%\amigo\user data\default\46be.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfb3590.tmp
from %LOCALAPPDATA%\amigo\user data\34d2.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg
from %LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg
from %LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg
from %LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg
from %LOCALAPPDATA%\amigo\user data\default\df80.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\default\df70.tmp to %LOCALAPPDATA%\amigo\user data\default\secure preferences
from %LOCALAPPDATA%\amigo\user data\db1b.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg
from %LOCALAPPDATA%\amigo\user data\default\d3ab.tmp to %LOCALAPPDATA%\amigo\user data\default\google profile.ico
from %LOCALAPPDATA%\amigo\temp\source3040_6347\chrome.7z to %LOCALAPPDATA%\amigo\application\44.0.2403.111\installer\chrome.7z
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfbacb2.tmp
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfbb885.tmp

Substitutes the following files

%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.new
%TEMP%\scoped_dir_1348_14227\crx_install\img\48x48.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\32x32.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\16x16.png
%TEMP%\scoped_dir_1348_14227\crx_install\img\128x128.png
%TEMP%\scoped_dir_1348_6334\crx_install\img\mail_off.png
%LOCALAPPDATA%\amigo\user data\local state
%TEMP%\scoped_dir_1348_7194\crx_install\img\main_icon.png
%TEMP%\scoped_dir_1348_15778\crx_install\img\share_off.png
%TEMP%\scoped_dir_1348_771\crx_install\images\icon_128.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg.new
%LOCALAPPDATA%\amigo\user data\default\history.cp
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg
%LOCALAPPDATA%\amigo\user data\default\extension data
%LOCALAPPDATA%\amigo\user data\default\secure preferences

Network activity

Connects to

'bs.###go.mail.ru':80
'mr##.mail.ru':80
'bi####ate.mail.ru':80
'ma######dater.cdnmail.ru':80
'xm#.###update.mail.ru':80
'clients2.google.com':443
'da##.#migo.mail.ru':80
'gs##tic.com':443
'tr######e.googleapis.com':443
'ma#l.ru':443
'r.##adx.net':443
'bs.yandex.ru':443

TCP

HTTP GET requests

http://bs.###go.mail.ru/update/2/version.txt?ve#################################################################################################
http://bs.###go.mail.ru/update/2/version.txt?ve##########################################################################################################################################
http://xm#.###update.mail.ru/friends.mrdj
http://xm#.###update.mail.ru/audit_config.mrdj
http://da##.#migo.mail.ru/config.amg?ve####################################################################################################################################
http://da##.#migo.mail.ru/state_policy.amg?ve##########################################################################################################################################
http://da##.#migo.mail.ru/check_policy.amg?ve##########################################################################################################################################
http://bi####ate.mail.ru/amigo/version2.xml?ma###################################################################################################################################################...
http://da##.#migo.mail.ru/force_update_policy.amg?ve#############################################################################################################################################...
http://bs.###go.mail.ru/update/2/version.txt?ve################################################################################################################################################
http://da##.#migo.mail.ru/state_policy.amg?ve#########################################################################################################################################
http://da##.#migo.mail.ru/config.amg?ve###################################################################################################################################
http://bs.###go.mail.ru/update/2/version.txt?ve##################################################################################################################################################...
http://bi####ate.mail.ru/chrome/version2.xml?ma##################################################################################################################################################...
http://xm#.###update.mail.ru/tasks.mrdj?ma#######################################################################################################################################################...
http://xm#.###update.mail.ru/cache_policy.mrdj
http://ma######dater.cdnmail.ru/updater_beta.exe
http://bi####ate.mail.ru/updater/version.xml?ma##################################################################################################################################################...
http://mr##.mail.ru/update/2/version.txt?ty######################################################################################################################################################...
http://da##.#migo.mail.ru/check_policy.amg?ve#########################################################################################################################################
http://ma#l.ru/cnt/1514499?gp######

Other

'clients2.google.com':443
'gs##tic.com':443
'ss#.#static.com':443
'tr######e.googleapis.com':443
'ma#l.ru':443
'li##.#mgsmail.ru':443
'rs.#ail.ru':443
'r.##adx.net':443
'bs.yandex.ru':443
'ma##.##dar.imgsmail.ru':443

UDP

DNS ASK bs.###go.mail.ru
DNS ASK bs.yandex.ru
DNS ASK b2.#ail.ru
DNS ASK an.#ail.ru
DNS ASK re###ma.mail.ru
DNS ASK r.##adx.net
DNS ASK li##.#mgsmail.ru
DNS ASK ad.#ail.ru
DNS ASK rs.#ail.ru
DNS ASK tr######e.googleapis.com
DNS ASK ma#l.ru
DNS ASK ss#.#static.com
DNS ASK gs##tic.com
DNS ASK da##.#migo.mail.ru
DNS ASK clients2.google.com
DNS ASK google.com
DNS ASK xm#.###update.mail.ru
DNS ASK ma######dater.cdnmail.ru
DNS ASK bi####ate.mail.ru
DNS ASK mr##.mail.ru
DNS ASK ma##.##dar.imgsmail.ru
DNS ASK xr##.mail.ru

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Amigo\User Data'

Creates and executes the following

'%TEMP%\cr_182c0.tmp\setup.exe' --install-archive="%TEMP%\CR_182C0.tmp\CHROME.PACKED.7Z"
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.14.1992542174\864401986" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.13.1182676060\1108648894" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.12.1824797648\1622964053" --lang=en-US --no-sandbox /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.10.639469536\1999603394" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_14227" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.11.2017318898\161181956" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_7194" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.9.744938488\1325435946" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_6334" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.8.1464307912\1720209718" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_771" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.7.33162731\204326574" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_15778" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=renderer --enable-deferred-image-decoding --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-pinch-virtual-viewport --en...
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.6.1138163210\29439400" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_15469" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.4.14000238\1318989798" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_12240" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=renderer --enable-deferred-image-decoding --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --devic...
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=gpu-process --channel="1348.0.750647950\189005723" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,22,45 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gpu...
'%ProgramFiles(x86)%\mail.ru\mailruupdater\mailruupdater.exe' --s
'%LOCALAPPDATA%\mail.ru\mailruupdater.exe'
'%LOCALAPPDATA%\amigo\application\amigo.exe'
'%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\mailruupdater.exe' --install
'%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\unitywebplayer.exe' /S
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.5.1924987237\949870164" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1348_14659" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1348.16.1347562854\880669336" --lang=en-US --no-sandbox /prefetch:-645351001

Executes the following

'%LOCALAPPDATA%\mail.ru\mailruupdater.exe' ' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial