Trojan.MulDrop8.23674

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\aut1.tmp
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\QuickAccess\QaConfig.dat
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Molebox\Molebox.dat
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Config\config.ini
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Config\config.dat
%TEMP%\tempbfset\Roaming\Maxthon5\Public\SiteIcon\SiteIcon.dat
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180206200532
%TEMP%\tempbfset\Roaming\Maxthon5\Public\SiteIcon\Mx007.ico
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Favorite\Favorite.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Favorite\favbackup\fav62.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Config\SyncConfig.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Config\config.ini
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Config\config.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563714514.11567ef2-bb12-4a87-abc2-75573077f33e.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\addonStartup.json.lz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extension-settings.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\state.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\session-state.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520564455147.89a0a6b3-4f42-4f9f-9517-e3216492cbc7.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520564438893.c7b2b32d-2e29-4236-b0c6-76d4dfa8bc97.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520564401882.65a73d84-403d-4897-bb97-198e008db94d.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520564010453.2e75a193-6be9-4712-ad2c-1b29bd882c66.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563993900.95db68d6-a300-45d7-ada6-76fab956433b.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563987706.74e24cc5-f86e-4a16-90cb-80ea39684d45.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563875268.70dbb02a-8692-46e3-acdb-1b2c4f8da182.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563870094.9bf0fecd-3af5-443d-affe-5743ebbc9922.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563850220.7f6024f4-ae2b-4507-bf1e-7d60bc987ae5.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563783926.7f8fdfaa-e6fe-4ddf-a722-3ffc9da4c3cd.main.jsonlz4
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563728536.9364e110-e7f5-4a13-83fe-868be45d3605.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563463058.3cb350d3-e794-4f8a-b0da-06ab9ba2c3e1.first-shutdown.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563463055.1290d8ff-c86d-4f13-908c-07b4235c2f83.main.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\datareporting\archived\2018-03\1520563462997.b79a1533-0d2a-43ad-ab7f-c61701651941.new-profile.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\crashes\store.json.mozlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\cookies.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\content-prefs.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\containers.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\compatibility.ini
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\cert9.db
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\browser-extension-data\cpmanager@mozillaonline.com\storage.js
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\blocklists\plugins.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\blocklists\addons.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\blocklist.xml
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\profiles.ini
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\addons.json
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\www.2345.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Bookmark.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\settings\settings.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\site_icon.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.taobao.com_3270921833.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\www.hao123.com.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.taobao.com_2378251753.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.jd.com_231888724.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.hao123.com_3314234330.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.hao123.com_3270921833.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.bfghodh.com_3839563647.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.baidu.com_3574897595.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.baidu.com_1945350878.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.2345.com_2152100337.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\weibo.com_1478391124.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\v.qq.com_1150196428.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\union.click.jd.com_3251979934.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\tmall.bfgho.com_3455441347.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\tbtm.bfgho.com_1139518425.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\tb1.bdstatic.com_227537604.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.qiyipic.com_258398459.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\www.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pic.c-ctrip.com\settings.sol
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#gss1.bdstatic.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aeu.alicdn.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\s.ssl.qhres.com\daohang_data.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\pic.c-ctrip.com\picaresonline\risk\ubtrms\DeviceInfo.00dfaab9.swf\guid_1.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\pic.c-ctrip.com\picaresonline\risk\ubtrms\DeviceInfo.00dfaab9.swf\di.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\aeu.alicdn.com\flash\JSocket.swf\kj.sol
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\visited.ini
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\www.hao123.com.ico
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ssl.qhres.com\settings.sol
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\union.click.jd.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\soft.123juzi.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\gou.jd.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Bookmark.db
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\visited.ini
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\VerdataInUser.ini
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Local State
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions\cpmanager@mozillaonline.com.xpi
%TEMP%\tempbfset\Roaming\SogouExplorer\ThumbInfo.db
%TEMP%\tempbfset\Roaming\SogouExplorer\favorite3.dat
%TEMP%\tempbfset\Roaming\SogouExplorer\config.xml
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\topmost.dat
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.sina.com.cn.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.jiayuan.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.gome.com.cn.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.bfgho.com.ico
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\51919d6546d1779536b45b01ea15929e_2.jpg
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.alitrip.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\wan.360.cn.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\union.click.jd.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\temai.taobao.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\s.click.taobao.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\reg.jiayuan.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\jx.tmall.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\ju.taobao.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\hao.360.cn.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\gou.jd.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\bj.58.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.2345.com.ico
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions\coba@mozilla.com.cn.xpi
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\751989af133ecef3f0d2950572fe3a77_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\ss1.bdstatic.com\sharedObjectBIDUPSID.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\s.ssl.qhres.com\daohang_data.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#ss1.bdstatic.com\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#s.ssl.qhres.com\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#g.alicdn.com\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#assets.alicdn.com\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\g.alicdn.com\ali.flashcookie.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\assets.alicdn.com\alipay.com.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\Slots\slot1.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\f2530d569369ef94431e2e3b5c025565_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\f14f8118501eda47b8c9073d014080b1_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\ed5dcb0aa318792956f3ee644dcd3d3f_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\d5fb38b8ea1da292598389aea1d5eb81_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\c5a9ac6304ff2dad5e2e83e419d6eb64_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\c57270bea3587d748245bd330dc303ce_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\bd903a0dca090dfe6b94d570f8b8ed99_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\bc26d016048ea683074a9e4a22dcdd34_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\b9151bcf3b6786df1286a8fdd581fc8d_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\a73406e5efa5d371940beb39f09b03fa_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\8d4b2c77030bca69decab61da4ff568d_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\810a418a8844d5143979cafb69c06ed9_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\52296ae191977eb0bce945ce393f5f69_2.jpg
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\static.youku.com_2644964928.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\15
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\11
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\10
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\1
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\.metadata-v2
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\.metadata
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\SiteSecurityServiceState.txt
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\shield-preference-experiments.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\sessionstore.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\sessionstore-backups\upgrade.jsonlz4-20180206200532
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\sessionstore-backups\previous.jsonlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\sessionCheckpoints.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\search.json.mozlz4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\12
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\revocations.txt
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\pluginreg.dat
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\places.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\pkcs11.txt
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\permissions.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\kinto.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\key4.db
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\handlers.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\formhistory.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\favicons.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions\wx-assistant@mozillaonline.com.xpi
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions\tabtweak@mozillaonline.com.xpi
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions\easyscreenshot@mozillaonline.com.xpi
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\prefs.js
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\extensions\cehomepage@mozillaonline.com.xpi
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\ai.taobao.com.ico
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\17
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Bookmarks.db
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Preferences
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Favicons
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Bookmarks
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\profiles.log
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\xulstore.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\webappsstore.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\weave\toFetch\tabs.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\weave\failed\tabs.json
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\times.json
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\permanent\chrome\.metadata-v2
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\permanent\chrome\.metadata
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.sqlite
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\9
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\8
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\7
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\6
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\5
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\4
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\3
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\2
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\19
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\storage\default\http+++offlintab.firefoxchina.cn\idb\123733528obfaftlni.files\13
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\65e00cbd8569ad8bf23a9831e2b39197_2.jpg
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\safe.bfgho.com_4287284115.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\2WGAD4FW.txt
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Favicons
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Cookies
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Cookies\Cookies.binarycookies
%TEMP%\tempbfset\Local\Apple Computer\Safari\Bookmarks.plist
%TEMP%\tempbfset\Local\Apple Computer\Preferences\com.apple.Safari.plist
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Top Sites
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Favicons
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Web DataV3
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Top Sites
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Secure Preferences
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Preferences
%TEMP%\tempbfset\Local\liebao\User Data\Default\Preferences
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Favicons2
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Bookmarks.bak
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\index.dat
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\6224O2ZD\www.uc123[1].xml
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\6224O2ZD\www.hao123[1].xml
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\6224O2ZD\hao.360[1].xml
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\PreferencesV2
%TEMP%\tempbfset\Local\liebao\User Data\Default\Preferences.1
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Favicons
%TEMP%\tempbfset\Local\liebao\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Secure Preferences
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Preferences
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%HOMEPATH%\Favorites\links\国美在线.url
%HOMEPATH%\Favorites\链接\名站大全.url
%HOMEPATH%\Favorites\链接\机票旅行.url
%HOMEPATH%\Favorites\链接\购物精选.url
%HOMEPATH%\Favorites\链接\京东购物.url
%HOMEPATH%\Favorites\链接\淘正品.url
%HOMEPATH%\Favorites\链接\唯品会.url
%HOMEPATH%\Favorites\链接\国美在线.url
%HOMEPATH%\Favorites\链接\苏宁易购.url
%HOMEPATH%\Favorites\搜索一下.url
%HOMEPATH%\Favorites\名站大全.url
%HOMEPATH%\Favorites\机票旅行.url
%HOMEPATH%\Favorites\购物精选.url
%HOMEPATH%\Favorites\京东购物.url
%HOMEPATH%\Favorites\链接\搜索一下.url
%HOMEPATH%\Favorites\淘正品.url
%HOMEPATH%\Favorites\国美在线.url
%HOMEPATH%\Favorites\苏宁易购.url
%WINDIR%\ScjCache\Icon.dll
%TEMP%\aut2.tmp
%ProgramFiles%\favback\Links\Windows.url
%ProgramFiles%\favback\Links\Windows Media.url
%ProgramFiles%\favback\Links\Windows Marketplace.url
%ProgramFiles%\favback\Links\Free Hotmail.url
%ProgramFiles%\favback\Links\Customize Links.url
%ProgramFiles%\favback\Radio Station Guide.url
%ProgramFiles%\favback\MSN.com.url
%ProgramFiles%\favback\Desktop.ini
%TEMP%\2880vhfyjxr
%HOMEPATH%\Favorites\唯品会.url
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%HOMEPATH%\Favorites\links\唯品会.url
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\page_file.dat
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\FaviconsV3
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\PreferencesV2
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Bookmarks
%TEMP%\tempbfset\bfgho7za.exe
%TEMP%\aut4.tmp
%TEMP%\tempbfset\clearbfgho.7z
%TEMP%\aut3.tmp
%HOMEPATH%\Favorites\links\搜索一下.url
%HOMEPATH%\Favorites\links\名站大全.url
%HOMEPATH%\Favorites\links\机票旅行.url
%HOMEPATH%\Favorites\links\购物精选.url
%HOMEPATH%\Favorites\links\京东购物.url
%HOMEPATH%\Favorites\links\淘正品.url
%HOMEPATH%\Favorites\links\苏宁易购.url
%TEMP%\tempbfset\Roaming\360safe\360ScanLog\360rp.exe.DEEPSCAN.2017-02-05.log
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\passport.weibo.com_4105825965.ico
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Bookmarks
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\bookmark\bookmark.db.bak
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\bookmark\bookmark.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\blank_tab\new_tab.db
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Cookies\Cookies.binarycookies
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Bookmarks.plist
%TEMP%\tempbfset\Roaming\Apple Computer\Preferences\com.apple.Safari.plist
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Top Sites
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\login.ini
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\www.2345.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Preferences
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\XS1OVAXX.txt
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Preferences
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\5GPEW0VV.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\music.baidu.com_1148648629.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\mlfimciooocappbfllnmeippdmbcogeb.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\mat1.gtimg.com_2538458108.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\jhs.bfgho.com_4205279814.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\img.alicdn.com_318582665.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\img.alicdn.com_2094374610.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\g.alicdn.com_669107118.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\fiomnmjeoicmfpndbdliigppeobhhmgp.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\baidu.bfgho.com_2015332763.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\atb.bfgho.com_4032870851.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\allx.bfgho.com_2241003121.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\ajd.bfgho.com_1149282017.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\0.baidu.com_2109806494.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\safe.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\Y1ENV3US.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\UUCF3229.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\RGNSZD9Q.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\PZF7UQIB.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\O1A1Z08I.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\LQPUMVCD.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\K316CJSR.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\IX2I6C6Y.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\index.dat
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\BW9G4XLN.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\8UDX8BPR.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\8UC3IKF9.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\74G4PHUB.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\69HTNI1D.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\s.ssl.qhres.com_2018486521.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Favicons.8
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Preferences
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Favicons
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Top Sites
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Favicons
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\config.ini
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Preferences
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\baidu.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\360sefav.db
%TEMP%\tempbfset\Roaming\360safe\UserData\RightMenuSetting.ini
%TEMP%\tempbfset\Roaming\360safe\SnapShot\originalsnapshot.dat
%TEMP%\tempbfset\Roaming\360safe\shis.dat
%TEMP%\tempbfset\Roaming\360safe\safeid\safeid.ini
%TEMP%\tempbfset\Roaming\360safe\LogInfo\New360_formal_3165570121_664_1.log2
%TEMP%\tempbfset\Roaming\360safe\Clean\OKClean\360OKCleanNew.ini
%TEMP%\tempbfset\Roaming\360safe\Clean\CleanSoft.ini
%TEMP%\tempbfset\Roaming\360safe\360SoftMgrLite\TaskBarBtn_Win10.ini
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\hao.360.cn.ico
%TEMP%\tempbfset\Roaming\360safe\360SoftMgrLite\TaskBarBtn.ini
%TEMP%\tempbfset\Roaming\360safe\360safe.setup.log
%TEMP%\tempbfset\Local\YYExplorer\User Data\resource.db
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Favicons
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Secure Preferences
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Mozilla\Firefox\Profiles\iizeu14w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.dll

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Bookmarks
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\soft.123juzi.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\gou.jd.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Bookmark.db
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\visited.ini
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\www.hao123.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\www.2345.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\VerdataInUser.ini
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\aeu.alicdn.com\flash\JSocket.swf\kj.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\www.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ssl.qhres.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pic.c-ctrip.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#gss1.bdstatic.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aeu.alicdn.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\s.ssl.qhres.com\daohang_data.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\pic.c-ctrip.com\picaresonline\risk\ubtrms\DeviceInfo.00dfaab9.swf\guid_1.sol
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\#SharedObjects\7UUGXG8J\pic.c-ctrip.com\picaresonline\risk\ubtrms\DeviceInfo.00dfaab9.swf\di.sol
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\visited.ini
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\www.hao123.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\JuziBrowser\User_Data\Default\ico\union.click.jd.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\g.alicdn.com_669107118.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\Y1ENV3US.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\XS1OVAXX.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\UUCF3229.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\RGNSZD9Q.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\PZF7UQIB.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\O1A1Z08I.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\LQPUMVCD.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\0.baidu.com_2109806494.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\K316CJSR.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\index.dat
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\BW9G4XLN.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\8UDX8BPR.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\8UC3IKF9.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\74G4PHUB.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\69HTNI1D.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\5GPEW0VV.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\IX2I6C6Y.txt
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.hao123.com_3314234330.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\img.alicdn.com_2094374610.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\Bookmark.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\site_icon.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.taobao.com_3270921833.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.qiyipic.com_258398459.ico
%TEMP%\tempbfset\Roaming\hao123JuziBrowser\User_Data\Default\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.jd.com_231888724.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\www.baidu.com_1945350878.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\weibo.com_1478391124.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\tb1.bdstatic.com_227537604.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\static.youku.com_2644964928.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\passport.weibo.com_4105825965.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\music.baidu.com_1148648629.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\mat1.gtimg.com_2538458108.ico
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\icon\images\fiomnmjeoicmfpndbdliigppeobhhmgp.ico
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Config\config.ini
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.sina.com.cn.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.jiayuan.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.gome.com.cn.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.alitrip.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\www.2345.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\union.click.jd.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\temai.taobao.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\s.click.taobao.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\reg.jiayuan.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\jx.tmall.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\wan.360.cn.ico
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\ed5dcb0aa318792956f3ee644dcd3d3f_2.jpg
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Config\config.dat
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\topmost.dat
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\Slots\slot1.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\f2530d569369ef94431e2e3b5c025565_2.jpg
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\ju.taobao.com.ico
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\f14f8118501eda47b8c9073d014080b1_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\c57270bea3587d748245bd330dc303ce_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\bc26d016048ea683074a9e4a22dcdd34_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\a73406e5efa5d371940beb39f09b03fa_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\810a418a8844d5143979cafb69c06ed9_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\Thumbnails\51919d6546d1779536b45b01ea15929e_2.jpg
%TEMP%\tempbfset\Roaming\SogouExplorer\ThumbInfo.db
%TEMP%\tempbfset\Roaming\SogouExplorer\favorite3.dat
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\cookie\cookie\2WGAD4FW.txt
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Molebox\Molebox.dat
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Config\config.ini
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Config\config.dat
%TEMP%\tempbfset\Roaming\Maxthon5\Public\SiteIcon\SiteIcon.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Favorite\Favorite.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Favorite\favbackup\fav62.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Config\SyncConfig.dat
%TEMP%\tempbfset\Roaming\Maxthon3\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\gou.jd.com.ico
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\bj.58.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\ai.taobao.com.ico
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Bookmarks.db
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Preferences
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\ico\hao.360.cn.ico
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Favicons
%TEMP%\tempbfset\Roaming\Opera Software\Opera Stable\Bookmarks
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\QuickAccess\QaConfig.dat
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\Maxthon5\Users\guest\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Shouxin\UserData\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\liebao\User Data\Default\Favicons
%TEMP%\tempbfset\Local\liebao\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\liebao\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Preferences
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Secure Preferences
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\6224O2ZD\www.hao123[1].xml
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Favicons
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Preferences
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Favicons2
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Bookmarks.bak
%TEMP%\tempbfset\Local\TaoBrowser\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\index.dat
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\6224O2ZD\www.uc123[1].xml
%TEMP%\tempbfset\Local\liebao\User Data\Default\Preferences
%TEMP%\tempbfset\Local\Microsoft\Internet Explorer\DOMStore\6224O2ZD\hao.360[1].xml
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Favicons
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\PreferencesV2
%TEMP%\tempbfset\Local\2345Explorer\User Data\Default\FaviconsV3
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\2345chrome\User Data\Default\PreferencesV2
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Top Sites
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Cookies
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Apple Computer\Safari\Cookies\Cookies.binarycookies
%TEMP%\tempbfset\Local\Apple Computer\Safari\Bookmarks.plist
%TEMP%\tempbfset\Local\Google\Chrome\User Data\Default\Favicons
%TEMP%\tempbfset\Local\Apple Computer\Preferences\com.apple.Safari.plist
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Preferences
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\360Chrome\Chrome\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\www.2345.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\tmall.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\tbtm.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\safe.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\jhs.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\hao.360.cn.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\config.ini
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\www.bfghodh.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\baidu.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\allx.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\ajd.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\360sefav.db
%TEMP%\tempbfset\Roaming\360safe\UserData\RightMenuSetting.ini
%TEMP%\tempbfset\Roaming\360safe\SnapShot\originalsnapshot.dat
%TEMP%\tempbfset\Roaming\360safe\shis.dat
%TEMP%\tempbfset\Roaming\360safe\safeid\safeid.ini
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\default\data\ico\atb.bfgho.com.ico
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Top Sites
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\bookmark\bookmark.db.bak
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\bookmark\bookmark.db
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\blank_tab\new_tab.db
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360safe\LogInfo\New360_formal_3165570121_664_1.log2
%TEMP%\tempbfset\Roaming\Apple Computer\Safari\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Preferences
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\X4UTV9J7\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\360se6\apps\data\users\login.ini
%TEMP%\tempbfset\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\360safe\Clean\OKClean\360OKCleanNew.ini
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Favicons.8
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Preferences
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Favicons
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Top Sites
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\TheWorld6\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\Tencent\QQBrowser\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\360safe\360SoftMgrLite\TaskBarBtn_Win10.ini
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\360safe\360SoftMgrLite\TaskBarBtn.ini
%TEMP%\tempbfset\Roaming\360safe\360ScanLog\360rp.exe.DEEPSCAN.2017-02-05.log
%TEMP%\tempbfset\Roaming\360safe\360safe.setup.log
%TEMP%\tempbfset\Local\YYExplorer\User Data\resource.db
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\#www.hao123.com\settings.sol
%TEMP%\tempbfset\Roaming\360safe\Clean\CleanSoft.ini
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\http_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\https_www.uc123.com_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Local Storage\https_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Favicons
%TEMP%\tempbfset\Local\YYExplorer\User Data\Default\Bookmarks
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Secure Preferences
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\www.hao123.com\res\swf\LocalStorage.swf\$hao123$.sol
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\CSQ8P32Z\macromedia.com\support\flashplayer\sys\settings.sol
%TEMP%\tempbfset\Local\UCBrowser\User Data\Default\Local Storage\http_hao.360.cn_0.localstorage
%TEMP%\tempbfset\Roaming\SogouExplorer\Webkit\Local State

Удаляет следующие файлы:

%TEMP%\aut1.tmp
%TEMP%\2880vhfyjxr
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp

Другое:

Создает и запускает на исполнение:

'%TEMP%\tempbfset\bfgho7za.exe' x -y -aoa -pbfgho -o%TEMP%\tempbfset\ %TEMP%\tempbfset\clearbfgho.7z

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c %TEMP%\tempbfset\bfgho7za.exe x -y -aoa -pbfgho -o%TEMP%\tempbfset\ %TEMP%\tempbfset\clearbfgho.7z

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней