Trojan.Crossrider1.57325

Technical Information

Malicious functions

Terminates or attempts to terminate

the following user processes:

iexplore.exe
firefox.exe

Registers BHO

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411351167}]

Modifies file system

Creates the following files

%TEMP%\nsz7f2e.tmp
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\install.rdf
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\locale\en-us\translations.dtd
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\defaults\preferences\prefs.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins.json
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\manifest.xml
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\78_crossriderinfo.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\16_ffappapiwrapper.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\14_crossriderutils.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\64_appapimessage.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\72_appapivalidation.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\47_resources_background.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon128.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\98_omnicommands.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\22_resources.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\4_jquery_1_7_1.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\17_jquery.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\28_initializer.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\13_crossriderapputils.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\21_debug.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\usercode\extension.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\usercode\background.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\options.xul
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\dialog.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\background.html
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\search_dialog.xul
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button4.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\prefs.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\crossrider_statusbar.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\panelarrow-up.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\main.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\utils.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\request.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\firefoxnotifications.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\message.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\pageaction.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\firefoxomnibox.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\dbmanager.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\background.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\webrequest.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\firefox.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\filemanager.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\baseobject.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\uninstallobserver.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\1_base.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\contextmenu.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\dom_bg.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon48.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\popup.html
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\update.css
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button2.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button5.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\skin.css
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon24.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button3.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button1.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon16.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\asyncdb.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\browseraction.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\tabs.js
%LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1-journal
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\asyncdb.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\browseraction.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\tabs.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\dom_bg.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon48.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\popup.html
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\update.css
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button2.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button5.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\skin.css
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon24.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button3.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button1.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\contextmenu.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\requestobject.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\filemanager.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\crossrider_statusbar.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\button4.png
%ProgramFiles(x86)%\razi\razi-codedownloader.exe
%ProgramFiles(x86)%\razi\razi-helper.exe
%ProgramFiles(x86)%\razi\razi-buttonutil.exe
%ProgramFiles(x86)%\razi\razi-buttonutil64.exe
%ProgramFiles(x86)%\razi\razi-buttonutil.dll
%ProgramFiles(x86)%\razi\razi-buttonutil64.dll
%ProgramFiles(x86)%\razi\razi.ico
%ProgramFiles(x86)%\razi\razi-bho.dll
%ProgramFiles(x86)%\razi\razi-bho64.dll
%ProgramFiles(x86)%\razi\background.html
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\panelarrow-up.png
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon16.png
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\extensiondatastore.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\webrequest.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\httpobserver.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\xhr.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\searchsettings.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\reloadobserver.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\logfile.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\prefs.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\registry.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\updatemanager.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\console.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\delegate.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\consts.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\progresslistenerobserver.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\reports.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\firefox.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\options.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\browser.xul
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\idbwrapper.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\requestobject.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\uninstallobserver.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\extensiondatastore.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\utils.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\request.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\firefoxnotifications.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\message.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\pageaction.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\firefoxomnibox.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\dbmanager.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api\background.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\folderiowrapper.js
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\installer.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\idbwrapper.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\httpobserver.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\folderiowrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\crossriderapi.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\reports.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\installer.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\onbgdocumentload.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\events.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\extensiondatastore.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\storagewrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\api\message.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\api\pageaction.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\api\cookie.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\api\chrome.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\util.js
%ProgramFiles(x86)%\razi\uninstall.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\consts.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\api\pageactionbg.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\icons\actions\1.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\icons\icon16.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\icons\icon128.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\manifest.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins.json
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\manifest.xml
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\78_crossriderinfo.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\14_crossriderutils.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\64_appapimessage.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\72_appapivalidation.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\47_resources_background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\popup.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\background.html
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\icons\icon48.png
%ProgramFiles(x86)%\razi\razi-bg.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\1_base.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\cookie_store.js
%TEMP%\nsz7f3f.tmp\tdctij.tmp
%TEMP%\nsz7f3f.tmp\wrapperutils.dll
%TEMP%\nsz7f3f.tmp\iaezlcuzcnpzl.exe
%TEMP%\nsz7f3f.tmp\stdutils.dll
%TEMP%\nsub413.tmp
%TEMP%\nskb424.tmp\stdutils.dll
%TEMP%\nskb424.tmp\system.dll
%TEMP%\nskb424.tmp\nsislog.dll
%TEMP%\raziinstaller_1728599173.log
%TEMP%\nskb424.tmp\installerutils.dll
%TEMP%\nskb424.tmp\nsisos.dll
%TEMP%\nskb424.tmp\md5dll.dll
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\updatemanager.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\app_api.js
%TEMP%\nskb424.tmp\userinfo.dll
%TEMP%\nskb424.tmp\temp_file_before.tmp
%TEMP%\nskb424.tmp\temp_file_after.tmp
%TEMP%\nskb424.tmp\razi.zip
%TEMP%\nskb424.tmp\zipdll.dll
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\main.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\xhr.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\logging.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\popupresource\popup.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\popupresource\newpopup.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\logfile.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\bg_app_api.js
%TEMP%\nsz7f3f.tmp\system.dll
%TEMP%\nskb424.tmp\crnsisplugins.dll
%APPDATA%\mozilla\firefox\profiles\q0evdndb.default\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\skin\icon128.png
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\97_resourceapiwrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\17_jquery.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\28_initializer.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\13_crossriderapputils....
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\21_debug.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\usercode\extension.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\usercode\background.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\options.xul
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\dialog.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\background.html
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\search_dialog.xul
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\baseobject.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\main.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\api.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\22_resources.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\17_jquery.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\4_jquery_1_7_1.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\searchsettings.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\reloadobserver.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\logfile.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\prefs.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\registry.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\updatemanager.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\console.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\delegate.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\consts.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\progresslistenerobserver...
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\reports.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\installer.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\options.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\core\xhr.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\4_jquery_1_7_1.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome\content\browser.xul
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\js\lib\delegate.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\80_chpopupappapi.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\28_initializer.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\13_crossriderapputils.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\21_debug.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\plugins\19_chappapiwrapper.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\usercode\extension.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\extensiondata\usercode\background.js
%LOCALAPPDATA%\google\chrome\user data\default\extensions\mdooeifdfabalfdkobogpkljhfpakegb\1.25.4_0\crossridermanifest.json
%TEMP%\nskb424.tmp\scs.exe
%TEMP%\nskb424.tmp\cookiedbindex.bat
%TEMP%\nskb424.tmp\execdos.dll
%TEMP%\nskb424.tmp\cookiedbindex.txt
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\98_omnicommands.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\22_resources.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\1_base.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\install.rdf
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\locale\en-us\translations.dtd
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\defaults\preferences\prefs.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\chrome.manifest
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins.json
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\manifest.xml
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\78_crossriderinfo.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\16_ffappapiwrapper.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\14_crossriderutils.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\64_appapimessage.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\72_appapivalidation.js
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions\61987118-bddd-4e2f-93a0-16233b16de9e@547dd241-215f-4422-b903-63091f87ba40.com\extensiondata\plugins\47_resources_backgroun...
%LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1
%TEMP%\nskb424.tmp\razi.xpi
%ProgramFiles(x86)%\razi\installer.log

Deletes the following files

%LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1-journal
%TEMP%\nsz7f3f.tmp\system.dll
%TEMP%\nsz7f3f.tmp\stdutils.dll
%TEMP%\nsz7f3f.tmp\iaezlcuzcnpzl.exe
%TEMP%\nskb424.tmp\zipdll.dll
%TEMP%\nskb424.tmp\userinfo.dll
%TEMP%\nskb424.tmp\temp_file_before.tmp
%TEMP%\nskb424.tmp\temp_file_after.tmp
%TEMP%\nskb424.tmp\system.dll
%TEMP%\nskb424.tmp\stdutils.dll
%TEMP%\nsz7f3f.tmp\tdctij.tmp
%TEMP%\nskb424.tmp\scs.exe
%TEMP%\nskb424.tmp\razi.xpi
%TEMP%\nskb424.tmp\nsisos.dll
%TEMP%\nskb424.tmp\nsislog.dll
%TEMP%\nskb424.tmp\md5dll.dll
%TEMP%\nskb424.tmp\installerutils.dll
%TEMP%\nskb424.tmp\execdos.dll
%TEMP%\nskb424.tmp\crnsisplugins.dll
%TEMP%\nskb424.tmp\cookiedbindex.txt
%TEMP%\nskb424.tmp\cookiedbindex.bat
%TEMP%\nskb424.tmp\razi.zip
%TEMP%\nsz7f3f.tmp\wrapperutils.dll

Modifies the following files

%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal
%LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js

Substitutes the following files

%LOCALAPPDATA%\google\chrome\user data\default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1-journal

Network activity

UDP

DNS ASK st###.#tatsmyapp.com
DNS ASK ap######ic.crossrider.com
DNS ASK er####.statsmyapp.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\nsz7f3f.tmp\iaezlcuzcnpzl.exe'
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\Databases.db" "SELECT id FROM Databases WHERE name = 'crossrider_cookies_43567' LIMIT 1"
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\Databases.db" "INSERT INTO Databases (origin, name, description, estimated_size) VALUES('chrome-extension_mdooeifdfabalfdkobogpkljhfpak...
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallerParams','{\"value\" ...
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationTime','{\"value\"...
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationThankYouPage','{\...
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO internaldb (name,value,expires) values('InstallerIdentifiers','{\"...
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO internaldb (name,value,expires) values('chrome_enabled','{\"value\...
'%ProgramFiles(x86)%\razi\razi-codedownloader.exe' /installapp /agentregpath='Razi' /appid=43567 /srcid='DM-1' /subid='0' /zdata='0' /bic=E7FDF8D5F2704987A83CDE51BF1453EDIE /verifier=ca16f5409dfc107217d469e4a212003b /installerversion=1_28_153 /...
'%ProgramFiles(x86)%\razi\razi-helper.exe' /externallog='%TEMP%\RaziInstaller_1728599173.log'
'%ProgramFiles(x86)%\razi\razi-bg.exe' /executebg /externallog='%TEMP%\RaziInstaller_1728599173.log'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nskB424.tmp\CookieDbIndex.bat
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Razi\Razi-bho.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Razi\Razi-bho64.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Razi\Razi-bho64.dll"
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nskB424.tmp\CookieDbIndex.bat' (with hidden window)
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\Databases.db" "INSERT INTO Databases (origin, name, description, estimated_size) VALUES('chrome-extension_mdooeifdfabalfdkobogpkljhfpak...' (with hidden window)
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallerParams','{\"value\" ...' (with hidden window)
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationTime','{\"value\"...' (with hidden window)
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO cookies (name,value,expires) values('InstallationThankYouPage','{\...' (with hidden window)
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO internaldb (name,value,expires) values('InstallerIdentifiers','{\"...' (with hidden window)
'%TEMP%\nskb424.tmp\scs.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\databases\chrome-extension_mdooeifdfabalfdkobogpkljhfpakegb_0\1" "REPLACE INTO internaldb (name,value,expires) values('chrome_enabled','{\"value\...' (with hidden window)
'%ProgramFiles(x86)%\razi\razi-codedownloader.exe' /installapp /agentregpath='Razi' /appid=43567 /srcid='DM-1' /subid='0' /zdata='0' /bic=E7FDF8D5F2704987A83CDE51BF1453EDIE /verifier=ca16f5409dfc107217d469e4a212003b /installerversion=1_28_153 /...' (with hidden window)
'%ProgramFiles(x86)%\razi\razi-helper.exe' /externallog='%TEMP%\RaziInstaller_1728599173.log'' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Razi\Razi-bho.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Razi\Razi-bho64.dll"' (with hidden window)
'%ProgramFiles(x86)%\razi\razi-bg.exe' /executebg /externallog='%TEMP%\RaziInstaller_1728599173.log'' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial