Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader7.17162

Added to the Dr.Web virus database: 2012-11-04

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0349-449c-8CDF-2767E7E6E2FA}] 'Exec' = 'http://yesmoney.co.kr/'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-2461-47fc-A02F-9EB8678B2A5C}] 'Exec' = 'http://event.go.co.kr/nbarcon/11.php?bncode=filemoaup'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ez_oneclick' = '"%PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe" -o'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-78A7-48d9-9094-E214DAB62467}] 'Exec' = 'http://event.go.co.kr/nbarcon/c.php?bncode=filemoaup'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-61C1-4d78-9748-81073EFB1E53}] 'Exec' = 'http://event.go.co.kr/nbarcon/gm.php?bncode=filemoaup'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-25AE-487c-8DD7-1CC9CE85512A}] 'Exec' = 'http://event.go.co.kr/nbarcon/au.php?bncode=filemoaup'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0386-42ec-9235-AB96A83F7FF1}] 'Exec' = 'http://event.go.co.kr/megapass/event.php?pid=filemoaup'
Malicious functions:
Executes the following:
  • <SYSTEM32>\cmd.exe /c \DelUS.bat
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\µрѕШјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\·ФµҐИЁјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ґЩїшёфґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Qook TVјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\іујц»кИЁјоЗО NSАМју.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ёВВЇґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ѕЖЅє№МїА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їмГј±№ јоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЅЕјј°иёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ДЅєЕёАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ЭЗ°јјАПґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Hmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј»з¶ы.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ВЇ·О¶З.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојјґ©ё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\»зБЦєкАМґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј.com.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ЗБё®Б¶ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\Б¦АПД«іЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\CJmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\їЈД«БЯ°нВч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\ё¶АМД«їНґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\јјАМєкД«µе іЧєс°ФАМјЗ ЖчАОЖ® ±ёАФ ЗБ·ОёрјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Е·Д«ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\°ЗґгјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ДЈ±ёЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ(ѕуВЇАМєҐЖ®).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\µµ±ЧёѕѕЦ°ЯїлЗ°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\BCД«µе ЅЕїлБ¤єёєёИЈ ј­єсЅє ЅЕГ» АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\QOOKАОЕНіЭ Аь±№°ЎАФјѕЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ЖкГчё¶ДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\·ЇєкЖк.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ДЭ·єЕНёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\їА·»БцёЮАМЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\АМё¶Ж®АОЕНіЭјоЗОёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ДБ№цЅєјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їш№ЩАМїш.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшѕоµҐАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Ж®·»µеЗГ·ЇЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\јТ°іЖГВтґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ЅМ±ЫЖДАМЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\№МЖГ2030.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЗЗЕж»юїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ё®ѕуЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\Г»јЦ ІїІїєф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ДЙѕојѕЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\БТЕҐ°ЈАе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\АеёАґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\Бѕ°ЎЗЄµејҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ЗЄµеё¶Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\·ФµҐГјЕ©Д«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ёЖЅєД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ґЩ·зАОЖч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\GSєёЗ輥.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\±ієё»эён АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\єОАЪёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\CJON mart.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\G7ДїЗЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\AbleMall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪ№Н19.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Зп·ОїмЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\±Чё°ёрѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\µїїшёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\№Щ·ОБ¶ё® јц»кЅДЗ° ѕѕДо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ґЩЗПґ©ёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\±иИс¶у °щ°Ё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\іЧїАЅєА§Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\µрѕѕєП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\·№µеИъЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\°ЎєЈіоАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє№лё®ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\БѕЅЕєёЗиґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё®ЖІГµАз.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\Б¦·ОЕхјјємґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\·О¶Зё®ДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ѕЖАМГ§ё°Бц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё¶АМєЈАМєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\єёё®єёё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє·Јµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\јјАМєкД«µе №Я±Ю ЅЕГ» АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅєЗЗµе№рЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\»пјєД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\№М·ЎАОЅґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\єёЗи 24.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅЕЗСД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АМАЇґЩАМ·єЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅґіЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їмё®ѕЖєс№Щ»эён АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч №«·бИёїш°ЎАФ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\eЕ¬ё°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗПЗПёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗгґП№цЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗПЗБЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗБ·ОїНДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗГ¶уАМїцДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗмАМїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їЈБ¶АМґєїе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їцДїИъ ёйјјБЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ѕЖАМЗПїмЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\OTTO.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ё¶АМѕЖё¶Бё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖРјЗЗГ·ЇЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їИ№ЗЅєЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їНїНґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їА°Ў°Ф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈЕНЅДЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ї§Бцёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\А§БоЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖјДДЖЫґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖРјЗЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ДЪДЪЖЛ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\АПёрЅєЖ®ёґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ДЪАМ.url
  • %TEMP%\nsb2.tmp\stack.dll
  • %TEMP%\nsb2.tmp\SetHoldData.dll
  • %HOMEPATH%\Desktop\Бс°ЬГЈ±в їБјЗ.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - їБјЗ.url
  • %PROGRAM_FILES%\ez_oneclick\Uninstall.exe
  • %TEMP%\nsb2.tmp\SelfDelete.dll
  • C:\DelUS.bat
  • %TEMP%\nsb2.tmp\DLLWebCount.dll
  • %TEMP%\nsb2.tmp\registry.dll
  • %TEMP%\nsb2.tmp\IEFunctions.dll
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ЗПЗБЕ¬·ґґеДД.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - 11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\Б¶АМєЈАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\А§БоА§µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\АЇё®Д«.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - CJmall.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - d&shop.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - »пјєёф.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - NSіујц»кИЁјоЗО.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - Gё¶ДП.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - KTmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Б¶АМ№®АЪ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Б¶АМЗПµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЧЕ©»зїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЇµрїҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АОЖчё¶ЅєЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ВЇµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖчЅєЖ®ёЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖъґхјјАМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДьґЩїо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДДЅє±оЖд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДоЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АҐјЦ·зјЗЖЗёЕ CGIMALL.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё®ѕуЅєДµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё¶АМЕ©·№µч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґЩїоБо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\°ЧЗГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґПБоДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ёЮ°ЎЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їўЅєЕ°ЖЫ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їНїмµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ѕЖЅОДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\єн·зАҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Ѕ¦ѕо№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\»м·ХіЄАО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ј±ґцї©їХ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єн·ўЖз·Оїм.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єк·Јµе·Їєк.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єн·ўДэ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\јј¶уёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈБ¶АМ№Р¶х.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈЕНјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈєс·и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЅєЕёАПїЈБш.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ѕЖАМЅєЕёАП24.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єЈіЧЖј.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\±Э»уГ·И­.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄјї¶у.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ifumall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЗС±№Б¤єёАОБх.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\LGЖРјЗјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄАО°Й.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\№«Е©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\№Дё®ѕИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ёнјєЅГ°и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄАОїИ№З.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ґхЅєЕЧАМБц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪё®ѕЖїЎ·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\»пјєєПЅєґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ѕѕіЧБ¶АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\»з¶ыБц±в.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\µрБцЕР±ієё№®°н.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\№ЭµрѕШ·зґПЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ѕЖАМєсєП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\KALИЈЕЪ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\¶ЇГіё®ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ЖјДПёµЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\їҐіЭґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\АОЕНіЭј­БЎ ё®єк·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\µµј­11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\АМБц·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЗСЅЕ±ЭА¶ »уґгЅЕГ» .url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\їмё®ЖДАМіЅјИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅЕЗС±ЭА¶Б¤єё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ѕЛЗБЅє·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\°ЎєсѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\їА№цГЯѕо ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ґл±ієПЅєДµ(Bookscan).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ј­ДЎѕИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\іЭЗЗѕЖґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ёфјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ёЮ°ЎЖРЅєБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\јјАМ№ВБч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\·к·з°ФАУ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЩ¶уДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\·°Е°ЅєґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ЅЙЅЙЕёЖДTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\БсБЄ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ДЪ°ФАУ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕЖАМЕЫёЕґПѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕѕіЧЕл АЇ·бёв№цЅ± °ЎАФ АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕѕіЧЖшЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЁЖ®·Ўєн.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОДЬµµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їБјЗјч№Ъ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж® АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\АҐЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ЗГ·№АХ°сЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЈЕЪЖ®ё®Ѕє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ЕхѕоАНЅєЗБ·№Ѕє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\Д«ЖчАЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ДієуЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЖдАМїАЗВ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЗС±№ЗРјъБ¤єё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\Б¤Г¶ »зАМ№ц ЅєДр.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЛ№ЩА§Бо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\АОЕ©·зЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ИЮіЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\іЄАМЅєёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\ёµЕ©ЗБ¶уАМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\°іАОБ¤єёµµїлВчґЬј­єсЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\TNS °Ў±ёЖРіОёрБэ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\TNS ·№АМµр ЖРіО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЖё®јц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\Gё¶ДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\їБјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\11№ш°Ў.url
  • %PROGRAM_FILES%\ez_oneclick\url2.dll
  • %PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\(БЦ)ЅєД«їмЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\»х·ТїЎµа.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\јј»уА» ї­ѕо°ЎґВ їµѕоДЈ±ё їЎµа№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\єёД«ЗБ·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\°ъїЬїАДЙАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ёЮАМДїЅєЕНµр.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\іЄАМЅєёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ЇЅГѕШДіЅГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\kt·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ЗС±№ІЙ№иґЮјѕЕё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\114Е©·№µрЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ФµҐДіЗЗЕ».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\»кїНёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅєЕё»уИЈАъГаАєЗа ЗПАМ·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\№МБо»з¶ы.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ё®µеДЪЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ёУґПїБјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ІЙ№иґЮј­єсЅє 119ЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1566flower.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ўЯ99ЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1300k.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\јҐЖчЕ».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\(БЦ)ЗГ·ЇЅєЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\±Чё°јҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\А±БѕЅЕІЙ№иґЮ ЗГ¶уїц365.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ ІЙ№иґЮ іЭ114.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\АЇґП·и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ѕЖё¶¶хЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ї№јЫДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\LGT °ЎБ·А§ДЎѕИЅЙ ј­єсЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеucc.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеёБ°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\µыАЪґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ClubSex.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\X-°ЙЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№ёуTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№д°шАЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єёXїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№Щ¶чі­ї©їм.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№«АОµµёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№ЩіЄіЄёф јєАОїлЗ° ЗТАОБЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69ЕЧАМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПїмїГё°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПАМё¶Ж®јоЗОёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ДЪЅєЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Б¦АПБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ГµА̹鿥.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗШЗЗёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшѕЯµї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69јЅЅєДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\2010ЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєAV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈБ¶АМ№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈЕНЗГ·№АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЕдАМёфґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЯЗСД«Жд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЅєАзЖТ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їН№ЩД·.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\БсјЅЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Гµїшґ©µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗеЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¤·ВёЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗЦЖјєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖё®јц№МЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєѕШЅГЖј.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅє-ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єь±ёё®ѕЯµї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\»пГµїшјЅЅєЖјєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖAV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јТ¶уЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖ°ЎѕѕTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГѕЖАМµ№.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГµрД«.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГ№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\іЧАМГіё®ЖЫєнёЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ґхЖдАМЅєјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±Чё°ДЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±ВѕЖАМЖд·Оёу.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±Ч·№АМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\¶уілЕ©ёІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЕІRX.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЕІєЈєЈ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\єсґхЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ё®ЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ё®їАї¤ё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\BRTC.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП°ФАУБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП№МЖГ АЇ·б°ЎАФ (ѕЦАОёёµй±в).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\mylg070.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SKT Аъ°ЎБ¤ѕЧБ¦ АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SMSЗЗѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\»Сё®їА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ГЦЅЕіЭєП №«·бБхБ¤АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\Жщјї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\їЈЖСЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\јоѕШѕЖАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ѕѕїЈЕх.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Papel Stationery.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ґЩАМјТёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\2001ѕЖїп·ї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\(БЦ)»уµµ°Ў±ё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\007єёАМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ё®µејѕЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ѕЖАМёрё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\їВµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\єЈЅєЖ®ЗПАМёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\№МїАµрїА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\єЈµщ·Јµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\АЧЕ©ѕЖАМ ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ДЪЅє№МИ­АеЗ°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\Еёё¶ґП Гµї¬ ёнЗ° И­»кАзЖС.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\їЎЖЅЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЖ®·ОєЈё®іЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\їЎДЪДЙѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЕВ№ЭДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µрѕѕїўЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\ёнЗФГµ»з.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µр№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЖдАМЅєµеёІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЗГ·ЇЅєГµ.url
Deletes the following files:
  • %TEMP%\nsb2.tmp\SelfDelete.dll
  • %TEMP%\nsb2.tmp\SetHoldData.dll
  • %TEMP%\nsb2.tmp\stack.dll
  • %TEMP%\nsb2.tmp\DLLWebCount.dll
  • %TEMP%\nsb2.tmp\IEFunctions.dll
  • %TEMP%\nsb2.tmp\registry.dll
Deletes itself.
Network activity:
Connects to:
  • 'lo#.##sence.co.kr':80
TCP:
HTTP GET requests:
  • lo#.##sence.co.kr/logexp.php?ai#####################################
  • lo#.##sence.co.kr/logexp.php?ai####################################
UDP:
  • DNS ASK lo#.##sence.co.kr
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: '' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android