Trojan.Zadved.676

Technical Information

Modifies file system

Creates the following files

%PROGRAMDATA%\mail.ru\id
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\thumbnails\games.mail.ru.jpeg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\thumbnails\mail.ru.jpeg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\thumbnails\news.mail.ru.jpeg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\thumbnails\torg.mail.ru.jpeg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\thumbnails\travel.mail.ru.jpeg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\01.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\02.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\03.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\04.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\wood_2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\thumbnails\calendar.mail.ru.jpeg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\05.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\08.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\09.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\10.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\11.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\application_core\file-system.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\application_core\jquery-core.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\application_core\sqlitestorage.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\application_core\visibletab.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\config\config.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\06.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\weather\07.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\libs\jquery-ui.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\google-analytics.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\themes__theme-fade-wrong.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\_flax.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\_mosaic.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\_wall.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-1.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-10.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-11.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-13.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-3.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\wall.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\_cookies.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\wood.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-4.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-8.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-9.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\leather.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\wood.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\wood_2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\themes__arrow-left.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\themes__arrow-right.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\themes__theme-fade-ok.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-5.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-6.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\body__bg-7.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\favicon.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\libs\jquery.js
%TEMP%\7425-4fd5-e5ff-d1e8
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\meta-inf\mozilla.rsa
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\meta-inf\mozilla.sf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\bootstrap.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\content\fx-metrics.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\content\loader.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\install.rdf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\skin\mail48.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\lib\version.js
%TEMP%\227e-ddf8-b809-87c1
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\homepage@mail.ru\meta-inf\manifest.mf
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qqkk58aj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6dkpkgld\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9rsaesst\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1es6aoif\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%TEMP%\amigo_ldir_2336_27279\227e-ddf8-b809-87c1
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\install.rdf
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\skin\vb-logo.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\visual-bookmarks.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\libs\suggests.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\bookmarks\drag_drop.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\bookmarks\edit-dialog.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\bookmarks\layout.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\bookmarks\remove-dialog.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\bookmarks\updates.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\currency.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\geo-monitoring.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\mail-counter.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\news.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\odnoklassniki-counter.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\main.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\searchbar.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\traffic.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\weather.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\proto\informer.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\proto\pane.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\proto\slider.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\proto\tab-strip.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\sandbox\facade.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\utils\utils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\manifest.json
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\mosaic.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\modules\themes.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\preview\_fabric.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\leather.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\flax.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\fabric.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\customscrollbar.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\dialog.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\general.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\grid.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\informers.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\menu.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\news.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\searchbar.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\background\background.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\newtabhomepage.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\background\modules.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\slide.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\themes.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\128x128.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\16x16.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\48x48.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\add_button.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\ajax_loader_mc.gif
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\clock.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\close.v2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\splash.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\suggests.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\css\tabs.css
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\overlay.xul
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\main.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\cross.png
%WINDIR%\syswow64\grouppolicy\gpt.ini
%LOCALAPPDATA%\mail.ru\gochromiumnativehost\manifest.json
%TEMP%\b5da-09a3-a02f-64bf
%LOCALAPPDATA%\mail.ru\gochromiumnativehost\native_host_app.exe
%TEMP%\cc88-acaa-54ea-9c2d
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\meta-inf\manifest.mf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\meta-inf\mozilla.rsa
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\meta-inf\mozilla.sf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\bootstrap.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\chrome.manifest
%TEMP%\upd86b6.tmp
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\content\fx-metrics.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\install.rdf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\skin\mail48.png
%TEMP%\992a-883c-d51d-13b5
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\meta-inf\manifest.mf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\meta-inf\mozilla.rsa
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\meta-inf\mozilla.sf
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\utils.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\fx-metrics.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\loader.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\search@mail.ru\content\loader.js
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\js\libs\knockout-2.2.1.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\dialog\close.v2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\exchange\exchange-3.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\searchbar.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\searchbar__button.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\sgmus.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\slide__control\slide__control-delete-hover.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\slide__control\slide__control-delete.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\slide__control\slide__control-edit-hover.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\slide__control\slide__control-edit.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\slider-arrow.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\pane-arrow.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-1.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\search_bg.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-11.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-3.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-4.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-5.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-6.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-7.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-8.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-9.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\cookies.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-10.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\background\background.js
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\themes\body__bg-13.jpg
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\reg1.bg.v2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\p-main_sub__gradient.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\no_photo.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\traffic\informers__traffic-jam.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\01.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\02.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\03.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\04.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\05.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\06.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\07.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\08.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\exchange\exchange-2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\09.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\11.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\leftright.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\loader.gif
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\loading.gif
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\logo.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\logo_bg.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\menu__item\menu__item-1.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\menu__item\menu__item-2.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\menu__item\menu__item-3.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\menu__item\menu__item-4.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\weather\10.png
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\multiauth.gif
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}\chrome\content\visual-bookmarks\images\informers\exchange\exchange-1.png
%TEMP%\amigo_scoped_dir_1583463082\227e-ddf8-b809-87c1.dul!

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qqkk58aj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6dkpkgld\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9rsaesst\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1es6aoif\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini

Deletes the following files

%TEMP%\b5da-09a3-a02f-64bf
%TEMP%\cc88-acaa-54ea-9c2d
%TEMP%\992a-883c-d51d-13b5
%TEMP%\7425-4fd5-e5ff-d1e8
%TEMP%\227e-ddf8-b809-87c1

Network activity

Connects to

'ar###il.adv.biz':80

TCP

HTTP GET requests

http://xm#.###update.mail.ru/switcher/conf.mrdj?co###############################################################################################################################################...
http://mr##.mail.ru/update/2/version.txt?ty######################################################################################################################################################...
http://mr##.mail.ru/update/2/version.txt?GU###############################################################################
http://am###dl.mail.ru/AmigoInstallerD1.exe

'go####dl.mail.ru':443

'xt#####ru.cdnmail.ru':443

'am###.mail.ru':443

UDP

DNS ASK go####dl.mail.ru
DNS ASK xm#.###update.mail.ru
DNS ASK mr##.mail.ru
DNS ASK ar###il.adv.biz
DNS ASK xt#####ru.cdnmail.ru
DNS ASK am###.mail.ru
DNS ASK am###dl.mail.ru

Miscellaneous

Creates and executes the following

'%TEMP%\upd86b6.tmp' --binded_data="AAAAAQAABE4AAAEAeyJwYXNzX3BheWxvYWQiOiB0cnVlLCAiY29tbWFuZF9saW5lIjogIiIsICJ0cyI6IDE0NzQyMTQ4NzMsICJxdWVyeV9zdHJpbmciOiAiYW1pZ29faW5zdGFsbD0xJnJmcj04MTE2NDImcGFydG5lcmlkPTgxMTY0Mi...
'%TEMP%\227e-ddf8-b809-87c1' --with-updater --ils=12 --no-gui --rfr=811642 --partner_new_url=http://ar###il.adv.biz/productApi/amigo?pr#######################################################################################...
'%TEMP%\amigo_ldir_2336_27279\227e-ddf8-b809-87c1' --ils=12 --rfr=811642 --partner_new_url=http://ar###il.adv.biz/productApi/amigo?pr###############################################################################################################...

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial