Trojan.Gozi.1025

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\AmigoHTML.64Z5SFRFTF737LDFDXUTS4QQ44\shell\open\command] '' = '"%LOCALAPPDATA%\Amigo\Application\amigo.exe" -- "%1"'
[HKLM\Software\Wow6432Node\Clients\StartMenuInternet\Amigo.64Z5SFRFTF737LDFDXUTS4QQ44\shell\open\command] '' = '"%LOCALAPPDATA%\Amigo\Application\amigo.exe"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'amigo' = '%LOCALAPPDATA%\Amigo\Application\amigo.exe --no-startup-window'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MailRuUpdater' = '%LOCALAPPDATA%\Mail.Ru\MailRuUpdater.exe'

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Updater.Mail.Ru] 'ImagePath' = '%ProgramFiles(x86)%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe --s'

Creates the following services

'Updater.Mail.Ru' %ProgramFiles(x86)%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe --s

Malicious functions

Injects code into

the following user processes:

amigo.exe

Reads files which store third party applications passwords

%LOCALAPPDATA%\amigo\user data\default\web data
%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\amigo\user data\default\cookies
%LOCALAPPDATA%\amigo\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%TEMP%\cr_55880.tmp\chrome.packed.7z
%LOCALAPPDATA%\amigo\user data\default\chromedwritefontcache
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\active.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\taskbar\vk.ico
%TEMP%\scoped_dir_1172_12458\crx_install\img\taskbar\ok.ico
%TEMP%\scoped_dir_1172_12458\crx_install\img\taskbar\mm.ico
%TEMP%\scoped_dir_1172_12458\crx_install\img\taskbar\mg.ico
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\ok_logotype.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\error.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\ok_features_3.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\ok_features_1.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\networks_vk.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\networks_tw.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\networks_ok.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\networks_mm.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\networks_fb.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\mm_logotype.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\ok_features_2.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\mm_features_3.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\inactive.png
%TEMP%\scoped_dir_1172_27076\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\polyfills.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\options_redirect.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\notifications.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\localize-page.js
%TEMP%\scoped_dir_1172_12458\crx_install\img\virus\background.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\menu\play.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\menu\music.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\menu\pause.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\menu\open.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\menu\ff.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\menu\fb.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\message.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\mail.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\info.png
%TEMP%\scoped_dir_1172_27076\decoded_message_catalogs
%TEMP%\scoped_dir_1172_12458\crx_install\img\tray\icons\event.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\mm_features_2.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\mm_features_1.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\mm_connect.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\error.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\success.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\chrome\icon19.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\ok.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\chrome\icon128.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\mm.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\fb.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\tw.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\chrome\icon48.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\vk.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\close.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon16.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon128.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\volume.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\shuffle.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\repeat.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\publishing\collapse.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\showcase-placeholders\games\1.jpg
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\amigo.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\features.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start_custom\connect_button.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\showcase-placeholders\games\6.jpg
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\networks\vk.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\special\new-year\new_year_small.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\special\new-year\new_year_middle.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\special\new-year\new_year_big.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\networks\tw.png
%LOCALAPPDATA%\amigo\user data\612a.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\networks\ok.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\networks\mm.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\background.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\showcase-placeholders\games\5.jpg
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\networks\fb.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\showcase-placeholders\games\4.jpg
%TEMP%\scoped_dir_1172_27076\crx_install\img\showcase-placeholders\games\3.jpg
%TEMP%\scoped_dir_1172_12458\crx_install\img\start\logotype.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\showcase-placeholders\games\2.jpg
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\restore-tile-arrow-light.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon48.png
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\injectsaveauth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\audio-bg.js
%LOCALAPPDATA%\amigo\user data\default\extension state\000003.log
%LOCALAPPDATA%\amigo\user data\default\extension state\log
%LOCALAPPDATA%\amigo\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\amigo\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\amigo\user data\default\cache\f_000004
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\inherits.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\log
%LOCALAPPDATA%\amigo\user data\default\cache\f_000003
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\func.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\manifest-000001
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\eventer.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\emitter.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\date.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\dataparser.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\css.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\crypt.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\check.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\localstorage.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\metric\errorlogger.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\panelbutton.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\main.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\loader.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\app.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\notifications\notify.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\notifications\notifies.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\metric\staticdatapromise.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\notification.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\model.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\metric\description.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\uri.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\types.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\templates.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000003.log
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\strings.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\number.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\metric\metric.js
%LOCALAPPDATA%\amigo\user data\default\790e.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\audio.js
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\play.png
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\draggable.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\messagesbox.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\messages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\knockout.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\knockout-ext.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\knockout-bindings.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\i18n.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\unwrapao.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\spider.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\tabber.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\oauth\data.js
%TEMP%\etilqs_ib0p8gflz50nx0j
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\visibilitywatcher.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\sharing.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\oauth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\menu.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\oauth\item.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\array.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\loader.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\modalwindow.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\vk_link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\vk_hash.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\tw_user.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\tw_urls.js
%LOCALAPPDATA%\amigo\user data\default\cache\f_000002
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\tw_hash.js
%LOCALAPPDATA%\amigo\user data\default\cache\f_000001
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\smileys.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\ok_link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\hash.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\fb_hash.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace\exposed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\textareacounter.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\t.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\bindings\autoreplace.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\background\main.js
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\restore-tile-arrow-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\popup-arrow-light.png
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\shortcut.js
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\47a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\page-action\add.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\confluence.mail.ru.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\44a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\cloud.mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\ask.fm.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\page-action\disabled.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\facebook.com.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\page-action\added.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\42a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\sites.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\start.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\41b.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\40a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\39a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\38a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\46a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\37.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\comment.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\fotostrana.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\news.mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\jira.mail.ru.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\collapser.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\instagram.com.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\demo\start-icons.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\hr.corp.mail.ru_irj_portal.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\36a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\dobro.mail.ru.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\demo\connect-buttons.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\53a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\52a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\51a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\50a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\49a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\48a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\games.mail.ru.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\43a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\34a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\33a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\19a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\media-tile\media-arrow-left.svg
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\22a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\media-tile\hitech.svg
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\virgo.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\21a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\24a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\23a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\virgo-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\media-tile\media-arrow-right.svg
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\17a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\taurus-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\16a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\15a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\scorpio.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\20a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\taurus.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\26a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\search.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\my.mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\media-tile\media-arrow-old.svg
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\menu.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\32a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\search-arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\31a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\onboarding-done.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\30a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\onboarding-arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\29a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\menu-arrow.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\sites-arrow.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\adding.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\onboarding\adding-arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\28a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\media-tile\recipes-right.svg
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\27a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\media-tile\recipes-left.svg
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\error.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\favorite-sprite.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\7.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\sys.mail.ru.ideas.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\11.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\6.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\5.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\desktop-image.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\4.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\3.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\2.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\add-tile-arrow-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\8.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\9.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\vk.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\user.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\themes\themes__arrow-right.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\tw.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\ok.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\music.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\1.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\mail.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\popup-arrow-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\themes\themes__arrow-left.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\mm.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\pause.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\mute.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\ff.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\player\fb.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\vk.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\new-tile-arrow-light.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\tw.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\panel-image.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\new-tile-arrow-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\more-themes-arrow-light.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\ok.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\music.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\more-themes-arrow-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\mm.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\options\mg.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\arrows\add-tile-arrow-light.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\weather\10.png
%TEMP%\scoped_dir_1172_12458\crx_install\js\libs\utils\cache.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\panelbuttons.js
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\45a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\sys.mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\twitter.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\message.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\media.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\like.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\home.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\tanks.mail.ru_game_unity.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\wikipedia.org.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\vkontakte.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\wf.mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\sf.mail.ru.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\gt.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\feed_tools_ok.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\favorites.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\otvet.mail.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\ok.ru.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\sys.mail.ru.blog.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\youtube.com.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\error.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\themes\random.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\predefined\vk.com.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\social\vk.com.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\twitter.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\sidebar-close.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\settings.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\social\twitter.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\search.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\search-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\social\ok.ru.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\retweeted.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\social\my.mail.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\retweet.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\retweet-post.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\reply.png
%LOCALAPPDATA%\amigo\user data\default\51ed.tmp
%TEMP%\scoped_dir_1172_27076\crx_install\img\social\facebook.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\icons\rang.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\notifications\event.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\scrollbars.css
%TEMP%\scoped_dir_1172_12458\crx_install\js\options\socialnetwork.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\tweet\hashtag.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\stream.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\tweet\entities.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\chat\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\chat\engine.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\utils.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\twitter.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\tweet.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\tweet\url.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\tweet\media.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\friends.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\profile.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\networkmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\messenger.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\limits.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\instance.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\publishing.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\status.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\status.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\smileys.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\profile.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\news.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\networkmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\tweet\usermention.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\vkontakte.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\music.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\longpoll.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\instance.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\group.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\engine.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\auth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\messenger.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\authworker.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\auth2.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\groupalbum.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\basealbum.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\app.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\chat\stanza\recentconversations.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\chat\stanza\readsubscription.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\mediatopic.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\chat\stanza\readmark.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\chat\stanza\presence.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\chat\stanza\conversation.js
%LOCALAPPDATA%\amigo\user data\default\cache\f_000008
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\streamentities.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\status.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\smileys.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\profile.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\chat\stanza\readdialog.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\photo.js
%LOCALAPPDATA%\amigo\user data\default\a1d5.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\like.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\photos.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\present.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\music\track.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\post.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\photo.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\join.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\friendship.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\content.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\posts\base.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\music\syncplayers.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tw\auth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\music\injectsyncplayers.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\video.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\useralbum.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\text.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\present.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\entities\poll.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\app.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\audio.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\doc.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\graffiti.js
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\knockout\knockout-3.3.0.js
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\bootstrap\img\glyphicons-halflings.png
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\bootstrap\img\glyphicons-halflings-white.png
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\bootstrap\css\bootstrap.min.css
%LOCALAPPDATA%\amigo\user data\default\ac32.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\state-machine.min.js
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\jsonpath.js
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\require\require.js
%TEMP%\scoped_dir_1172_12458\crx_install\templates\vk\common.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\options\social-networks.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\options\common.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\options\chat.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\options\amigo.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\fb\common.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\vkontakte.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\virus.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\options\tray.html
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\require\text.js
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\require\tmpl.js
%TEMP%\scoped_dir_1172_12458\crx_install\vendors\zepto\zepto-1.0.js
%LOCALAPPDATA%\amigo\user data\e4e2.tmp
%LOCALAPPDATA%\amigo\user data\default\session storage\log
%LOCALAPPDATA%\amigo\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\amigo\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_diciddlabejpoaofdnmoamebeohoiobg_0.localstorage
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_diciddlabejpoaofdnmoamebeohoiobg_0.localstorage-journal
%LOCALAPPDATA%\amigo\user data\default\d46c.tmp
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_kgkggmpkealihpbjpdmcblcplljamohl_0.localstorage
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_kgkggmpkealihpbjpdmcblcplljamohl_0.localstorage-journal
%LOCALAPPDATA%\amigo\user data\bca7.tmp
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_pafkbggdmjlpgkdkcbjmhmfcdpncadgh_0.localstorage-journal
%LOCALAPPDATA%\amigo\user data\default\local storage\https_mail.ru_0.localstorage
%LOCALAPPDATA%\amigo\user data\default\local storage\https_mail.ru_0.localstorage-journal
%TEMP%\scoped_dir_1172_12458\decoded_message_catalogs
%TEMP%\scoped_dir_1172_12458\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1172_12458\crx_install\templates\twitter.html
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\odnoklassniki.js
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\scorpio-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\templates\tabs.html
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\eventmanager.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\event.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\app.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\news\post.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\news\phototag.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\news\photo.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\news\note.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\loader.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\news\friendship.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\video.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\sticker.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\poll.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\photo.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\page.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\note.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\attachments\link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\vk\music\track.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\main.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\menu.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\openamigo.js
%TEMP%\scoped_dir_1172_12458\crx_install\templates\social-networks.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\publishing.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\options.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\odnoklassniki.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\music.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\music-player.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\moimir.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\messages.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\knockout-bindings.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\instagram.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\facebook.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\chat.html
%TEMP%\scoped_dir_1172_12458\crx_install\templates\app.html
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\menu\socialnetwork.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\menu\separator.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\menu\music.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\tray\menu\item.js
%TEMP%\scoped_dir_1172_12458\crx_install\templates\tests.html
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\25a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\music.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\auth2.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\socialnetworktabs.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\status.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\statestreaming.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\statelistener.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\starter.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\spyofurls.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\spyofcookies.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\synclogin.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\streamingprocess.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\newsunreaddecorator.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\searcher.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\profilenull.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\profile.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\postcomment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\oauth2.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\oauth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\servicemonitoring.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\socialnetwork.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\chat.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\iq.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\xmppclientbuilder.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\xmppclient.js
%LOCALAPPDATA%\amigo\user data\9141.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\smileylist.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\activecontacts.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\messageerror.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\smiley.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\egohihcbmlmdokfdoecjpdiadnkjgmdd\000001.dbtmp
%LOCALAPPDATA%\amigo\user data\default\local extension settings\egohihcbmlmdokfdoecjpdiadnkjgmdd\manifest-000001
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\messageform.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\dialog.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\contactslist.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\messenger.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\egohihcbmlmdokfdoecjpdiadnkjgmdd\log
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\networkmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\mockauth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\optionsmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\masterconnect.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\main.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\loader.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\keys.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\dominit.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\optionsopen.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\config.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\chat.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\browsersettings.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\backgroundpage.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\app.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\share\share.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\share\network.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\share\main.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\chrome.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\publishing.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\settings.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\music.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\sharing.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\messages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\contactmatcheddecorator.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\interval.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\injectsynclogin.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\globalmessage.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\editableelement.js
%LOCALAPPDATA%\amigo\application\debug.log
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\contactssortfunc.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\contactlist.js
%WINDIR%\syswow64\grouppolicy\gpt.ini
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\attachmentsgroup.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\viruswindow.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tests.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\tab.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\sidebar.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\ping.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\presence.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\roster.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\chat\stanza\stanzaelement.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\createattachments.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\comment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\application.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\music\track.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\chat\message.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\status.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\smileys.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\event.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\profile.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\networkmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\music.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\moimir.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\messenger.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\instance.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\engine.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\friendship.js
%LOCALAPPDATA%\amigo\user data\default\cache\f_000006
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\group.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\messenger.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\instance.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\group.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\feedpost.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\auth2.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\videoattachment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\video.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\photoattachment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\photo.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\nullpost.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\music.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\multipost.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\message.js
%LOCALAPPDATA%\amigo\user data\default\cache\f_000007
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\post\like.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\mm\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ok\networkmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\share\loader.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\photo.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\graph.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\facebook.js
%LOCALAPPDATA%\amigo\user data\default\cache\f_000005
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\comments.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\comment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\auth.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\instance.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachment.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\publishing\publishing.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\music\tracklist.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\music\track.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\music\player.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\music\musicroom.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\music\music.js
%LOCALAPPDATA%\amigo\user data\default\local extension settings\egohihcbmlmdokfdoecjpdiadnkjgmdd\000003.log
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\core\publishing\sharing.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\likes.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\messenger.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\networkmessages.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\likes.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\instance.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\instagram.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\contact.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\auth2.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachments\video.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachments\question.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachments\picture.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachments\photo.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachments\media.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\attachments\link.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\status.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\smileys.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\profile.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\post.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\fb\newsfeed.js
%TEMP%\scoped_dir_1172_12458\crx_install\js\sidebar\ig\profile.js
%LOCALAPPDATA%\amigo\user data\default\8f4d.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\14a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\sagittarius.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\13a.gif
%TEMP%\scoped_dir_1172_28534\crx_install\sign.bin
%TEMP%\scoped_dir_1172_4676\crx_install\resources\injectsynclogin.js
%TEMP%\scoped_dir_1172_12458\crx_install\assets\fonts\opensans-bold.woff2
%TEMP%\scoped_dir_1172_4676\crx_install\resources\master.js
%TEMP%\scoped_dir_1172_28534\crx_install\index.html
%TEMP%\scoped_dir_1172_12458\crx_install\assets\fonts\emojisymbols-regular.woff
%TEMP%\scoped_dir_1172_12458\crx_install\virus.html
%TEMP%\scoped_dir_1172_27076\crx_install\manifest.json
%TEMP%\scoped_dir_1172_12458\crx_install\tray.html
%TEMP%\scoped_dir_1172_12458\crx_install\start_mm.html
%TEMP%\scoped_dir_1172_12458\crx_install\share.html
%TEMP%\scoped_dir_1172_4676\crx_install\resources\injectsaveauth.js
%TEMP%\scoped_dir_1172_12458\crx_install\start.html
%TEMP%\scoped_dir_1172_4676\crx_install\resources\amigo.js
%TEMP%\scoped_dir_1172_12458\crx_install\sign.bin
%TEMP%\scoped_dir_1172_12458\crx_install\sidebar.html
%TEMP%\scoped_dir_1172_27076\crx_install\background.html
%TEMP%\scoped_dir_1172_4676\crx_install\oauth\oauth.html
%TEMP%\scoped_dir_1172_17145\crx_install\sign.bin
%TEMP%\scoped_dir_1172_17145\crx_install\manifest.json
%TEMP%\scoped_dir_1172_25424\crx_install\inject_script.js
%TEMP%\scoped_dir_1172_28534\crx_install\fonts\opensans-bold.woff2
%TEMP%\scoped_dir_1172_9154\crx_install\background.html
%TEMP%\scoped_dir_1172_12458\crx_install\assets\fonts\opensans-semibold.woff2
%TEMP%\scoped_dir_1172_25424\crx_install\background.js
%TEMP%\scoped_dir_1172_17965\crx_install\manifest.json
%TEMP%\scoped_dir_1172_13355\crx_install\index.html
%TEMP%\scoped_dir_1172_12458\crx_install\save_auth.html
%TEMP%\scoped_dir_1172_4676\crx_install\resources\oauth_inject.js
%TEMP%\scoped_dir_1172_12458\crx_install\assets\fonts\opensans-regular.woff2
%TEMP%\scoped_dir_1172_28534\crx_install\css\main.css
%TEMP%\scoped_dir_1172_17965\crx_install\background.html
%TEMP%\scoped_dir_1172_25424\crx_install\background.html
%TEMP%\scoped_dir_1172_4676\crx_install\resources\tw_authworker.js
%TEMP%\scoped_dir_1172_17145\crx_install\index.html
%TEMP%\scoped_dir_1172_12458\crx_install\assets\fonts\opensans-light.woff2
%TEMP%\scoped_dir_1172_27076\crx_install\sign.bin
%TEMP%\scoped_dir_1172_12458\crx_install\start_ok.html
%TEMP%\scoped_dir_1172_4676\crx_install\sign.bin
%TEMP%\scoped_dir_1172_12458\crx_install\require-config.js
%TEMP%\e38f.tmp
%TEMP%\e5b4.tmp
%TEMP%\scoped_dir_1172_25424\hlnkhcccfccipjdgeddoifmlognfajdp.crx
%TEMP%\e594.tmp
%TEMP%\mrutmp.exe
%TEMP%\scoped_dir_1172_9154\hfpahoblpjopcfnlokmndooidiinhiie.crx
%TEMP%\scoped_dir_1172_17145\llhmkeckmmlocaeoejlhmlipmfileimk.crx
%TEMP%\scoped_dir_1172_17965\kgkggmpkealihpbjpdmcblcplljamohl.crx
%TEMP%\e516.tmp
%TEMP%\scoped_dir_1172_13355\mbipmajmbfjakbcfnjdldckninlnmhoe.crx
%LOCALAPPDATA%\amigo\user data\default\cookies
%TEMP%\e19b.tmp
%TEMP%\scoped_dir_1172_4676\eeecheimdlkopnpajfcdmacgkjlkcmji.crx
%TEMP%\etilqs_5ccf3rgzhp0vmta
%LOCALAPPDATA%\amigo\user data\default\cookies-journal
%TEMP%\scoped_dir_1172_28534\ekiocibneoalnmflkbpgmhheomcojihd.crx
%TEMP%\scoped_dir_1172_27076\egohihcbmlmdokfdoecjpdiadnkjgmdd.crx
%TEMP%\e625.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\options_redirect.html
%TEMP%\scoped_dir_1172_13355\crx_install\manifest.json
%TEMP%\e5d5.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\background.html
%TEMP%\scoped_dir_1172_4676\crx_install\background.html
%TEMP%\scoped_dir_1172_12458\crx_install\options.html
%TEMP%\scoped_dir_1172_12458\crx_install\oauth.html
%TEMP%\scoped_dir_1172_12458\crx_install\manifest.json
%TEMP%\scoped_dir_1172_12458\crx_install\incognito.html
%TEMP%\scoped_dir_1172_12458\crx_install\changelog.md
%TEMP%\scoped_dir_1172_12458\crx_install\blank.html
%LOCALAPPDATA%\amigo\user data\default\shortcuts
%TEMP%\scoped_dir_1172_4676\crx_install\manifest.json
%LOCALAPPDATA%\amigo\user data\default\shortcuts-journal
%TEMP%\scoped_dir_1172_16184\odneijmnendnigglgefjpcjdflkgfllj.crx
%TEMP%\e655.tmp
%TEMP%\scoped_dir_1172_21945\nhhefclnfbjmnbbkhjplpnciolbbbdkd.crx
%TEMP%\e635.tmp
%TEMP%\scoped_dir_1172_1133\ndfnaopimdacfcnbjdikmppjaamhgake.crx
%TEMP%\scoped_dir_1172_4676\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1172_17965\crx_install\options.html
%LOCALAPPDATA%\amigo\user data\default\login data-journal
%TEMP%\scoped_dir_1172_12458\crx_install\assets\sound\notifications\audio.txt
%TEMP%\scoped_dir_1172_16184\crx_install\index.html
%TEMP%\scoped_dir_1172_1133\crx_install\js\common.js
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\opensans-bold.woff
%TEMP%\scoped_dir_1172_25424\crx_install\images\icon_mail.png
%TEMP%\scoped_dir_1172_17965\crx_install\img\arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\attachments.css
%TEMP%\scoped_dir_1172_21945\crx_install\sign.bin
%TEMP%\scoped_dir_1172_12458\crx_install\css\chat.css
%TEMP%\scoped_dir_1172_17145\crx_install\fonts\opensans-semibold.woff2
%TEMP%\etilqs_322nottej1dopz6
%TEMP%\scoped_dir_1172_17145\crx_install\fonts\opensans-regular.woff2
%TEMP%\scoped_dir_1172_1133\crx_install\js\background.js
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\lato-regular.woff
%TEMP%\scoped_dir_1172_25424\crx_install\images\icon_delta.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_128.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\48x48.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\default_pic.jpg
%TEMP%\scoped_dir_1172_13355\crx_install\img\lastfm_grey_small.png
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\opensans-regular.woff
%TEMP%\scoped_dir_1172_12458\crx_install\css\app.css
%TEMP%\scoped_dir_1172_21945\crx_install\popup.html
%TEMP%\scoped_dir_1172_9154\crx_install\img\mail.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-close.png
%TEMP%\scoped_dir_1172_16184\crx_install\sign.bin
%TEMP%\scoped_dir_1172_17965\crx_install\img\folder_flag.png
%TEMP%\scoped_dir_1172_1133\crx_install\js\inject.js
%TEMP%\scoped_dir_1172_13355\crx_install\img\navigation-buttons.png
%TEMP%\scoped_dir_1172_25424\crx_install\resources\hint.js
%TEMP%\scoped_dir_1172_12458\crx_install\css\collapsible.css
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\opensans-light.woff
%TEMP%\scoped_dir_1172_17145\crx_install\fonts\robotocondensed-regular.woff2
%TEMP%\scoped_dir_1172_9154\crx_install\img\local_mail.png
%LOCALAPPDATA%\amigo\user data\default\login data
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_48.png
%TEMP%\scoped_dir_1172_21945\crx_install\css\index.css
%TEMP%\scoped_dir_1172_16184\crx_install\manifest.json
%TEMP%\scoped_dir_1172_17965\crx_install\img\close.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_16.png
%TEMP%\e604.tmp
%TEMP%\e18b.tmp
%LOCALAPPDATA%low\unity\webplayer\unitywebplayerupdate.exe
%TEMP%\scoped_dir_1172_25424\crx_install\manifest.json
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\lato-black.woff
%TEMP%\scoped_dir_1172_25424\crx_install\sign.bin
%TEMP%\scoped_dir_1172_17965\crx_install\sign.bin
%TEMP%\scoped_dir_1172_17145\crx_install\css\main.css
%TEMP%\scoped_dir_1172_28534\crx_install\fonts\opensans-regular.woff2
%TEMP%\scoped_dir_1172_9154\crx_install\manifest.json
%TEMP%\scoped_dir_1172_21945\crx_install\background.html
%TEMP%\scoped_dir_1172_9154\crx_install\sign.bin
%TEMP%\scoped_dir_1172_13355\crx_install\img\128x128.png
%TEMP%\scoped_dir_1172_13355\crx_install\sign.bin
%TEMP%\scoped_dir_1172_28534\crx_install\fonts\opensans-light.woff2
%TEMP%\scoped_dir_1172_9154\crx_install\index.html
%TEMP%\scoped_dir_1172_27076\crx_install\visual-bookmarks.html
%LOCALAPPDATA%\amigo\user data\default\network action predictor
%LOCALAPPDATA%\amigo\user data\default\network action predictor-journal
%TEMP%\scoped_dir_1172_17965\crx_install\popup.html
%TEMP%\scoped_dir_1172_28534\crx_install\fonts\opensans-semibold.woff2
%TEMP%\scoped_dir_1172_13355\crx_install\img\32x32.png
%TEMP%\scoped_dir_1172_17145\crx_install\fonts\opensans-light.woff2
%TEMP%\scoped_dir_1172_12458\crx_install\assets\sound\notifications\test.txt
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\lato-light.woff
%TEMP%\scoped_dir_1172_25424\crx_install\images\icon_bell.png
%TEMP%\scoped_dir_1172_17965\crx_install\css\popup.css
%TEMP%\scoped_dir_1172_1133\crx_install\sign.bin
%TEMP%\scoped_dir_1172_28534\crx_install\img\check.png
%TEMP%\scoped_dir_1172_9154\crx_install\css\main.css
%LOCALAPPDATA%\amigo\user data\default\history.cp
%TEMP%\scoped_dir_1172_21945\crx_install\manifest.json
%TEMP%\scoped_dir_1172_13355\crx_install\img\16x16.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\all.css
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\lato-bold.woff
%TEMP%\scoped_dir_1172_17965\crx_install\css\options.css
%TEMP%\scoped_dir_1172_17145\crx_install\fonts\opensans-bold.woff2
%TEMP%\scoped_dir_1172_25424\crx_install\images\icon_128.png
%LOCALAPPDATA%\mail.ru\mrst\1
%TEMP%\scoped_dir_1172_1133\crx_install\manifest.json
%LOCALAPPDATA%\amigo\user data\default\fed6.tmp
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_eeecheimdlkopnpajfcdmacgkjlkcmji_0.localstorage-journal
%TEMP%\scoped_dir_1172_12458\crx_install\css\data-counter.css
%TEMP%\e10c.tmp
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\en-gb.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\fi.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\fa.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\et.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\es.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\es-419.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\en-us.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\gu.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\fr.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\bg.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\da.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\cs.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\chrome_200_percent.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\chrome_100_percent.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ca.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\bn.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\de.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\el.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\hi.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ar.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\pl.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\nl.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\nb.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ms.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\mr.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ml.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\he.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\pt-br.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\lv.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\kn.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ja.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\it.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\id.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\hu.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\hr.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\lt.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ko.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\amigo_resources.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\am.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\metro_driver.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\libexif.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\libegl.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\d3dcompiler_47.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\chrome_watcher.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\chrome_elf.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\pepperflash\pepflashplayer.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\chrome_child.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\icudtl.dat
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\snapshot_blob.bin
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\natives_blob.bin
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome.7z
%TEMP%\chrome_installer.log
%TEMP%\cr_55880.tmp\setup.exe
%TEMP%\cr_55880.tmp\setup.ex_
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\chrome.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\widevinecdmadapter.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\xinput1_3.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\libglesv2.dll
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\amigo.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\nacl_irt_x86_32.nexe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mg.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\47.5.2526.173.manifest
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\pepperflash\manifest.json
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\extensions\external_extensions.json
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\vk.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\ok.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\music.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mm.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mail.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\nacl_irt_x86_64.nexe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\wow_helper.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\unitywebplayer.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\nacl64.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mailruupdater.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\delegate_execute.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\amigo_cr.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\pt-pt.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\resources.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\fil.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ro.pak
%LOCALAPPDATA%\amigo\user data\default\history
%TEMP%\etilqs_47fo7178bc5vlgi
%LOCALAPPDATA%\amigo\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\amigo\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\amigo\user data\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\etilqs_m7mgzjbxtydzccq
%LOCALAPPDATA%\amigo\user data\default\web data
%LOCALAPPDATA%\amigo\user data\default\history-journal
%LOCALAPPDATA%\amigo\user data\default\favicons
%LOCALAPPDATA%\amigo\user data\default\favicons-journal
%TEMP%\etilqs_xylsrjyfqczansb
%ProgramFiles(x86)%\mail.ru\mailruupdater\mailruupdater.exe
%TEMP%\nspcca3.tmp\uac.dll
%LOCALAPPDATA%\unity\webplayer\uninstall.exe
%LOCALAPPDATA%\mail.ru\mailruupdater.exe
%LOCALAPPDATA%low\unity\webplayer\loader\npunity3d32.dll
%LOCALAPPDATA%low\unity\webplayer\loader\info.plist
%LOCALAPPDATA%\amigo\user data\default\readme
%LOCALAPPDATA%\amigo\user data\default\top sites-journal
%LOCALAPPDATA%\amigo\user data\default\e0bd.tmp
%LOCALAPPDATA%low\unity\webplayer\loader\unitywebpluginax.ocx
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ru.pak
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\llhmkeckmmlocaeoejlhmlipmfileimk.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\ekiocibneoalnmflkbpgmhheomcojihd.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\odneijmnendnigglgefjpcjdflkgfllj.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\ndfnaopimdacfcnbjdikmppjaamhgake.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\nhhefclnfbjmnbbkhjplpnciolbbbdkd.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\hfpahoblpjopcfnlokmndooidiinhiie.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\diciddlabejpoaofdnmoamebeohoiobg.crx
%LOCALAPPDATA%\amigo\user data\default\visited links
%LOCALAPPDATA%\amigo\user data\first run
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\egohihcbmlmdokfdoecjpdiadnkjgmdd.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\eeecheimdlkopnpajfcdmacgkjlkcmji.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\kgkggmpkealihpbjpdmcblcplljamohl.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\hlnkhcccfccipjdgeddoifmlognfajdp.crx
%TEMP%\amigoext_983205be-0342-45e1-83f4-e0145b736d3a\mbipmajmbfjakbcfnjdldckninlnmhoe.crx
%LOCALAPPDATA%\amigo\user data\default\top sites
%TEMP%\etilqs_hbd1jbsvb4mob79
%LOCALAPPDATA%\amigo\user data\default\web data-journal
%LOCALAPPDATA%\amigo\user data\default\e18a.tmp
%TEMP%\scoped_dir_1172_12458\diciddlabejpoaofdnmoamebeohoiobg.crx
%LOCALAPPDATA%low\unity\webplayer\unitybugreporter.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\secondarytile.png
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\visualelements\logo.png
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\zh-tw.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\zh-cn.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\vi.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\uk.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\amigo.visualelementsmanifest.xml
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\tr.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\te.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\ta.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\sw.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\sv.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\sr.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\sl.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\sk.pak
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\locales\th.pak
%LOCALAPPDATA%\amigo\application\amigo.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\47.5.2526.173\visualelements\smalllogo.png
%LOCALAPPDATA%\amigo\application\47.5.2526.173\installer\setup.exe
%ALLUSERSPROFILE%\mail.ru\id
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\amigo.lnk
%APPDATA%\mailproducts\id
%TEMP%\nspcca3.tmp\system.dll
%TEMP%\nspcca3.tmp\utilsplugin.dll
%TEMP%\nspcca3.tmp\userinfo.dll
%TEMP%\nszcba8.tmp
%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\unitywebplayer.exe
%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\mailruupdater.exe
%APPDATA%\microsoft\windows\start menu\programs\amigo.lnk
%LOCALAPPDATA%\amigo\application\mm.ico
%APPDATA%\microsoft\internet explorer\quick launch\amigo.lnk
%HOMEPATH%\desktop\amigo.lnk
%LOCALAPPDATA%\amigo\application\music.ico
%LOCALAPPDATA%\amigo\application\mail.ico
%LOCALAPPDATA%\amigo\application\vk.ico
%LOCALAPPDATA%\amigo\application\ok.ico
%LOCALAPPDATA%\amigo\application\mg.ico
%LOCALAPPDATA%low\unity\webplayer\loader\unitywebplayernp.map
%TEMP%\scoped_dir_1172_12458\crx_install\templates\tray.html
%TEMP%\scoped_dir_1172_21945\crx_install\img\arrows_scroll.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\placeholder2.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\chat_off_press.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\mm_off_press.png
%APPDATA%\microsoft\windows\start menu\programs\amigo apps\амиго.музыка.lnk
%TEMP%\scoped_dir_1172_27076\crx_install\img\plus.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\pencil.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\mm_off.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\mm.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\mm_press.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\fb_off_press.png
%LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\амиго.музыка.ico.md5
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\fb.png
%LOCALAPPDATA%\amigo\user data\default\2a5e.tmp
%LOCALAPPDATA%\amigo\user data\2a1f.tmp
%TEMP%\scoped_dir_1172_28534\decoded_message_catalogs
%TEMP%\scoped_dir_1172_27076\crx_install\img\options-spritesheet.png
%TEMP%\scoped_dir_1172_28534\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\fb_off.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\chat_press.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\ok.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\search-cancel-button.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\tw_off.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\tw.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\trash.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\share.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\spinner.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\qu_press.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\side-menu.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\search.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\qu.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\ok_press.png
%LOCALAPPDATA%\amigo\user data\default\3180.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\ok_off_press.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\ok_off.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\search-crosses.png
%TEMP%\scoped_dir_1172_16184\decoded_message_catalogs
%TEMP%\scoped_dir_1172_16184\decoded_images
%TEMP%\scoped_dir_1172_27076\crx_install\img\remove-tile-cross.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\no-int-big-white.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\no-int-big-black.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\chat_off.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\tray\all.css
%TEMP%\scoped_dir_1172_17965\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_128.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\cancel.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\tray\menu.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\tray\app.css
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon48.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\drop-arrow-up.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_16.png
%TEMP%\scoped_dir_1172_17965\decoded_message_catalogs
%TEMP%\scoped_dir_1172_27076\crx_install\img\dots.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\options\layout.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\options\icons.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\options\controls.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\options\app.css
%TEMP%\scoped_dir_1172_17145\decoded_message_catalogs
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon16.png
%TEMP%\scoped_dir_1172_16184\crx_install\js\bundle.js
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\chat.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\default_pic.jpg
%LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\2953.tmp
%TEMP%\scoped_dir_1172_12458\crx_install\img\mark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\video_play.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\published.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\playpause.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\green-circle.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\mono_iconset.gif
%TEMP%\scoped_dir_1172_13355\decoded_message_catalogs
%TEMP%\scoped_dir_1172_13355\decoded_images
%TEMP%\scoped_dir_1172_27076\crx_install\img\drop-arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_48.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\loading.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\hand.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.update
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\tw_off_press.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\white-cross.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\tw_press.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\at-sign.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\capricorn.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\capricorn-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\winking.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\cancer.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\wait.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\surprised.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\sun.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\gemini-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\smiley.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\cancer-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\sealed.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\sad.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\aries.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\aries-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\puking.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\aquarius.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\sleepy.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\gemini.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\01.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\leo-dark.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon128.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\12a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\11a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\10a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\sagittarius-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\pisces.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\09a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\08a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\07a.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\06a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\pisces-dark.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\libra.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\04b.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\03a.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\libra-dark.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\ok\02.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\leo.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\laugh.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\drag-arrows.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\kitty.gif
%TEMP%\scoped_dir_1172_1133\crx_install\js\relap.js
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\music-large.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\user-online.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\profile.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\mail-small.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\im_smile_cross.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\close-dialog.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\active.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\angry.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\vk_press.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\mail-large.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\vk_off_press.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\horo-small.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\vk_off.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\horo-medium.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\horo-large.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\buttons\vk.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\mail-medium.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\blushed.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\cool.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\crying.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\hint-more-themes.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\hint-cross.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\kissheart.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\innocent.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\ill.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\drag-tile-arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\hugs.gif
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\hearteyes.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\can-drag-tile.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\heart.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\add-tile.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\grin.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\add-site.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\facepalm.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\music-small.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\extensions\music-medium.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chat\smileys\mm\devil.gif
%TEMP%\scoped_dir_1172_27076\crx_install\img\horo\aquarius-dark.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\check.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\hints\restore-tile.png
%TEMP%\scoped_dir_1172_28534\crx_install\manifest.json
%TEMP%\scoped_dir_1172_9154\crx_install\js\background.js
%TEMP%\scoped_dir_1172_12458\crx_install\css\instagram.css
%TEMP%\scoped_dir_1172_1133\decoded_images
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-clear.png
%TEMP%\scoped_dir_1172_21945\crx_install\img\tm.png
%TEMP%\scoped_dir_1172_16184\crx_install\fonts\opensans-light.woff2
%TEMP%\scoped_dir_1172_12458\crx_install\css\fonts.css
%TEMP%\scoped_dir_1172_27076\crx_install\js\app.js
%LOCALAPPDATA%\amigo\user data\default\cache\data_3
%LOCALAPPDATA%\amigo\user data\default\cache\data_1
%LOCALAPPDATA%\amigo\user data\default\cache\data_0
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-empty-content.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\placeholder4.png
%TEMP%\scoped_dir_1172_21945\crx_install\img\recovery_img.png
%LOCALAPPDATA%\amigo\user data\default\cache\index
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-anchor-up.png
%LOCALAPPDATA%\amigo\user data\default\cache\data_2
%TEMP%\scoped_dir_1172_9154\crx_install\js\interface.js
%TEMP%\scoped_dir_1172_1133\decoded_message_catalogs
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-close.png
%TEMP%\scoped_dir_1172_17965\crx_install\sound\5.ogg
%TEMP%\scoped_dir_1172_16184\crx_install\img\clear-history-icon.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\loading.css
%TEMP%\scoped_dir_1172_21945\crx_install\js\app.build.js
%TEMP%\scoped_dir_1172_13355\crx_install\img\small-player-bg.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-move.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-delete.png
%TEMP%\scoped_dir_1172_16184\crx_install\fonts\opensans-semibold.woff2
%TEMP%\scoped_dir_1172_13355\crx_install\img\settings.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-folder.png
%TEMP%\scoped_dir_1172_27076\crx_install\js\background.js
%TEMP%\scoped_dir_1172_17965\crx_install\js\popup.js
%TEMP%\scoped_dir_1172_12458\crx_install\css\layout.css
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-export-import.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\playlist.png
%TEMP%\scoped_dir_1172_16184\crx_install\fonts\opensans-regular.woff2
%TEMP%\scoped_dir_1172_17965\crx_install\js\options.js
%LOCALAPPDATA%\amigo\user data\safe browsing cookies
%TEMP%\etilqs_lppmsoacg1ywzrc
%LOCALAPPDATA%\amigo\user data\safe browsing cookies-journal
%TEMP%\scoped_dir_1172_17965\crx_install\img\mail_off.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\errors.css
%TEMP%\scoped_dir_1172_9154\crx_install\img\share_off.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-delete.png
%TEMP%\scoped_dir_1172_16184\crx_install\css\all.css
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_128.png
%TEMP%\scoped_dir_1172_1133\crx_install\js\relap_inject.js
%TEMP%\scoped_dir_1172_21945\crx_install\img\history_img.png
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\ptm75f_w.woff
%TEMP%\scoped_dir_1172_13355\crx_install\img\placeholder3.png
%TEMP%\scoped_dir_1172_27076\crx_install\fonts\opensans-semibold.woff
%TEMP%\scoped_dir_1172_12458\crx_install\css\dropdown.css
%TEMP%\scoped_dir_1172_9154\crx_install\img\share.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-create.png
%TEMP%\scoped_dir_1172_17965\crx_install\img\mail.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\noname.png
%TEMP%\scoped_dir_1172_21945\crx_install\img\close.png
%TEMP%\scoped_dir_1172_4676\decoded_images
%LOCALAPPDATA%\amigo\user data\default\934.tmp
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_16.png
%LOCALAPPDATA%\amigo\user data\default\944.tmp
%TEMP%\scoped_dir_1172_17965\crx_install\js\background.js
%LOCALAPPDATA%\amigo\user data\933.tmp
%TEMP%\scoped_dir_1172_9154\crx_install\img\status.png
%TEMP%\scoped_dir_1172_9154\crx_install\img\social.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\feed.css
%TEMP%\scoped_dir_1172_21945\crx_install\img\recent.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_48.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg.new
%TEMP%\scoped_dir_1172_27076\crx_install\css\main.css
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-edit.png
%TEMP%\scoped_dir_1172_16184\crx_install\fonts\opensans-bold.woff2
%TEMP%\scoped_dir_1172_21945\crx_install\img\main_icon.png
%LOCALAPPDATA%\amigo\user data\default\cursession
%TEMP%\scoped_dir_1172_4676\decoded_message_catalogs
%TEMP%\scoped_dir_1172_9154\crx_install\img\share_on.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\facebook.css
%TEMP%\scoped_dir_1172_27076\crx_install\js\preload.js
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-empty-content.png
%TEMP%\scoped_dir_1172_21945\crx_install\js\background.build.js
%TEMP%\scoped_dir_1172_13355\crx_install\resources\background.js
%TEMP%\scoped_dir_1172_16184\crx_install\img\search.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\static.css
%TEMP%\scoped_dir_1172_16184\crx_install\img\search-cancel-button.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\currency-arrow-light.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\start_custom.css
%TEMP%\scoped_dir_1172_16184\crx_install\img\right-arrow.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\start.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\status.css
%TEMP%\scoped_dir_1172_27076\crx_install\img\currency-arrow-light-rotated.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\left-arrow.png
%TEMP%\scoped_dir_1172_28534\crx_install\js\main.js
%TEMP%\scoped_dir_1172_17145\crx_install\js\main.js
%TEMP%\scoped_dir_1172_17145\crx_install\js\background.js
%TEMP%\scoped_dir_1172_12458\crx_install\css\share.css
%TEMP%\scoped_dir_1172_27076\crx_install\img\boards-panel-preview.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\filter-icon.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\social-networks.css
%TEMP%\scoped_dir_1172_21945\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\css\sticky-header.css
%TEMP%\scoped_dir_1172_21945\decoded_message_catalogs
%TEMP%\scoped_dir_1172_12458\crx_install\css\options\all.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\inject\login-bar.css
%TEMP%\scoped_dir_1172_27076\crx_install\img\dialog-cross.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\virus.css
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.update
%TEMP%\scoped_dir_1172_16184\crx_install\img\up-arrow.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.update
%TEMP%\scoped_dir_1172_12458\crx_install\css\user-select.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\twitter.css
%TEMP%\scoped_dir_1172_9154\decoded_message_catalogs
%TEMP%\scoped_dir_1172_25424\decoded_message_catalogs
%TEMP%\scoped_dir_1172_27076\crx_install\img\currency-arrow.png
%TEMP%\scoped_dir_1172_9154\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\css\tabs.css
%TEMP%\scoped_dir_1172_25424\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\css\search-form.css
%TEMP%\scoped_dir_1172_17145\decoded_images
%TEMP%\scoped_dir_1172_28534\crx_install\img\substrate.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\inject\save-auth.css
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-remove.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\music-player.css
%LOCALAPPDATA%\amigo\user data\default\extension rules\000003.log
%LOCALAPPDATA%\amigo\user data\default\extension rules\log
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-open-folder.png
%LOCALAPPDATA%\amigo\user data\default\extension rules\000001.dbtmp
%LOCALAPPDATA%\amigo\user data\default\extension rules\manifest-000001
%TEMP%\scoped_dir_1172_13355\crx_install\resources\index.js
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-search-cancel.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\moimir.css
%TEMP%\scoped_dir_1172_13355\crx_install\resources\index.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\messages.css
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-folder.png
%TEMP%\scoped_dir_1172_27076\crx_install\js\vendors.js
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-remove.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\localize.css
%TEMP%\scoped_dir_1172_16184\crx_install\img\delete-icon.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-search-cancel.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\music.css
%TEMP%\scoped_dir_1172_12458\crx_install\css\publishing.css
%TEMP%\scoped_dir_1172_17145\crx_install\img\tip-grey.png
%TEMP%\scoped_dir_1172_13355\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_1172_16184\crx_install\img\fake-checkbox.png
%TEMP%\scoped_dir_1172_12458\crx_install\css\reset.css
%TEMP%\scoped_dir_1172_17145\crx_install\img\tip-blue.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-sorting-direction.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\boards-icon.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\substrate.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\empty-content.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-show.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\black-cross.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\search.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\play.svg
%TEMP%\scoped_dir_1172_16184\crx_install\img\dustbin-icon.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\icon-search.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\arrows.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\icon-search.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\tip-grey_fill.png
%LOCALAPPDATA%\amigo\user data\default\local storage\chrome-extension_eeecheimdlkopnpajfcdmacgkjlkcmji_0.localstorage

Deletes the following files

%TEMP%\cr_55880.tmp\setup.ex_
%TEMP%\scoped_dir_1172_28534\ekiocibneoalnmflkbpgmhheomcojihd.crx
%TEMP%\scoped_dir_1172_28534\decoded_message_catalogs
%TEMP%\scoped_dir_1172_28534\decoded_images
%LOCALAPPDATA%\amigo\user data\default\extension data~rfc2b15.tmp
%LOCALAPPDATA%\amigo\user data\local state~rfc2af6.tmp
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_48.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_16.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_128.png
%TEMP%\scoped_dir_1172_13355\mbipmajmbfjakbcfnjdldckninlnmhoe.crx
%TEMP%\scoped_dir_1172_13355\decoded_message_catalogs
%TEMP%\scoped_dir_1172_13355\decoded_images
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon16.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon128.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\16x16.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\128x128.png
%TEMP%\scoped_dir_1172_17965\kgkggmpkealihpbjpdmcblcplljamohl.crx
%TEMP%\scoped_dir_1172_17965\decoded_message_catalogs
%TEMP%\scoped_dir_1172_17965\decoded_images
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.update
%TEMP%\scoped_dir_1172_17965\crx_install\img\mail_off.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\48x48.png
%TEMP%\e635.tmp
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon48.png
%LOCALAPPDATA%\amigo\user data\default\transportsecurity~rfcfc96.tmp
%LOCALAPPDATA%\amigo\user data\local state~rfce530.tmp
%LOCALAPPDATA%\amigo\user data\default\secure preferences~rfcd44e.tmp
%LOCALAPPDATA%\amigo\user data\local state~rfcbc9a.tmp
%TEMP%\scoped_dir_1172_12458\diciddlabejpoaofdnmoamebeohoiobg.crx
%TEMP%\scoped_dir_1172_12458\decoded_message_catalogs
%TEMP%\scoped_dir_1172_12458\decoded_images
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_48.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_16.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_128.png
%LOCALAPPDATA%\amigo\user data\default\extension data~rfcac36.tmp
%LOCALAPPDATA%\amigo\user data\local state~rfc9137.tmp
%LOCALAPPDATA%\amigo\user data\default\secure preferences~rfc8f44.tmp
%LOCALAPPDATA%\amigo\user data\default\extension data~rfc7925.tmp
%TEMP%\scoped_dir_1172_27076\egohihcbmlmdokfdoecjpdiadnkjgmdd.crx
%TEMP%\scoped_dir_1172_27076\decoded_message_catalogs
%TEMP%\scoped_dir_1172_27076\decoded_images
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon48.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon16.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon128.png
%LOCALAPPDATA%\amigo\user data\local state~rfc6122.tmp
%LOCALAPPDATA%\amigo\user data\default\extension data~rfc51e6.tmp
%LOCALAPPDATA%\amigo\user data\default\secure preferences~rfc31f8.tmp
%TEMP%\scoped_dir_1172_16184\odneijmnendnigglgefjpcjdflkgfllj.crx
%TEMP%\scoped_dir_1172_16184\decoded_message_catalogs
%TEMP%\scoped_dir_1172_17145\llhmkeckmmlocaeoejlhmlipmfileimk.crx
%TEMP%\scoped_dir_1172_13355\crx_install\img\32x32.png
%TEMP%\scoped_dir_1172_17145\decoded_message_catalogs
%TEMP%\scoped_dir_1172_17145\decoded_images
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_48.png
%TEMP%\nspcca3.tmp\system.dll
%TEMP%\e5b4.tmp
%TEMP%\e594.tmp
%TEMP%\e516.tmp
%TEMP%\e38f.tmp
%TEMP%\e19b.tmp
%TEMP%\e18b.tmp
%LOCALAPPDATA%\amigo\user data\default\e18a.tmp
%TEMP%\e10c.tmp
%TEMP%\nspcca3.tmp\utilsplugin.dll
%TEMP%\nspcca3.tmp\userinfo.dll
%TEMP%\nspcca3.tmp\uac.dll
%TEMP%\cr_55880.tmp\setup.exe
%TEMP%\e604.tmp
%TEMP%\cr_55880.tmp\chrome.packed.7z
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\wow_helper.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\vk.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\unitywebplayer.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\ok.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\music.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mm.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mg.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mailruupdater.exe
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\mail.ico
%LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\amigo.exe
%LOCALAPPDATA%\amigo\user data\default\extension data~rfcff93.tmp
%TEMP%\scoped_dir_1172_16184\decoded_images
%TEMP%\e625.tmp
%TEMP%\mrutmp.exe
%TEMP%\e5d5.tmp
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_16.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_128.png
%TEMP%\scoped_dir_1172_25424\hlnkhcccfccipjdgeddoifmlognfajdp.crx
%TEMP%\scoped_dir_1172_25424\decoded_message_catalogs
%TEMP%\scoped_dir_1172_25424\decoded_images
%TEMP%\scoped_dir_1172_9154\hfpahoblpjopcfnlokmndooidiinhiie.crx
%TEMP%\scoped_dir_1172_9154\decoded_message_catalogs
%TEMP%\scoped_dir_1172_9154\decoded_images
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg
%TEMP%\scoped_dir_1172_25424\crx_install\images\icon_128.png
%TEMP%\scoped_dir_1172_9154\crx_install\img\share_off.png
%TEMP%\scoped_dir_1172_21945\nhhefclnfbjmnbbkhjplpnciolbbbdkd.crx
%TEMP%\scoped_dir_1172_21945\decoded_message_catalogs
%TEMP%\scoped_dir_1172_21945\decoded_images
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.update
%TEMP%\scoped_dir_1172_21945\crx_install\img\main_icon.png
%TEMP%\scoped_dir_1172_1133\ndfnaopimdacfcnbjdikmppjaamhgake.crx
%TEMP%\scoped_dir_1172_1133\decoded_message_catalogs
%TEMP%\scoped_dir_1172_1133\decoded_images
%TEMP%\scoped_dir_1172_4676\eeecheimdlkopnpajfcdmacgkjlkcmji.crx
%TEMP%\scoped_dir_1172_4676\decoded_message_catalogs
%TEMP%\scoped_dir_1172_4676\decoded_images
%LOCALAPPDATA%\amigo\user data\default\history.cp
%TEMP%\e655.tmp
%LOCALAPPDATA%\amigo\user data\default\secure preferences~rfd0b36.tmp

Moves the following files

from %LOCALAPPDATA%\amigo\temp\source1308_26848\chrome-bin\amigo.visualelementsmanifest.xml to %LOCALAPPDATA%\amigo\application\amigo.visualelementsmanifest.xml
from %LOCALAPPDATA%\amigo\user data\default\790e.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfc7925.tmp
from %LOCALAPPDATA%\amigo\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\local extension settings\pafkbggdmjlpgkdkcbjmhmfcdpncadgh\current
from %LOCALAPPDATA%\amigo\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\extension state\current
from %LOCALAPPDATA%\amigo\user data\default\8f4d.tmp to %LOCALAPPDATA%\amigo\user data\default\secure preferences
from %LOCALAPPDATA%\amigo\user data\default\secure preferences to %LOCALAPPDATA%\amigo\user data\default\secure preferences~rfc8f44.tmp
from %LOCALAPPDATA%\amigo\user data\default\local extension settings\egohihcbmlmdokfdoecjpdiadnkjgmdd\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\local extension settings\egohihcbmlmdokfdoecjpdiadnkjgmdd\current
from %LOCALAPPDATA%\amigo\user data\9141.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfc9137.tmp
from %LOCALAPPDATA%\amigo\user data\default\ac32.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfcff93.tmp
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfcac36.tmp
from %LOCALAPPDATA%\amigo\user data\bca7.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfcbc9a.tmp
from %LOCALAPPDATA%\amigo\user data\default\d46c.tmp to %LOCALAPPDATA%\amigo\user data\default\secure preferences
from %LOCALAPPDATA%\amigo\user data\default\secure preferences to %LOCALAPPDATA%\amigo\user data\default\secure preferences~rfcd44e.tmp
from %LOCALAPPDATA%\amigo\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\session storage\current
from %LOCALAPPDATA%\amigo\user data\e4e2.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfce530.tmp
from %LOCALAPPDATA%\amigo\user data\default\transportsecurity to %LOCALAPPDATA%\amigo\user data\default\transportsecurity~rfcfc96.tmp
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfc6122.tmp
from %LOCALAPPDATA%\amigo\user data\default\a1d5.tmp to %LOCALAPPDATA%\amigo\user data\default\transportsecurity
from %LOCALAPPDATA%\amigo\user data\612a.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg
from %LOCALAPPDATA%\amigo\temp\source1308_26848\chrome.7z to %LOCALAPPDATA%\amigo\application\47.5.2526.173\installer\chrome.7z
from %LOCALAPPDATA%\amigo\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\amigo\user data\default\e0bd.tmp to %LOCALAPPDATA%\amigo\user data\default\google profile.ico
from %LOCALAPPDATA%\amigo\user data\default\fed6.tmp to %LOCALAPPDATA%\amigo\user data\default\network persistent state
from %LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg
from %LOCALAPPDATA%\amigo\user data\933.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\default\934.tmp to %LOCALAPPDATA%\amigo\user data\default\secure preferences
from %LOCALAPPDATA%\amigo\user data\default\944.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\default\extension rules\000001.dbtmp to %LOCALAPPDATA%\amigo\user data\default\extension rules\current
from %LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg
from %LOCALAPPDATA%\amigo\user data\default\51ed.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\config.amg
from %LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.new to %LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg
from %LOCALAPPDATA%\amigo\user data\2a1f.tmp to %LOCALAPPDATA%\amigo\user data\local state
from %LOCALAPPDATA%\amigo\user data\local state to %LOCALAPPDATA%\amigo\user data\local state~rfc2af6.tmp
from %LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\2953.tmp to %LOCALAPPDATA%\amigo\user data\default\web applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\амиго.музыка.ico
from %LOCALAPPDATA%\amigo\user data\default\2a5e.tmp to %LOCALAPPDATA%\amigo\user data\default\extension data
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfc2b15.tmp
from %LOCALAPPDATA%\amigo\user data\default\3180.tmp to %LOCALAPPDATA%\amigo\user data\default\secure preferences
from %LOCALAPPDATA%\amigo\user data\default\secure preferences to %LOCALAPPDATA%\amigo\user data\default\secure preferences~rfc31f8.tmp
from %LOCALAPPDATA%\amigo\user data\default\extension data to %LOCALAPPDATA%\amigo\user data\default\extension data~rfc51e6.tmp
from %LOCALAPPDATA%\amigo\user data\default\secure preferences to %LOCALAPPDATA%\amigo\user data\default\secure preferences~rfd0b36.tmp

Substitutes the following files

%LOCALAPPDATA%\amigo\user data\default\history.cp
%TEMP%\scoped_dir_1172_13355\crx_install\img\48x48.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_128.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_16.png
%TEMP%\scoped_dir_1172_28534\crx_install\img\favorites_48.png
%LOCALAPPDATA%\amigo\user data\local state
%LOCALAPPDATA%\amigo\user data\default\extension data
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon128.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon16.png
%TEMP%\scoped_dir_1172_16184\crx_install\img\icons\icon48.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.update
%LOCALAPPDATA%\amigo\user data\default\secure preferences
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon128.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon16.png
%TEMP%\scoped_dir_1172_27076\crx_install\img\icons\amigo\icon48.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_128.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\32x32.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_16.png
%TEMP%\scoped_dir_1172_13355\crx_install\img\16x16.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg
%TEMP%\scoped_dir_1172_21945\crx_install\img\main_icon.png
%TEMP%\scoped_dir_1172_9154\crx_install\img\share_off.png
%TEMP%\scoped_dir_1172_25424\crx_install\images\icon_128.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\local_common.amg
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_128.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_16.png
%TEMP%\scoped_dir_1172_17145\crx_install\img\download_48.png
%TEMP%\scoped_dir_1172_17965\crx_install\img\mail_off.png
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\check_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.new
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg
%LOCALAPPDATA%\amigo\user data\amigo_safe\force_update_policy.amg.update
%LOCALAPPDATA%\amigo\user data\amigo_safe\state_policy.amg.new
%TEMP%\scoped_dir_1172_13355\crx_install\img\128x128.png
%TEMP%\scoped_dir_1172_12458\crx_install\img\chrome_48.png

Network activity

Connects to

'bs.###go.mail.ru':80
'clients4.google.com':443
'tr######e.googleapis.com':443
'vk.com':443
'ok.ru':443
'bs.yandex.ru':443
'co####r.yadro.ru':443
'tn###ounter.ru':443
'ap#.###oklassniki.ru':80
'r.##adx.net':443
'da##.#migo.mail.ru':80
'ss#.#static.com':443
'ma#l.ru':80
'xm#.###update.mail.ru':80
'ma######dater.cdnmail.ru':80
'bi####ate.mail.ru':80
'mr##.mail.ru':80
'ma#l.ru':443
'tw##ter.com':443

TCP

HTTP GET requests

http://bs.###go.mail.ru/update/2/version.txt?ve#################################################################################################
http://bs.###go.mail.ru/update/2/version.txt?ve#####################################################################################################################################
http://ma#l.ru/cnt/1514499?gp######
http://da##.#migo.mail.ru/state_policy.amg?ve##########################################################################################################################################
http://da##.#migo.mail.ru/config.amg?ve####################################################################################################################################
http://da##.#migo.mail.ru/force_update_policy.amg?ve#############################################################################################################################################...
http://da##.#migo.mail.ru/check_policy.amg?ve##########################################################################################################################################
http://bs.###go.mail.ru/update/2/version.txt?ve################################################################################################################################################
http://bs.###go.mail.ru/update/2/version.txt?ve##########################################################################################################################################
http://ap#.###oklassniki.ru/
http://bs.###go.mail.ru/update/2/version.txt?ve##################################################################################################################################################...
http://xm#.###update.mail.ru/audit_config.mrdj
http://bi####ate.mail.ru/amigo/version2.xml?ma###################################################################################################################################################...
http://bi####ate.mail.ru/chrome/version2.xml?ma##################################################################################################################################################...
http://xm#.###update.mail.ru/tasks.mrdj?ma#######################################################################################################################################################...
http://xm#.###update.mail.ru/cache_policy.mrdj
http://ma######dater.cdnmail.ru/updater_beta.exe
http://bi####ate.mail.ru/updater/version.xml?ma##################################################################################################################################################...
http://mr##.mail.ru/update/2/version.txt?ty######################################################################################################################################################...
http://xm#.###update.mail.ru/friends.mrdj
http://am###.appsmail.ru/platform/api

HTTP POST requests

http://s.###go.mail.ru/sid.408?v_################################################################################################################################################################...

Other

'ss#.#static.com':443
'clients4.google.com':443
'cs####ort.mail.ru':443
'pr####y-cs.mail.ru':443
'tr######e.googleapis.com':443
'bs.###go.mail.ru':443
'vk.com':443
'ok.ru':443
'bs.yandex.ru':443
'co####r.yadro.ru':443
'xr##.mail.ru':443
'ma##.##dar.imgsmail.ru':443
'tn###ounter.ru':443
'im#.#mgsmail.ru':443
'po###l.mail.ru':443
'rs.#ail.ru':443
'r.##adx.net':443
'to####z1.mail.ru':443
'li##.#mgsmail.ru':443
'ma#l.ru':443
'we####ser.mail.ru':443
'ap#.vk.com':443

UDP

DNS ASK bs.###go.mail.ru
DNS ASK tn###ounter.ru
DNS ASK co####r.yadro.ru
DNS ASK st##.##dar.imgsmail.ru
DNS ASK bs.yandex.ru
DNS ASK s.###go.mail.ru
DNS ASK mc####tal.mail.ru
DNS ASK vk.com
DNS ASK ok.ru
DNS ASK pr####y-cs.mail.ru
DNS ASK r3.#ail.ru
DNS ASK cs####ort.mail.ru
DNS ASK clients4.google.com
DNS ASK we####ser.mail.ru
DNS ASK ap#.###oklassniki.ru
DNS ASK tw##ter.com
DNS ASK am###.appsmail.ru
DNS ASK ap#.vk.com
DNS ASK xr##.mail.ru
DNS ASK clients2.google.com
DNS ASK ma##.##dar.imgsmail.ru
DNS ASK po###l.mail.ru
DNS ASK mr##.mail.ru
DNS ASK bi####ate.mail.ru
DNS ASK google.com
DNS ASK ma######dater.cdnmail.ru
DNS ASK xm#.###update.mail.ru
DNS ASK ma#l.ru
DNS ASK tr######e.googleapis.com
DNS ASK ss#.#static.com
DNS ASK da##.#migo.mail.ru
DNS ASK rs.#ail.ru
DNS ASK ad.#ail.ru
DNS ASK li##.#mgsmail.ru
DNS ASK to####z1.mail.ru
DNS ASK r.##adx.net
DNS ASK re###ma.mail.ru
DNS ASK an.#ail.ru
DNS ASK b2.#ail.ru
DNS ASK im#.#mgsmail.ru
DNS ASK se#####.amigo.mail.ru

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Amigo\User Data'

Creates and executes the following

'%TEMP%\cr_55880.tmp\setup.exe' --install-archive="%TEMP%\CR_55880.tmp\CHROME.PACKED.7Z"
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.26.882246202\1262149620" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.25.348127016\1477963182" --lang=en-US --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=renderer --lang=en-US --force-fieldtrials=AutofillClassifier/Enabled/*AutofillFieldMetadata/Enabled/*AutomaticTabDiscarding/Enabled/*BrowserBlacklist/Enabled/CaptivePortalInterstitial/En...
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.23.124824212\44631679" --lang=en-US --no-sandbox /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=renderer --lang=en-US --force-fieldtrials=AutofillClassifier/Enabled/AutofillFieldMetadata/Enabled/*AutomaticTabDiscarding/Enabled/*BrowserBlacklist/Enabled/CaptivePortalInterstitial/Ena...
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=renderer --lang=en-US --force-fieldtrials=AutofillClassifier/Enabled/AutofillFieldMetadata/Enabled/*AutomaticTabDiscarding/Enabled/BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enab...
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.12.917908490\842065006" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_16184" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.11.1157783422\321260082" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_21945" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.10.1916723324\916214252" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_1133" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.9.1688131776\1355962865" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_13355" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.8.395115685\1020880046" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_17145" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.27.1526121953\67341245" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_22322" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.7.1799437028\1603670777" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_17965" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.5.1095872632\20644600" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_9154" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.4.1437047558\1330000564" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_28534" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.3.252329780\1959661860" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_27076" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.2.2135465412\1804548445" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_4676" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=renderer --lang=en-US --force-fieldtrials=AutofillClassifier/Enabled/AutofillFieldMetadata/Enabled/AutomaticTabDiscarding/Enabled/BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enabl...
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.1.14251675\1933967252" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_12458" --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\mail.ru\mailruupdater\mailruupdater.exe' --s
'%LOCALAPPDATA%\mail.ru\mailruupdater.exe'
'%LOCALAPPDATA%\amigo\application\amigo.exe'
'%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\unitywebplayer.exe' /S
'%TEMP%\amigo_ffa3c3e0-b3b6-4d8c-928c-75aa59a806a0\mailruupdater.exe' --install
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.6.820670888\82726786" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_25424" --ignored=" --type=renderer " /prefetch:-645351001
'%LOCALAPPDATA%\amigo\application\amigo.exe' --type=utility --channel="1172.28.664949949\684995629" --lang=en-US --utility-allowed-dir="%TEMP%\scoped_dir_1172_19276" --ignored=" --type=renderer " /prefetch:-645351001

Executes the following

'%LOCALAPPDATA%\mail.ru\mailruupdater.exe' ' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial