Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.MulDrop6.47487

Added to the Dr.Web virus database: 2016-07-15

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\service_launcher_core] 'ImagePath' = '"%ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\smss.exe"'
  • [<HKLM>\SYSTEM\ControlSet001\Services\service_launcher_core] 'Start' = '00000002'
Malicious functions:
Executes the following:
  • '%ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\smss.exe'
  • '%ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\smss.exe' SERVICE_INSTALL
Modifies file system:
Creates the following files:
  • %ALLUSERSPROFILE%\Application Data\AEQWV.tft
  • %ALLUSERSPROFILE%\Application Data\muKN.zjq
  • %ALLUSERSPROFILE%\Application Data\rRpLReLmO6.akd
  • %ALLUSERSPROFILE%\Application Data\k4BEqkK8.jqr
  • %ALLUSERSPROFILE%\Application Data\AtFqhGqSp.hws
  • %ALLUSERSPROFILE%\Application Data\aHwVz.ism
  • %ALLUSERSPROFILE%\Application Data\KJKeSKtKH.gkx
  • %ALLUSERSPROFILE%\Application Data\L89.wvk
  • %ALLUSERSPROFILE%\Application Data\aCC.brg
  • %ALLUSERSPROFILE%\Application Data\9JTnszeG.cmj
  • %ALLUSERSPROFILE%\Application Data\c0MN32L.hvp
  • %ALLUSERSPROFILE%\Application Data\GgBx6bj.wkf
  • %ALLUSERSPROFILE%\Application Data\7s7ncMYbrz.gch
  • %ALLUSERSPROFILE%\Application Data\maBTYz.sng
  • %ALLUSERSPROFILE%\Application Data\QEQ454wEHb.xfq
  • %ALLUSERSPROFILE%\Application Data\aYRR.rnn
  • %ALLUSERSPROFILE%\Application Data\GTQ2NNuP.qta
  • %ALLUSERSPROFILE%\Application Data\a5CXEZe95S.lem
  • %ALLUSERSPROFILE%\Application Data\Mp7u.ytw
  • %ALLUSERSPROFILE%\Application Data\KX5.sba
  • %ALLUSERSPROFILE%\Application Data\xyZ.nxq
  • %ALLUSERSPROFILE%\Application Data\BWy4.hhi
  • %ALLUSERSPROFILE%\Application Data\1Til4.ban
  • %ALLUSERSPROFILE%\Application Data\jKfG9OL8C.prd
  • %ALLUSERSPROFILE%\Application Data\oO5.wbt
  • %ALLUSERSPROFILE%\Application Data\386gjUf.bqi
  • %ALLUSERSPROFILE%\Application Data\hXUqKIf1.kvw
  • %ALLUSERSPROFILE%\Application Data\DTHCFyInut.znr
  • %ALLUSERSPROFILE%\Application Data\3av.slu
  • %ALLUSERSPROFILE%\Application Data\eBM.uln
  • %ALLUSERSPROFILE%\Application Data\tihKuQPC.zzv
  • %ALLUSERSPROFILE%\Application Data\ksrjg.bgl
  • %ALLUSERSPROFILE%\Application Data\0vAea80bwh.lad
  • %ALLUSERSPROFILE%\Application Data\D8V4nUt.gle
  • %ALLUSERSPROFILE%\Application Data\SikSGO.arp
  • %ALLUSERSPROFILE%\Application Data\RbYSLQR.iot
  • %ALLUSERSPROFILE%\Application Data\r05L3J.ear
  • %ALLUSERSPROFILE%\Application Data\PGEBhX.www
  • %ALLUSERSPROFILE%\Application Data\TNY5Pq3InX4.twc
  • %ALLUSERSPROFILE%\Application Data\tp1VDqk.nap
  • %ALLUSERSPROFILE%\Application Data\nsM6rfEXoLb.bep
  • %ALLUSERSPROFILE%\Application Data\LKQ.oqh
  • %ALLUSERSPROFILE%\Application Data\Lq0.bgg
  • %ALLUSERSPROFILE%\Application Data\nFjEG86.jjo
  • %ALLUSERSPROFILE%\Application Data\1ENKb.xgl
  • %ALLUSERSPROFILE%\Application Data\QIBlbp.exf
  • %ALLUSERSPROFILE%\Application Data\kx9JasFHq.cll
  • %ALLUSERSPROFILE%\Application Data\TjOjpDphO.scp
  • %ALLUSERSPROFILE%\Application Data\ipuzln.wvh
  • %ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\smss.InstallLog
  • %ALLUSERSPROFILE%\Application Data\HHocSC6.jan
  • %ALLUSERSPROFILE%\Application Data\uvZO7.yuk
  • %ALLUSERSPROFILE%\Application Data\ppdEQs2b.kwq
  • %ALLUSERSPROFILE%\Application Data\6nbRk.pgk
  • %ALLUSERSPROFILE%\Application Data\pmS6fo0vdmI.ydb
  • %ALLUSERSPROFILE%\Application Data\2P4jqx.ium
  • %ALLUSERSPROFILE%\Application Data\fI28KtIS.nkb
  • %ALLUSERSPROFILE%\Application Data\c8N5j0IwVvA.klu
  • %ALLUSERSPROFILE%\Application Data\vAGgm.nfb
  • %ALLUSERSPROFILE%\Application Data\axwATQe0j.dom
  • %ALLUSERSPROFILE%\Application Data\m6VRi656Lsx.ftr
  • %ALLUSERSPROFILE%\Application Data\rva5hDkot.wea
  • %ALLUSERSPROFILE%\Application Data\yVaZlsPcB8W.xjo
  • %ALLUSERSPROFILE%\Application Data\2mF6iR8qEk9.rbc
  • %ALLUSERSPROFILE%\Application Data\s9PEK4cU.qlc
  • %ALLUSERSPROFILE%\Application Data\ZImVkep6q.rbb
  • %ALLUSERSPROFILE%\Application Data\k40i.xci
  • %ALLUSERSPROFILE%\Application Data\9Zmw91V.ffp
  • %ALLUSERSPROFILE%\Application Data\3OmHy.qii
  • %ALLUSERSPROFILE%\Application Data\S7eo8.qow
  • %ALLUSERSPROFILE%\Application Data\Lj5L.gwa
  • %ALLUSERSPROFILE%\Application Data\vKHoBkWyz.uty
  • %ALLUSERSPROFILE%\Application Data\0Dsnd.hcf
  • %ALLUSERSPROFILE%\Application Data\Xi5baLlrzmw.bnf
  • %ALLUSERSPROFILE%\Application Data\s5OAmF9.jxm
  • %ALLUSERSPROFILE%\Application Data\12v.gvl
  • %ALLUSERSPROFILE%\Application Data\4AlTyP5Aw.kkn
  • %ALLUSERSPROFILE%\Application Data\omqt2TaaQD.edr
  • %ALLUSERSPROFILE%\Application Data\AHkyemx.bid
  • %ALLUSERSPROFILE%\Application Data\Cg8OyR.zyr
  • %ALLUSERSPROFILE%\Application Data\AGzqm.rsy
  • %ALLUSERSPROFILE%\Application Data\eqyILSX7S.dqf
  • %ALLUSERSPROFILE%\Application Data\NnvQ.jwj
  • %ALLUSERSPROFILE%\Application Data\XWrXbzYA.jaz
  • %ALLUSERSPROFILE%\Application Data\RKWqih.hxt
  • %ALLUSERSPROFILE%\Application Data\GqFqC7jG.oto
  • %ALLUSERSPROFILE%\Application Data\ceK.gnn
  • %ALLUSERSPROFILE%\Application Data\Xz5H1w7yF.hck
  • %ALLUSERSPROFILE%\Application Data\HyjNNY.wbs
  • %ALLUSERSPROFILE%\Application Data\KWV.vat
  • %ALLUSERSPROFILE%\Application Data\EHD2.rms
  • %ALLUSERSPROFILE%\Application Data\gzo.cza
  • %ALLUSERSPROFILE%\Application Data\aanUAn7YG9.lvi
  • %ALLUSERSPROFILE%\Application Data\WEdyKHQsI.msv
  • %ALLUSERSPROFILE%\Application Data\RsU7Ky5hiw1.fdj
  • %ALLUSERSPROFILE%\Application Data\VcseH.cwu
  • %ALLUSERSPROFILE%\Application Data\kTZJxOBF1W7.xbd
  • %ALLUSERSPROFILE%\Application Data\xbF5fdoIdjJ.ztt
  • %ALLUSERSPROFILE%\Application Data\pehOW4PeGZA.ktz
  • %ALLUSERSPROFILE%\Application Data\kKXiwIUqX9.ehp
  • %ALLUSERSPROFILE%\Application Data\lBZ94KWZq9.bid
  • %ALLUSERSPROFILE%\Application Data\HDd7aT.bqk
  • %ALLUSERSPROFILE%\Application Data\E9IhCAaUBOa.slc
  • %ALLUSERSPROFILE%\Application Data\zznOw1ELmvW.jmv
  • %ALLUSERSPROFILE%\Application Data\I7ya4.oig
  • %ALLUSERSPROFILE%\Application Data\AZqa0IVo.nro
  • %ALLUSERSPROFILE%\Application Data\c2Rohr4ivHn.wdz
  • %ALLUSERSPROFILE%\Application Data\HMvc3r.njp
  • %ALLUSERSPROFILE%\Application Data\9XL5hCe.zxf
  • %ALLUSERSPROFILE%\Application Data\iL2.zzn
  • %ALLUSERSPROFILE%\Application Data\BLQUb.rbh
  • %ALLUSERSPROFILE%\Application Data\WL7BZuk9.xph
  • %ALLUSERSPROFILE%\Application Data\YN3oW6Km6p.huo
  • %ALLUSERSPROFILE%\Application Data\oznSc.pxa
  • %ALLUSERSPROFILE%\Application Data\uv7G6IOMzWu.oux
  • %ALLUSERSPROFILE%\Application Data\MJd.azs
  • %ALLUSERSPROFILE%\Application Data\In4.upx
  • %ALLUSERSPROFILE%\Application Data\tn4.jen
  • %ALLUSERSPROFILE%\Application Data\4F8WxL5daOq.xiu
  • %ALLUSERSPROFILE%\Application Data\dBc.rlr
  • %ALLUSERSPROFILE%\Application Data\GrxNLn.lye
  • %ALLUSERSPROFILE%\Application Data\pEi126nrAT4.mvq
  • %ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\smss.InstallState
  • %ALLUSERSPROFILE%\Application Data\qFUaUoF8fHb.rcb
  • %ALLUSERSPROFILE%\Application Data\Czri2uQrbZ.pua
  • %ALLUSERSPROFILE%\Application Data\oi7iu.nks
  • %ALLUSERSPROFILE%\Application Data\sdrPZYY.wxf
  • %ALLUSERSPROFILE%\Application Data\q4F.pfn
  • %ALLUSERSPROFILE%\Application Data\IdzoD5hE.dac
  • %ALLUSERSPROFILE%\Application Data\b78T.qjw
  • %ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\serial.sn
  • %ALLUSERSPROFILE%\Application Data\9ldlYNNC.itm
  • %ALLUSERSPROFILE%\Application Data\nkm5owKLj7K.zeb
  • %ALLUSERSPROFILE%\Application Data\5JSEQ8Bomp.kgq
  • %ALLUSERSPROFILE%\Application Data\M5A.vtn
  • %ALLUSERSPROFILE%\Application Data\LdQ2t3c.bsp
  • %ALLUSERSPROFILE%\Application Data\v5QOK0DT.yyk
  • %ALLUSERSPROFILE%\Application Data\VB8vlZ.hgn
  • %ALLUSERSPROFILE%\Application Data\6S6f.osh
  • %ALLUSERSPROFILE%\Application Data\ygBs65y.hjz
  • %ALLUSERSPROFILE%\Application Data\r8No6.xmq
  • %ALLUSERSPROFILE%\Application Data\lVY35uy.qzn
  • %ALLUSERSPROFILE%\Application Data\2nN8AKV.arn
  • %ALLUSERSPROFILE%\Application Data\Paob.irk
  • %ALLUSERSPROFILE%\Application Data\KyFAGdS31.ugg
  • %ALLUSERSPROFILE%\Application Data\NJuf.anz
  • %ALLUSERSPROFILE%\Application Data\9tw4HeJGb.pnx
  • %ALLUSERSPROFILE%\Application Data\X8u.xoy
  • %ALLUSERSPROFILE%\Application Data\3jdOtxZt.gsk
  • %ALLUSERSPROFILE%\Application Data\OHb596RqZ.vso
  • %ALLUSERSPROFILE%\Application Data\Thjzbv856.aac
  • %ALLUSERSPROFILE%\Application Data\oAoyvV.seq
  • %ALLUSERSPROFILE%\Application Data\9k1.rrs
  • %ALLUSERSPROFILE%\Application Data\m1OCgQxGdi.rjt
  • %ALLUSERSPROFILE%\Application Data\OZa1AnjjH.srd
  • %ALLUSERSPROFILE%\Application Data\m1942R.okd
  • %ALLUSERSPROFILE%\Application Data\NyhiAxdkA.htk
  • %ALLUSERSPROFILE%\Application Data\rZs2a3Fg.zoe
  • %ALLUSERSPROFILE%\Application Data\BI6p9yQ9Fd.zyd
  • %ALLUSERSPROFILE%\Application Data\MJWfBJJlgH.sxh
  • %ALLUSERSPROFILE%\Application Data\AvUo0.ymo
  • %ALLUSERSPROFILE%\Application Data\FAAtmPW.kqg
  • %ALLUSERSPROFILE%\Application Data\pBdz.hcb
  • %ALLUSERSPROFILE%\Application Data\Wtjgkh9.zsq
  • %ALLUSERSPROFILE%\Application Data\Jq6.hbw
  • %ALLUSERSPROFILE%\Application Data\L0HLZjJ.xdh
  • %ALLUSERSPROFILE%\Application Data\sPw0fQXno0Z.zqc
  • %ALLUSERSPROFILE%\Application Data\qm0.zso
  • %ALLUSERSPROFILE%\Application Data\UShV0CRV.klb
  • %ALLUSERSPROFILE%\Application Data\Q6YA.ijp
  • %ALLUSERSPROFILE%\Application Data\JSKM.rng
  • %ALLUSERSPROFILE%\Application Data\GI1F.nsb
  • %ALLUSERSPROFILE%\Application Data\NG09t4KoT.vwz
  • %ALLUSERSPROFILE%\Application Data\pxmV.mfh
  • %ALLUSERSPROFILE%\Application Data\QEV8QM.pwp
  • %ALLUSERSPROFILE%\Application Data\mOFVfMK6yu.nuv
  • %ALLUSERSPROFILE%\Application Data\CLUEr78r.ikc
  • %ALLUSERSPROFILE%\Application Data\0AMMG.xog
  • %ALLUSERSPROFILE%\Application Data\18Wmc3GH.uam
  • %ALLUSERSPROFILE%\Application Data\uBH9QoBs3.gei
  • %ALLUSERSPROFILE%\Application Data\hJcTRK6zv.kxv
  • %ALLUSERSPROFILE%\Application Data\hS5Nba.dih
  • %ALLUSERSPROFILE%\Application Data\jNdcLo.mdp
  • %ALLUSERSPROFILE%\Application Data\cRv.ski
  • %ALLUSERSPROFILE%\Application Data\HiHKFO.ofd
  • %ALLUSERSPROFILE%\Application Data\vmu5.kto
  • %ALLUSERSPROFILE%\Application Data\aVDjH3ov.yuy
  • %ALLUSERSPROFILE%\Application Data\5OCTT.rml
  • %ALLUSERSPROFILE%\Application Data\Ycg2xhg.sof
  • %ALLUSERSPROFILE%\Application Data\OPgVrw9js.wjy
  • %ALLUSERSPROFILE%\Application Data\PI7ci.hzc
  • %ALLUSERSPROFILE%\Application Data\VpQ3gS7GZ.ink
  • %ALLUSERSPROFILE%\Application Data\USF.ihh
  • %ALLUSERSPROFILE%\Application Data\Qb1BUl5Ua.zel
  • %ALLUSERSPROFILE%\Application Data\mLnH.cul
  • %ALLUSERSPROFILE%\Application Data\P6bh.zjh
  • %ALLUSERSPROFILE%\Application Data\nfG.wge
  • %ALLUSERSPROFILE%\Application Data\pVEhhQr.nbs
  • %ALLUSERSPROFILE%\Application Data\mcKpq.xwz
  • %ALLUSERSPROFILE%\Application Data\1CbRDGDmlW9.cld
  • %ALLUSERSPROFILE%\Application Data\K0xBdkG3mG.qsd
  • %ALLUSERSPROFILE%\Application Data\KkI5yB1.ajc
  • %ALLUSERSPROFILE%\Application Data\L6GY.nno
  • %ALLUSERSPROFILE%\Application Data\buoKtV.sam
  • %ALLUSERSPROFILE%\Application Data\PIlvVUEwJh.ukd
  • %ALLUSERSPROFILE%\Application Data\ieDfYbTjjZe.qfd
  • %ALLUSERSPROFILE%\Application Data\Uk3mD2qZSp.dxo
  • %ALLUSERSPROFILE%\Application Data\DlmW9Vqt.mue
  • %ALLUSERSPROFILE%\Application Data\pQweKcenNBJ.lvw
  • %ALLUSERSPROFILE%\Application Data\WSvLfZQkLgR.gbv
  • %ALLUSERSPROFILE%\Application Data\cjw2QhzWBc.sag
  • %ALLUSERSPROFILE%\Application Data\19wk22QFY.fnm
  • %ALLUSERSPROFILE%\Application Data\fNEAN.lng
  • %ALLUSERSPROFILE%\Application Data\Jyz.weg
  • %ALLUSERSPROFILE%\Application Data\GdmmZpd.mwj
  • %ALLUSERSPROFILE%\Application Data\dGs.rgb
  • %ALLUSERSPROFILE%\Application Data\Kuv.sjv
  • %ALLUSERSPROFILE%\Application Data\1dJoHPljgvc.qul
  • %ALLUSERSPROFILE%\Application Data\qygp.ztv
  • %ALLUSERSPROFILE%\Application Data\j0Cm.ygh
  • %ALLUSERSPROFILE%\Application Data\wnZPsi2j.wcn
  • %ALLUSERSPROFILE%\Application Data\QQNwWPHF0bj.byg
  • %ALLUSERSPROFILE%\Application Data\IgYEces.huq
  • %ALLUSERSPROFILE%\Application Data\FMmmmoz1.eeu
  • %ALLUSERSPROFILE%\Application Data\sLRectHIY.wts
  • %ALLUSERSPROFILE%\Application Data\tfP6mTv8V.ywd
  • %ALLUSERSPROFILE%\Application Data\hcnNc.zjk
  • %ALLUSERSPROFILE%\Application Data\6YmRe.fgh
  • %ALLUSERSPROFILE%\Application Data\glc4Gq.lfl
  • %ALLUSERSPROFILE%\Application Data\mmCe4Ca.apo
  • %ALLUSERSPROFILE%\Application Data\dNDMPnlIL.hab
  • %ALLUSERSPROFILE%\Application Data\cc24Uvke.hio
  • %ALLUSERSPROFILE%\Application Data\SuQKqM.wqf
  • %ALLUSERSPROFILE%\Application Data\hqwB13eH.kgt
  • %ALLUSERSPROFILE%\Application Data\tCW5qOIWdb.ica
  • %ALLUSERSPROFILE%\Application Data\Kl3.lty
  • %ALLUSERSPROFILE%\Application Data\hgxQk0Tsx.xzk
  • %ALLUSERSPROFILE%\Application Data\Z1ES7BrJG.jef
  • %ALLUSERSPROFILE%\Application Data\C2hwuEJ.dqa
  • %ALLUSERSPROFILE%\Application Data\Mda.otl
  • %ALLUSERSPROFILE%\Application Data\lNV.izd
  • %ALLUSERSPROFILE%\Application Data\oNAO6hsQYRf.fgz
  • %ALLUSERSPROFILE%\Application Data\2zkoL.csv
  • %ALLUSERSPROFILE%\Application Data\77V64.rlj
  • %ALLUSERSPROFILE%\Application Data\NdVta3w.mtu
  • %ALLUSERSPROFILE%\Application Data\J3I.spk
  • %ALLUSERSPROFILE%\Application Data\JNBD.tty
  • %ALLUSERSPROFILE%\Application Data\UNYai8b.rcv
  • %ALLUSERSPROFILE%\Application Data\oZr.tyj
  • %ALLUSERSPROFILE%\Application Data\Caou4YdB.sdi
  • %ALLUSERSPROFILE%\Application Data\WhDxm.phu
  • %ALLUSERSPROFILE%\Application Data\VNuFe0P6P0.mxt
  • %ALLUSERSPROFILE%\Application Data\rm5ohNhM.xjg
  • %ALLUSERSPROFILE%\Application Data\Q1iLm5U.cak
  • %ALLUSERSPROFILE%\Application Data\k91s7W.lci
  • %ALLUSERSPROFILE%\Application Data\jOd.hdc
  • %ALLUSERSPROFILE%\Application Data\xCUmUovQ.jat
  • %ALLUSERSPROFILE%\Application Data\vXtVWFhybc9.ldz
  • %ALLUSERSPROFILE%\Application Data\q8Keo0.hdw
  • %ALLUSERSPROFILE%\Application Data\zVBHQAtTP1.ltp
  • %ALLUSERSPROFILE%\Application Data\nHgvE.lkm
  • %ALLUSERSPROFILE%\Application Data\4PMI6.pft
  • %ALLUSERSPROFILE%\Application Data\ukDi2LGbf6K.lhj
  • %ALLUSERSPROFILE%\Application Data\FXxj.ppo
  • %ALLUSERSPROFILE%\Application Data\JO3.eat
  • %ALLUSERSPROFILE%\Application Data\nST.txd
  • %ALLUSERSPROFILE%\Application Data\6vXWGP237K.lwn
  • %ALLUSERSPROFILE%\Application Data\6Gz6.eoi
  • %ALLUSERSPROFILE%\Application Data\s9G2LRkBLn.row
  • %ALLUSERSPROFILE%\Application Data\RhXstom.pzu
  • %ALLUSERSPROFILE%\Application Data\ZbWL.wps
  • %ALLUSERSPROFILE%\Application Data\8eCbAtaffX5.lum
  • %ALLUSERSPROFILE%\Application Data\43ArL8gT.xuh
  • %ALLUSERSPROFILE%\Application Data\8KG.kql
  • %ALLUSERSPROFILE%\Application Data\NuTe2.mox
  • %ALLUSERSPROFILE%\Application Data\imn7y58Ys.idi
  • %ALLUSERSPROFILE%\Application Data\oP8mmF.gag
  • %ALLUSERSPROFILE%\Application Data\mqR.kja
  • %ALLUSERSPROFILE%\Application Data\tiAlzl3YiJ.mlb
  • %ALLUSERSPROFILE%\Application Data\99OeQeCMl.srt
  • %ALLUSERSPROFILE%\Application Data\vN3yIZILkP.yju
  • %ALLUSERSPROFILE%\Application Data\UWMjAbK.xfv
  • %ALLUSERSPROFILE%\Application Data\Gjs.rnb
  • %ALLUSERSPROFILE%\Application Data\beFzX.dlv
  • %ALLUSERSPROFILE%\Application Data\zzx1fc9.oxm
  • %ALLUSERSPROFILE%\Application Data\QHxq.jsc
  • %ALLUSERSPROFILE%\Application Data\KN10mQkG.exv
  • %ALLUSERSPROFILE%\Application Data\mPjbylxf2TB.uws
  • %ALLUSERSPROFILE%\Application Data\SpKNDv6.hce
  • %ALLUSERSPROFILE%\Application Data\cDo.qpl
  • %ALLUSERSPROFILE%\Application Data\qWEtX.pyx
  • %ALLUSERSPROFILE%\Application Data\eTA3m.abx
  • %ALLUSERSPROFILE%\Application Data\kSP3CXkPS.oox
  • %ALLUSERSPROFILE%\Application Data\I838m.khg
  • %ALLUSERSPROFILE%\Application Data\IbuxL.ucl
  • %ALLUSERSPROFILE%\Application Data\hdE17hnr0z.tzm
  • %ALLUSERSPROFILE%\Application Data\tdTLMb4Edo.kwp
  • %ALLUSERSPROFILE%\Application Data\A5a5XzeW8n.ttj
  • %ALLUSERSPROFILE%\Application Data\WrGfakYF6.zmb
  • %ALLUSERSPROFILE%\Application Data\bNg.yxt
  • %ALLUSERSPROFILE%\Application Data\7jXSNMX.tkx
  • %ALLUSERSPROFILE%\Application Data\95iRNHC32.mpf
  • %ALLUSERSPROFILE%\Application Data\LjoKmE.caa
  • %ALLUSERSPROFILE%\Application Data\mpUYr8F3KS.jjd
  • %ALLUSERSPROFILE%\Application Data\8ke1SK.fmp
  • %ALLUSERSPROFILE%\Application Data\mxeXCPf.zut
  • %ALLUSERSPROFILE%\Application Data\A58.ygy
  • %ALLUSERSPROFILE%\Application Data\6nt4RX7rp.itt
  • %ALLUSERSPROFILE%\Application Data\SqeIMr5Vpv.anr
  • %ALLUSERSPROFILE%\Application Data\9FQQTPt70nz.nsp
  • %ALLUSERSPROFILE%\Application Data\lB9m40i.hwp
  • %ALLUSERSPROFILE%\Application Data\XNH.lyg
  • %ALLUSERSPROFILE%\Application Data\OKayaH.myu
  • %ALLUSERSPROFILE%\Application Data\QxMl3QX.sfq
  • %ALLUSERSPROFILE%\Application Data\kulIlE.bkm
  • %ALLUSERSPROFILE%\Application Data\E9aynL8og.ssz
  • %ALLUSERSPROFILE%\Application Data\XBBxqHYnBC.bjt
  • %ALLUSERSPROFILE%\Application Data\59F1cKCUxT.udp
  • %ALLUSERSPROFILE%\Application Data\SlapZbYT.hdi
  • %ALLUSERSPROFILE%\Application Data\0eNjQa.llg
  • %ALLUSERSPROFILE%\Application Data\V1TORInfI.rkl
  • %ALLUSERSPROFILE%\Application Data\XMoXOV.dxp
  • %ALLUSERSPROFILE%\Application Data\L0GmaCip3.zwp
  • %ALLUSERSPROFILE%\Application Data\DIFqIv.skr
  • %ALLUSERSPROFILE%\Application Data\Ig66Vuumxb.jok
  • %ALLUSERSPROFILE%\Application Data\QmVAxDtp.lxj
  • %ALLUSERSPROFILE%\Application Data\h3j2oZql3.gwr
  • %ALLUSERSPROFILE%\Application Data\7bB.yuq
  • %ALLUSERSPROFILE%\Application Data\irLjlQQIjI.qim
  • %ALLUSERSPROFILE%\Application Data\VWD8C9XwhE.ybf
  • %ALLUSERSPROFILE%\Application Data\8jYTQ.nun
  • %ALLUSERSPROFILE%\Application Data\i2Il.spt
  • %ALLUSERSPROFILE%\Application Data\zLn.ebv
  • %ALLUSERSPROFILE%\Application Data\uo9.goc
  • %ALLUSERSPROFILE%\Application Data\hK5.wlw
  • %ALLUSERSPROFILE%\Application Data\KCf5IRqNoO.dxj
  • %ALLUSERSPROFILE%\Application Data\YQSWutC2s2.yrm
  • %ALLUSERSPROFILE%\Application Data\dLxHDYQ.gom
  • %ALLUSERSPROFILE%\Application Data\5uBb0L6.ozj
  • %ALLUSERSPROFILE%\Application Data\bqKX7jZKc.haf
  • %ALLUSERSPROFILE%\Application Data\q0F.xte
  • %ALLUSERSPROFILE%\Application Data\LZJfV1.neh
  • %ALLUSERSPROFILE%\Application Data\O0ogwdqW.uhy
  • %ALLUSERSPROFILE%\Application Data\QjVxF9Rec9U.kwm
  • %ALLUSERSPROFILE%\Application Data\mrn3rSW6.nsj
  • %ALLUSERSPROFILE%\Application Data\6wSvF.uff
  • %ALLUSERSPROFILE%\Application Data\3RG55N.mcs
  • %ALLUSERSPROFILE%\Application Data\NTO5V9XKBo.bie
  • %ALLUSERSPROFILE%\Application Data\g17.hem
  • %ALLUSERSPROFILE%\Application Data\TVdvbMLIK2.oap
  • %ALLUSERSPROFILE%\Application Data\mwM.ahe
  • %ALLUSERSPROFILE%\Application Data\nQIQsq.fcu
  • %ALLUSERSPROFILE%\Application Data\iq4Vu.sbl
  • %ALLUSERSPROFILE%\Application Data\k0G3I04.psh
  • %ALLUSERSPROFILE%\Application Data\BGP.uwe
  • %ALLUSERSPROFILE%\Application Data\DLi.mkh
  • %ALLUSERSPROFILE%\Application Data\p1mRTiTjy.bgn
  • %ALLUSERSPROFILE%\Application Data\yLQtY7bF.kwo
  • %ALLUSERSPROFILE%\Application Data\MicrosoftCoreLiveUpdateEngine\smss.exe
  • %ALLUSERSPROFILE%\Application Data\pYYXGaiqp.glr
  • %ALLUSERSPROFILE%\Application Data\482rE993RrN.qlh
  • %ALLUSERSPROFILE%\Application Data\xoNvjBCw2J4.hfr
  • %ALLUSERSPROFILE%\Application Data\fnW.xpr
  • %ALLUSERSPROFILE%\Application Data\BtF1DeDiPD.jif
  • %ALLUSERSPROFILE%\Application Data\YAzMXsHJtNK.glt
  • %ALLUSERSPROFILE%\Application Data\hvVZBX.fop
Deletes the following files:
  • %ALLUSERSPROFILE%\Application Data\rRpLReLmO6.akd
  • %ALLUSERSPROFILE%\Application Data\AEQWV.tft
  • %ALLUSERSPROFILE%\Application Data\AtFqhGqSp.hws
  • %ALLUSERSPROFILE%\Application Data\Mp7u.ytw
  • %ALLUSERSPROFILE%\Application Data\k4BEqkK8.jqr
  • %ALLUSERSPROFILE%\Application Data\muKN.zjq
  • %ALLUSERSPROFILE%\Application Data\aCC.brg
  • %ALLUSERSPROFILE%\Application Data\KJKeSKtKH.gkx
  • %ALLUSERSPROFILE%\Application Data\c0MN32L.hvp
  • %ALLUSERSPROFILE%\Application Data\aHwVz.ism
  • %ALLUSERSPROFILE%\Application Data\9JTnszeG.cmj
  • %ALLUSERSPROFILE%\Application Data\maBTYz.sng
  • %ALLUSERSPROFILE%\Application Data\GgBx6bj.wkf
  • %ALLUSERSPROFILE%\Application Data\aYRR.rnn
  • %ALLUSERSPROFILE%\Application Data\QIBlbp.exf
  • %ALLUSERSPROFILE%\Application Data\QEQ454wEHb.xfq
  • %ALLUSERSPROFILE%\Application Data\7s7ncMYbrz.gch
  • %ALLUSERSPROFILE%\Application Data\KX5.sba
  • %ALLUSERSPROFILE%\Application Data\a5CXEZe95S.lem
  • %ALLUSERSPROFILE%\Application Data\BWy4.hhi
  • %ALLUSERSPROFILE%\Application Data\GTQ2NNuP.qta
  • %ALLUSERSPROFILE%\Application Data\xyZ.nxq
  • %ALLUSERSPROFILE%\Application Data\L89.wvk
  • %ALLUSERSPROFILE%\Application Data\386gjUf.bqi
  • %ALLUSERSPROFILE%\Application Data\jKfG9OL8C.prd
  • %ALLUSERSPROFILE%\Application Data\DTHCFyInut.znr
  • %ALLUSERSPROFILE%\Application Data\LKQ.oqh
  • %ALLUSERSPROFILE%\Application Data\hXUqKIf1.kvw
  • %ALLUSERSPROFILE%\Application Data\oO5.wbt
  • %ALLUSERSPROFILE%\Application Data\ksrjg.bgl
  • %ALLUSERSPROFILE%\Application Data\eBM.uln
  • %ALLUSERSPROFILE%\Application Data\D8V4nUt.gle
  • %ALLUSERSPROFILE%\Application Data\3av.slu
  • %ALLUSERSPROFILE%\Application Data\0vAea80bwh.lad
  • %ALLUSERSPROFILE%\Application Data\r05L3J.ear
  • %ALLUSERSPROFILE%\Application Data\SikSGO.arp
  • %ALLUSERSPROFILE%\Application Data\TNY5Pq3InX4.twc
  • %ALLUSERSPROFILE%\Application Data\1Til4.ban
  • %ALLUSERSPROFILE%\Application Data\PGEBhX.www
  • %ALLUSERSPROFILE%\Application Data\RbYSLQR.iot
  • %ALLUSERSPROFILE%\Application Data\Lq0.bgg
  • %ALLUSERSPROFILE%\Application Data\nsM6rfEXoLb.bep
  • %ALLUSERSPROFILE%\Application Data\1ENKb.xgl
  • %ALLUSERSPROFILE%\Application Data\tp1VDqk.nap
  • %ALLUSERSPROFILE%\Application Data\nFjEG86.jjo
  • %ALLUSERSPROFILE%\Application Data\kx9JasFHq.cll
  • %ALLUSERSPROFILE%\Application Data\TjOjpDphO.scp
  • %ALLUSERSPROFILE%\Application Data\ipuzln.wvh
  • %ALLUSERSPROFILE%\Application Data\s9PEK4cU.qlc
  • %ALLUSERSPROFILE%\Application Data\HHocSC6.jan
  • %ALLUSERSPROFILE%\Application Data\uvZO7.yuk
  • %ALLUSERSPROFILE%\Application Data\ppdEQs2b.kwq
  • %ALLUSERSPROFILE%\Application Data\6nbRk.pgk
  • %ALLUSERSPROFILE%\Application Data\pmS6fo0vdmI.ydb
  • %ALLUSERSPROFILE%\Application Data\2P4jqx.ium
  • %ALLUSERSPROFILE%\Application Data\fI28KtIS.nkb
  • %ALLUSERSPROFILE%\Application Data\axwATQe0j.dom
  • %ALLUSERSPROFILE%\Application Data\c8N5j0IwVvA.klu
  • %ALLUSERSPROFILE%\Application Data\rva5hDkot.wea
  • %ALLUSERSPROFILE%\Application Data\mxeXCPf.zut
  • %ALLUSERSPROFILE%\Application Data\m6VRi656Lsx.ftr
  • %ALLUSERSPROFILE%\Application Data\vAGgm.nfb
  • %ALLUSERSPROFILE%\Application Data\ZImVkep6q.rbb
  • %ALLUSERSPROFILE%\Application Data\2mF6iR8qEk9.rbc
  • %ALLUSERSPROFILE%\Application Data\9Zmw91V.ffp
  • %ALLUSERSPROFILE%\Application Data\yVaZlsPcB8W.xjo
  • %ALLUSERSPROFILE%\Application Data\k40i.xci
  • %ALLUSERSPROFILE%\Application Data\3OmHy.qii
  • %ALLUSERSPROFILE%\Application Data\S7eo8.qow
  • %ALLUSERSPROFILE%\Application Data\Lj5L.gwa
  • %ALLUSERSPROFILE%\Application Data\vKHoBkWyz.uty
  • %ALLUSERSPROFILE%\Application Data\0Dsnd.hcf
  • %ALLUSERSPROFILE%\Application Data\Xi5baLlrzmw.bnf
  • %ALLUSERSPROFILE%\Application Data\s5OAmF9.jxm
  • %ALLUSERSPROFILE%\Application Data\12v.gvl
  • %ALLUSERSPROFILE%\Application Data\4AlTyP5Aw.kkn
  • %ALLUSERSPROFILE%\Application Data\omqt2TaaQD.edr
  • %ALLUSERSPROFILE%\Application Data\AHkyemx.bid
  • %ALLUSERSPROFILE%\Application Data\Cg8OyR.zyr
  • %ALLUSERSPROFILE%\Application Data\AGzqm.rsy
  • %ALLUSERSPROFILE%\Application Data\eqyILSX7S.dqf
  • %ALLUSERSPROFILE%\Application Data\NnvQ.jwj
  • %ALLUSERSPROFILE%\Application Data\XWrXbzYA.jaz
  • %ALLUSERSPROFILE%\Application Data\RKWqih.hxt
  • %ALLUSERSPROFILE%\Application Data\GqFqC7jG.oto
  • %ALLUSERSPROFILE%\Application Data\ceK.gnn
  • %ALLUSERSPROFILE%\Application Data\Xz5H1w7yF.hck
  • %ALLUSERSPROFILE%\Application Data\HyjNNY.wbs
  • %ALLUSERSPROFILE%\Application Data\KWV.vat
  • %ALLUSERSPROFILE%\Application Data\EHD2.rms
  • %ALLUSERSPROFILE%\Application Data\tihKuQPC.zzv
  • %ALLUSERSPROFILE%\Application Data\kTZJxOBF1W7.xbd
  • %ALLUSERSPROFILE%\Application Data\RsU7Ky5hiw1.fdj
  • %ALLUSERSPROFILE%\Application Data\VcseH.cwu
  • %ALLUSERSPROFILE%\Application Data\iL2.zzn
  • %ALLUSERSPROFILE%\Application Data\BLQUb.rbh
  • %ALLUSERSPROFILE%\Application Data\aanUAn7YG9.lvi
  • %ALLUSERSPROFILE%\Application Data\E9IhCAaUBOa.slc
  • %ALLUSERSPROFILE%\Application Data\lBZ94KWZq9.bid
  • %ALLUSERSPROFILE%\Application Data\HDd7aT.bqk
  • %ALLUSERSPROFILE%\Application Data\WEdyKHQsI.msv
  • %ALLUSERSPROFILE%\Application Data\xbF5fdoIdjJ.ztt
  • %ALLUSERSPROFILE%\Application Data\HMvc3r.njp
  • %ALLUSERSPROFILE%\Application Data\AZqa0IVo.nro
  • %ALLUSERSPROFILE%\Application Data\c2Rohr4ivHn.wdz
  • %ALLUSERSPROFILE%\Application Data\UShV0CRV.klb
  • %ALLUSERSPROFILE%\Application Data\VB8vlZ.hgn
  • %ALLUSERSPROFILE%\Application Data\zznOw1ELmvW.jmv
  • %ALLUSERSPROFILE%\Application Data\oznSc.pxa
  • %ALLUSERSPROFILE%\Application Data\WL7BZuk9.xph
  • %ALLUSERSPROFILE%\Application Data\YN3oW6Km6p.huo
  • %ALLUSERSPROFILE%\Application Data\I7ya4.oig
  • %ALLUSERSPROFILE%\Application Data\9XL5hCe.zxf
  • %ALLUSERSPROFILE%\Application Data\pehOW4PeGZA.ktz
  • %ALLUSERSPROFILE%\Application Data\tn4.jen
  • %ALLUSERSPROFILE%\Application Data\MJd.azs
  • %ALLUSERSPROFILE%\Application Data\dBc.rlr
  • %ALLUSERSPROFILE%\Application Data\5JSEQ8Bomp.kgq
  • %ALLUSERSPROFILE%\Application Data\4F8WxL5daOq.xiu
  • %ALLUSERSPROFILE%\Application Data\In4.upx
  • %ALLUSERSPROFILE%\Application Data\qFUaUoF8fHb.rcb
  • %ALLUSERSPROFILE%\Application Data\pEi126nrAT4.mvq
  • %ALLUSERSPROFILE%\Application Data\oi7iu.nks
  • %ALLUSERSPROFILE%\Application Data\GrxNLn.lye
  • %ALLUSERSPROFILE%\Application Data\Czri2uQrbZ.pua
  • %ALLUSERSPROFILE%\Application Data\IdzoD5hE.dac
  • %ALLUSERSPROFILE%\Application Data\sdrPZYY.wxf
  • %ALLUSERSPROFILE%\Application Data\b78T.qjw
  • %ALLUSERSPROFILE%\Application Data\kKXiwIUqX9.ehp
  • %ALLUSERSPROFILE%\Application Data\uv7G6IOMzWu.oux
  • %ALLUSERSPROFILE%\Application Data\q4F.pfn
  • %ALLUSERSPROFILE%\Application Data\M5A.vtn
  • %ALLUSERSPROFILE%\Application Data\nkm5owKLj7K.zeb
  • %ALLUSERSPROFILE%\Application Data\v5QOK0DT.yyk
  • %ALLUSERSPROFILE%\Application Data\9ldlYNNC.itm
  • %ALLUSERSPROFILE%\Application Data\LdQ2t3c.bsp
  • %ALLUSERSPROFILE%\Application Data\r8No6.xmq
  • %ALLUSERSPROFILE%\Application Data\6S6f.osh
  • %ALLUSERSPROFILE%\Application Data\2nN8AKV.arn
  • %ALLUSERSPROFILE%\Application Data\NyhiAxdkA.htk
  • %ALLUSERSPROFILE%\Application Data\lVY35uy.qzn
  • %ALLUSERSPROFILE%\Application Data\ygBs65y.hjz
  • %ALLUSERSPROFILE%\Application Data\9tw4HeJGb.pnx
  • %ALLUSERSPROFILE%\Application Data\KyFAGdS31.ugg
  • %ALLUSERSPROFILE%\Application Data\3jdOtxZt.gsk
  • %ALLUSERSPROFILE%\Application Data\Paob.irk
  • %ALLUSERSPROFILE%\Application Data\X8u.xoy
  • %ALLUSERSPROFILE%\Application Data\oAoyvV.seq
  • %ALLUSERSPROFILE%\Application Data\OHb596RqZ.vso
  • %ALLUSERSPROFILE%\Application Data\m1OCgQxGdi.rjt
  • %ALLUSERSPROFILE%\Application Data\gzo.cza
  • %ALLUSERSPROFILE%\Application Data\9k1.rrs
  • %ALLUSERSPROFILE%\Application Data\Thjzbv856.aac
  • %ALLUSERSPROFILE%\Application Data\rZs2a3Fg.zoe
  • %ALLUSERSPROFILE%\Application Data\m1942R.okd
  • %ALLUSERSPROFILE%\Application Data\MJWfBJJlgH.sxh
  • %ALLUSERSPROFILE%\Application Data\OZa1AnjjH.srd
  • %ALLUSERSPROFILE%\Application Data\BI6p9yQ9Fd.zyd
  • %ALLUSERSPROFILE%\Application Data\NJuf.anz
  • %ALLUSERSPROFILE%\Application Data\Wtjgkh9.zsq
  • %ALLUSERSPROFILE%\Application Data\FAAtmPW.kqg
  • %ALLUSERSPROFILE%\Application Data\L0HLZjJ.xdh
  • %ALLUSERSPROFILE%\Application Data\uBH9QoBs3.gei
  • %ALLUSERSPROFILE%\Application Data\Jq6.hbw
  • %ALLUSERSPROFILE%\Application Data\pBdz.hcb
  • %ALLUSERSPROFILE%\Application Data\Q6YA.ijp
  • %ALLUSERSPROFILE%\Application Data\qm0.zso
  • %ALLUSERSPROFILE%\Application Data\GI1F.nsb
  • %ALLUSERSPROFILE%\Application Data\sPw0fQXno0Z.zqc
  • %ALLUSERSPROFILE%\Application Data\JSKM.rng
  • %ALLUSERSPROFILE%\Application Data\QEV8QM.pwp
  • %ALLUSERSPROFILE%\Application Data\NG09t4KoT.vwz
  • %ALLUSERSPROFILE%\Application Data\CLUEr78r.ikc
  • %ALLUSERSPROFILE%\Application Data\AvUo0.ymo
  • %ALLUSERSPROFILE%\Application Data\mOFVfMK6yu.nuv
  • %ALLUSERSPROFILE%\Application Data\pxmV.mfh
  • %ALLUSERSPROFILE%\Application Data\hJcTRK6zv.kxv
  • %ALLUSERSPROFILE%\Application Data\18Wmc3GH.uam
  • %ALLUSERSPROFILE%\Application Data\jNdcLo.mdp
  • %ALLUSERSPROFILE%\Application Data\0AMMG.xog
  • %ALLUSERSPROFILE%\Application Data\hS5Nba.dih
  • %ALLUSERSPROFILE%\Application Data\vmu5.kto
  • %ALLUSERSPROFILE%\Application Data\cRv.ski
  • %ALLUSERSPROFILE%\Application Data\5OCTT.rml
  • %ALLUSERSPROFILE%\Application Data\KkI5yB1.ajc
  • %ALLUSERSPROFILE%\Application Data\aVDjH3ov.yuy
  • %ALLUSERSPROFILE%\Application Data\HiHKFO.ofd
  • %ALLUSERSPROFILE%\Application Data\VpQ3gS7GZ.ink
  • %ALLUSERSPROFILE%\Application Data\OPgVrw9js.wjy
  • %ALLUSERSPROFILE%\Application Data\Qb1BUl5Ua.zel
  • %ALLUSERSPROFILE%\Application Data\Ycg2xhg.sof
  • %ALLUSERSPROFILE%\Application Data\USF.ihh
  • %ALLUSERSPROFILE%\Application Data\nfG.wge
  • %ALLUSERSPROFILE%\Application Data\mLnH.cul
  • %ALLUSERSPROFILE%\Application Data\mcKpq.xwz
  • %ALLUSERSPROFILE%\Application Data\glc4Gq.lfl
  • %ALLUSERSPROFILE%\Application Data\pVEhhQr.nbs
  • %ALLUSERSPROFILE%\Application Data\P6bh.zjh
  • %ALLUSERSPROFILE%\Application Data\L6GY.nno
  • %ALLUSERSPROFILE%\Application Data\K0xBdkG3mG.qsd
  • %ALLUSERSPROFILE%\Application Data\PIlvVUEwJh.ukd
  • %ALLUSERSPROFILE%\Application Data\1CbRDGDmlW9.cld
  • %ALLUSERSPROFILE%\Application Data\buoKtV.sam
  • %ALLUSERSPROFILE%\Application Data\PI7ci.hzc
  • %ALLUSERSPROFILE%\Application Data\pQweKcenNBJ.lvw
  • %ALLUSERSPROFILE%\Application Data\Uk3mD2qZSp.dxo
  • %ALLUSERSPROFILE%\Application Data\cjw2QhzWBc.sag
  • %ALLUSERSPROFILE%\Application Data\sLRectHIY.wts
  • %ALLUSERSPROFILE%\Application Data\WSvLfZQkLgR.gbv
  • %ALLUSERSPROFILE%\Application Data\DlmW9Vqt.mue
  • %ALLUSERSPROFILE%\Application Data\GdmmZpd.mwj
  • %ALLUSERSPROFILE%\Application Data\fNEAN.lng
  • %ALLUSERSPROFILE%\Application Data\Kuv.sjv
  • %ALLUSERSPROFILE%\Application Data\19wk22QFY.fnm
  • %ALLUSERSPROFILE%\Application Data\dGs.rgb
  • %ALLUSERSPROFILE%\Application Data\j0Cm.ygh
  • %ALLUSERSPROFILE%\Application Data\1dJoHPljgvc.qul
  • %ALLUSERSPROFILE%\Application Data\QQNwWPHF0bj.byg
  • %ALLUSERSPROFILE%\Application Data\ieDfYbTjjZe.qfd
  • %ALLUSERSPROFILE%\Application Data\wnZPsi2j.wcn
  • %ALLUSERSPROFILE%\Application Data\qygp.ztv
  • %ALLUSERSPROFILE%\Application Data\tfP6mTv8V.ywd
  • %ALLUSERSPROFILE%\Application Data\FMmmmoz1.eeu
  • %ALLUSERSPROFILE%\Application Data\6YmRe.fgh
  • %ALLUSERSPROFILE%\Application Data\IgYEces.huq
  • %ALLUSERSPROFILE%\Application Data\hcnNc.zjk
  • %ALLUSERSPROFILE%\Application Data\mmCe4Ca.apo
  • %ALLUSERSPROFILE%\Application Data\dNDMPnlIL.hab
  • %ALLUSERSPROFILE%\Application Data\cc24Uvke.hio
  • %ALLUSERSPROFILE%\Application Data\SuQKqM.wqf
  • %ALLUSERSPROFILE%\Application Data\hqwB13eH.kgt
  • %ALLUSERSPROFILE%\Application Data\tCW5qOIWdb.ica
  • %ALLUSERSPROFILE%\Application Data\Kl3.lty
  • %ALLUSERSPROFILE%\Application Data\hgxQk0Tsx.xzk
  • %ALLUSERSPROFILE%\Application Data\Z1ES7BrJG.jef
  • %ALLUSERSPROFILE%\Application Data\C2hwuEJ.dqa
  • %ALLUSERSPROFILE%\Application Data\Mda.otl
  • %ALLUSERSPROFILE%\Application Data\lNV.izd
  • %ALLUSERSPROFILE%\Application Data\oNAO6hsQYRf.fgz
  • %ALLUSERSPROFILE%\Application Data\2zkoL.csv
  • %ALLUSERSPROFILE%\Application Data\77V64.rlj
  • %ALLUSERSPROFILE%\Application Data\NdVta3w.mtu
  • %ALLUSERSPROFILE%\Application Data\J3I.spk
  • %ALLUSERSPROFILE%\Application Data\JNBD.tty
  • %ALLUSERSPROFILE%\Application Data\UNYai8b.rcv
  • %ALLUSERSPROFILE%\Application Data\oZr.tyj
  • %ALLUSERSPROFILE%\Application Data\Caou4YdB.sdi
  • %ALLUSERSPROFILE%\Application Data\WhDxm.phu
  • %ALLUSERSPROFILE%\Application Data\VNuFe0P6P0.mxt
  • %ALLUSERSPROFILE%\Application Data\rm5ohNhM.xjg
  • %ALLUSERSPROFILE%\Application Data\Q1iLm5U.cak
  • %ALLUSERSPROFILE%\Application Data\k91s7W.lci
  • %ALLUSERSPROFILE%\Application Data\jOd.hdc
  • %ALLUSERSPROFILE%\Application Data\xCUmUovQ.jat
  • %ALLUSERSPROFILE%\Application Data\vXtVWFhybc9.ldz
  • %ALLUSERSPROFILE%\Application Data\q8Keo0.hdw
  • %ALLUSERSPROFILE%\Application Data\zVBHQAtTP1.ltp
  • %ALLUSERSPROFILE%\Application Data\nHgvE.lkm
  • %ALLUSERSPROFILE%\Application Data\4PMI6.pft
  • %ALLUSERSPROFILE%\Application Data\ukDi2LGbf6K.lhj
  • %ALLUSERSPROFILE%\Application Data\FXxj.ppo
  • %ALLUSERSPROFILE%\Application Data\JO3.eat
  • %ALLUSERSPROFILE%\Application Data\nST.txd
  • %ALLUSERSPROFILE%\Application Data\6vXWGP237K.lwn
  • %ALLUSERSPROFILE%\Application Data\6Gz6.eoi
  • %ALLUSERSPROFILE%\Application Data\s9G2LRkBLn.row
  • %ALLUSERSPROFILE%\Application Data\RhXstom.pzu
  • %ALLUSERSPROFILE%\Application Data\ZbWL.wps
  • %ALLUSERSPROFILE%\Application Data\8eCbAtaffX5.lum
  • %ALLUSERSPROFILE%\Application Data\43ArL8gT.xuh
  • %ALLUSERSPROFILE%\Application Data\8KG.kql
  • %ALLUSERSPROFILE%\Application Data\Jyz.weg
  • %ALLUSERSPROFILE%\Application Data\mqR.kja
  • %ALLUSERSPROFILE%\Application Data\imn7y58Ys.idi
  • %ALLUSERSPROFILE%\Application Data\99OeQeCMl.srt
  • %ALLUSERSPROFILE%\Application Data\I838m.khg
  • %ALLUSERSPROFILE%\Application Data\tiAlzl3YiJ.mlb
  • %ALLUSERSPROFILE%\Application Data\oP8mmF.gag
  • %ALLUSERSPROFILE%\Application Data\beFzX.dlv
  • %ALLUSERSPROFILE%\Application Data\UWMjAbK.xfv
  • %ALLUSERSPROFILE%\Application Data\QHxq.jsc
  • %ALLUSERSPROFILE%\Application Data\vN3yIZILkP.yju
  • %ALLUSERSPROFILE%\Application Data\zzx1fc9.oxm
  • %ALLUSERSPROFILE%\Application Data\SpKNDv6.hce
  • %ALLUSERSPROFILE%\Application Data\KN10mQkG.exv
  • %ALLUSERSPROFILE%\Application Data\qWEtX.pyx
  • %ALLUSERSPROFILE%\Application Data\V1TORInfI.rkl
  • %ALLUSERSPROFILE%\Application Data\cDo.qpl
  • %ALLUSERSPROFILE%\Application Data\mPjbylxf2TB.uws
  • %ALLUSERSPROFILE%\Application Data\IbuxL.ucl
  • %ALLUSERSPROFILE%\Application Data\kSP3CXkPS.oox
  • %ALLUSERSPROFILE%\Application Data\tdTLMb4Edo.kwp
  • %ALLUSERSPROFILE%\Application Data\eTA3m.abx
  • %ALLUSERSPROFILE%\Application Data\hdE17hnr0z.tzm
  • %ALLUSERSPROFILE%\Application Data\Gjs.rnb
  • %ALLUSERSPROFILE%\Application Data\7jXSNMX.tkx
  • %ALLUSERSPROFILE%\Application Data\WrGfakYF6.zmb
  • %ALLUSERSPROFILE%\Application Data\LjoKmE.caa
  • %ALLUSERSPROFILE%\Application Data\XBBxqHYnBC.bjt
  • %ALLUSERSPROFILE%\Application Data\95iRNHC32.mpf
  • %ALLUSERSPROFILE%\Application Data\bNg.yxt
  • %ALLUSERSPROFILE%\Application Data\A58.ygy
  • %ALLUSERSPROFILE%\Application Data\8ke1SK.fmp
  • %ALLUSERSPROFILE%\Application Data\SqeIMr5Vpv.anr
  • %ALLUSERSPROFILE%\Application Data\mpUYr8F3KS.jjd
  • %ALLUSERSPROFILE%\Application Data\6nt4RX7rp.itt
  • %ALLUSERSPROFILE%\Application Data\XNH.lyg
  • %ALLUSERSPROFILE%\Application Data\9FQQTPt70nz.nsp
  • %ALLUSERSPROFILE%\Application Data\QxMl3QX.sfq
  • %ALLUSERSPROFILE%\Application Data\A5a5XzeW8n.ttj
  • %ALLUSERSPROFILE%\Application Data\OKayaH.myu
  • %ALLUSERSPROFILE%\Application Data\lB9m40i.hwp
  • %ALLUSERSPROFILE%\Application Data\59F1cKCUxT.udp
  • %ALLUSERSPROFILE%\Application Data\E9aynL8og.ssz
  • %ALLUSERSPROFILE%\Application Data\0eNjQa.llg
  • %ALLUSERSPROFILE%\Application Data\kulIlE.bkm
  • %ALLUSERSPROFILE%\Application Data\SlapZbYT.hdi
  • %ALLUSERSPROFILE%\Application Data\DIFqIv.skr
  • %ALLUSERSPROFILE%\Application Data\XMoXOV.dxp
  • %ALLUSERSPROFILE%\Application Data\QmVAxDtp.lxj
  • %ALLUSERSPROFILE%\Application Data\bqKX7jZKc.haf
  • %ALLUSERSPROFILE%\Application Data\Ig66Vuumxb.jok
  • %ALLUSERSPROFILE%\Application Data\L0GmaCip3.zwp
  • %ALLUSERSPROFILE%\Application Data\VWD8C9XwhE.ybf
  • %ALLUSERSPROFILE%\Application Data\7bB.yuq
  • %ALLUSERSPROFILE%\Application Data\i2Il.spt
  • %ALLUSERSPROFILE%\Application Data\h3j2oZql3.gwr
  • %ALLUSERSPROFILE%\Application Data\8jYTQ.nun
  • %ALLUSERSPROFILE%\Application Data\hK5.wlw
  • %ALLUSERSPROFILE%\Application Data\zLn.ebv
  • %ALLUSERSPROFILE%\Application Data\YQSWutC2s2.yrm
  • %ALLUSERSPROFILE%\Application Data\NuTe2.mox
  • %ALLUSERSPROFILE%\Application Data\KCf5IRqNoO.dxj
  • %ALLUSERSPROFILE%\Application Data\uo9.goc
  • %ALLUSERSPROFILE%\Application Data\q0F.xte
  • %ALLUSERSPROFILE%\Application Data\5uBb0L6.ozj
  • %ALLUSERSPROFILE%\Application Data\O0ogwdqW.uhy
  • %ALLUSERSPROFILE%\Application Data\dLxHDYQ.gom
  • %ALLUSERSPROFILE%\Application Data\LZJfV1.neh
  • %ALLUSERSPROFILE%\Application Data\irLjlQQIjI.qim
  • %ALLUSERSPROFILE%\Application Data\mrn3rSW6.nsj
  • %ALLUSERSPROFILE%\Application Data\6wSvF.uff
  • %ALLUSERSPROFILE%\Application Data\3RG55N.mcs
  • %ALLUSERSPROFILE%\Application Data\NTO5V9XKBo.bie
  • %ALLUSERSPROFILE%\Application Data\g17.hem
  • %ALLUSERSPROFILE%\Application Data\TVdvbMLIK2.oap
  • %ALLUSERSPROFILE%\Application Data\mwM.ahe
  • %ALLUSERSPROFILE%\Application Data\nQIQsq.fcu
  • %ALLUSERSPROFILE%\Application Data\iq4Vu.sbl
  • %ALLUSERSPROFILE%\Application Data\k0G3I04.psh
  • %ALLUSERSPROFILE%\Application Data\BGP.uwe
  • %ALLUSERSPROFILE%\Application Data\DLi.mkh
  • %ALLUSERSPROFILE%\Application Data\p1mRTiTjy.bgn
  • %ALLUSERSPROFILE%\Application Data\yLQtY7bF.kwo
  • %ALLUSERSPROFILE%\Application Data\QjVxF9Rec9U.kwm
  • %ALLUSERSPROFILE%\Application Data\pYYXGaiqp.glr
  • %ALLUSERSPROFILE%\Application Data\482rE993RrN.qlh
  • %ALLUSERSPROFILE%\Application Data\xoNvjBCw2J4.hfr
  • %ALLUSERSPROFILE%\Application Data\fnW.xpr
  • %ALLUSERSPROFILE%\Application Data\BtF1DeDiPD.jif
  • %ALLUSERSPROFILE%\Application Data\YAzMXsHJtNK.glt
  • %ALLUSERSPROFILE%\Application Data\hvVZBX.fop
Network activity:
UDP:
  • DNS ASK mf##vnq.com
  • DNS ASK Dm#.com
  • DNS ASK HY###ikT.com
  • DNS ASK D5###UUOwMd.com
  • DNS ASK Fd#.com
  • DNS ASK sJ###t2U.com
  • DNS ASK s2##.com
  • DNS ASK Ns###sxA5.com
  • DNS ASK i7###8OStsM.com
  • DNS ASK tt###ZCBd.com
  • DNS ASK WP#.com
  • DNS ASK gc##NH.com
  • DNS ASK No##Db.com
  • DNS ASK wl###02w.com
  • DNS ASK EI###nVJ.com
  • DNS ASK w3##T.com
  • DNS ASK eb###rApUk.com
  • DNS ASK vj##69.com
  • DNS ASK 6K###ewP4.com
  • DNS ASK tV#.com
  • DNS ASK 8k###KeqSMS.com
  • DNS ASK sU###jspox.com
  • DNS ASK H9##K.com
  • DNS ASK GK###2VwS3.com
  • DNS ASK ZA##T.com
  • DNS ASK 6c###PyHXeB.com
  • DNS ASK sq###zdKWnW.com
  • DNS ASK YM###aNDby7.com
  • DNS ASK 5t##k.com
  • DNS ASK mg###W6O.com
  • DNS ASK 3K#.com
  • DNS ASK Ju###QTS.com
  • DNS ASK Fl###58b2.com
  • DNS ASK fZ##.com
  • DNS ASK IP###DRSkx.com
  • DNS ASK 1T##D1.com
  • DNS ASK V0##.com
  • DNS ASK zP###QMp2dZ.com
  • DNS ASK Ra###K83IG.com
  • DNS ASK so##0.com
  • DNS ASK sn##w.com
  • DNS ASK OY#.com
  • DNS ASK Rr##Fd.com
  • DNS ASK O5##71.com
  • DNS ASK v0##nH.com
  • DNS ASK tM#.com
  • DNS ASK EE###3u1.com
  • DNS ASK sL##Dq.com
  • DNS ASK 7I##2.com
  • DNS ASK bP###Lt7A.com
  • DNS ASK MP##t.com
  • DNS ASK ly###6yBsMu.com
  • DNS ASK XP###iTTE.com
  • DNS ASK 52###eBV99.com
  • DNS ASK mS###OLaNyV.com
  • DNS ASK 62###n5Ol.com
  • DNS ASK bJ###dDtnr.com
  • DNS ASK BM##9IC.com
  • DNS ASK zJ###ix0.com
  • DNS ASK DI##IR.com
  • DNS ASK LU##.com
  • DNS ASK jl###obSUj.com
  • DNS ASK VJ##j.com
  • DNS ASK KH###3wQN2.com
  • DNS ASK 8a###otdEPF.com
  • DNS ASK Ns#.com
  • DNS ASK YB###2rA6.com
  • DNS ASK hM###yjCF.com
  • DNS ASK TY###3zTn.com
  • DNS ASK t7###ifpc49.com
  • DNS ASK n7###6vMcl.com
  • DNS ASK 96##Ay.com
  • DNS ASK 4O###Yae.com
  • DNS ASK 3t###f14ic.com
  • DNS ASK 1D###tMTUxs.com
  • DNS ASK Xs###QBb37.com
  • DNS ASK LR###2vuVp.com
  • DNS ASK 5c###8KOk7k.com
  • DNS ASK bn###NvHGg.com
  • DNS ASK Vy###W5rhuy.com
  • DNS ASK o5###V9e.com
  • DNS ASK gm###OM9.com
  • DNS ASK ue###zKgL.com
  • DNS ASK Sn###bZfCLB.com
  • DNS ASK Vr##t.com
  • DNS ASK Bp###Dc5T5.com
  • DNS ASK sg###UOTZbF.com
  • DNS ASK 2p##9Z.com
  • DNS ASK rz##Tyx.com
  • DNS ASK uW##xL.com
  • DNS ASK 01###BZ3y.com
  • DNS ASK qn##8d.com
  • DNS ASK 4L##u.com
  • DNS ASK JK##a.com
  • DNS ASK qc##bLQ.com
  • DNS ASK hX##f1.com
  • DNS ASK aH###IfwwV.com
  • DNS ASK Fu##iY2.com
  • DNS ASK Tx##k3.com
  • DNS ASK dC###WrcY.com
  • DNS ASK xv##.com
  • DNS ASK Wq###2ZG.com
  • DNS ASK 9A###T6UHlT.com
  • DNS ASK 4F##b.com
  • DNS ASK AF##K.com
  • DNS ASK 1K#.com
  • DNS ASK n2##V7.com
  • DNS ASK eq###sA4d.com
  • DNS ASK 0g##gS.com
  • DNS ASK QI##i.com
  • DNS ASK Yy##sr.com
  • DNS ASK oq###knmA.com
  • DNS ASK Q8##nL.com
  • DNS ASK Ds###f04tRz.com
  • DNS ASK Or##X.com
  • DNS ASK g2##2Mg.com
  • DNS ASK m7##3YN.com
  • DNS ASK gk##.com
  • DNS ASK x2###MKIpY.com
  • DNS ASK AX###Nv46.com
  • DNS ASK oW##EZ0.com
  • DNS ASK WO##Xw.com
  • DNS ASK Db###1249q0.com
  • DNS ASK gt##.com
  • DNS ASK FD##g.com
  • DNS ASK xM##3.com
  • DNS ASK mw###Dk6llT.com
  • DNS ASK vt###BlF.com
  • DNS ASK Ne##E2J.com
  • DNS ASK QR###puuq.com
  • DNS ASK b6###4uf2k.com
  • DNS ASK wi##5lj.com
  • DNS ASK 7H##2iE.com
  • DNS ASK Bw###UkvJ.com
  • DNS ASK Zu###xqqVm0.com
  • DNS ASK v1#.com
  • DNS ASK No##.com
  • DNS ASK wg#.com
  • DNS ASK iT#.com
  • DNS ASK 7j###miU81I.com
  • DNS ASK jp##v.com
  • DNS ASK U8###QgV4pb.com
  • DNS ASK k1##.com
  • DNS ASK iZ##Bz3.com
  • DNS ASK 9F###HuX.com
  • DNS ASK IS###9Uk86.com
  • DNS ASK 97##r.com
  • DNS ASK ky#.com
  • DNS ASK Lt###5BhTtz.com
  • DNS ASK ls###05Vq.com
  • DNS ASK gj##LKe.com
  • DNS ASK oH##.com
  • DNS ASK 8H##fq.com
  • DNS ASK 46##kCJ.com
  • DNS ASK 8L###2vC4.com
  • DNS ASK bW#.com
  • DNS ASK Ft##ej2.com

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android