Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader7.1332

Added to the Dr.Web virus database: 2012-10-05

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0349-449c-8CDF-2767E7E6E2FA}] 'Exec' = 'http://yesmoney.co.kr/'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-2461-47fc-A02F-9EB8678B2A5C}] 'Exec' = 'http://event.go.co.kr/nbarcon/11.php?bncode=dbgoencoder'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ez_oneclick' = '"%PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe" -o'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-78A7-48d9-9094-E214DAB62467}] 'Exec' = 'http://event.go.co.kr/nbarcon/c.php?bncode=dbgoencoder'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-61C1-4d78-9748-81073EFB1E53}] 'Exec' = 'http://event.go.co.kr/nbarcon/gm.php?bncode=dbgoencoder'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-25AE-487c-8DD7-1CC9CE85512A}] 'Exec' = 'http://event.go.co.kr/nbarcon/au.php?bncode=dbgoencoder'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0386-42ec-9235-AB96A83F7FF1}] 'Exec' = 'http://event.go.co.kr/megapass/event.php?pid=dbgoencoder'
Malicious functions:
Executes the following:
  • <SYSTEM32>\cmd.exe /c \DelUS.bat
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Hmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Qook TVјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\іујц»кИЁјоЗО NSАМју.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\AKёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\CJmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\GS SHOP.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ёВВЇґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ДЅєЕёАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ЭЗ°јјАПґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ґЩїшёфґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\µрѕШјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\·ФµҐИЁјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\»зБЦєкАМґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј.com.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојјґ©ё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ѕЖАМГ§ё°Бц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\Б¦·ОЕхјјємґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\·О¶Зё®ДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\јјАМєкД«µе іЧєс°ФАМјЗ ЖчАОЖ® ±ёАФ ЗБ·ОёрјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\їЈД«БЯ°нВч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\Б¦АПД«іЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј»з¶ы.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ЗБё®Б¶ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\ё¶АМД«їНґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\їА·»БцёЮАМЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ(ѕуВЇАМєҐЖ®).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\№МЖГ2030.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\јТ°іЖГВтґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ЅМ±ЫЖДАМЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\µµ±ЧёѕѕЦ°ЯїлЗ°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\·ЇєкЖк.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ДЭ·єЕНёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ДЈ±ёЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Е·Д«ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\°ЗґгјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їш№ЩАМїш.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшѕоµҐАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЅЕјј°иёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ѕЖЅє№МїА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їмГј±№ јоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЗЗЕж»юїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\CLUB5678 №«·бИёїшёрБэ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ё®ѕуЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\АМё¶Ж®АОЕНіЭјоЗОёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ДБ№цЅєјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Ж®·»µеЗГ·ЇЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\єОАЪёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\АеёАґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\Бѕ°ЎЗЄµејҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ґЩЗПґ©ёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\µїїшёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\№Щ·ОБ¶ё® јц»кЅДЗ° ѕѕДо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ДЙѕојѕЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ЗЄµеё¶Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\GSєёЗ輥.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\БТЕҐ°ЈАе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ВьЕдЅДЗ°БЦЅДИё»з.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\Г»јЦ ІїІїєф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Гµїшґ©µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪё®ѕЖїЎ·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪ№Н19.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗЦЖјєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗеЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\БсјЅЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\G7ДїЗЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\±иИс¶у °щ°Ё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\іЧїАЅєА§Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Зп·ОїмЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\AbleMall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\CJON mart.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє·Јµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє№лё®ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\БѕЅЕєёЗиґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їмё®ѕЖєс№Щ»эён АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АМАЇґЩАМ·єЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅґіЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё®ЖІГµАз.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё¶АМєЈАМєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\єёё®єёё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\°ЎєЈіоАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\µрѕѕєП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\·№µеИъЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\·ФµҐГјЕ©Д«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ёЖЅєД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\№М·ЎАОЅґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\±ієё»эён АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ґЩ·зАОЖч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\·ФµҐјХЗШєёЗи.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅЕЗСД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч №«·бИёїш°ЎАФ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\»пјєД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\јјАМєкД«µе №Я±Ю ЅЕГ» АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅєЗЗµе№рЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗГ¶уАМїцДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗПЗБЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗПЗПёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖРјЗЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖРјЗЗГ·ЇЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗБ·ОїНДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ё¶АМѕЖё¶Бё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ѕЖАМЗПїмЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їЈБ¶АМґєїе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗгґП№цЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗмАМїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\OTTO.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ї§Бцёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їА°Ў°Ф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їИ№ЗЅєЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈБ¶АМ№Р¶х.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈЕНјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈЕНЅДЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ДЪАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ДЪДЪЖЛ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖјДДЖЫґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їНїНґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\А§БоЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\АПёрЅєЖ®ёґ.url
  • %HOMEPATH%\Desktop\Бс°ЬГЈ±в їБјЗ.url
  • %TEMP%\nsc2.tmp\stack.dll
  • %TEMP%\nsc2.tmp\SetHoldData.dll
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-№«єс.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - їБјЗ.url
  • %TEMP%\nsc2.tmp\DLLWebCount.dll
  • %TEMP%\nsc2.tmp\SelfDelete.dll
  • C:\DelUS.bat
  • %PROGRAM_FILES%\ez_oneclick\Uninstall.exe
  • %TEMP%\nsc2.tmp\registry.dll
  • %TEMP%\nsc2.tmp\IEFunctions.dll
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\Б¶АМєЈАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ЗПЗБЕ¬·ґґеДД.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - 11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їцДїИъ ёйјјБЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\А§БоА§µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\АЇё®Д«.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - NSіујц»кИЁјоЗО.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - d&shop.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - »пјєёф.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - CJmall.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - Gё¶ДП.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - KTmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АҐјЦ·зјЗЖЗёЕ CGIMALL.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЇµрїҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АОЖчё¶ЅєЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їўЅєЕ°ЖЫ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їБјЗ ЅєД«АМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їНїмµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДоЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДьґЩїо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖчЅєЖ®ёЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЧЕ©»зїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ВЇµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДДЅє±оЖд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\eЕ¬ё°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\°ЧЗГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґПБоДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ЖкГчё¶ДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\BCД«µе ЅЕїлБ¤єёєёИЈ ј­єсЅє ЅЕГ» АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\QOOKАОЕНіЭ Аь±№°ЎАФјѕЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\єн·зАҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Ѕ¦ѕо№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ѕЖЅОДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё®ѕуЅєДµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё¶АМЕ©·№µч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ёЮ°ЎЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єк·Јµе·Їєк.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єн·ўДэ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єн·ўЖз·Оїм.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\№«Е©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\№Дё®ѕИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єЈіЧЖј.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЅєЕёАПїЈБш.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ѕЖАМЅєЕёАП24.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈєс·и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\»м·ХіЄАО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ј±ґцї©їХ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЅґЕ°¶у.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ifumall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\±Э°­-·Јµе·О№Щёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\±Э»уГ·И­.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖъґхјјАМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЗС±№Б¤єёАОБх.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\LGЖРјЗјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ґхЅєЕЧАМБц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ёБ°нё®є».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ёнјєЅГ°и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄјї¶у.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄАО°Й.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄАОїИ№З.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¤·ВёЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\µµј­11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\µрБцЕР±ієё№®°н.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\№ЭµрѕШ·зґПЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\їА№цГЯѕо ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\YES24.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ґл±ієПЅєДµ(Bookscan).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ѕЖАМєсєП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\їҐіЭґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\АОЕНіЭј­БЎ ё®єк·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\»з¶ыБц±в.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\»пјєєПЅєґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ѕѕіЧБ¶АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅЕЗС±ЭА¶Б¤єё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ѕЛЗБЅє·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\їмё®ЖДАМіЅјИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\№МБо»з¶ы.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\»кїНёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅєЕё»уИЈАъГаАєЗа ЗПАМ·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\іЭЗЗѕЖґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ёфјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ј­ДЎѕИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\АМБц·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЗСЅЕ±ЭА¶ »уґгЅЕГ» .url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\°ЎєсѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЁЖ®·Ўєн.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЩ¶уДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\µµіКГчїµИ­.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ЕхѕоАНЅєЗБ·№Ѕє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ЗГ·№АХ°сЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЈЕЪЖ®ё®Ѕє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\јјАМ№ВБч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ЅЙЅЙЕёЖДTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕѕіЧЕл АЇ·бёв№цЅ± °ЎАФ АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\·°Е°ЅєґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\·к·з°ФАУ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ёЮ°ЎЖРЅєБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\¶ЇГіё®ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж® АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ЖјДПёµЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\KALИЈЕЪ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\іШЅєЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\АҐЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\Д«ЖчАЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ДієуЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їБјЗјч№Ъ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОДЬµµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЛ№ЩА§Бо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\АОЕ©·зЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\Б¤Г¶ »зАМ№ц ЅєДр.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\»х·ТїЎµа.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\јј»уА» ї­ѕо°ЎґВ їµѕоДЈ±ё їЎµа№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЖё®јц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\TNS ·№АМµр ЖРіО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\°іАОБ¤єёµµїлВчґЬј­єсЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\іЄАМЅєёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЖдАМїАЗВ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЗС±№ЗРјъБ¤єё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\TNS °Ў±ёЖРіОёрБэ.url
  • %PROGRAM_FILES%\ez_oneclick\url2.dll
  • %PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\11№ш°Ў.url
  • %TEMP%\nsc2.tmp\KillProcDLL.dll
  • %TEMP%\nsc2.tmp\DLLWaitForKillProgram.dll
  • %TEMP%\nsc2.tmp\Locate.dll
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\°ъїЬїАДЙАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ёЮАМДїЅєЕНµр.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\єёД«ЗБ·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\Gё¶ДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\їБјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\(БЦ)ЅєД«їмЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\114Е©·№µрЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\kt·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\іЄАМЅєёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ ІЙ№иґЮ іЭ114.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ІЙ№иґЮј­єсЅє 119ЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ЗС±№ІЙ№иґЮјѕЕё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ФµҐДіЗЗЕ».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ё®µеДЪЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ёУґПїБјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\µ·Б¶АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\¶уАМЗБ·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ЇЅГѕШДіЅГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\(БЦ)ЗГ·ЇЅєЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1300k.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1566flower.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\ёµЕ©ЗБ¶уАМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\јҐЖчЕ».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\ѕЖАМ¶уАМЕ©Е¬ёЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ї№јЫДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\АЇґП·и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\А±БѕЅЕІЙ№иґЮ ЗГ¶уїц365.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ўЯ99ЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\±Чё°јҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ѕЖё¶¶хЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшѕЯµї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69јЅЅєДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69ЕЧАМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\2010ЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєAV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\¶уАМєк69tv.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеucc.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеёБ°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ClubSex.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\X-°ЙЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\µыАЪґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\єЈЅєЖ®ЗПАМёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ѕЖАМёрё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\їВµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ё®µејѕЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\№МїАµрїА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\єЈµщ·Јµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПїмїГё°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПАМё¶Ж®јоЗОёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗШЗЗёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Б¦АПБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ГµА̹鿥.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ДЪЅєЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јТ¶уЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖ°ЎѕѕTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖё®јц№МЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГµрД«.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГ№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГѕЖАМµ№.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈБ¶АМ№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈЕНЗГ·№АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їН№ЩД·.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЯЗСД«Жд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЅєАзЖТ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЕдАМёфґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№Щ¶чі­ї©їм.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№д°шАЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єёXїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№ёуTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№«АОµµёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№ЩіЄіЄёф јєАОїлЗ° ЗТАОБЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєѕШЅГЖј.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖAV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єь±ёё®ѕЯµї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\»пГµїшјЅЅєЖјєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅє-ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\їЈЖСЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ГЦЅЕіЭєП №«·бБхБ¤АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\Жщјї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\»Сё®їА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\јоѕШѕЖАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ѕѕїЈЕх.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±Ч·№АМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±Чё°ДЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\іЧАМГіё®ЖЫєнёЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\BRTC.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\cl4.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±ВѕЖАМЖд·Оёу.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\БсБЄ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ДЪ°ФАУ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\LGT °ЎБ·А§ДЎѕИЅЙ ј­єсЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕѕіЧЖшЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕЖАМЕЫёЕґПѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\їЈЕНЗГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\±вЗБЖјДЬ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП°ФАУБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП№МЖГ АЇ·б°ЎАФ (ѕЦАОёёµй±в).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SKT Аъ°ЎБ¤ѕЧБ¦ АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SMSЗЗѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\mylg070.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µр№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µрѕѕїўЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\ёнЗФГµ»з.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЕВ№ЭДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЖдАМЅєµеёІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЗГ·ЇЅєГµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\2001ѕЖїп·ї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Papel Stationery.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ґЩАМјТёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\АЧЕ©ѕЖАМ ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\(БЦ)»уµµ°Ў±ё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\007єёАМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ё®їАї¤ё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\єсґхЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЕІRX.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ґхЖдАМЅєјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\¶уілЕ©ёІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ё®ЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\їЎЖЅЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ДЪЅє№МИ­АеЗ°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\Еёё¶ґП Гµї¬ ёнЗ° И­»кАзЖС.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЕІєЈєЈ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЖ®·ОєЈё®іЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\їЎДЪДЙѕо.url
Deletes the following files:
  • %TEMP%\nsc2.tmp\SelfDelete.dll
  • %TEMP%\nsc2.tmp\registry.dll
  • %TEMP%\nsc2.tmp\stack.dll
  • %TEMP%\nsc2.tmp\SetHoldData.dll
  • %TEMP%\nsc2.tmp\Locate.dll
  • %TEMP%\nsc2.tmp\DLLWebCount.dll
  • %TEMP%\nsc2.tmp\DLLWaitForKillProgram.dll
  • %TEMP%\nsc2.tmp\KillProcDLL.dll
  • %TEMP%\nsc2.tmp\IEFunctions.dll
Deletes itself.
Network activity:
Connects to:
  • 'lo#.##sence.co.kr':80
TCP:
HTTP GET requests:
  • lo#.##sence.co.kr/logexp.php?ai######################################
UDP:
  • DNS ASK lo#.##sence.co.kr
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: '' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android