Adware.Downware.2077

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\services\Guard.Mail.ru] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%TEMP%\GuardMailRu.exe' /install /nocheck
'%PROGRAM_FILES%\Mail.Ru\Guard\GuardMailRu.exe'
'%TEMP%\GuardMailRu.exe' /INSTALL2 /LANG=ru /GUID={53A5189C-21E6-45C7-BFC2-BF114FA47A0F}
'<Current directory>\MedalHonorWG_9370816_270.exe'
'%HOMEPATH%\Documents\MailRuSputnik.exe' /silent /rfr=openpart /partner_new_url=http://lo###oney.ru/v_install?si############################## /partner_online_url=http://lo###oney.ru/coi?gu#####################################

Executes the following:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" "%PROGRAM_FILES%\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" ENABLE ALL
'<SYSTEM32>\conhost.exe'
'<SYSTEM32>\reg.exe' import C:/Users/FFPXOMEV/AppData/Local/Temp/ie.reg
'<SYSTEM32>\cscript.exe' //B //Nologo "%TEMP%\shortcut.js"

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\start_search.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\stop.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\st_d.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\st_u.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\stream_green_100x17.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\add_ico.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\add_ico_1.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\stream_logo_120x90.bmp
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\404_form.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\travel.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\troecarstvie.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\top.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\torg.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\tv.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\weather.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\widget.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\video.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\wap.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\logoback155.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\portal-menu__bg.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\input_right.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\logo.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbail_bg.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\toolbar-logo.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tria.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbnail_bg.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbnail_bg_1.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\bg_line.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\button.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\ajax-loader.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\ajax-loader_1.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\button_bg.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\ico.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\input_bg.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\close.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\form.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\hi_tech.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\horo.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\foto.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\games.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\hosting.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\lady.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\legenda.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\jagger.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\jokes.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\deti.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\dictionaries.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\content.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\crossfire.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\drive.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\encyclopedies.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\files.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\education.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\email.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\pics.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\rabota.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\ok.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\perfect_world.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\realty.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\soft.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\sputnik.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\search.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\showbiz.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\mail_agent.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\maps.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\loong.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\love.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\mobile.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\my_world.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\news.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\money.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\my_site.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\trib.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\send.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\storage.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\search.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\searchControl.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\toolbar.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\webMetrics.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\xcom.services.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\version.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\vote.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\ggrelease.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\highlighter.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\ggdebug.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\gglib.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\httpRequestObserver.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\rawdeflate.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\resizeImage.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\installation.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\observers.js
%PROGRAM_FILES%\Mail.Ru\Sputnik\MailRuSputnik.dll
%PROGRAM_FILES%\Mail.Ru\Sputnik\SputnikFlashPlayer.exe
%TEMP%\shortcut.js
%APPDATA%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mail.Ru.lnk
%PROGRAM_FILES%\Mail.Ru\Sputnik\MailRuSputnik.exe
%PROGRAM_FILES%\Mail.Ru\Guard\GuardMailRu.exe
<SYSTEM32>\config\systemprofile\AppData\Roaming\{DCD48218-E972-4d0c-9E5F-43462BC13E3B}\{9bed5ee2-0547-4706-8600-d3897629ade0}
%TEMP%\GuardMailRu.exe
<Auxiliary element>
%TEMP%\ie.reg
%HOMEPATH%\Favorites\Mail.Ru.url
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\xcom.services.ok.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\xmlObjects.js
%HOMEPATH%\Favorites\Mail.Ru Агент - используй для общения!.url
<LS_APPDATA>Low\Mail.Ru\Sputnik\MailRu.ico
%TEMP%\Mail.Ru.lnk
<LS_APPDATA>Low\Mail.Ru\GoMailRu.ico
%HOMEPATH%\Desktop\Искать в Интернете.url
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_10.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_4.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_8.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_9.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_5.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_8.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_9.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_6.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_7.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_8.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_9.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_10.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_5.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_10.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_6.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_7.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_4.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_5.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\defaults\preferences\mail.ru.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\install.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\components\odnoklassniki.xcom.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\components\sputnik.xcom.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\addonListener.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\base64.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\chevron.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\ajaxService.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\attention.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_5.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_6.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_10.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_4.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_7.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather_default.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\zoom.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_8.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_9.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.chf.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.cny.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.byr.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.cad.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.dkk.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.isk.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.jpy.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.eur.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.gbp.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.search_provider.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.searchtools.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\contents.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\http_form_strings.properties
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.toolbar.properties
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.2gis.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.aud.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.weather_city.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\InformerStream.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.my.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.provider.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.maps.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.money.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.url-rank.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.fast-services.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.search.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.weather.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.cyrrencies.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.sek.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.sgd.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.kzt.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.nok.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.try.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.xdr.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.mail.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.uah.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.usd.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\defaultValue.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\informerPanel.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\chevron.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\contents.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\mail.ru.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\newtabhomepage.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\save_controls.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\music_window.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\newtab.xul
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.tmp
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\MRSputnikData\install_options.xml
<Current directory>\MedalHonorWG_9370816_270.exe
%HOMEPATH%\Documents\MailRuSputnik.exe
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\META-INF\manifest.mf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome.manifest
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\brand.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\META-INF\zigbert.rsa
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\META-INF\zigbert.sf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\404_form.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\contents.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\tabs_storage.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\tools.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\logo.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\ansi.properties
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\blank.html
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\logoback155.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\search404.css
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\settings.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\settings.xul
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\search.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\search.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\mailruInformers.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\sputnik.toolbar.xul
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\tabs.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\mailruObservers.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\sputnik.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.services.xml
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\marks.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\messages.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mailru_logo.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\map.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\money.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\odnoklassniki_info_logo.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\odnoklassniki_logo.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\notifications.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\odnoklassniki.ru.toolbar.css
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\hilite_text.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\informer_class.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\gripper.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\guests.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\jams_100x17.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.ru.tabs.css
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.ru.toolbar.css
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.ru.search.css
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\blogs.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\boomz.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\auto.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\berserk.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\bugz.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\catalog.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\chats.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\business_tycoon.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\cards.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\search_discuss.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\search_page.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\preferences.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\req_vote.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\search_text.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\allods.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\answers.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\3sider.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\afisha.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\contents.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\aud_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\checkbox-disabled.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\checkbox-unchecked.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\byr_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\cny_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\dkk_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\cad_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\chf_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\2gis.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\arrow.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.toolbar.dtd
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik_form_edit.html
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\back.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\c_t.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\checkbox-checked.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\back_dark.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\c_b.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\xdr_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currency_arrow_down.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\uah_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\usd_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currency_arrow_up.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\flow.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\greycar.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\discussions.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\eqv.gif
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\isk_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\jpy_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\eur_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\gbp_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\kzt_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\sgd_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\try_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\nok_na.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\sek_na.png

Deletes the following files:

%TEMP%\Mail.Ru.lnk
%TEMP%\shortcut.js

Moves the following files:

from %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.tmp to %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.js

Network activity:

UDP:

DNS ASK dn#.##ftncsi.com
DNS ASK mr#.mail.ru

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial