Should I block it?

No, this file is 100% safe to run.

Additional versions

1, 0, 0, 123	46.67%
1, 0, 0, 98	6.67%
1, 0, 0, 98	6.67%
1, 0, 0, 91	20.00%
1, 0, 0, 40	20.00%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegEnumKeyExW, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, RegOpenKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegQueryValueExW, RegSetValueExW, RegQueryInfoKeyW, OpenProcessToken, LookupAccountSidW, ConvertSidToStringSidW

comctl32.dll

InitCommonControlsEx

gdi32.dll

DeleteObject, SelectObject, DeleteDC, CreateCompatibleBitmap, CreateCompatibleDC, GetStockObject, BitBlt, GetDeviceCaps, CreateSolidBrush, GetObjectW

kernel32.dll

DllMain

ole32.dll

CoCreateGuid, StringFromCLSID, CoInitialize, CoUninitialize, OleUninitialize, OleInitialize, CreateStreamOnHGlobal, CLSIDFromString, CLSIDFromProgID, CoGetClassObject, OleLockRunning, StringFromGUID2, CoTaskMemFree, CoCreateInstance, CoTaskMemRealloc, CoTaskMemAlloc

shell32.dll

CommandLineToArgvW, SHGetSpecialFolderPathW, ShellExecuteExW, SHGetFolderPathW

urlmon.dll

CoInternetParseUrl

user32.dll

SetWindowLongW, SetCapture, RedrawWindow, GetDesktopWindow, GetWindowLongW, DefWindowProcW, CharNextW, GetSysColor, MoveWindow, SetWindowPos, wsprintfW, LoadStringA, GetClientRect, ClientToScreen, ScreenToClient, GetDC, ReleaseDC, InvalidateRect, UnregisterClassA, MessageBoxW, RegisterWindowMessageW, GetWindowTextLengthW, GetWindowTextW, SetWindowTextW, CreateAcceleratorTableW, CreateWindowExW, RegisterClassExW, LoadCursorW, GetClassInfoExW, IsWindow, SendMessageW, SetFocus, GetFocus, GetWindow, DestroyAcceleratorTable, IsChild, BeginPaint, EndPaint, CallWindowProcW, DestroyWindow, FillRect, ReleaseCapture, GetClassNameW, GetDlgItem, GetParent, InvalidateRgn, LoadStringW

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

ws2_32.dll

getaddrinfo, WSASocketW, WSASend, WSARecv, freeaddrinfo

wtsapi32.dll

WTSQueryUserToken, WTSEnumerateSessionsW, WTSFreeMemory

MailRuUpdater.exe

MailRuUpdater by LLC Mail.Ru (Signed)

Remove MailRuUpdater.exe

Version:	1, 0, 0, 91
MD5:	3866063d9c790c87b19bf6a6df319c7f
SHA1:	25cd922bcb76e094f5d9a1fc532a85e169a65449
SHA256:	a6835125ec2e1cc09647994c6de099e4202cad341722cf22cdb5b2623e2716ef

What is MailRuUpdater.exe?

Mail.Ru updater is the software updater program which runs in the background of Windows and automatically starts up when your PC boots. It checks for software udpates and automatically downloads and installs them if found. The updater will check for updates remotely and install them based on an internal schedule.

Overview

mailruupdater.exe executes as a process with the local user's privileges. It is set to be run when the PC boots and the user logs into Windows (added to the Run registry key for the current user). The file is digitally signed by LLC Mail.Ru which was issued by the Thawte certificate authority (CA). Note, some antivirus scanners have flagged this file, however it is not necessarily considered malware (see below for details).

Details

File name:	mailruupdater.exe
Publisher:	Mail.Ru
Product name:	MailRuUpdater
Description:	Mail.Ru updater
Typical file path:	C:\users\user\appdata\local\mail.ru\mailruupdater.exe
File version:	1, 0, 0, 91
Size:	1.48 MB (1,554,976 bytes)
Certificate
Issued to:	LLC Mail.Ru
Authority (CA):	Thawte
Effective date:	Monday, September 12, 2011
Expiration date:	Wednesday, July 2, 2014
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Startup files (user) run

Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

'MailRuUpdater' → C:\users\user\appdata\Local\Mail.Ru\MailRuUpdater.exe

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00108146%	0.028634%
Kernel CPU:	0.00082023%	0.013761%
User CPU:	0.00026123%	0.014873%
Kernel CPU time:	6,006,039 ms/min	100,923,805ms/min
CPU cycles:	3,046/sec	17,470,203/sec
Context switches:	1/sec	284/sec
Memory
Private memory:	2.31 MB	21.59 MB
Private (maximum):	6.9 MB
Private (minimum):	832 KB
Non-paged memory:	2.31 MB	21.59 MB
Virtual memory:	68.63 MB	140.96 MB
Virtual memory (peak):	73.88 MB	169.69 MB
Working set:	2.56 MB	18.61 MB
Working set (peak):	6.98 MB	37.95 MB
Page faults:	24,224/min	2,039/min
I/O
I/O read transfer:	0 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	4 Bytes/sec	448.09 KB/min
I/O other operations:	2/sec	1,671/min
Resource allocations
Threads:	6	12
Handles:	110	600
GUI GDI count:	6	103
GUI GDI peak:	7	142
GUI USER count:	2	49
GUI USER peak:	2	71