Adware.Ezoneclick.1

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0349-449c-8CDF-2767E7E6E2FA}] 'Exec' = 'http://yesmoney.co.kr/'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-2461-47fc-A02F-9EB8678B2A5C}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/11.php?bncode=filemoaup'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ez_oneclick' = '"%PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe" -o'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-78A7-48d9-9094-E214DAB62467}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/c.php?bncode=filemoaup'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-61C1-4d78-9748-81073EFB1E53}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/gm.php?bncode=filemoaup'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-25AE-487c-8DD7-1CC9CE85512A}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/au.php?bncode=filemoaup'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0386-42ec-9235-AB96A83F7FF1}] 'Exec' = 'http://%65v%65nt.go.co.kr/megapass/event.php?pid=filemoaup'

Malicious functions:

Executes the following:

<SYSTEM32>\cmd.exe /c \DelUS.bat

Modifies file system :

Creates the following files:

%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\·ФµҐИЁјоЗО.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ёВВЇґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\µрѕШјҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\іујц»кИЁјоЗО NSАМју.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ґЩїшёфґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ДЅєЕёАП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їмГј±№ јоЗО.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їш№ЩАМїш.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ѕЖЅє№МїА.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ЭЗ°јјАПґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЅЕјј°иёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Qook TVјоЗО.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ВЇ·О¶З.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ЗБё®Б¶ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј»з¶ы.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј.com.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојјґ©ё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\ё¶АМД«їНґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\CJmall.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Hmall.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\Б¦АПД«іЭ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\јјАМєкД«µе іЧєс°ФАМјЗ ЖчАОЖ® ±ёАФ ЗБ·ОёрјЗ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\їЈД«БЯ°нВч.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшѕоµҐАМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\·ЇєкЖк.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ЅєДр№ВБч.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\µµ±ЧёѕѕЦ°ЯїлЗ°.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Е·Д«ґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\°ЗґгјҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ДЭ·єЕНёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\eЕ¬ё°.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\°ЧЗГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\QOOKАОЕНіЭ Аь±№°ЎАФјѕЕН.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ЖкГчё¶ДП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\BCД«µе ЅЕїлБ¤єёєёИЈ јєсЅє ЅЕГ» АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ДЈ±ёЕ¬·ґ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Ж®·»µеЗГ·ЇЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЗЗЕж»юїц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ДБ№цЅєјҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшДП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\АМё¶Ж®АОЕНіЭјоЗОёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ё®ѕуЖГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ(ѕуВЇАМєҐЖ®).url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\їА·»БцёЮАМЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\№МЖГ2030.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ЅМ±ЫЖДАМЖГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\Г»јЦ ІїІїєф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\ДЙѕојѕЅєёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\БТЕҐ°ЈАе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\АеёАґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\Бѕ°ЎЗЄµејҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\ЗЄµеё¶Ж®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\·ФµҐГјЕ©Д«µе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ёЖЅєД«µе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ґЩ·зАОЖч.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\GSєёЗијҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\±ієё»эён АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\єОАЪёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\G7ДїЗЗ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\±Чё°ёрѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\CJON mart.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Зп·ОїмЖГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\AbleMall.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\±Э»кАО»пµµёЕјѕЕН.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\µїїшёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\№Щ·ОБ¶ё® јц»кЅДЗ° ѕѕДо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\ґЩЗПґ©ёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\±иИс¶у °щ°Ё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°-ґЩАМѕоЖ®)\іЧїАЅєА§Ж®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\№М·ЎАОЅґ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\·№µеИъЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё®ЖІГµАз.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\µрѕѕєП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\БѕЅЕєёЗиґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\°ЎєЈіоАМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё¶АМєЈАМєс.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\·О¶Зё®ДЎ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\»зБЦєкАМґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\Б¦·ОЕхјјємґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\єёё®єёё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ѕЖАМГ§ё°Бц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє№лё®ґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅєЗЗµе№рЕ©.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅЕЗСД«µе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\јјАМєкД«µе №Я±Ю ЅЕГ» АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\єёЗи 24.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\»пјєД«µе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч №«·бИёїш°ЎАФ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅґіЭ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє·Јµе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АМАЇґЩАМ·єЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їмё®ѕЖєс№Щ»эён АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\±вЗБЖјДЬ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЗГ¶уАМїцДЎ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЗПЗБЕ¬·ґ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЗБ·ОїНДЎ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЖРјЗЅєЕдё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЖРјЗЗГ·ЇЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЗПЗПёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ё¶АМѕЖё¶Бё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ѕЖАМЗПїмЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\OTTO.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЗгґП№цЕН.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЗмАМїд.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЖјДДЖЫґП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їА°Ў°Ф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їАјѕЅє(osense).url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ї§Бцёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їЈЕНјҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їЈЕНЅДЅєёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їИ№ЗЅєЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ДЪАМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ДЪДЪЖЛ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\АПёрЅєЖ®ёґ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їНїНґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\А§БоЅєЕдё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їЈБ¶АМґєїе.url
%TEMP%\nsb2.tmp\stack.dll
%TEMP%\nsb2.tmp\SetHoldData.dll
%HOMEPATH%\Desktop\Бс°ЬГЈ±в їБјЗ.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-ДЪё®ѕЖ.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - їБјЗ.url
%PROGRAM_FILES%\ez_oneclick\Uninstall.exe
%TEMP%\nsb2.tmp\SelfDelete.dll
C:\DelUS.bat
%TEMP%\nsb2.tmp\DLLWebCount.dll
%TEMP%\nsb2.tmp\registry.dll
%TEMP%\nsb2.tmp\IEFunctions.dll
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-№«єс.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ЗПЗБЕ¬·ґґеДД.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - 11№ш°Ў.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\АЇё®Д«.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їцДїИъ ёйјјБЎ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\А§БоА§µе.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - CJmall.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - d&shop.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - »пјєёф.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - NSіујц»кИЁјоЗО.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - Gё¶ДП.url
%HOMEPATH%\Favorites\Бс°ЬГЈ±в - KTmall.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЧЕ©»зїд.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Б¶АМ№®АЪ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АОЖчё¶ЅєЕН.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АҐјЦ·зјЗЖЗёЕ CGIMALL.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЇµрїҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Б¶АМЗПµе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДьґЩїо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖчЅєЖ®ёЗ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДоЖДАП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ВЇµрЅєЕ©.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДДЅє±оЖд.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їНїмµрЅєЕ©.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё¶АМЕ©·№µч.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ёЮ°ЎЖДАП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё®ѕуЅєДµ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґПБоДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґЩїоБо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\єн·зАҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їўЅєЕ°ЖЫ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їБјЗ ЅєД«АМЗБ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ѕЖЅОДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Ѕ¦ѕо№ЪЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЅґЖЫґЩїо Иёїш°ЎАФ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖъґхјјАМЗБ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\єн·ўЖз·Оїм.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\»м·ХіЄАО.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\єн·ўДэ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\єЈіЧЖј.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\єк·Јµе·Їєк.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ј±ґцї©їХ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їЈєс·и.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\їЈБ¶АМ№Р¶х.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ѕЖАМЅєЕёАП24.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\јј¶уёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ЅєЕёАПїЈБш.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\№Дё®ѕИ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\±Э»уГ·И.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\іЄјї¶у.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ifumall.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЗС±№Б¤єёАОБх.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\LGЖРјЗјҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\іЄАО°Й.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ёнјєЅГ°и.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\№«Е©.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ёБ°нё®є».url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\іЄАОїИ№З.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ)\ґхЅєЕЧАМБц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪ№Н19.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\»з¶ыБц±в.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\»пјєєПЅєґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\№ЭµрѕШ·зґПЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\µµј11№ш°Ў.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\µрБцЕР±ієё№®°н.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\ѕѕіЧБ¶АМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\ЖјДПёµЕ©.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\KALИЈЕЪ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\АОЕНіЭјБЎ ё®єк·О.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\ѕЖАМєсєП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\їҐіЭґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј-АЅ№Э-°шї¬)\ґл±ієПЅєДµ(Bookscan).url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅЕЗС±ЭА¶Б¤єё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ѕЛЗБЅє·Р.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅєЕё»уИЈАъГаАєЗа ЗПАМ·Р.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\№МБо»з¶ы.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\»кїНёУґП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\АМБц·Р.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\јДЎѕИ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\їА№цГЯѕо ДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ёфјоЗО.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\°ЎєсѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\іЭЗЗѕЖґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\¶ЇГіё®ґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\ёЮ°ЎЖРЅєБё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\јјАМ№ВБч.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\·к·з°ФАУ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\µµіКГчїµИ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\·°Е°ЅєґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\ЅЙЅЙЕёЖДTV.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\БсБЄ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\ДЪ°ФАУ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\ѕЖАМЕЫёЕґПѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\ѕѕіЧЕл АЇ·бёв№цЅ± °ЎАФ АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ-їµИ-°ФАУ)\ѕѕіЧЖшЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЩ¶уДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОДЬµµ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОЕхѕо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їБјЗјч№Ъ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж® АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\АҐЕхѕо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЈЕЪЖ®ё®Ѕє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЁЖ®·Ўєн.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ЕхѕоАНЅєЗБ·№Ѕє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\Д«ЖчАЇ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ДієуЅєЕдё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЛ№ЩА§Бо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\АОЕ©·зЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЖё®јц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\»х·ТїЎµа.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\јј»уА» їѕо°ЎґВ їµѕоДЈ±ё їЎµа№ЪЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\Б¤Г¶ »зАМ№ц ЅєДр.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёјєсЅє)\TNS °Ў±ёЖРіОёрБэ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёјєсЅє)\TNS ·№АМµр ЖРіО.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ИЮіЭ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЖдАМїАЗВ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЗС±№ЗРјъБ¤єё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\єёД«ЗБ·О.url
%PROGRAM_FILES%\ez_oneclick\url2.dll
%PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe
%TEMP%\nsb2.tmp\Locate.dll
%TEMP%\nsb2.tmp\KillProcDLL.dll
%TEMP%\nsb2.tmp\DLLWaitForKillProgram.dll
%HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\11№ш°Ў.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\°ъїЬїАДЙАМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ёЮАМДїЅєЕНµр.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\(БЦ)ЅєД«їмЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\Gё¶ДП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\їБјЗ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёјєсЅє)\°іАОБ¤єёµµїлВчґЬјєсЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\114Е©·№µрЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\kt·Р.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ЗС±№ІЙ№иґЮјѕЕё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ ІЙ№иґЮ іЭ114.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ІЙ№иґЮјєсЅє 119ЗГ¶уїц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\іЄАМЅєёУґП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ё®µеДЪЗБ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ёУґПїБјЗ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ФµҐДіЗЗЕ».url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\¶уАМЗБ·Р.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ЇЅГѕШДіЅГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\А±БѕЅЕІЙ№иґЮ ЗГ¶уїц365.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\(БЦ)ЗГ·ЇЅєЗГ¶уїц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1300k.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёјєсЅє)\јҐЖчЕ».url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёјєсЅє)\іЄАМЅєёУґП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёјєсЅє)\ёµЕ©ЗБ¶уАМЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1566flower.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ї№јЫДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\АЇґП·и.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ѕЖё¶¶хЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ўЯ99ЗГ¶уїц.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\±Чё°јҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\LGT °ЎБ·А§ДЎѕИЅЙ јєсЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеucc.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеёБ°Ў.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\¶уАМєк69tv.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\іІјцЕ¬·ґ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\µыАЪґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№ёуTV.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№д°шАЇ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єёXїд.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№Щ¶чії©їм.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№«АОµµёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№ЩіЄіЄёф јєАОїлЗ° ЗТАОБЎ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\X-°ЙЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗШЗЗёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\2010ЖДАП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПАМё¶Ж®јоЗОёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ДЪЅєЅєЕІ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПїмїГё°.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєAV.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69ЕЧАМЗБ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ClubSex.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69јЅЅєДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєЖДАП.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшѕЯµї.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єь±ёё®ѕЯµї.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈЕНЗГ·№АМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їН№ЩД·.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈБ¶АМ№«єс.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЅєАзЖТ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЕдАМёфґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¤·ВёЗ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Гµїшґ©µе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪё®ѕЖїЎ·О.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\БсјЅЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗЦЖјєс.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗеЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЯЗСД«Жд.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖAV.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєѕШЅГЖј.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\»пГµїшјЅЅєЖјєс.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅє-ДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГµрД«.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖ°ЎѕѕTV.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖё®јц№МЖГ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јТ¶уЕ¬·ґ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГ№«єс.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГѕЖАМµ№.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\іЧАМГіё®ЖЫєнёЇ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ґхЖдАМЅєјҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\±Чё°ДЪЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\±ВѕЖАМЖд·Оёу.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\±Ч·№АМЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\¶уілЕ©ёІ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ЅєЕІRX.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ЅєЕІєЈєЈ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\єсґхЅєЕІ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ё®ЅєЕІ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ё®їАї¤ё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\BRTC.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП°ФАУБё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП№МЖГ АЇ·б°ЎАФ (ѕЦАОёёµй±в).url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\mylg070.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SKT Аъ°ЎБ¤ѕЧБ¦ АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SMSЗЗѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\»Сё®їА.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ГЦЅЕіЭєП №«·бБхБ¤АМєҐЖ®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\Жщјї.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\їЈЖСЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\јоѕШѕЖАМ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ѕѕїЈЕх.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ЅєЖ®·ОєЈё®іЭ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ґЩАМјТёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ё®µејѕЅєёф.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Papel Stationery.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\007єёАМЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\2001ѕЖїп·ї.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\№МїАµрїА.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Б¦АПБё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ГµАМ№йїҐ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\їВµрЅєЕ©.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\єЈµщ·Јµе.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ѕЖАМёрё®.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\(БЦ)»уµµ°Ў±ё.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\Еёё¶ґП Гµї¬ ёнЗ° И»кАзЖС.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ЕВ№ЭДЪё®ѕЖ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ДЪЅє№МИАеЗ°.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\їЎДЪДЙѕо.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\їЎЖЅЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ЖдАМЅєµеёІ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\ёнЗФГµ»з.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\АЧЕ©ѕЖАМ ґеДД.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µрѕѕїўЅє.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-ИАеЗ°)\ЗГ·ЇЅєГµ.url
%HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µр№ЪЅє.url

Deletes the following files:

%TEMP%\nsb2.tmp\SelfDelete.dll
%TEMP%\nsb2.tmp\registry.dll
%TEMP%\nsb2.tmp\stack.dll
%TEMP%\nsb2.tmp\SetHoldData.dll
%TEMP%\nsb2.tmp\Locate.dll
%TEMP%\nsb2.tmp\DLLWebCount.dll
%TEMP%\nsb2.tmp\DLLWaitForKillProgram.dll
%TEMP%\nsb2.tmp\KillProcDLL.dll
%TEMP%\nsb2.tmp\IEFunctions.dll

Deletes itself.

Network activity:

Connects to:

'lo#.##sence.co.kr':80

TCP:

HTTP GET requests:

lo#.##sence.co.kr/logexp.php?ai####################################

UDP:

DNS ASK lo#.##sence.co.kr

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: ''

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial