Trojan.Encoder.35318

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'VSpH9' = '%WINDIR%\Microsoft.NET\Framework\vBJyh\svchost.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'VSpH9' = '%WINDIR%\Microsoft.NET\Framework\vBJyh\svchost.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserUpdateCheck' = '%LOCALAPPDATA%\dnscacheugc.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework\vBJyh\svchost.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'

Injects code into

the following system processes:

%WINDIR%\syswow64\dnscacheugc.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\508softwareandos.doc
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\coffee.bmp
%APPDATA%\opera software\opera stable\login data
%APPDATA%\mozilla\firefox\profiles.ini

Modifies file system

Creates the following files

%WINDIR%\microsoft.net\framework\vbjyh\svchost.exe
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\read-me.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\read-me.txt
%APPDATA%\opera software\opera stable\local storage\read-me.txt
%APPDATA%\opera software\opera stable\jump list iconsold\read-me.txt
%APPDATA%\opera software\opera stable\jump list icons\read-me.txt
%APPDATA%\opera software\opera stable\extension state\read-me.txt
%APPDATA%\opera software\opera stable\dictionaries\read-me.txt
%APPDATA%\opera software\opera stable\databases\read-me.txt
%APPDATA%\mra\read-me.txt
%APPDATA%\mra\update\read-me.txt
%APPDATA%\mra\base\read-me.txt
%APPDATA%\mozilla\firefox\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\read-me.txt
%APPDATA%\mail.ru\agent\mra\sounds\read-me.txt
%APPDATA%\mail.ru\agent\mra\translation\read-me.txt
%APPDATA%\mail.ru\agent\mra\video\read-me.txt
%APPDATA%\mail.ru\agent\read-me.txt
%APPDATA%\mirc\read-me.txt
%APPDATA%\mirc\scripts\read-me.txt
%APPDATA%\mozilla\firefox\crash reports\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\read-me.txt
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\read-me.txt
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\read-me.txt
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\read-me.txt
%APPDATA%\opera software\opera stable\read-me.txt
%LOCALAPPDATA%\dnscacheugc.exe
C:\users\public\8d9e927358f0e450365f21c7cbb7996edff5c6f92a853e877e85154f384b2ad7
D:\read-me.txt
C:\users\read-me.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\read-me.txt
%HOMEPATH%\read-me.txt
%HOMEPATH%\videos\read-me.txt
%HOMEPATH%\searches\read-me.txt
%HOMEPATH%\saved games\read-me.txt
%HOMEPATH%\pictures\read-me.txt
%HOMEPATH%\music\read-me.txt
%HOMEPATH%\links\read-me.txt
%HOMEPATH%\favorites\read-me.txt
%HOMEPATH%\favorites\windows live\read-me.txt
%HOMEPATH%\favorites\msn websites\read-me.txt
%HOMEPATH%\favorites\microsoft websites\read-me.txt
%HOMEPATH%\favorites\links for united states\read-me.txt
%APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\read-me.txt
%APPDATA%\telegram desktop\tdata\read-me.txt
%APPDATA%\telegram desktop\read-me.txt
%APPDATA%\thunderbird\crash reports\read-me.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\read-me.txt
%APPDATA%\thunderbird\profiles\wjj9aet2.default\read-me.txt
%APPDATA%\winamp\plugins\milkdrop2\read-me.txt
%APPDATA%\thunderbird\read-me.txt
%APPDATA%\winamp\read-me.txt
%HOMEPATH%\contacts\read-me.txt
%HOMEPATH%\desktop\read-me.txt
%HOMEPATH%\documents\read-me.txt
%HOMEPATH%\downloads\read-me.txt
%HOMEPATH%\favorites\links\read-me.txt
%APPDATA%\qipguard\read-me.txt
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\read-me.txt

Moves the following files

from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\96.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\95.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\94.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\93.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kut.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kut.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\92.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\90.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\89.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\88.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\87.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\91_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\86.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kuru.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\kuru.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\igrau.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\igrau.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_utko.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_utko.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_soshl_asuma.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_soshl_asuma.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_poteralsa.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_poteralsa.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_krivetko.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_krivetko.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_inoplanet_razum.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\ia_inoplanet_razum.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gulau.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gulau.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gotovlu.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gotovlu.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\98_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gizn_gavno.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gizn_gavno.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\97_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\doma.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\doma.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\dnd.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\cherep.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\cherep.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\chat.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\boleu.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\boleu.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\belka.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\belka.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\99_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gde_ia.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\gde_ia.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\em.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\em.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\70.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\69.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\68.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\67.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\66.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\64.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\63.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\62.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\61.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\65_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\85.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\84_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\83.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\82.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\81.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\80.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\72_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\79.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\71_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\77.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\76.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\75.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\74.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\73_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\78_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\60.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\music.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\music.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_29.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_29.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_invisible.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_invisible.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_gray.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_dnd.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_dnd.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_connecting.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_connecting.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_chat.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_chat.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_away.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\24bit.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\24bit.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\seekfriends.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\seekfriends.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_invisible.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_invisible.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_dnd.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_dnd.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_chat.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_chat.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_away.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_wrong_data.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_wrong_data.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_gray.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_connecting.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_odkl_connecting.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\wrong_data.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\wrong_data.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\jabber_status_gray.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_shkole.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_gray.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_wrong_data.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_wrong_data.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\icq_status_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_busy.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_away.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_gray.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_busy.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\gtalk_status_away.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\status_mobile.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\status_mobile.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\seekfriends.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aim_status_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_vstreche.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_vstreche.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_rabote.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\na_rabote.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_30.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_30.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_41.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_41.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_40.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_40.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_38.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_38.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_37.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_37.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_36.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_36.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_35.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_35.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_34.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_34.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_33.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_33.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_32.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_32.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_42.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_42.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_43.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_43.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\vi_oshiblis_nomerom_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu_bit.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu_bit.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\splu.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\seekfriends.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rocket.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rocket.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rabotau.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\rabotau.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pu_kofe.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pu_kofe.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo_bit.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo_bit.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\pivo.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\star.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\star.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\v_institute.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_44.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_44.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_mobile.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_mobile.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\telefon_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_45.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_45.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_49.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_49.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_connecting.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_big.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away_big.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_away.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_50.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_50.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\status_invisible_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\59.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\58.ico.mrv
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.mrv
from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.mrv
from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.mrv
from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.mrv
from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.mrv
from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.mrv
from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.mrv
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.mrv
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.mrv
from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.mrv
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.mrv
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.mrv
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.mrv
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.mrv
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.mrv
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.mrv
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.mrv
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.mrv
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.mrv
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.mrv
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.mrv
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.mrv
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.mrv
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.mrv
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.mrv
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.mrv
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.mrv
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.mrv
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.mrv
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal.mrv
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb.mrv
from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies.mrv
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001 to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001.mrv
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old.mrv
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3.mrv
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current.mrv
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index.mrv
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.mrv
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.mrv
from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.mrv
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.mrv
from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.mrv
from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.mrv
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.mrv
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.mrv
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.mrv
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.mrv
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.mrv
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.mrv
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.mrv
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.mrv
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.mrv
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.mrv
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.mrv
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.mrv
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.mrv
from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.mrv
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.mrv
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.mrv
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.mrv
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.mrv
from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.mrv
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.mrv
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.mrv
from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.mrv
from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.mrv
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.mrv
from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.mrv
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.mrv
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.mrv
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.mrv
from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.mrv
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.mrv
from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.mrv
from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.mrv
from %APPDATA%\mail.ru\agent\vivo.dll to %APPDATA%\mail.ru\agent\vivo.dll.mrv
from %APPDATA%\mail.ru\agent\sciter32.dll to %APPDATA%\mail.ru\agent\sciter32.dll.mrv
from %APPDATA%\mail.ru\agent\mrainplaceviewer.dll to %APPDATA%\mail.ru\agent\mrainplaceviewer.dll.mrv
from %APPDATA%\mail.ru\agent\magentsetup.exe to %APPDATA%\mail.ru\agent\magentsetup.exe.mrv
from %APPDATA%\mail.ru\agent\magent.exe to %APPDATA%\mail.ru\agent\magent.exe.mrv
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll.mrv
from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.mrv
from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\104_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\56.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\13.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\12.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\11.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\57_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\102.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\103_xp.ico.mrv
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.mrv
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.mrv
from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.mrv
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.mrv
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.mrv
from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.mrv
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.mrv
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.mrv
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.mrv
from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.mrv
from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.mrv
from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.mrv
from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.mrv
from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.mrv
from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.mrv
from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.mrv
from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.mrv
from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.mrv
from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.mrv
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.mrv
from %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 to %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2021-11-10_14_x5qkry9yysawyostzmcdfa==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2021-11-10_14_x5qkry9yysawyostzmcdfa==.jsonlz4.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.mrv
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif.mrv
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif.mrv

Modifies the following files

D:\install.log
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%HOMEPATH%\favorites\msn websites\msnbc news.url
%HOMEPATH%\favorites\msn websites\msn.url
%HOMEPATH%\favorites\msn websites\msn sports.url
%HOMEPATH%\favorites\msn websites\msn money.url
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\windows live\windows live spaces.url
%HOMEPATH%\favorites\windows live\windows live mail.url
%HOMEPATH%\favorites\windows live\windows live gallery.url
%HOMEPATH%\favorites\windows live\get windows live.url
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\links\recentplaces.lnk
%HOMEPATH%\links\downloads.lnk
%HOMEPATH%\links\desktop.lnk
%HOMEPATH%\links\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\pictures\desktop.ini
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\searches\indexed locations.search-ms
%HOMEPATH%\searches\everywhere.search-ms
%HOMEPATH%\searches\desktop.ini
%HOMEPATH%\videos\desktop.ini
%HOMEPATH%\ntuser.pol
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
<Drive name for removable media>:\correct.avi
C:\users\desktop.ini
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\vBJyh\svchost.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\vBJyh\svchost.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
'%WINDIR%\syswow64\dnscacheugc.exe'

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней