Trojan.Encoder.36854

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\parnas_01.jpg
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\dial.bmp
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\contoso_1.cer
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

C:\users\public\45abb370569e343a74364af530efcc79e97aec87
%APPDATA%\mra\update\aaa!
%APPDATA%\mra\aaa!
%APPDATA%\opera software\opera stable\databases\aaa!
%APPDATA%\opera software\opera stable\dictionaries\aaa!
%APPDATA%\opera software\opera stable\extension state\aaa!
%APPDATA%\opera software\opera stable\jump list icons\aaa!
%APPDATA%\opera software\opera stable\jump list iconsold\aaa!
%APPDATA%\opera software\opera stable\local storage\aaa!
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\aaa!
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\aaa!
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\aaa!
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\aaa!
%APPDATA%\opera software\opera stable\aaa!
%APPDATA%\qipguard\aaa!
%APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\aaa!
%APPDATA%\telegram desktop\tdata\aaa!
%APPDATA%\telegram desktop\aaa!
%APPDATA%\thunderbird\crash reports\aaa!
%APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\aaa!
%APPDATA%\thunderbird\profiles\wjj9aet2.default\aaa!
%APPDATA%\thunderbird\aaa!
%APPDATA%\winamp\plugins\ml\aaa!
%APPDATA%\winamp\plugins\milkdrop2\aaa!
%APPDATA%\mra\base\aaa!
%APPDATA%\mirc\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\static_png\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\statuses\gtalk\aaa!
%HOMEPATH%\saved games\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\statuses\icq\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\statuses\jabber\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\aaa!
%APPDATA%\mail.ru\agent\mra\sounds\aaa!
%APPDATA%\mail.ru\agent\mra\translation\aaa!
%APPDATA%\mail.ru\agent\mra\video\aaa!
%APPDATA%\mail.ru\agent\aaa!
%APPDATA%\mirc\scripts\aaa!
%APPDATA%\winamp\aaa!
%HOMEPATH%\contacts\aaa!
%HOMEPATH%\desktop\aaa!
b:\boot\ja-jp\aaa!
b:\boot\ko-kr\aaa!
b:\boot\nb-no\aaa!
b:\boot\nl-nl\aaa!
b:\boot\pl-pl\aaa!
b:\boot\pt-br\aaa!
b:\boot\pt-pt\aaa!
b:\boot\ru-ru\aaa!
b:\boot\sv-se\aaa!
b:\boot\tr-tr\aaa!
b:\boot\zh-cn\aaa!
b:\boot\zh-hk\aaa!
b:\boot\zh-tw\aaa!
b:\boot\bootstat.dat
b:\boot\aaa!
b:\xeldz
b:\bootsect.bak
b:\aaa!
b:\bootmgr
C:\aaa!
b:\boot\hu-hu\aaa!
b:\boot\fr-fr\aaa!
b:\boot\it-it\aaa!
b:\boot\fonts\aaa!
%HOMEPATH%\documents\aaa!
b:\boot\fi-fi\aaa!
%HOMEPATH%\downloads\aaa!
%HOMEPATH%\favorites\links\aaa!
%HOMEPATH%\favorites\links for united states\aaa!
%HOMEPATH%\favorites\microsoft websites\aaa!
%HOMEPATH%\favorites\msn websites\aaa!
%HOMEPATH%\favorites\windows live\aaa!
%HOMEPATH%\favorites\aaa!
%HOMEPATH%\links\aaa!
%HOMEPATH%\music\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\statuses\aim\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\aaa!
%HOMEPATH%\searches\aaa!
%HOMEPATH%\videos\aaa!
%HOMEPATH%\aaa!
C:\users\aaa!
b:\boot\cs-cz\aaa!
b:\boot\da-dk\aaa!
b:\boot\de-de\aaa!
b:\boot\el-gr\aaa!
b:\boot\en-us\aaa!
b:\boot\es-es\aaa!
%HOMEPATH%\pictures\aaa!
%APPDATA%\mail.ru\agent\mra\smiles\smiles\emoji\aaa!

Moves the following files

from b:\bootmgr to b:\bootmgr.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blum.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blum.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shok.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shok.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\scratch_one-s_head.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\sad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rolleyes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rolleyes.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rofl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\rofl.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\pardon.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\pardon.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\nea.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\nea.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\music.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\music.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\man_in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\man_in_love.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\mocking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\mocking.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\kiss_mini.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\good.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\good.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\give_rose.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\give_rose.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\fool.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\fool.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\facepalm.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\facepalm.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dirol.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dirol.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\drinks.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\drinks.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\dance.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\diablo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\diablo.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\crazy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\crazy.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shout.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\shout.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\cray.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\cray.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\unknw.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\unknw.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wacko2.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wacko2.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\10a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\20a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\19a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\17a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\16a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\15a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\14a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\13a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\12a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\11a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\08a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\09a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s005.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s005.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\07a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\04b.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\01.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\06a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\03a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\02.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\wink.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\yahoo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\yahoo.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\smile.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blush.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\blush.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\biggrin.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\biggrin.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\bad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\bad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s013.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s013.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s009.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s009.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s007.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s007.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s008.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s006.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s006.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s005.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s005.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s004.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s004.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s003.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s003.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s002.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s002.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s001.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s001.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s020.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s020.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s019.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s019.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s018.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s018.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s017.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s017.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s016.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s016.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s015.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s015.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s014.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s014.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s011.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s011.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s013.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s013.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s012.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s012.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s010.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s010.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s010.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s010.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s015.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s015.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s016.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s016.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s012.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s012.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set03\angel.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s014.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s014.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s015.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s015.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s014.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s014.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s013.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s013.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s012.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s012.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s011.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s011.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s010.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s010.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s009.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s009.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s008.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s009.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s009.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s007.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s007.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s006.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s006.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s004.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s004.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s003.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s003.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s002.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s002.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s001.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set04\s001.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s020.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s020.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s019.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s019.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s017.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s017.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s018.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s018.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s016.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s016.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\21a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s011.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set05\s011.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\22a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\47a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\47a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blinking.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\angel.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yes.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\yahoo.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wacko1.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\wink.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\unknown.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\unknown.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sorry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sorry.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\smile.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shout.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shout.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shok.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\shok.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\scratch_one-s_head.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\sad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\rofl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\rofl.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\pardon.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\pardon.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\nea.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\nea.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\music.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\music.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mocking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mocking.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\man_in_love.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\mad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\lol.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\lol.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\kiss3.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\blushing.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\bomb.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thank you.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\surprised.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\stop.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\smile.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\scream.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\sad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\nothing to say.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\mad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\listening to music.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissing.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\ireful.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\ireful.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kiss.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\kissed.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\gross.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\in love.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\falling asleep.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\drinking.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\devil.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\crying.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\cool.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\i_am_so_happy.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hi.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hi.gif.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\48a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\48a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\45a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\45a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\44a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\44a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\43a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\43a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\42a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\42a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\41b.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\41b.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\40a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\40a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\39a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\39a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\38a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\38a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\37.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\37.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\36a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\34a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\33a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\32a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\31a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\30a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\29a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\28a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\27a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\26a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\24a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\49a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\49a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\50a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\50a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hang1.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\hang1.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cool.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cool.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\crazy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\crazy.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\good.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\good.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_rose.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\girl_angel.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\give_heart.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\gamer.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\gamer.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\drinks.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\drinks.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\diablo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\diablo.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\dance.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\dance.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\cry.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\25a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\23a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\46a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\46a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bye2.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bye2.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blum1.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blum1.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blush.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\blush.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\biggrin.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bad.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bad.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\air_kiss.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\53a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\53a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\51a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\51a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\52a.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\odnoklassniki\52a.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bomb.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\koloboks\bomb.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s006.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s006.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s008.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s004.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s004.gif.crypted
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.crypted
from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.crypted
from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.crypted
from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.crypted
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.crypted
from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.crypted
from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.crypted
from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.crypted
from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.crypted
from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.crypted
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.crypted
from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.crypted
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.crypted
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.crypted
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.crypted
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.crypted
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.crypted
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.crypted
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.crypted
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.crypted
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.crypted
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old.crypted
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies.crypted
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.crypted
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.crypted
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.crypted
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.crypted
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.crypted
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal.crypted
from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal.crypted
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal.crypted
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001 to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.crypted
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.crypted
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.crypted
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.crypted
from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.crypted
from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.crypted
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.crypted
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.crypted
from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.crypted
from b:\boot\bootstat.dat to b:\boot\bootstat.dat.crypted
from b:\xeldz to b:\xeldz.crypted
from b:\bootsect.bak to b:\bootsect.bak.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.crypted
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.crypted
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.crypted
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.crypted
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.crypted
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.crypted
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.crypted
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.crypted
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.crypted
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.crypted
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.crypted
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.crypted
from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.crypted
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.crypted
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.crypted
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.crypted
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.crypted
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.crypted
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.crypted
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.crypted
from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.crypted
from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.crypted
from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.crypted
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.crypted
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.crypted
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.crypted
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb.crypted
from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fuck.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fuck.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kiss.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fist.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\fist.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\disappointed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\disappointed.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\die.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\die.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\devil.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\devil.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\cry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\cry.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\detzl.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\detzl.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\crocodile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\crocodile.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\coolguy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\coolguy.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bullshit.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bullshit.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\blink.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\blink.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biggrin.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biggrin.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biganger.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\biganger.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bee.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bee.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bazilio.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\bazilio.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ass.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ass.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\angry.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\angry.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\amazed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\amazed.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\aaa.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\aaa.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\want_you.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\undress.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\hm.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\hm.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_left.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_left.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s003.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s003.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sceptic.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sceptic.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\shy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\shy.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s002.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s002.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s001.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\set06\s001.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\zloradstvo.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\victory.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\victory.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\vampire.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\vampire.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\think.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\think.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\tears.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\tears.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\smile.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\smile.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sleepy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\sleepy.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\heart.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\on_wings.gif.crypted
from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\really.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\really.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\pig.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\pig.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\plug.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\plug.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\oo.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\oo.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ok.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\ok.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\live.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\live.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\laughter.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\laughter.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kukes.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\kukes.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_right.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\koza_right.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\rrr.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\smiles\rrr.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\laughing.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\thumbs up.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kiss.gif.crypted
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.crypted
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.crypted
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.crypted
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.crypted
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.crypted
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.crypted
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.crypted
from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.crypted
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.crypted
from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.crypted
from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.crypted
from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.crypted
from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.crypted
from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.crypted
from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.crypted
from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.crypted
from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.crypted
from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.crypted
from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.crypted
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll.crypted
from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.crypted
from %APPDATA%\mail.ru\agent\mrainplaceviewer.dll to %APPDATA%\mail.ru\agent\mrainplaceviewer.dll.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\jealousy.gif.crypted
from %APPDATA%\mail.ru\agent\vivo.dll to %APPDATA%\mail.ru\agent\vivo.dll.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\in_love.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\dont_be_late.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\broken_heart.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\s008.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\lets_play.gif.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\valentine\kissed.gif.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.crypted
from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.crypted
from %APPDATA%\mail.ru\agent\sciter32.dll to %APPDATA%\mail.ru\agent\sciter32.dll.crypted
from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.crypted
from %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\mail.ru\agent\mra\smiles\smiles\icq6.0-emoticons\tongue out.gif.crypted

Modifies the following files

C:\users\desktop.ini
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
%HOMEPATH%\favorites\links for united states\desktop.ini
%HOMEPATH%\favorites\microsoft websites\microsoft store.url
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url
%HOMEPATH%\favorites\msn websites\msnbc news.url
%HOMEPATH%\favorites\msn websites\msn.url
%HOMEPATH%\favorites\msn websites\msn sports.url
%HOMEPATH%\favorites\msn websites\msn money.url
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\windows live\windows live spaces.url
%HOMEPATH%\favorites\windows live\windows live mail.url
%HOMEPATH%\favorites\windows live\windows live gallery.url
%HOMEPATH%\favorites\windows live\get windows live.url
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\links\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\pictures\desktop.ini
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\searches\indexed locations.search-ms
%HOMEPATH%\searches\everywhere.search-ms
%HOMEPATH%\searches\desktop.ini
%HOMEPATH%\videos\desktop.ini
%HOMEPATH%\ntuser.pol
%HOMEPATH%\favorites\links for united states\usa.gov.url
%HOMEPATH%\favorites\links\desktop.ini

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Se...' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Se...

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней